Merge origin/main into delivery-kit/main by alexey-igrychev · Pull Request #80 · deckhouse/delivery-kit

alexey-igrychev · 2026-04-21T22:43:35Z

Summary

Merge upstream werf/werf main branch into delivery-kit/main, incorporating 74 commits. Fix werf verify crash caused by missing --docker-config flag registration.

Key changes

Merge 74 upstream commits from origin/main
Resolve conflicts across CI workflows, docs, go.mod, and source files
Uncomment common.SetupDockerConfig(...) in cmd/werf/verify/verify.go — the call was commented out but required by InitDockerRegistry: true in runMain, causing a nil pointer dereference on *opts.Cmd.DockerConfig

Why

werf verify panics at runtime because InitCommonComponents with InitDockerRegistry: true dereferences DockerConfig, which is never allocated without SetupDockerConfig. Every other command that uses InitDockerRegistry or InitProcessContainerBackend properly calls SetupDockerConfig — verify was the only inconsistency.

Conflict resolutions

Area	Resolution
7 CI workflows (docs, registry cleanup, test cr)	Kept deleted per delivery-kit
3 CI workflows (issues, test_daily, tests)	Kept delivery-kit versions with custom runners
CHANGELOG.md	Combined both sets of entries
Docs (EN/RU build/process.md)	Kept both SBOM + envfile/build-report sections
go.mod (nelm)	Upgraded to origin's v1.23.3, merged all indirect deps
buildah_backend.go	Kept both SBOM + lchown/extractTar functions
legacy_stage_image.go	Used origin's improved GetID() with digest fallback
stages_storage.go	Added new error sentinels (existing ones kept in errors.go)
Test files	Combined both test sets
sbom commands	Fixed CreateDockerRegistry signature for new param

Review focus / risks

cmd/werf/verify/verify.go:73 — the only code change beyond the merge; verify that no other Setup* calls need uncommenting (audited: remaining commented-out calls correspond to disabled InitCommonComponentsOptions, so they are consistent)
Large merge — review conflict resolutions in CI workflows and go.mod for correctness

Signed-off-by: Ilya Lesikov <ilya@lesikov.com>

Signed-off-by: Polina Sizintseva <polina.sizintseva@flant.com>

…f#7407) Signed-off-by: Polina Sizintseva <polina.sizintseva@flant.com> Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com> Co-authored-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

werf#7394) Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>

Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>

…werf#7416) Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

…ges (werf#7413) Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

…seInstall, ReleaseUninstall and ReleaseRollback (werf#7418) Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

…f#7258) On Windows, filepath.Join produces backslash-separated paths that break Docker container execution. Replace filepath.Join with path.Join for all container-internal path construction in pkg/stapel/stapel.go, which always uses forward slashes regardless of host OS. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

werf#7414) Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

… disappear between readdir and stat Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

…nfig from DOCKER_AUTH_CONFIG env var When enabled, werf ci-env creates a fresh temporary Docker config directory from the DOCKER_AUTH_CONFIG environment variable instead of copying the existing Docker config. This is useful in CI environments like GitLab where DOCKER_AUTH_CONFIG is already set with registry credentials. The flag is opt-in (default false) and does not change existing behavior. Errors if DOCKER_AUTH_CONFIG is empty when the flag is enabled. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

Comment out the check for up-to-date mocks in the lint workflow.

Extend .env build report generation (ToEnvFileData) with additional fields (DockerImageID, DockerImageDigest, DockerRepo, DockerTag, WerfImageName, Final) and add a parser (parseEnvFileBuildReport) to read them back into ImagesReport. LoadBuildReportFromFile now detects .env extension and routes to the appropriate parser, enabling 'werf export --use-build-report --build-report-path=report.env'. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

