chore: cherry pick for 1.2.2

.github/workflows/codequality.yml

@@ -44,6 +44,8 @@ jobs:
           go-version-file: go.mod
 
       - name: golangci-lint
-        uses: golangci/[email protected]
+        env:
+          GOGC: "90" # Garbage collection limit to avoid OOM errors
+        uses: golangci/[email protected]
         with:
-          version: v1.57
+          version: v1.62

.github/workflows/create-release.yaml

@@ -40,6 +40,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          token: ${{ secrets.GIT_BOT_TOKEN }} # creating git tag using bot token because GITHUB_TOKEN would not trigger build workflow (https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow).
 
       - name: Create changelog
         env:
@@ -54,14 +55,13 @@ jobs:
           RELEASE_ID=$(./.github/scripts/create_draft_release.sh ${{ github.event.inputs.version }}) # this will use the CHANGELOG.md from the step 'Create changelog'
           echo "release_id=$RELEASE_ID" >> $GITHUB_OUTPUT
 
-      - name: Trigger 'release-nats-manager-build' prow job
+      - name: Add lightweight tag to trigger release build job
+        env:
+          GITHUB_TOKEN: ${{ secrets.GIT_BOT_TOKEN }} # creating git tag using bot token because GITHUB_TOKEN would not trigger build workflow (https://docs.github.com/en/actions/using-workflows/triggering-a-workflow#triggering-a-workflow-from-a-workflow).
         run: |
           git tag ${{ github.event.inputs.version }}
           git push origin ${{ github.event.inputs.version }}
 
-      - name: Wait for 'release-nats-manager-build'
-        run: ./.github/scripts/check-prow-build-job.sh ${{ github.ref_name }} 600 10 30
-
       - name: Create and upload nats-manager.yaml and nats-default-cr.yaml
         env:
           KUSTOMIZE_VERSION: "v4.5.6"
@@ -71,9 +71,45 @@ jobs:
     outputs:
       release_id: ${{ steps.create-draft.outputs.release_id }}
 
+  wait-for-build-job:
+    name: Wait for build job
+    needs: [ create-draft ]
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout eventing-tools
+        uses: actions/checkout@v4
+        with:
+          repository: 'kyma-project/eventing-tools'
+          path: 'kyma-project/eventing-tools'
+          ref: main
+          sparse-checkout: 'scripts/wait-for-commit-check'
+
+      - name: Setup python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+          cache: 'pip'
+
+      - name: Install requirements
+        run: |
+          pip install -r $GITHUB_WORKSPACE/kyma-project/eventing-tools/scripts/wait-for-commit-check/requirements.txt
+
+      - name: wait for build
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY_FULL_NAME: ${{ github.repository_owner }}/nats-manager
+          GIT_REF: ${{ github.event.inputs.version }}
+          # The re-usable image-builder workflow from neighbors appends the "Build image" suffix to the check run name.
+          GIT_CHECK_RUN_NAME: "build-${{ github.event.inputs.version }} / Build image"
+          INTERVAL: 60
+          TIMEOUT: 900
+        run: |
+          python $GITHUB_WORKSPACE/kyma-project/eventing-tools/scripts/wait-for-commit-check/run.py
+
   publish-release:
     name: Publish release
-    needs: [verify-release-status, create-draft]
+    needs: [verify-release-status, create-draft, wait-for-build-job]
     runs-on: ubuntu-latest
 
     steps:

.github/workflows/lint-conventional-prs.yml

@@ -14,7 +14,7 @@ jobs:
     name: Check Title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@e9fabac35e210fea40ca5b14c0da95a099eff26f
+      - uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/pull-build-image.yaml

@@ -0,0 +1,18 @@
+name: Pull Build Image
+
+on:
+  pull_request_target:
+    types: [opened, edited, synchronize, reopened, ready_for_review]
+
+permissions:
+  id-token: write # This is required for requesting the JWT token
+  contents: read # This is required for actions/checkout
+
+jobs:
+  build:
+    uses: kyma-project/test-infra/.github/workflows/image-builder.yml@main
+    with:
+      name: nats-manager
+      dockerfile: Dockerfile
+      context: .
+      export-tags: true

