Bump @typespec/http from 1.5.0 to 1.6.0 in /typespec

.devcontainer/post-create.sh

@@ -19,5 +19,5 @@ go install go.uber.org/mock/mockgen@v0.4.0
 # Prerequisites for Code Generation, see https://github.com/radius-project/radius/tree/main/docs/contributing/contributing-code/contributing-code-prerequisites#code-generation
 cd typespec || exit 
 npm ci 
-npm install -g autorest 
-npm install -g oav 
+npm install -g autorest@3.7.2
+npm install -g oav@4.0.2

.github/actions/copy-deployment-engine-image/action.yml

@@ -1,3 +1,5 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-action.json
+---
 name: Copy Deployment Engine image
 description: Copy a deployment engine image from Azure Container Registry to GitHub Container Registry.
 inputs:
@@ -35,10 +37,10 @@ runs:
   using: composite
   steps:
     - name: Set up Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
 
     - name: Log in to Azure
-      uses: azure/login@v2
+      uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
       with:
         client-id: ${{ env.DE_CONTAINER_AZURE_CLIENT_ID }}
         tenant-id: ${{ env.DE_CONTAINER_AZURE_TENANT_ID }}
@@ -50,7 +52,7 @@ runs:
         az acr login --name "${{ inputs.acr-name }}"
 
     - name: Log in to GitHub Container Registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
       with:
         registry: ${{ inputs.destination-registry }}
         username: ${{ inputs.ghcr-username }}

.github/actions/create-kind-cluster/action.yaml

@@ -1,3 +1,5 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-action.json
+---
 name: "Create a KinD cluster"
 description: |
   Create a KinD cluster.
@@ -31,7 +33,7 @@ inputs:
     required: true
     default: "5000"
 runs:
-  using: "composite"
+  using: composite
   steps:
     - name: Install KinD
       shell: bash
@@ -45,7 +47,7 @@ runs:
       run: |
         # https://kind.sigs.k8s.io/docs/user/local-registry/
         # Create the cluster with necessary configurations
-        # to expose 30080 port for Gitea
+        # to expose 30080 port for the local Git server
         cat <<EOF | kind create cluster --config=-
         kind: Cluster
         apiVersion: kind.x-k8s.io/v1alpha4
@@ -62,7 +64,7 @@ runs:
       shell: bash
       run: |
         # Create the cluster with necessary configurations
-        # to expose 30080 port for Gitea
+        # to expose 30080 port for the local Git server
         cat <<EOF | kind create cluster --config=-
         kind: Cluster
         apiVersion: kind.x-k8s.io/v1alpha4
@@ -109,7 +111,7 @@ runs:
       shell: bash
       run: |
         # Create the cluster with necessary configurations for the secure local registry
-        # and to expose 30080 port for Gitea
+        # and to expose 30080 port for the local Git server
         cat <<EOF | kind create cluster --config=-
         kind: Cluster
         apiVersion: kind.x-k8s.io/v1alpha4

.github/actions/create-local-registry/action.yaml

@@ -1,3 +1,5 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-action.json
+---
 name: "Create a local registry"
 description: |
   This action creates a local registry for the images to be pushed to.
@@ -25,7 +27,7 @@ outputs:
     description: "The temporary directory where the certificates are stored"
     value: ${{ steps.create-temp-cert-dir.outputs.TEMP_CERT_DIR }}
 runs:
-  using: "composite"
+  using: composite
   steps:
     - name: Create temporary directory for certificates
       if: ${{ inputs.secure == 'true' }}

.github/actions/download-pr-data-artifact/action.yaml

@@ -1,3 +1,5 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-action.json
+---
 name: "Download PR number saved as an artifact"
 description: |
   This action can be used together with save-pr-as-artifact custom action which uploads the PR number as an artifact.
@@ -7,10 +9,10 @@ outputs:
     value: ${{ steps.set-pr-number.outputs.pr_number }}
     description: The PR number downloaded from the artifact
 runs:
-  using: "composite"
+  using: composite
   steps:
     - name: Download artifact
-      uses: actions/github-script@v7
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
       with:
         script: |
           let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -34,7 +36,7 @@ runs:
       run: unzip pr_number.zip
     - name: Set PR number
       id: set-pr-number
-      uses: actions/github-script@v7
+      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
       with:
         script: |
           let fs = require('fs');

