Run 'make upgrade-klone' and 'make generate'

.github/renovate.json5

@@ -1,6 +1,6 @@
 {
   $schema: 'https://docs.renovatebot.com/renovate-schema.json',
   extends: [
-    'github>cert-manager/renovate-config:default.json5',
+    'github>cert-manager/makefile-modules:renovate-config.json5',
   ],
 }

.github/workflows/make-self-upgrade.yaml

@@ -32,13 +32,13 @@ jobs:
           exit 1
 
       - name: Octo STS Token Exchange
-        uses: octo-sts/action@d6c70ad3b9ac85df6da6b9749014d7283987cfec # v1.0.3
+        uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
         id: octo-sts
         with:
           scope: 'jetstack/jetstack-secure'
           identity: make-self-upgrade
 
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         # Adding `fetch-depth: 0` makes sure tags are also fetched. We need
         # the tags so `git describe` returns a valid version.
         # see https://github.com/actions/checkout/issues/701 for extra info about this option
@@ -50,7 +50,7 @@ jobs:
         run: |
           make print-go-version >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
         with:
           go-version: ${{ steps.go-version.outputs.result }}
 

Makefile

@@ -39,8 +39,16 @@
 # For details on some of these "prelude" settings, see:
 # https://clarkgrubb.com/makefile-style-guide
 MAKEFLAGS += --warn-undefined-variables --no-builtin-rules
-SHELL := /usr/bin/env PS1="" bash
-.SHELLFLAGS := -uo pipefail -c
+SHELL := /usr/bin/env bash
+# The `--norc` option prevents "PS1: unbound" errors.
+# If Bash thinks it is being run with its standard input connected to a network
+# connection (such as via SSH or via Docker), it reads and executes commands
+# from ~/.bashrc, regardless of whether it thinks it is in interactive mode.
+# Bash does not set PS1 in non-interactive environments. But on Ubuntu 24.04 the
+# default /etc/bash.bashrc file assumes that PS1 is set.
+#
+# See https://www.gnu.org/software/bash/manual/bash.html#Invoked-by-remote-shell-daemon
+.SHELLFLAGS := --norc -uo pipefail -c
 .DEFAULT_GOAL := help
 .DELETE_ON_ERROR:
 .SUFFIXES:

klone.yaml

@@ -10,55 +10,55 @@ targets:
     - folder_name: generate-verify
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 4479013f57fb2f7f0f28b4e951dc1ba6e6badddc
+      repo_hash: 2c5045aea89e02724fed0b9148e6b21abca94e9a
       repo_path: modules/generate-verify
     - folder_name: go
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 4479013f57fb2f7f0f28b4e951dc1ba6e6badddc
+      repo_hash: 2c5045aea89e02724fed0b9148e6b21abca94e9a
       repo_path: modules/go
     - folder_name: helm
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 4479013f57fb2f7f0f28b4e951dc1ba6e6badddc
+      repo_hash: 2c5045aea89e02724fed0b9148e6b21abca94e9a
       repo_path: modules/helm
     - folder_name: help
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 4479013f57fb2f7f0f28b4e951dc1ba6e6badddc
+      repo_hash: 2c5045aea89e02724fed0b9148e6b21abca94e9a
       repo_path: modules/help
     - folder_name: kind
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 4479013f57fb2f7f0f28b4e951dc1ba6e6badddc
+      repo_hash: 2c5045aea89e02724fed0b9148e6b21abca94e9a
       repo_path: modules/kind
     - folder_name: klone
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 4479013f57fb2f7f0f28b4e951dc1ba6e6badddc
+      repo_hash: 2c5045aea89e02724fed0b9148e6b21abca94e9a
       repo_path: modules/klone
     - folder_name: licenses
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 4479013f57fb2f7f0f28b4e951dc1ba6e6badddc
+      repo_hash: 2c5045aea89e02724fed0b9148e6b21abca94e9a
       repo_path: modules/licenses
     - folder_name: oci-build
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 4479013f57fb2f7f0f28b4e951dc1ba6e6badddc
+      repo_hash: 2c5045aea89e02724fed0b9148e6b21abca94e9a
       repo_path: modules/oci-build
     - folder_name: oci-publish
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 4479013f57fb2f7f0f28b4e951dc1ba6e6badddc
+      repo_hash: 2c5045aea89e02724fed0b9148e6b21abca94e9a
       repo_path: modules/oci-publish
     - folder_name: repository-base
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 4479013f57fb2f7f0f28b4e951dc1ba6e6badddc
+      repo_hash: 2c5045aea89e02724fed0b9148e6b21abca94e9a
       repo_path: modules/repository-base
     - folder_name: tools
       repo_url: https://github.com/cert-manager/makefile-modules.git
       repo_ref: main
-      repo_hash: 4479013f57fb2f7f0f28b4e951dc1ba6e6badddc
+      repo_hash: 2c5045aea89e02724fed0b9148e6b21abca94e9a
       repo_path: modules/tools