…ario (werf#7423) Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

Signed-off-by: Polina Sizintseva <polina.sizintseva@flant.com>

🤖 I have created a release *beep* *boop* --- ## [2.65.0](werf/werf@v2.64.0...v2.65.0) (2026-03-29) ### Features * **build-report:** support reading .env format build reports ([8e1501c](werf@8e1501c)) * **ci-env:** add --use-docker-auth-config flag to generate Docker config from DOCKER_AUTH_CONFIG env var ([c2701f7](werf@c2701f7)) * **deploy:** add structured image values to $.Values.global.werf.images ([werf#7413](werf#7413)) ([1b93dcc](werf@1b93dcc)) ### Bug Fixes * **build:** fix git owner and group with buildah backend ([werf#7415](werf#7415)) ([7af23b6](werf@7af23b6)) * **build:** use path.Join for container-internal paths in stapel ([werf#7258](werf#7258)) ([c974594](werf@c974594)) * **deploy:** goroutine leak in watch error channel consumer for ReleaseInstall, ReleaseUninstall and ReleaseRollback ([werf#7418](werf#7418)) ([f2d817c](werf@f2d817c)) * **deploy:** release had pending status after error instead of failed ([werf#7416](werf#7416)) ([b523cf2](werf@b523cf2)) * **host-cleanup:** handle race condition in tmp files GC when entries disappear between readdir and stat ([18ff151](werf@18ff151)) * **includes:** respect --loose-giterminism for --allow-includes-update ([werf#7414](werf#7414)) ([db75a5a](werf@db75a5a)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

…Fetch (werf#7425) ## Summary - Fix `werf export` failing with `reference not found` when `werf-includes.yaml` specifies a non-default branch name (e.g. `branch: devops/includes-problem`) - Extract `syncLocalBranches` helper from `FetchOrigin` and call it from `CloneAndFetch` after a fresh clone, so local `refs/heads/*` branches are created from `refs/remotes/origin/*` immediately — not only after the next fetch ## Problem When `CloneAndFetch` performs a fresh `git clone`, the cloned repo only has remote-tracking refs (`refs/remotes/origin/*`). The `branchRef` function in `pkg/includes/repo.go` resolves branch names via `refs/heads/*`, which don't exist yet. This causes `reference not found` for any non-default branch on the first run. The existing `syncLocalBranches` logic (creating local refs from remote refs) already existed in `FetchOrigin`, but was never called after the initial clone path — only after subsequent fetches. ## Changes - **`pkg/git_repo/remote.go`**: Extract `syncLocalBranches` private method from `FetchOrigin`; call it from `CloneAndFetch` after fresh clone; reuse in `FetchOrigin` - **`pkg/git_repo/remote_ai_test.go`**: Add test covering 3 branch patterns: `main`, `feature-branch`, `devops/includes-problem` (slash-containing) Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

… stage with no instructions (werf#7434) When stageDependencies.install (or beforeSetup/setup) has paths but the corresponding shell/ansible section is empty or missing, the stage is never generated and the dependency paths are silently ignored. This causes changes to matched files to not trigger rebuilds. Emit a global warning in this case. Marked with TODO(v3) to become a hard error in v3. Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

Signed-off-by: Polina Sizintseva <polina.sizintseva@flant.com>

Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>

Signed-off-by: Polina Sizintseva <polina.sizintseva@flant.com>

Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>

Signed-off-by: Polina Sizintseva <polina.sizintseva@flant.com>

Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>

…builds (werf#7480) Signed-off-by: Evgeniy Frolov <evgeniy.frolov@flant.com>

🤖 I have created a release *beep* *boop* --- ## [2.67.2](werf/werf@v2.67.1...v2.67.2) (2026-04-21) ### Bug Fixes * **build, docker, stapel:** fix stage image cache for multi-platform builds ([werf#7480](werf#7480)) ([23f89b3](werf@23f89b3)) * **build, docker:** handle `no such container` error ([werf#7482](werf#7482)) ([83b3227](werf@83b3227)) * **ci:** pr docs preview ([werf#7485](werf#7485)) ([d29c18b](werf@d29c18b)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

