chore: backport kubefleet main (2026-09-01)

.github/.copilot/breadcrumbs/2026-09-01-1119-kubefleet-main-backport.md

@@ -0,0 +1,36 @@
+# Implementation: September 2026 KubeFleet Main Backport
+
+## Overview
+
+Merge the latest `kubefleet-dev/kubefleet` main branch into `Azure/fleet` main while preserving Fleet-specific module paths, build settings, chart layout, and link-check configuration.
+
+## Plan
+
+1. Confirm `cncf` and `upstream` remotes, fetch both main branches, and fast-forward the session branch to `upstream/main`.
+2. Merge `cncf/main` with a merge commit, preferring incoming conflict resolutions and retaining incoming modify/delete files.
+3. Restore Fleet conventions for Go module/import paths, repository links, Docker builder versions, CRD chart symlinks, and authenticated Slack link checking.
+4. Run `make reviewable` in WSL and fix backport-related failures.
+5. Commit any post-merge fixes, push the branch, and open a new pull request against `Azure/fleet:main`.
+
+## Success Criteria
+
+- [x] The branch begins at the latest `upstream/main`.
+- [x] `cncf/main` is merged with a merge commit.
+- [x] Go module and import references use `go.goms.io/fleet`.
+- [x] Dockerfiles use the latest incoming Microsoft Go builder consistently.
+- [x] No new CRD template symlinks remain.
+- [x] `make reviewable` passes in WSL.
+- [x] A new pull request targets `Azure/fleet:main` from the pushed fork branch.
+
+## Implementation Notes
+
+- Base: `upstream/main` at `f21dbd0cfd3cb10923472fa8557e4c9717ba3597`.
+- Initial incoming: `cncf/main` at `48bde0d8`, merged as `533a4a8a`.
+- Refreshed incoming: `cncf/main` at `81194d7d`, merged as `ccd19190`.
+- Restored incoming Go imports in `test/e2e/join_and_leave_test.go` to `go.goms.io/fleet`.
+- Confirmed all four Dockerfiles use `mcr.microsoft.com/oss/go/microsoft/golang:1.26.6-1`.
+- Confirmed the Slack archives URL remains covered by `ignorePatterns`.
+- Confirmed no new CRD template symlinks were introduced relative to the first merge parent.
+- Ran `make reviewable` successfully in WSL with `GOTOOLCHAIN=go1.26.6`; shell scripts were normalized only in the working tree for validation and restored to the checkout line-ending convention afterward.
+- Refetched `cncf/main` after PR #858 landed, merged its cross-compilation changes, and reran `make reviewable` successfully.
+- Published the backport as `Azure/fleet` PR #1338.

.github/workflows/code-lint.yml

@@ -79,7 +79,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
         with:
           version: v3.17.0
 

.github/workflows/codeql-analysis.yml

@@ -42,7 +42,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -56,7 +56,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+      uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -69,4 +69,4 @@ jobs:
     #   ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4

.github/workflows/codespell.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 

.github/workflows/release.yml

@@ -60,39 +60,47 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      # A single multi-arch `docker buildx build` per image publishes the full
+      # tag (e.g. "v0.4.0") and, for stable releases, the short alias
+      # (e.g. "0.4.0") in the same push - no separate retag step. RC images are
+      # published under the long form ("v0.4.0-rc.1") for testers only: the
+      # short-tag namespace is deliberately reserved for stable releases that
+      # consumers can safely pin to, so RC tags get no short alias.
       - name: Build and push images with tag ${{ env.TAG }}
-        run: |
-          make push
-
-      # The short-tag (e.g. ":0.4.0") aliases the long form for stable releases
-      # only. RC images are published under the long form (":v0.4.0-rc.1") for
-      # testers, but we deliberately do NOT alias them to a short tag - the
-      # short-tag namespace is reserved for stable releases that consumers can
-      # safely pin to (and "imagetools create" with an RC alias would publish
-      # "0.4.0-rc.1" into that namespace, muddying it).
-      - name: Tag and push images without v prefix
-        if: ${{ !contains(needs.export-registry.outputs.tag, '-rc.') }}
         env:
           VERSION: ${{ needs.export-registry.outputs.version }}
         run: |
           set -euo pipefail
-          for IMAGE in ${{ env.HUB_AGENT_IMAGE_NAME }} ${{ env.MEMBER_AGENT_IMAGE_NAME }} ${{ env.REFRESH_TOKEN_IMAGE_NAME }}; do
-            docker buildx imagetools create \
-              --tag "${{ env.REGISTRY }}/${IMAGE}:${VERSION}" \
-              "${{ env.REGISTRY }}/${IMAGE}:${{ env.TAG }}"
-          done
+          if [[ "${TAG}" == *-rc.* ]]; then
+            make push
+          else
+            make push IMAGE_EXTRA_TAG="${VERSION}"
+          fi
 