.github/actions/install-flux/action.yaml

@@ -1,3 +1,5 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-action.json
+---
 name: "Install Flux CLI and Source Controller"
 description: "Installs Flux CLI and Source Controller."
 inputs:
@@ -6,12 +8,13 @@ inputs:
     required: false
     default: "2.6.4"
 runs:
-  using: "composite"
+  using: composite
   steps:
     - name: Install Flux CLI
-      uses: fluxcd/flux2/action@main
+      uses: fluxcd/flux2/action@b6e76ca2534f76dcb8dd94fb057cdfa923c3b641 # v2.7.3
       with:
         version: ${{ inputs.version }}
+
     - name: Install Flux Source Controller
       shell: bash
       run: |

.github/actions/install-git-http-backend/action.yaml

@@ -0,0 +1,25 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-action.json
+---
+name: "Install Git HTTP Backend"
+description: "Installs a git HTTP backend, configures basic auth, and exposes it inside the cluster using alpine/git."
+inputs:
+  git-username:
+    description: "Username for basic authentication"
+    required: true
+  git-password:
+    description: "Password for basic authentication"
+    required: true
+  namespace:
+    description: "Namespace to deploy the git-http-backend into"
+    required: false
+    default: "git-http-backend"
+  image:
+    description: "Container image to use for the git backend"
+    required: false
+    default: "alpine/git:2.45.2"
+runs:
+  using: composite
+  steps:
+    - name: Install git-http-backend
+      shell: bash
+      run: .github/actions/install-git-http-backend/install-git-http-backend.sh "${{ inputs.git-username }}" "${{ inputs.git-password }}" "${{ inputs.namespace }}" "${{ inputs.image }}"

.github/actions/install-git-http-backend/git-http-backend-entrypoint.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+# Bootstrap script for the alpine/git container. Installs nginx/fcgiwrap, renders configuration from
+# templates, and launches the Git HTTP backend suitable for Radius functional tests.
+set -eu
+
+# Ensure nginx + fcgiwrap + git HTTP backend bits are present (alpine/git is minimal by default).
+apk add --no-cache nginx fcgiwrap spawn-fcgi apache2-utils gettext git-daemon
+
+# Generate the basic-auth credentials picked up by nginx.
+htpasswd -bc /etc/nginx/.htpasswd "${GIT_USERNAME}" "${GIT_PASSWORD}"
+
+# fcgiwrap needs a UNIX socket; keep everything under /run/git-http.
+SOCKET_DIR="/run/git-http"
+export SOCKET_DIR
+
+# Prepare writable directories for the socket and bare Git repos.
+mkdir -p "${SOCKET_DIR}" "${GIT_SERVER_TEMP_DIR}"
+chown -R nginx:nginx "${SOCKET_DIR}" "${GIT_SERVER_TEMP_DIR}"
+
+# Allow nginx user to interact with repositories regardless of owner checks.
+git config --system --add safe.directory "${GIT_SERVER_TEMP_DIR}"
+git config --system --add safe.directory "${GIT_SERVER_TEMP_DIR}/*"
+
+# Render the nginx configuration using the environment exported above.
+envsubst '${GIT_SERVER_TEMP_DIR} ${SOCKET_DIR}' </config/nginx.conf.template >/etc/nginx/http.d/git.conf
+
+# Start fcgiwrap (serves /usr/libexec/git-core/git-http-backend) and foreground nginx.
+spawn-fcgi -s "${SOCKET_DIR}/fcgiwrap.sock" -M 766 -u nginx -g nginx /usr/bin/fcgiwrap
+exec nginx -g 'daemon off;'

