Release 3.5 dd v3.5.14 dd.1

.github/workflows/e2e.yaml

@@ -25,7 +25,8 @@ jobs:
         echo "${TARGET}"
         case "${TARGET}" in
           linux-amd64-e2e)
-            CPU='4' EXPECT_DEBUG='true' COVER='false' RACE='true' make test-e2e-release
+            make install-gofail
+            CPU='4' EXPECT_DEBUG='true' COVER='false' RACE='true' FAILPOINTS='true' make test-e2e-release
             ;;
           linux-386-e2e)
             GOARCH=386 CPU='4' EXPECT_DEBUG='true' COVER='false' RACE='true' make test-e2e

.github/workflows/gh-workflow-approve.yaml

@@ -0,0 +1,40 @@
+---
+name: Approve GitHub Workflows
+
+on:
+  pull_request_target:
+    types:
+      - labeled
+      - synchronize
+
+jobs:
+  approve:
+    name: Approve ok-to-test
+    if: contains(github.event.pull_request.labels.*.name, 'ok-to-test')
+    runs-on: ubuntu-latest
+    permissions:
+      actions: write
+    steps:
+      - name: Update PR
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        continue-on-error: true
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          debug: ${{ secrets.ACTIONS_RUNNER_DEBUG == 'true' }}
+          script: |
+            const result = await github.rest.actions.listWorkflowRunsForRepo({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              event: "pull_request",
+              status: "action_required",
+              head_sha: context.payload.pull_request.head.sha,
+              per_page: 100
+            });
+
+            for (var run of result.data.workflow_runs) {
+              await github.rest.actions.approveWorkflowRun({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id: run.id
+              });
+            }

.github/workflows/govuln.yaml

@@ -0,0 +1,19 @@
+---
+name: Go Vulnerability Checker
+on: [push, pull_request]
+permissions: read-all
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - id: goversion
+        run: echo "goversion=$(cat .go-version)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
+        with:
+          go-version: ${{ steps.goversion.outputs.goversion }}
+      - run: date
+      - run: |
+          set -euo pipefail
+
+          go install golang.org/x/vuln/cmd/govulncheck@latest && govulncheck ./...

.github/workflows/release.yaml

@@ -4,10 +4,10 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
     - id: goversion
       run: echo "goversion=$(cat .go-version)" >> "$GITHUB_OUTPUT"
-    - uses: actions/setup-go@v2
+    - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
       with:
         go-version: ${{ steps.goversion.outputs.goversion }}
     - name: release
@@ -30,3 +30,41 @@ jobs:
     - name: test-image
       run: |
         VERSION=3.5.99 ./scripts/test_images.sh
+    - name: save-image
+      run: |
+        docker image save -o /tmp/etcd-img.tar gcr.io/etcd-development/etcd
+    - name: upload-image
+      uses: actions/upload-artifact@v3
+      with:
+        name: etcd-img
+        path: /tmp/etcd-img.tar
+        retention-days: 1
+  trivy-scan:
+    needs: main
+    strategy:
+      fail-fast: false
+      matrix:
+        platforms: [amd64, arm64, ppc64le, s390x]
+    permissions:
+      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
+    runs-on: ubuntu-latest
+    steps:
+      - name: get-image
+        uses: actions/download-artifact@v3
+        with:
+          name: etcd-img
+          path: /tmp
+      - name: load-image
+        run: |
+          docker load < /tmp/etcd-img.tar
+      - name: trivy-scan
+        uses: aquasecurity/trivy-action@d710430a6722f083d3b36b8339ff66b32f22ee55 # v0.19.0
+        with:
+          image-ref: 'gcr.io/etcd-development/etcd:v3.5.99-${{ matrix.platforms }}'
+          severity: 'CRITICAL,HIGH'
+          format: 'sarif'
+          output: 'trivy-results-${{ matrix.platforms }}.sarif'
+      - name: upload scan results
+        uses: github/codeql-action/upload-sarif@956f09c2ef1926b580554b9014cfb8a51abf89dd # v2.16.6
+        with:
+          sarif_file: 'trivy-results-${{ matrix.platforms }}.sarif'

.github/workflows/static-analysis.yaml

@@ -0,0 +1,32 @@
+---
+name: Static Analysis
+on: [push, pull_request]
+permissions: read-all
+jobs:
+  run:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - id: goversion
+        run: echo "goversion=$(cat .go-version)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
+        with:
+          go-version: ${{ steps.goversion.outputs.goversion }}
+      - run: |
+          set -euo pipefail
+
+          make verify
+      - run: |
+          set -euo pipefail
+
+          make fix
+
+          DIFF=$(git status --porcelain)
+
+          if [ -n "$DIFF" ]; then
+            echo "These files were modified:"
+            echo
+            echo "$DIFF"
+            echo
+            exit 1
+          fi

