Merge branch 'main' into nov24-ppc64le-support

.github/workflows/helm-chart-lint.yaml

@@ -27,7 +27,7 @@ jobs:
 
       - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
-          python-version: 3.7
+          python-version: 3.13
 
       - name: Set up chart-testing
         uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1

.github/workflows/olm_tests.yaml

@@ -6,7 +6,7 @@ on:
   pull_request:
 env:
   GO_VERSION: '1.23'
-  KIND_IMG_TAG: v1.31.2
+  KIND_IMG_TAG: v1.32.0
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true

.github/workflows/test.yml

@@ -38,7 +38,7 @@ jobs:
       - name: Install dependencies
         run: sudo hack/install-packages
       - run: make test-unit
-      - uses: codecov/codecov-action@7f8b4b4bde536c465e797be725718b88c5d95e0e # v5.1.1
+      - uses: codecov/codecov-action@1e68e06f1dbfde0e4cefc87efeba9e4643565303 # v5.1.2
         with:
           files: build/coverage.out
           flags: unittests

.golangci.yml

@@ -29,6 +29,7 @@ linters:
     - errname
     - errorlint
     - exhaustive
+    - exptostd
     - fatcontext
     - forcetypeassert
     - gci
@@ -66,7 +67,9 @@ linters:
     - nakedret
     - nestif
     - nilerr
+    - nilnesserr
     - nilnil
+    - nlreturn
     - noctx
     - nolintlint
     - nosprintfhostport
@@ -97,8 +100,10 @@ linters:
     - unparam
     - unused
     - usestdlibvars
+    - usetesting
     - wastedassign
     - whitespace
+    - wsl
     - zerologlint
     # - cyclop
     # - depguard
@@ -113,12 +118,10 @@ linters:
     # - ireturn
     # - maintidx
     # - mnd
-    # - nlreturn
     # - nonamedreturns
     # - testpackage
     # - varnamelen
     # - wrapcheck
-    # - wsl
 linters-settings:
   revive:
     rules:

Dockerfile.ubi

@@ -18,7 +18,7 @@
 # for more details
 
 # hash below referred to latest
-FROM registry.access.redhat.com/ubi8/go-toolset@sha256:3494f435c2f573bdb7ed4d59eadc7ec9dde3e088907de5cd6f2fdf4a57206615 AS build
+FROM registry.access.redhat.com/ubi8/go-toolset@sha256:9b7b1a47d31de7c15966a1c63141f985d8c0b100a768ece74c5a7262dc0e6e27 AS build
 USER root
 WORKDIR /work
 
@@ -45,7 +45,7 @@ ARG STATIC_LINK=no
 RUN make
 
 # hash below referred to latest
-FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:dee813b83663d420eb108983a1c94c614ff5d3fcb5159a7bd0324f0edbe7fca1
+FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:b87097994ed62fbf1de70bc75debe8dacf3ea6e00dd577d74503ef66452c59d6
 ARG version
 USER root
 

Makefile

@@ -14,7 +14,7 @@
 
 GO ?= go
 
-GOLANGCI_LINT_VERSION = v1.62.0
+GOLANGCI_LINT_VERSION = v1.63.4
 REPO_INFRA_VERSION = v0.2.5
 KUSTOMIZE_VERSION = 5.5.0
 OPERATOR_SDK_VERSION ?= v1.37.0
@@ -88,7 +88,9 @@ endif
 export CGO_LDFLAGS
 export CGO_ENABLED=1
 
-BUILD_FILES := $(shell find . -type f -name '*.go' -or -name '*.mod' -or -name '*.sum' -not -name '*_test.go')
+BUILD_FILES := $(shell find . -type f -name '*.go' -or -name '*.mod' -or -name '*.sum' -or -name 'recorder.bpf.o.*' -not -name '*_test.go')
+BPF_FILES := $(shell find internal/pkg/daemon/bpfrecorder/bpf -type f -name '*.c' -or -name '*.h')
+BPF_OUTPUT_FILES := $(shell find internal/pkg/daemon/bpfrecorder/bpf -type f -name 'recorder.bpf.o.*')
 export GOFLAGS?=-mod=vendor
 GO_PROJECT := sigs.k8s.io/$(PROJECT)
 LDVARS := \
@@ -160,7 +162,7 @@ $(BUILD_DIR)/$(CLI_BINARY): $(BUILD_DIR) $(BUILD_FILES)
 
 .PHONY: clean
 clean: ## Clean the build directory
-	rm -rf $(BUILD_DIR)
+	rm -rf $(BUILD_DIR) $(BPF_OUTPUT_FILES)
 
 .PHONY: $(BUILD_DIR)/kustomize
 $(BUILD_DIR)/kustomize: $(BUILD_DIR)
@@ -341,17 +343,18 @@ update-vmlinux: ## Generate the vmlinux.h required for building the BPF modules.
 	./hack/update-vmlinux
 
 .PHONY: update-btf
-update-btf: update-bpf ## Build and update all generated BTF code for supported kernels
-	./hack/update-btf
+update-btf: $(BUILD_DIR) ## Build and update all generated BTF code for supported kernels
+	$(GO) run ./internal/pkg/daemon/bpfrecorder/generate
 
 .PHONY: update-bpf
-update-bpf: $(BUILD_DIR) ## Build and update all generated BPF code with nix
-	for arch in amd64 arm64; do \
-		nix-build nix/default-bpf-$$arch.nix ;\
-		cp -f result/recorder.bpf.o $(BUILD_DIR)/recorder.bpf.o.$$arch ;\
-	done
-	chmod 0644 $(BUILD_DIR)/recorder.bpf.o.*
-	$(GO) run ./internal/pkg/daemon/bpfrecorder/generate
+update-bpf: clean \
+    internal/pkg/daemon/bpfrecorder/bpf/recorder.bpf.o.amd64 \
+    internal/pkg/daemon/bpfrecorder/bpf/recorder.bpf.o.arm64
+
+internal/pkg/daemon/bpfrecorder/bpf/recorder.bpf.o.%: $(BPF_FILES) ## Build and update all generated BPF code with nix
+	nix-build nix/default-bpf-$*.nix
+	cp -f result/recorder.bpf.o ./internal/pkg/daemon/bpfrecorder/bpf/recorder.bpf.o.$*
+	chmod 0644 ./internal/pkg/daemon/bpfrecorder/bpf/recorder.bpf.o.$*
 
 # Verification targets
 
@@ -468,7 +471,7 @@ test-unit: $(BUILD_DIR) ## Run the unit tests
 test-e2e: ## Run the end-to-end tests
 	CGO_LDFLAGS= \
 	E2E_SKIP_FLAKY_TESTS=true \
-	$(GO) test -parallel 1 -timeout 60m -count=1 ./test -v
+	$(GO) test -parallel 1 -timeout 60m -count=1 ./test -v $(ARGS)
 
 .PHONY: test-flaky-e2e
 test-flaky-e2e: ## Only run the flaky end-to-end tests
@@ -478,7 +481,7 @@ test-flaky-e2e: ## Only run the flaky end-to-end tests
 
 .PHONY: test-spoc-e2e
 test-spoc-e2e: build/spoc
-	$(GO) test -v ./test/spoc
+	$(GO) test -v ./test/spoc $(ARGS)
 
 # Generate CRD manifests
 manifests: $(BUILD_DIR)/kubernetes-split-yaml $(BUILD_DIR)/kustomize