-      - name: Verify images
+      # Confirm every published tag is a real multi-arch manifest list rather
+      # than a silently degraded single-arch image: a build that pushed only one
+      # architecture would otherwise go unnoticed until a consumer on the other
+      # architecture failed to pull. Stable releases also carry the short alias.
+      - name: Verify images are multi-arch
         env:
           VERSION: ${{ needs.export-registry.outputs.version }}
         run: |
           set -euo pipefail
-          echo "✅ Published images:"
+          tags="${TAG}"
+          if [[ "${TAG}" != *-rc.* ]]; then
+            tags="${tags} ${VERSION}"
+          fi
+          echo "✅ Verifying published images:"
           for IMAGE in ${{ env.HUB_AGENT_IMAGE_NAME }} ${{ env.MEMBER_AGENT_IMAGE_NAME }} ${{ env.REFRESH_TOKEN_IMAGE_NAME }}; do
-            echo "  - ${{ env.REGISTRY }}/${IMAGE}:${{ env.TAG }}"
-            if [[ "${TAG}" != *-rc.* ]]; then
-              echo "  - ${{ env.REGISTRY }}/${IMAGE}:${VERSION}"
-            fi
+            for tag in ${tags}; do
+              ref="${{ env.REGISTRY }}/${IMAGE}:${tag}"
+              echo "  - ${ref}"
+              manifest="$(docker buildx imagetools inspect "${ref}")"
+              for platform in linux/amd64 linux/arm64; do
+                grep -q "Platform:.*${platform}" <<<"${manifest}" \
+                  || { echo "::error::${ref} is missing platform ${platform}"; exit 1; }
+              done
+            done
           done
 
   # Publish the raw CRDs as a standalone release asset so consumers can install

.github/workflows/workflow-lint.yml

@@ -22,7 +22,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@9ca718d3bf646d6534007c269a635b3e54cadf99 # v2.19.2
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
         with:
           egress-policy: audit
 

.golangci.yml

@@ -1,30 +1,28 @@
+version: "2"
+
 run:
   timeout: 15m
   go: '1.26.6'
 
-linters-settings:
-  stylecheck:
-    checks: [ "all", "-ST1001" ]  # Disables dot-import warnings
-  revive:
-    rules:
-      - name: dot-imports
-        disabled: true
-  gosec:
-    excludes:
-      - G404 #Use of weak random number generator (math/rand or math/rand/v2). It is only used in tests.
-
 linters:
-  disable-all: true
+  default: none
+  settings:
+    staticcheck:
+      checks: [ "all", "-ST1001" ]  # Disables dot-import warnings
+    revive:
+      rules:
+        - name: dot-imports
+          disabled: true
+    gosec:
+      excludes:
+        - G404 #Use of weak random number generator (math/rand or math/rand/v2). It is only used in tests.
   enable:
     - decorder
     - errcheck
     - errorlint
     - goconst
     - gocyclo
-    - gofmt
-    - goimports
     - gosec
-    - gosimple
     - govet
     - ineffassign
     - misspell
@@ -34,9 +32,11 @@ linters:
     - revive
     - staticcheck
     - tparallel
-    - typecheck
     - unconvert
     - unused
     - whitespace
-  # Run with --fast=false for more extensive checks
-  fast: true
+
+formatters:
+  enable:
+    - gofmt
+    - goimports