.github/workflows/pull-e2e-test.yml

@@ -15,7 +15,44 @@ on:
       - "sec-scanners-config.yaml"
 
 jobs:
+  wait-for-build-job:
+    name: Wait for build job
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout eventing-tools
+        uses: actions/checkout@v4
+        with:
+          repository: 'kyma-project/eventing-tools'
+          path: 'kyma-project/eventing-tools'
+          ref: main
+          sparse-checkout: 'scripts/wait-for-commit-check'
+
+      - name: Setup python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+          cache: 'pip'
+
+      - name: Install requirements
+        run: |
+          pip install -r $GITHUB_WORKSPACE/kyma-project/eventing-tools/scripts/wait-for-commit-check/requirements.txt
+
+      - name: Wait for build job
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPOSITORY_FULL_NAME: ${{ github.repository_owner }}/nats-manager
+          GIT_REF: "${{ github.event.pull_request.head.sha }}" # Note: 'github.event.pull_request.head.sha' is not same as 'github.sha' on pull requests.
+          # The re-usable image-builder workflow from neighbors appends the "Build image" suffix to the check run name.
+          GIT_CHECK_RUN_NAME: "build / Build image"
+          INTERVAL: 60
+          TIMEOUT: 900
+        run: |
+          python $GITHUB_WORKSPACE/kyma-project/eventing-tools/scripts/wait-for-commit-check/run.py
+
   e2e:
+    name: e2e
+    needs: [ wait-for-build-job ]
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
@@ -45,19 +82,6 @@ jobs:
         run: |
           make install IMG=$DOCKER_IMAGE
 
-      - name: Wait for the 'pull-nats-manager-build' job to succeed
-        uses: kyma-project/wait-for-commit-status-action@2b3ffe09af8b6f40e1213d5fb7f91a7bd41ffb20
-        with:
-          context: "pull-nats-manager-build"
-          commit_ref: "${{ github.event.pull_request.head.sha }}" # Note: 'github.event.pull_request.head.sha' is not same as 'github.sha' on pull requests.
-          timeout: 600000 # 10 minutes in milliseconds
-          # The check interval is kept long otherwise it will exhaust the GitHub rate limit (More info: https://docs.github.com/en/rest/overview/resources-in-the-rest-api?apiVersion=2022-11-28#rate-limiting)
-          check_interval: 60000 # 1 minute in milliseconds
-        env:
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          GITHUB_OWNER: "${{ github.repository_owner }}"
-          GITHUB_REPO: "nats-manager"
-
       - name: Create kyma-system namespace
         run: |
           kubectl create namespace kyma-system
@@ -116,5 +140,63 @@ jobs:
         run: |
           kubectl get nats --all-namespaces
 
-# references:
-# wait for other gh checks to finish: https://github.com/marketplace/actions/wait-for-check
+  e2e-upgrade: # This job tests the upgrade of NATS module from latest image of the main branch to the current commit.
+    name: e2e-upgrade
+    needs: [ wait-for-build-job ]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Cache Go dependencies
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: "./go.mod"
+          check-latest: true
+          cache-dependency-path: "./go.sum"
+
+      - run: go version
+
+      - name: Install k3d tools
+        run: |
+          make -C hack/ci/ install-k3d-tools
+
+      - name: Install Kyma CLI & setup k3d cluster using kyma CLI
+        run: |
+          make kyma
+          make -C hack/ci/ create-k3d
+          kubectl version
+          kubectl cluster-info
+
+      - name: Install latest NATS manager from main branch
+        run: |
+          make -C hack/ci/ create-kyma-system-ns
+          make deploy IMG=europe-docker.pkg.dev/kyma-project/prod/nats-manager:main
+
+      - name: Setup & test NATS CR
+        run: |
+          make e2e-setup
+
+      - name: Install the new NATS manager from current commit
+        run: |
+          make deploy IMG=${DOCKER_IMAGE}
+
+      - name: Wait for new changes to be reflected
+        # Waits for NATS-manager image to be updated and NATS CR readiness.
+        run: |
+          export MANAGER_IMAGE=${DOCKER_IMAGE}
+          make e2e-setup
+
+      - name: Run NATS bench
+        run: |
+          go install github.com/nats-io/natscli/nats@latest
+          export PATH=$HOME/go/bin:$PATH
+          make e2e-bench
+
+      - name: Test NATS-server
+        run: |
+          make e2e-nats-server
+
+      - name: Cleanup NATS CR
+        run: |
+          make e2e-cleanup

.github/workflows/push-build-image.yaml

@@ -0,0 +1,39 @@
+name: Push Build Image
+
+on:
+  push:
+    branches:
+      - "main"
+      - "release-*"
+    paths-ignore:
+      - "docs/**"
+
+permissions:
+  id-token: write # This is required for requesting the JWT token
+  contents: read # This is required for actions/checkout
+
+jobs:
+  compute-tags:
+    runs-on: ubuntu-latest
+    outputs:
+      tags: ${{ steps.get_tag.outputs.TAGS }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Get the latest tag
+        id: get_tag
+        run: |
+          {
+            echo 'TAGS<<EOF'
+            echo "${{ github.sha }}"
+            echo "${{ github.ref_name}}"
+            echo EOF
+          } >> "$GITHUB_OUTPUT"
+  build:
+    needs: compute-tags
+    uses: kyma-project/test-infra/.github/workflows/image-builder.yml@main
+    with:
+      name: nats-manager
+      dockerfile: Dockerfile
+      context: .
+      tags: ${{ needs.compute-tags.outputs.tags }}