Sync with flant/shell-operator (alpine 3.23 base) and drop perl-utils

.dockerignore

@@ -2,6 +2,7 @@
 docs
 examples
 scripts
+!scripts/ci/verify-image.sh
 test
 libjq
 
@@ -10,4 +11,4 @@ libjq
 Dockerfile
 LICENSE
 *.md
-*.png
+*.png

.github/workflows/images.yaml

@@ -0,0 +1,78 @@
+# - Detect base-image changes in Dockerfile FROM instructions.
+# - Build amd64, arm64 and arm/v7 only when bases change or on manual runs.
+# - Check base-image and binary architectures and run smoke tests without publishing images.
+name: Base image architecture checks
+on:
+  pull_request:
+    types: [opened, synchronize]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  changes:
+    name: Detect base image changes
+    runs-on: ubuntu-latest
+    outputs:
+      build: ${{ steps.check.outputs.build }}
+    steps:
+      - name: Check out shell-operator code
+        if: github.event_name == 'pull_request'
+        uses: actions/checkout@v7
+      - name: Decide whether to build images
+        id: check
+        shell: bash
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          BEFORE_SHA: ${{ github.event.before || github.event.pull_request.base.sha }}
+          AFTER_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          if [ "$EVENT_NAME" = workflow_dispatch ]; then
+            echo "▶️ Manual run requested: building and checking all platforms."
+            echo "build=true" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Compare this push so unrelated commits do not repeat the full build.
+          git fetch --no-tags --depth=1 origin "$BEFORE_SHA" "$AFTER_SHA"
+          git show "$BEFORE_SHA:Dockerfile" | awk 'toupper($1) == "FROM" { $1=$1; print }' > "$RUNNER_TEMP/base-images-before"
+          git show "$AFTER_SHA:Dockerfile" | awk 'toupper($1) == "FROM" { $1=$1; print }' > "$RUNNER_TEMP/base-images-after"
+
+          if cmp -s "$RUNNER_TEMP/base-images-before" "$RUNNER_TEMP/base-images-after"; then
+            echo "⏭️ Base images unchanged. Skipping architecture checks."
+            echo "build=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "🔄 Base image changes detected."
+            echo "🚀 Full build and architecture checks requested for all platforms."
+            echo "build=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  build:
+    needs: changes
+    if: needs.changes.outputs.build == 'true'
+    name: Build and verify (${{ matrix.platform }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [linux/amd64, linux/arm64, linux/arm/v7]
+    steps:
+      - name: Check out shell-operator code
+        uses: actions/checkout@v7
+      - name: Set up QEMU
+        uses: docker/[email protected]
+        with:
+          platforms: arm64,arm
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+      - name: Build and verify image
+        env:
+          PLATFORM: ${{ matrix.platform }}
+        run: |
+          echo "🏗️ Building $PLATFORM image with architecture verification enabled."
+          docker buildx build \
+            --platform "$PLATFORM" \
+            --build-arg appVersion=ci \
+            --output type=cacheonly \
+            .

.github/workflows/lint.yaml

@@ -39,7 +39,7 @@ jobs:
     steps:
       - uses: actions/setup-python@v6
         with:
-          python-version: 3.8
+          python-version: "3.12"
       - name: Check out addon-operator code
         uses: actions/checkout@v7
       - name: Run codespell

Dockerfile

@@ -1,8 +1,4 @@
-# Prebuilt jq from deckhouse base images (v1.0.40).
-FROM --platform=${TARGETPLATFORM:-linux/amd64} registry.deckhouse.io/container-factory@sha256:4b36dcf53c35b50e0afbc445232713aff15f788a61b832cd720bf9e88fc9fba8 AS libjq
-
-# Go builder stage (builder/golang-alpine, Go 1.26.4 on alpine 3.22).
-FROM --platform=${TARGETPLATFORM:-linux/amd64} registry.deckhouse.io/container-factory@sha256:193e8ed6cd7fc19015ab615ccf92d0fe02471e66e3e5abf560b3a87fb05bdb62 AS builder
+FROM --platform=${TARGETPLATFORM:-linux/amd64} golang:1.26.4-alpine3.23@sha256:18b460dd17542c2ba43299a633cf6ebfc1115101509531471d7cfce1019af083 AS builder
 