make/_shared/go/base/.github/workflows/govulncheck.yaml

@@ -20,7 +20,7 @@ jobs:
     if: github.repository == '{{REPLACE:GH-REPOSITORY}}'
 
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         # Adding `fetch-depth: 0` makes sure tags are also fetched. We need
         # the tags so `git describe` returns a valid version.
         # see https://github.com/actions/checkout/issues/701 for extra info about this option
@@ -30,7 +30,7 @@ jobs:
         run: |
           make print-go-version >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
         with:
           go-version: ${{ steps.go-version.outputs.result }}
 

make/_shared/repository-base/base/.github/workflows/make-self-upgrade.yaml

@@ -32,13 +32,13 @@ jobs:
           exit 1
 
       - name: Octo STS Token Exchange
-        uses: octo-sts/action@d6c70ad3b9ac85df6da6b9749014d7283987cfec # v1.0.3
+        uses: octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1
         id: octo-sts
         with:
           scope: '{{REPLACE:GH-REPOSITORY}}'
           identity: make-self-upgrade
 
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         # Adding `fetch-depth: 0` makes sure tags are also fetched. We need
         # the tags so `git describe` returns a valid version.
         # see https://github.com/actions/checkout/issues/701 for extra info about this option
@@ -50,7 +50,7 @@ jobs:
         run: |
           make print-go-version >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
         with:
           go-version: ${{ steps.go-version.outputs.result }}
 

make/_shared/repository-base/base/Makefile

@@ -39,8 +39,16 @@
 # For details on some of these "prelude" settings, see:
 # https://clarkgrubb.com/makefile-style-guide
 MAKEFLAGS += --warn-undefined-variables --no-builtin-rules
-SHELL := /usr/bin/env PS1="" bash
-.SHELLFLAGS := -uo pipefail -c
+SHELL := /usr/bin/env bash
+# The `--norc` option prevents "PS1: unbound" errors.
+# If Bash thinks it is being run with its standard input connected to a network
+# connection (such as via SSH or via Docker), it reads and executes commands
+# from ~/.bashrc, regardless of whether it thinks it is in interactive mode.
+# Bash does not set PS1 in non-interactive environments. But on Ubuntu 24.04 the
+# default /etc/bash.bashrc file assumes that PS1 is set.
+#
+# See https://www.gnu.org/software/bash/manual/bash.html#Invoked-by-remote-shell-daemon
+.SHELLFLAGS := --norc -uo pipefail -c
 .DEFAULT_GOAL := help
 .DELETE_ON_ERROR:
 .SUFFIXES:

make/_shared/repository-base/renovate-bootstrap-config.json5

@@ -1,6 +1,6 @@
 {
   $schema: 'https://docs.renovatebot.com/renovate-schema.json',
   extends: [
-    'github>cert-manager/renovate-config:default.json5',
+    'github>cert-manager/makefile-modules:renovate-config.json5',
   ],
 }