Merge branch 'main' into renovate/ghcr.io-siderolabs-kubelet-1.x

Author: onedr0p

.github/workflows/flate.yaml

@@ -40,7 +40,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Flate
-        uses: home-operations/flate/action@bf3405a189626478b0aa6ec98dc4d6f7d419df17 # v0.4.12
+        uses: home-operations/flate/action@317908633d5acf3fc40f7fa02a5153a0499362a0 # v0.6.4
 
       - name: Run Flate
         id: flate

.github/workflows/template-e2e-cluster.yaml

@@ -57,13 +57,13 @@ jobs:
           sudo apt-get install --yes --no-install-recommends gettext-base qemu-system-x86 qemu-utils ovmf
 
       - name: Setup mise
-        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
       - name: Boot maintenance-mode nodes
         id: cluster
-        uses: home-operations/talosctl-cluster-action@42a2d1c476f87245e2d1882ec825fb31368b9686 # v0.1.6
+        uses: home-operations/talosctl-cluster-action@fb6a31bf5de43218acc80d2e23958a16eee7380c # v0.2.2
         with:
           config: ./.github/template-tests/e2e/talos-cluster.yaml
           cache: true

.github/workflows/template-e2e.yaml

@@ -55,7 +55,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup mise
-        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
@@ -83,7 +83,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup mise
-        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
@@ -115,7 +115,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup mise
-        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           experimental: true
           install_args: --locked
@@ -138,7 +138,7 @@ jobs:
         run: oxfmt --check ./.sops.yaml ./bootstrap ./kubernetes ./talos
 
       - name: Install flate
-        uses: home-operations/flate/action@bf3405a189626478b0aa6ec98dc4d6f7d419df17 # v0.4.12
+        uses: home-operations/flate/action@317908633d5acf3fc40f7fa02a5153a0499362a0 # v0.6.4
         with:
           base: ""
 

.mise/config.toml

@@ -6,28 +6,28 @@ TALOSCONFIG = "{{config_root}}/talos/talosconfig"
 JUST_UNSTABLE = "1"
 
 [tools]
-uv = "0.12.5"                       # required:template
-age = "1.3.1"
-cloudflared = "2026.8.2"
-flux2 = "2.9.4"
-gh = "2.98.0"
+uv = "0.12.9"                        # required:template
+age = "1.3.2"
+cloudflared = "2026.8.3"
+flux2 = "2.9.5"
+gh = "2.99.0"
 gum = "2.0.0"
 helm = "4.2.4"
 helmfile = "1.7.4"
 jq = "1.8.2"
 just = "1.58.0"
 kubeconform = "0.8.0"
-kubectl = "1.36.4"
+kubectl = "1.37.0"
 kustomize = "5.8.1"
-lefthook = "2.1.10"
-node = "24.19.0"
-oxfmt = "0.64.0"
-sd = "1.1.0"                        # required:template
+lefthook = "2.1.12"
+node = "24.20.0"
+oxfmt = "0.66.0"
+sd = "1.1.0"                         # required:template
 sops = "3.13.3"
-talosctl = "1.13.7"
-"github:postfinance/topf" = "v0.5.0"
+talosctl = "1.14.0"
+"github:postfinance/topf" = "v0.6.0"
 yq = "4.53.6"
-zizmor = "1.29.0"
+zizmor = "1.30.0"
 
 [hooks]
 postinstall = "lefthook install"

.mise/mise.lock

@@ -6,7 +6,7 @@
     enabled: true,
     schedule: ["before 3am on the first day of the month"],
     commitMessageExtra: "({{manager}})",
-    additionalBranchPrefix: "{{manager}}-"
+    additionalBranchPrefix: "{{manager}}-",
   },
   packageRules: [
     {
@@ -19,14 +19,16 @@
       description: "Mise Tools Group",
       matchManagers: ["mise"],
       groupName: "mise tools",
-      groupSlug: "mise-tools",
       minimumReleaseAge: "3 days",
     },
     {
       description: "Talos Group",
       groupName: "talos",
-      matchPackageNames: ["ghcr.io/siderolabs/installer", "siderolabs/talos", "talosctl"],
-      minimumGroupSize: 3,
+      matchPackageNames: ["siderolabs/talos"],
+      group: {
+        commitMessageTopic: "{{{groupName}}} group",
+      },
+      minimumGroupSize: 2,
     },
     {
       description: "Flux Operator Group",

.renovaterc.json5

@@ -91,6 +91,8 @@ These guidelines provide a strong baseline, but there are always exceptions and
 
     📍 _**Having trouble installing the tools?** Try unsetting the `GITHUB_TOKEN` env var and then run these commands again_
 
+    📍 _**Platforms:** `.mise/mise.lock` pins tool downloads for Linux on amd64 and arm64 and macOS on arm64 (`linux-x64`, `linux-arm64`, `macos-arm64`). If you also need musl (e.g. Alpine), Windows or Intel macOS, add those platforms to the lockfile and commit it: `mise lock -p linux-x64-musl,linux-arm64-musl,windows-x64,macos-x64`_
+
 5. Logout of the GitHub Container Registry as this may cause authorization problems in future steps when using the public registry:
 
     ```sh

README.md

@@ -4,7 +4,7 @@ version = "0.0.0"
 requires-python = ">=3.14"
 dependencies = [
   "makejinja==2.8.2",
-  "pydantic==2.13.4",
+  "pydantic==2.13.5",
 ]
 
 [dependency-groups]

pyproject.toml

@@ -9,5 +9,5 @@ spec:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 0.2.3
+    tag: 0.2.5
   url: oci://ghcr.io/home-operations/charts/echo

template/config/kubernetes/apps/default/echo/app/ocirepository.yaml.j2

@@ -9,5 +9,5 @@ spec:
     mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
     operation: copy
   ref:
-    tag: 0.58.1
+    tag: 0.59.0
   url: oci://ghcr.io/controlplaneio-fluxcd/charts/flux-instance