 ARG appVersion=latest
 
@@ -32,25 +28,26 @@ RUN GOOS=linux \
     -o shell-operator \
     ./cmd/shell-operator
 
-# Final runtime image (builder/alpine 3.22 from deckhouse base images v1.0.40).
-FROM --platform=${TARGETPLATFORM:-linux/amd64} registry.deckhouse.io/container-factory@sha256:8fa8cf713bf8cfc9038901e5b2fbc97d0403794d834dc4a619e9e81312a6feef
+FROM --platform=${TARGETPLATFORM:-linux/amd64} alpine:3.23@sha256:ff7f0c727dd796aa36787bfcd9a64bf35a6ce72a73451b3359fde849b6703d63
 
 ARG TARGETPLATFORM
 ARG kubectlVersion=v1.35.8
 ARG yqVersion=v4.54.1
 
 # Install runtime dependencies.
-# perl-utils provides `shasum` and yq provides YAML->JSON conversion, both
-# required by downstream consumers' shell-operator hooks (e.g. the
-# aws-tagging-operator chart's resource-change.sh, which shells out to both
-# with no fallback and fails closed under failurePolicy: Fail if missing).
+# yq (installed below) provides YAML->JSON conversion, required by downstream
+# consumers' shell-operator hooks (e.g. the aws-tagging-operator chart's
+# resource-change.sh, which shells out to it with no fallback and fails closed
+# under failurePolicy: Fail if missing). Those hooks hash with busybox
+# `sha1sum`; perl-utils (`shasum`) is not installed because perl carries
+# Critical CVEs with no fix.
 RUN apk --no-cache add \
     ca-certificates \
     bash \
     sed \
     tini \
-    curl \
-    perl-utils
+    jq \
+    curl
 
 # Determine kubectl architecture and download
 RUN kubectlArch=$(echo ${TARGETPLATFORM:-linux/amd64} | sed 's/\/v7//') && \
@@ -70,9 +67,14 @@ RUN mkdir /hooks
 # Copy necessary files
 ADD frameworks/shell /frameworks/shell
 ADD shell_lib.sh /
-COPY --from=libjq /usr/bin/jq /usr/bin/jq
 COPY --from=builder /app/shell-operator /
 
+# Reject incorrect architectures before the image can be published.
+RUN --mount=type=bind,source=scripts/ci/verify-image.sh,target=/tmp/verify-image.sh \
+    apk add --no-cache --virtual .image-verification file && \
+    sh /tmp/verify-image.sh "${TARGETPLATFORM:-linux/amd64}" && \
+    apk del .image-verification
+
 # Set working directory
 WORKDIR /
 

go.mod

@@ -9,14 +9,14 @@ require (
 	github.com/go-chi/chi/v5 v5.3.0
 	github.com/go-openapi/spec v0.22.1
 	github.com/go-openapi/strfmt v0.26.2
-	github.com/go-openapi/swag v0.27.1 // indirect
+	github.com/go-openapi/swag v0.26.0 // indirect
 	github.com/go-openapi/validate v0.25.1
 	github.com/gofrs/uuid/v5 v5.4.0
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/kennygrant/sanitize v1.2.4
 	github.com/onsi/gomega v1.42.0
 	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.24.0
+	github.com/prometheus/client_golang v1.23.2
 	github.com/stretchr/testify v1.11.1
 	go.opentelemetry.io/otel v1.45.0
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.45.0
@@ -25,10 +25,10 @@ require (
 	golang.org/x/time v0.15.0
 	gopkg.in/robfig/cron.v2 v2.0.0-20150107220207-be2e0b0deed5
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.37.0
-	k8s.io/apiextensions-apiserver v0.37.0
-	k8s.io/apimachinery v0.37.0
-	k8s.io/client-go v0.37.0
+	k8s.io/api v0.35.8
+	k8s.io/apiextensions-apiserver v0.35.8
+	k8s.io/apimachinery v0.35.8
+	k8s.io/client-go v0.35.8
 	sigs.k8s.io/yaml v1.6.0
 )
 