…7448) ## Summary Fixes werf#6755 When running `werf bundle copy --docker-config=<dir>`, the custom docker config is used for pulling the bundle chart itself but **not** for pulling the associated images. This results in a `DENIED: Permission denied` error when pulling images from a registry that requires the custom credentials. ## Root Cause The `bundle copy` command initializes the docker registry via `InitCommonComponents` with `InitDockerRegistry: true`, which calls `DockerRegistryInit` → `docker_registry.Init`. However, it does **not** call `docker.InitDockerConfig()`, so the `DOCKER_CONFIG` environment variable is never set. The image pulling code in `PullImageArchive` uses `authn.DefaultKeychain` from `go-containerregistry`, which reads from `$DOCKER_CONFIG` to locate credentials. Without the env var set, it falls back to `~/.docker/config.json` and cannot find the custom credentials. Other commands (like `werf build`) call `InitProcessContainerBackend`, which calls `docker.Init()` → `docker.InitDockerConfig()`, so they work correctly. But `bundle copy` skips this step since it doesn't need a full container backend. ## Fix Call `docker.InitDockerConfig()` with the configured docker config directory in `runCopy()` after `InitCommonComponents`. This sets the `DOCKER_CONFIG` environment variable so that `authn.DefaultKeychain` can find the credentials for image pulling. ## Files Changed - `cmd/werf/bundle/copy/copy.go` — Add `docker.InitDockerConfig()` call with the `--docker-config` value Co-authored-by: rvasikarla <rvasikarla@splunk.com>

…is requested (werf#7488) ## Summary Systemic follow-up to werf#7448. Centralizes `docker.InitDockerConfig` in `InitCommonComponents` as the single source of truth for `DOCKER_CONFIG` initialization. ## Problem `docker.InitDockerConfig` was called in multiple places: - Buildah branch of `InitProcessContainerBackend` (`container_backend.go`) - Docker branch via `InitProcessDocker` → `docker.Init` → `docker.InitDockerConfig` - Per-command band-aid in `bundle copy` (added by werf#7448) Any command using `InitDockerRegistry` without `InitProcessContainerBackend` didn't get `DOCKER_CONFIG` set, breaking `authn.DefaultKeychain` credential lookup. ## Fix - Call `docker.InitDockerConfig` once in `InitCommonComponents` when either `InitDockerRegistry` or `InitProcessContainerBackend` is requested — early, before any registry interaction. - Remove the duplicate call from `InitProcessContainerBackend` buildah branch. - Remove the per-command band-aid from `bundle copy`. `InitDockerConfig` is idempotent (just `os.Setenv` + global var), so the docker path (`InitProcessDocker` → `docker.Init`) calling it again is harmless. ## Files Changed - `cmd/werf/common/components_manager.go` — Add centralized `docker.InitDockerConfig` call - `cmd/werf/common/container_backend.go` — Remove duplicate from buildah branch - `cmd/werf/bundle/copy/copy.go` — Remove per-command band-aid from werf#7448 Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com> # Conflicts: # .github/workflows/_docs_deploy.yml # .github/workflows/docs_cleanup-registry.yml # .github/workflows/docs_deploy_latest.yml # .github/workflows/docs_deploy_pr.yml # .github/workflows/docs_deploy_tag.yml # .github/workflows/issues_delayed-auto-close.yml # .github/workflows/release_registry-cleanup.yml # .github/workflows/test_cr-cleanup.yml # .github/workflows/test_daily.yml # .github/workflows/tests.yml # CHANGELOG.md # docs/pages_en/usage/build/process.md # docs/pages_ru/usage/build/process.md # go.mod # go.sum # pkg/container_backend/buildah_backend.go # pkg/container_backend/legacy_stage_image.go # pkg/storage/repo_stages_storage_test.go # pkg/storage/stages_storage.go # pkg/storage/suite_test.go

Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

ilya-lesikov and others added 30 commits March 23, 2026 17:55

chore: bump channels

529d7f9

Signed-off-by: Ilya Lesikov <ilya@lesikov.com>

fix(build): fix stage build time in report (werf#7404)

74ae247

Signed-off-by: Polina Sizintseva <polina.sizintseva@flant.com>

chore(build): registries insecure and cleanup docker requirement (wer…

6a11f08

…f#7407) Signed-off-by: Polina Sizintseva <polina.sizintseva@flant.com> Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com> Co-authored-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

fix(build): handle broken import metadata images in container registry (

0413384

werf#7394) Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>

chore(dev): move self-improvement rules to separate skill file

0e9f069

Signed-off-by: Alexandr Zaytsev <alexandr.zaytsev@flant.com>

chore(main): release 2.64.0

d33ba20

chore(release): 2 alpha

eaf6a18

docs(build): update build report and telemetry documentation

1cc19a4

fix(deploy): release had pending status after error instead of failed (…

b523cf2

…werf#7416) Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

feat(deploy): add structured image values to $.Values.global.werf.ima…

1b93dcc

…ges (werf#7413) Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

fix(deploy): goroutine leak in watch error channel consumer for Relea…

f2d817c

…seInstall, ReleaseUninstall and ReleaseRollback (werf#7418) Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

fix(includes): respect --loose-giterminism for --allow-includes-update (

db75a5a

werf#7414) Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

fix(host-cleanup): handle race condition in tmp files GC when entries…

18ff151

… disappear between readdir and stat Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

chore: fix gci import ordering in generated mocks

75856f2

Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

chore(ci): comment out mock check step in lint workflow

a3362fb

Comment out the check for up-to-date mocks in the lint workflow.

