Epic: GHA migration follow-up from skopeo-sandbox review

[timcoding1988]

Summary

Tracking epic for unresolved CI review feedback from the podman-container-tools/skopeo-sandbox Cirrus → GHA migration.

The sandbox work landed upstream in PR #2883. These items are follow-up from sandbox PR https://github.com/podman-container-tools/skopeo-sandbox/pull/1 / PR https://github.com/podman-container-tools/skopeo-sandbox/pull/9 review threads and the upstream audit before deprecating the sandbox repo.

Sub-issues

• ci: migrate renovate.json5 to podman-container-tools/automation #2912 — migrate renovate.json5 to podman-container-tools/automation
• ci: add zizmor workflow for GitHub Actions security scanning #2913 — add zizmor workflow for GitHub Actions security scanning
• ci: remove leftover Cirrus config after GHA migration #2914 — remove leftover Cirrus config after GHA migration
• ci: remove git safe.directory workaround from container jobs #2915 — remove git safe.directory workaround from container jobs
• ci: golangci-lint installed via make tools instead of golangci-lint-action #2916 — golangci-lint installed via make tools instead of golangci-lint-action
• ci: ostree_rs_ext job uses archived ostree-rs-ext repository #2917 — ostree_rs_ext job uses archived ostree-rs-ext repository
• ci: cancel-in-progress cancels overlapping CI runs on main pushes #2918 — cancel-in-progress cancels overlapping CI runs on main pushes
• ci: doccheck does build + install before validate-docs #2922 — doccheck does build + install before validate-docs
• ci: redundant make vendor in test_skopeo job #2923 — redundant make vendor in test_skopeo job
• ci: ostree_rs_ext reinstalls Rust and rebuilds dependencies every run #2924 — ostree_rs_ext reinstalls Rust and rebuilds dependencies every run

Related (not sub-issues)

• PR ci: make the automation release renovate managed #2911 — Renovate-managed AUTOMATION_RELEASE in ci.yml (companion to ci: migrate renovate.json5 to podman-container-tools/automation #2912)
• Draft PR [draft/DNM] GHA CI nits #2885 — started safe.directory / Makefile GOBIN cleanup (companion to ci: remove git safe.directory workaround from container jobs #2915)
• CI Switch: Cirrus -> TMT #2633 — broader CI Switch: Cirrus → TMT umbrella
• Draft PR [NOT READY] More TMT #2640 — TMT work including ostree-rs-ext (related to ci: ostree_rs_ext job uses archived ostree-rs-ext repository #2917)

Background

• Sandbox: https://github.com/podman-container-tools/skopeo-sandbox
• Upstream migration: PR CI migration #2883

[timcoding1988]

@mtrmac please let me know if this is good. I opened the issues (even some of them has been worked on), as long as it is not completed. we can use this epic for track and discussion.

@Luap99 we can private or delete the sandbox repo.

[mtrmac]

@timcoding1988 Thanks for filing those, and especially for linking all the later context.

A few more things worth recording I think (all optimizations that shouldn’t materially change the test contents, so pretty low-priority):

• https://github.com/podman-container-tools/skopeo-sandbox/pull/1#discussion_r3181672805 : doccheck should be possible to do with just make validate-docs without make install (and without removing /usr/bin/skopeo)
• https://github.com/podman-container-tools/skopeo-sandbox/pull/1#discussion_r3182590794 : make vendor in the test_skopeo task is redundant (and go mod verify is fairly costly): that task depends on validate which already checked this
• https://github.com/podman-container-tools/skopeo-sandbox/pull/1#discussion_r3182673020 : (If we preserve the ostree_rs_ext tests,) perhaps we can avoid installing Rust + dependencies on every run, by building into CI images or caching