🌱 Backport main to 2.4

.github/dependabot.yml

@@ -1,36 +1,65 @@
 version: 2
 updates:
+  # GitHub Actions
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+        interval: "weekly"
+    commit-message:
+        prefix: ":seedling:"
+    labels:
+      - "kind/cleanup"
+      - "area/ci"
+      - "ok-to-test"
+      - "release-note-none"
+
+  # Main Go module
   - package-ecosystem: "gomod"
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
     commit-message:
       prefix: ":seedling:"
     labels:
       - "kind/cleanup"
+      - "area/dependency"
+      - "ok-to-test"
+      - "release-note-none"
     groups:
       dependencies:
         patterns:
           - "*"
     ignore:
       # Ignore Cluster-API as its upgraded manually.
       - dependency-name: "sigs.k8s.io/cluster-api*"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
       # Ignore controller-runtime as its upgraded manually.
       - dependency-name: "sigs.k8s.io/controller-runtime"
-      # Ignore k8s and its transitives modules as they are upgraded manually
-      # together with controller-runtime.
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      # Ignore k8s and its transitives modules as they are upgraded manually together with controller-runtime.
       - dependency-name: "k8s.io/*"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
       - dependency-name: "go.etcd.io/*"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
       - dependency-name: "google.golang.org/grpc"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      # Bumping the kustomize API independently can break compatibility with client-go as they share k8s.io/kube-openapi as a dependency.
+      - dependency-name: "sigs.k8s.io/kustomize/api"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
 
   - package-ecosystem: "docker"
     directory: "/"
     schedule:
       interval: "weekly"
+      day: "monday"
     commit-message:
       prefix: ":seedling:"
     labels:
       - "kind/cleanup"
+      - "area/dependency"
+      - "ok-to-test"
+      - "release-note-none"
     groups:
       dependencies:
         patterns:
@@ -41,46 +70,48 @@ updates:
     directory: "/hack/tools"
     schedule:
       interval: "weekly"
+      day: "wednesday"
     commit-message:
       prefix: ":seedling:"
     labels:
       - "kind/cleanup"
+      - "area/dependency"
+      - "ok-to-test"
+      - "release-note-none"
     groups:
       dependencies:
         patterns:
           - "*"
     ignore:
       # Ignore Cluster-API as its upgraded manually.
       - dependency-name: "sigs.k8s.io/cluster-api*"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
       # Ignore controller-runtime as its upgraded manually.
       - dependency-name: "sigs.k8s.io/controller-runtime"
-      # Ignore k8s and its transitives modules as they are upgraded manually
-      # together with controller-runtime.
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      # Ignore k8s and its transitives modules as they are upgraded manually together with controller-runtime.
       - dependency-name: "k8s.io/*"
-      # Ignore controller-tools as its upgraded manually.
-      - dependency-name: "sigs.k8s.io/controller-tools"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      - dependency-name: "go.etcd.io/*"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      - dependency-name: "google.golang.org/grpc"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
+      # Bumping the kustomize API independently can break compatibility with client-go as they share k8s.io/kube-openapi as a dependency.
+      - dependency-name: "sigs.k8s.io/kustomize/api"
+        update-types: [ "version-update:semver-major", "version-update:semver-minor" ]
 
   - package-ecosystem: "docker"
     directory: "/hack/tools"
     schedule:
       interval: "weekly"
+      day: "wednesday"
     commit-message:
       prefix: ":seedling:"
     labels:
       - "kind/cleanup"
-    groups:
-      dependencies:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    commit-message:
-      prefix: ":seedling:"
-    labels:
-      - "kind/cleanup"
+      - "area/dependency"
+      - "ok-to-test"
+      - "release-note-none"
     groups:
       dependencies:
         patterns:

.github/workflows/pr-golangci-lint.yaml

@@ -0,0 +1,33 @@
+name: PR golangci-lint
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+# Remove all permissions from GITHUB_TOKEN except metadata.
+permissions: {}
+
+jobs:
+  golangci:
+    name: lint
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        working-directory:
+          - ""
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # tag=v4.1.1
+      - name: Calculate go version
+        id: vars
+        run: echo "go_version=$(make go-version)" >> $GITHUB_OUTPUT
+      - name: Set up Go
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # tag=v5.0.0
+        with:
+          go-version: ${{ steps.vars.outputs.go_version }}
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # tag=v4.0.0
+        with:
+          version: v1.56.1
+          args: --out-format=colored-line-number
+          working-directory: ${{matrix.working-directory}}