@@ -38,7 +38,8 @@ replace github.com/go-openapi/validate => github.com/flant/go-openapi-validate v
 require (
 	github.com/caarlos0/env/v11 v11.4.1
 	github.com/deckhouse/module-sdk v0.13.0
-	github.com/go-openapi/swag/yamlutils v0.27.1
+	github.com/go-logr/logr v1.4.4
+	github.com/go-openapi/swag/yamlutils v0.26.0
 	github.com/goccy/go-json v0.10.6
 	github.com/gojuno/minimock/v3 v3.4.7
 	github.com/itchyny/gojq v0.12.19
@@ -47,7 +48,7 @@ require (
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	go.uber.org/goleak v1.3.0
-	sigs.k8s.io/controller-runtime v0.25.2
+	sigs.k8s.io/controller-runtime v0.23.3
 )
 
 require (
@@ -65,25 +66,23 @@ require (
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.2 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
-	github.com/go-logr/logr v1.4.4 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/analysis v0.24.1 // indirect
 	github.com/go-openapi/errors v0.22.7 // indirect
-	github.com/go-openapi/jsonpointer v1.0.0 // indirect
-	github.com/go-openapi/jsonreference v1.0.0 // indirect
+	github.com/go-openapi/jsonpointer v0.23.1 // indirect
+	github.com/go-openapi/jsonreference v0.21.6 // indirect
 	github.com/go-openapi/loads v0.23.2 // indirect
 	github.com/go-openapi/runtime v0.29.2 // indirect
-	github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
-	github.com/go-openapi/swag/conv v0.27.1 // indirect
-	github.com/go-openapi/swag/fileutils v0.27.1 // indirect
+	github.com/go-openapi/swag/cmdutils v0.26.0 // indirect
+	github.com/go-openapi/swag/conv v0.26.0 // indirect
+	github.com/go-openapi/swag/fileutils v0.26.0 // indirect
 	github.com/go-openapi/swag/jsonname v0.26.0 // indirect
-	github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
-	github.com/go-openapi/swag/loading v0.27.1 // indirect
-	github.com/go-openapi/swag/mangling v0.27.1 // indirect
-	github.com/go-openapi/swag/netutils v0.27.1 // indirect
-	github.com/go-openapi/swag/pools v0.27.1 // indirect
-	github.com/go-openapi/swag/stringutils v0.27.1 // indirect
-	github.com/go-openapi/swag/typeutils v0.27.1 // indirect
+	github.com/go-openapi/swag/jsonutils v0.26.0 // indirect
+	github.com/go-openapi/swag/loading v0.26.0 // indirect
+	github.com/go-openapi/swag/mangling v0.26.0 // indirect
+	github.com/go-openapi/swag/netutils v0.26.0 // indirect
+	github.com/go-openapi/swag/stringutils v0.26.0 // indirect
+	github.com/go-openapi/swag/typeutils v0.26.0 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
@@ -92,6 +91,7 @@ require (
 	github.com/google/go-containerregistry v0.21.3 // indirect
 	github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
@@ -108,8 +108,8 @@ require (
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.70.0 // indirect
-	github.com/prometheus/procfs v0.21.1 // indirect
+	github.com/prometheus/common v0.66.1 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/sergi/go-diff v1.3.1 // indirect
 	github.com/tidwall/gjson v1.19.0 // indirect
@@ -123,7 +123,7 @@ require (
 	go.opentelemetry.io/proto/otlp v1.11.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
+	golang.org/x/exp v0.0.0-20250711185948-6ae5c78190dc // indirect
 	golang.org/x/mod v0.41.0 // indirect
 	golang.org/x/net v0.60.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
@@ -140,11 +140,11 @@ require (
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	k8s.io/cli-runtime v0.35.8 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
-	k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
+	k8s.io/kube-openapi v0.0.0-20260603220949-865597e52e25 // indirect
+	k8s.io/utils v0.0.0-20260507154919-ff6756f316d2 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/kustomize/api v0.20.1 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.20.1 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect
 )