docs: document build report formats, usage, and CI/CD deployment scen…

dcff75e

…ario (werf#7423) Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

fix(build): fix git owner and group with buildah backend (werf#7415)

7af23b6

Signed-off-by: Polina Sizintseva <polina.sizintseva@flant.com>

chore(release): 2 alpha,beta

8d37125

chore(main): release 2.65.1

35233ea

chore(release): 2 alpha,beta,ea,rock-solid

78af2ee

fix(deploy): restore global.env

5e5defd

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

chore(main): release 2.65.2

897b989

chore(release): 2 alpha,beta

0182807

chore(ci): exclude generated mocks from go formatting (werf#7431)

fe40bc6

Signed-off-by: Polina Sizintseva <polina.sizintseva@flant.com>

flant-team-sysdev and others added 22 commits April 14, 2026 11:55

chore(main): release 2.67.0

eafffc9

chore(release): 2 alpha,ea,stable,rock-solid

1fa80d8

chore(release): 2 stable

967d406

chore(deps): bump common-go to fix symlink handling in staged builds

5e6a273

Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>

chore(ci): skip test PR jobs for release-please branches (werf#7477)

ada8113

Signed-off-by: Polina Sizintseva <polina.sizintseva@flant.com>

fix(build, buildah): apply owner group to dst dir (werf#7462)

fea6b40

Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>

fix(build, buildah): correct expansion of instructions (werf#7460)

aef6003

Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>

chore(main): release 2.67.1

e186b88

chore(release): 2 alpha,beta,ea

d4b8a9a

fix(ci): pr docs preview (werf#7485)

d29c18b

Signed-off-by: Polina Sizintseva <polina.sizintseva@flant.com>

refactor(host-cleanup): add percentage value to log (werf#7478)

d74b915

Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>

refactor(build): extend missing file log message (werf#7481)

fd7c5ef

Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>

fix(build, docker): handle no such container error (werf#7482)

83b3227

Signed-off-by: Radmir Khurum <radmir.khurum@flant.com>

fix(build, docker, stapel): fix stage image cache for multi-platform …

23f89b3

…builds (werf#7480) Signed-off-by: Evgeniy Frolov <evgeniy.frolov@flant.com>

chore(release): 2 all

b9143a8

feat(deploy): adopt chart ts init for werf (werf#7489)

63542e2

Signed-off-by: Dmitry Mordvinov <dmitry.mordvinov@flant.com>

chore(release): 2 beta,ea,stable

fe5ae8d

fix: regenerate mocks and add missing Mutate method to test stub

0cbb7b5

Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

alexey-igrychev marked this pull request as draft April 21, 2026 23:00

alexey-igrychev added 4 commits April 22, 2026 07:44

test: disable BuildahBackend data archives tests

7341fc8

Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

test: update exposed ports expectations to allow for alternate formats

6625779

Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

refactor(verify): add docker config option

df5e6bb

Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

test: also accept 'invalid port' for empty expose in clean-test

2857667

Signed-off-by: Aleksei Igrychev <aleksei.igrychev@palark.com>

alexey-igrychev marked this pull request as ready for review April 22, 2026 11:03

alexey-igrychev merged commit 466bc95 into main Apr 22, 2026
15 checks passed

alexey-igrychev deleted the delivery-kit-main branch April 22, 2026 11:03

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Merge origin/main into delivery-kit/main#80

Merge origin/main into delivery-kit/main#80
alexey-igrychev merged 80 commits intomainfrom
delivery-kit-main

alexey-igrychev commented Apr 21, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

Conversation

alexey-igrychev commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Key changes

Why

Conflict resolutions

Review focus / risks

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

9 participants

alexey-igrychev commented Apr 21, 2026 •

edited

Loading