.github/workflows/tests-template.yaml

@@ -0,0 +1,76 @@
+---
+name: Reusable Tests Workflow
+on:
+  workflow_call:
+    inputs:
+      arch:
+        required: true
+        type: string
+      runs-on:
+        required: true
+        type: string
+      targets:
+        required: false
+        type: string
+
+jobs:
+  test:
+    runs-on: ${{ inputs.runs-on }}
+    # this is to prevent arm64 jobs from running at forked projects
+    if: inputs.arch == 'amd64' || github.repository == 'etcd-io/etcd'
+    strategy:
+      fail-fast: false
+      matrix:
+        target: ${{ fromJSON(inputs.targets) }}
+    steps:
+      - uses: actions/checkout@v2
+      - id: goversion
+        run: echo "goversion=$(cat .go-version)" >> "$GITHUB_OUTPUT"
+      - uses: actions/setup-go@v2
+        with:
+          go-version: ${{ steps.goversion.outputs.goversion }}
+      - run: date
+      - env:
+          TARGET: ${{ matrix.target }}
+        run: |
+          set -euo pipefail
+
+          echo "${TARGET}"
+          case "${TARGET}" in
+            linux-test-smoke)
+              GOARCH=${{ inputs.arch }} CPU=4 RACE='false' make test-smoke
+              ;;
+            linux-integration-1-cpu)
+              make install-gofail
+              GOARCH=${{ inputs.arch }} CPU=1 RACE='false' FAILPOINTS='true' make test-integration
+              ;;
+            linux-integration-2-cpu)
+              make install-gofail
+              GOARCH=${{ inputs.arch }} CPU=2 RACE='false' FAILPOINTS='true' make test-integration
+              ;;
+            linux-integration-4-cpu)
+              make install-gofail
+              GOARCH=${{ inputs.arch }} CPU=4 RACE='false' FAILPOINTS='true' make test-integration
+              ;;
+            linux-unit-4-cpu-race)
+              GOARCH=${{ inputs.arch }} RACE='true' CPU='4' GO_TEST_FLAGS='-p=2' make test-unit
+              ;;
+            linux-386-unit-1-cpu)
+              GOOS=linux GOARCH=386 CPU=1 GO_TEST_FLAGS='-p=4' make test-unit
+              ;;
+            all-build)
+              GOARCH=amd64 PASSES='build' ./test.sh
+              GOARCH=386 PASSES='build' ./test.sh
+              GO_BUILD_FLAGS='-v -mod=readonly' GOOS=darwin GOARCH=amd64 ./build.sh
+              GO_BUILD_FLAGS='-v -mod=readonly' GOOS=darwin GOARCH=arm64 ./build.sh
+              GO_BUILD_FLAGS='-v -mod=readonly' GOOS=windows GOARCH=amd64 ./build.sh
+              GO_BUILD_FLAGS='-v -mod=readonly' GOARCH=arm ./build.sh
+              GO_BUILD_FLAGS='-v -mod=readonly' GOARCH=arm64 ./build.sh
+              GO_BUILD_FLAGS='-v -mod=readonly' GOARCH=ppc64le ./build.sh
+              GO_BUILD_FLAGS='-v -mod=readonly' GOARCH=s390x ./build.sh
+              ;;
+            *)
+              echo "Failed to find target"
+              exit 1
+              ;;
+          esac

.github/workflows/tests.yaml

@@ -1,65 +1,25 @@
 name: Tests
 on: [push, pull_request]
 jobs:
-  test:
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        target:
-        - linux-amd64-fmt
-        - linux-amd64-integration-1-cpu
-        - linux-amd64-integration-2-cpu
-        - linux-amd64-integration-4-cpu
-        - linux-amd64-unit-4-cpu-race
-        - all-build
-        - linux-386-unit-1-cpu
-    steps:
-    - uses: actions/checkout@v2
-    - id: goversion
-      run: echo "goversion=$(cat .go-version)" >> "$GITHUB_OUTPUT"
-    - uses: actions/setup-go@v2
-      with:
-        go-version: ${{ steps.goversion.outputs.goversion }}
-    - run: date
-    - env:
-        TARGET: ${{ matrix.target }}
-      run: |
-        set -euo pipefail
-
-        echo "${TARGET}"
-        case "${TARGET}" in
-          linux-amd64-fmt)
-            GOARCH=amd64 PASSES='fmt bom dep' ./test.sh
-            ;;
-          linux-amd64-integration-1-cpu)
-            GOARCH=amd64 CPU=1 RACE='false' make test-integration
-            ;;
-          linux-amd64-integration-2-cpu)
-            GOARCH=amd64 CPU=2 RACE='false' make test-integration
-            ;;
-          linux-amd64-integration-4-cpu)
-            GOARCH=amd64 CPU=4 RACE='false' make test-integration
-            ;;
-          linux-amd64-unit-4-cpu-race)
-            GOARCH=amd64 RACE='true' CPU='4' GO_TEST_FLAGS='-p=2' make test-unit
-            ;;
-          all-build)
-            GOARCH=amd64 PASSES='build' ./test.sh
-            GOARCH=386 PASSES='build' ./test.sh
-            GO_BUILD_FLAGS='-v -mod=readonly' GOOS=darwin GOARCH=amd64 ./build.sh
-            GO_BUILD_FLAGS='-v -mod=readonly' GOOS=darwin GOARCH=arm64 ./build.sh
-            GO_BUILD_FLAGS='-v -mod=readonly' GOOS=windows GOARCH=amd64 ./build.sh
-            GO_BUILD_FLAGS='-v -mod=readonly' GOARCH=arm ./build.sh
-            GO_BUILD_FLAGS='-v -mod=readonly' GOARCH=arm64 ./build.sh
-            GO_BUILD_FLAGS='-v -mod=readonly' GOARCH=ppc64le ./build.sh
-            GO_BUILD_FLAGS='-v -mod=readonly' GOARCH=s390x ./build.sh
-            ;;
-          linux-386-unit-1-cpu)
-            GOARCH=386 RACE='false' CPU='1' GO_TEST_FLAGS='-p=4' make test-unit
-            ;;
-          *)
-            echo "Failed to find target"
-            exit 1
-            ;;
-        esac
+  amd64:
+    uses: ./.github/workflows/tests-template.yaml
+    with:
+      arch: amd64
+      runs-on: ubuntu-latest
+      targets: "['linux-test-smoke',
+        'linux-integration-1-cpu',
+        'linux-integration-2-cpu',
+        'linux-integration-4-cpu',
+        'linux-unit-4-cpu-race',
+        'linux-386-unit-1-cpu',
+        'all-build']"
+  arm64:
+    uses: ./.github/workflows/tests-template.yaml
+    with:
+      arch: arm64
+      runs-on: actuated-arm64-8cpu-32gb
+      targets: "['linux-test-smoke',
+        'linux-integration-1-cpu',
+        'linux-integration-2-cpu',
+        'linux-integration-4-cpu',
+        'linux-unit-4-cpu-race']"

.go-version

@@ -1 +1 @@
-1.20.8
+1.21.10

Dockerfile-release.amd64

@@ -1,4 +1,4 @@
-FROM --platform=linux/amd64 gcr.io/distroless/static-debian11
+FROM --platform=linux/amd64 gcr.io/distroless/static-debian11@sha256:6d31326376a7834b106f281b04f67b5d015c31732f594930f2ea81365f99d60c
 
 ADD etcd /usr/local/bin/
 ADD etcdctl /usr/local/bin/

Dockerfile-release.arm64

@@ -1,4 +1,4 @@
-FROM --platform=linux/arm64 gcr.io/distroless/static-debian11
+FROM --platform=linux/arm64 gcr.io/distroless/static-debian11@sha256:6d31326376a7834b106f281b04f67b5d015c31732f594930f2ea81365f99d60c
 
 ADD etcd /usr/local/bin/
 ADD etcdctl /usr/local/bin/

Dockerfile-release.ppc64le

@@ -1,4 +1,4 @@
-FROM --platform=linux/ppc64le gcr.io/distroless/static-debian11
+FROM --platform=linux/ppc64le gcr.io/distroless/static-debian11@sha256:6d31326376a7834b106f281b04f67b5d015c31732f594930f2ea81365f99d60c
 
 ADD etcd /usr/local/bin/
 ADD etcdctl /usr/local/bin/

Dockerfile-release.s390x

@@ -1,4 +1,4 @@
-FROM --platform=linux/s390x gcr.io/distroless/static-debian11
+FROM --platform=linux/s390x gcr.io/distroless/static-debian11@sha256:6d31326376a7834b106f281b04f67b5d015c31732f594930f2ea81365f99d60c
 
 ADD etcd /usr/local/bin/
 ADD etcdctl /usr/local/bin/