.github/actions/install-git-http-backend/git-http-backend-nginx.conf

@@ -0,0 +1,31 @@
+server {
+# Reference docs:
+#   - Core directives: https://nginx.org/en/docs/http/ngx_http_core_module.html
+#   - FastCGI params: https://nginx.org/en/docs/http/ngx_http_fastcgi_module.html
+#   - HTTP auth basic: https://nginx.org/en/docs/http/ngx_http_auth_basic_module.html
+#
+# Expose the git-http-backend on port 3000 inside the cluster.
+    listen 3000;
+    server_name _;
+    root ${GIT_SERVER_TEMP_DIR};
+
+    # Require basic auth using credentials provisioned by the entrypoint script.
+    auth_basic "Git Server";
+    auth_basic_user_file /etc/nginx/.htpasswd;
+
+    location / {
+        client_max_body_size 0;
+        include fastcgi_params;
+
+        # Forward all requests to git-http-backend via fcgiwrap.
+        fastcgi_pass unix:${SOCKET_DIR}/fcgiwrap.sock;
+        fastcgi_param SCRIPT_FILENAME /config/git-http-backend-wrapper.sh;
+        fastcgi_param PATH_INFO $uri;
+        fastcgi_param SCRIPT_NAME $uri;
+        fastcgi_param GIT_PROJECT_ROOT ${GIT_SERVER_TEMP_DIR};
+        fastcgi_param GIT_HTTP_EXPORT_ALL 1;
+        fastcgi_param GIT_HTTP_MAX_REQUEST_BUFFER 1048576000;
+        fastcgi_param REMOTE_USER $remote_user;
+        fastcgi_param HTTP_AUTHORIZATION $http_authorization;
+    }
+}

.github/actions/install-git-http-backend/git-http-backend-wrapper.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+set -eu
+
+# Ensure PATH_INFO always starts with a leading slash to keep git-http-backend happy.
+if [ "${PATH_INFO:-}" != "" ] && [ "${PATH_INFO#*/}" = "${PATH_INFO}" ]; then
+  PATH_INFO="/${PATH_INFO}"
+  export PATH_INFO
+fi
+
+# Default to exporting all repositories unless explicitly disabled.
+export GIT_HTTP_EXPORT_ALL=${GIT_HTTP_EXPORT_ALL:-1}
+
+exec /usr/libexec/git-core/git-http-backend

.github/actions/install-git-http-backend/git-http-backend.yaml

@@ -0,0 +1,85 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: git-http-backend
+  namespace: ${NAMESPACE}
+  labels:
+    app: git-http-backend
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: git-http-backend
+  template:
+    metadata:
+      labels:
+        app: git-http-backend
+    spec:
+      containers:
+        - name: git-http-backend
+          image: ${IMAGE}
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - /config/entrypoint.sh
+          env:
+            - name: GIT_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: git-http-backend-auth
+                  key: username
+            - name: GIT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: git-http-backend-auth
+                  key: password
+            - name: GIT_SERVER_TEMP_DIR
+              value: ${SERVER_TEMP_DIR}
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
+          ports:
+            - containerPort: 3000
+              name: http
+          readinessProbe:
+            tcpSocket:
+              port: 3000
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          livenessProbe:
+            tcpSocket:
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: git-data
+              mountPath: ${SERVER_TEMP_DIR}
+      volumes:
+        - name: config
+          configMap:
+            name: git-http-backend-config
+            defaultMode: 0555
+        - name: git-data
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: git-http
+  namespace: ${NAMESPACE}
+  labels:
+    app: git-http-backend
+spec:
+  selector:
+    app: git-http-backend
+  ports:
+    - name: http
+      port: 3000
+      targetPort: 3000
+      protocol: TCP

.github/actions/install-git-http-backend/install-git-http-backend.sh

@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# Installs a Git HTTP backend backed by alpine/git and nginx.
+set -euo pipefail
+
+if [[ $# -lt 2 ]]; then
+  echo "Usage: $0 <git-username> <git-password> [namespace] [image]" >&2
+  exit 1
+fi
+
+SCRIPT_DIR=$(cd -- "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)
+
+GIT_USERNAME=$1
+GIT_PASSWORD=$2
+NAMESPACE=${3:-git-http-backend}
+IMAGE=${4:-${GIT_HTTP_IMAGE:-alpine/git:2.45.2}} # allow override via env or arg
+SERVER_TEMP_DIR=${GIT_SERVER_TEMP_DIR:-/var/lib/git}
+
+MANIFEST_TEMPLATE="${SCRIPT_DIR}/git-http-backend.yaml"
+ENTRYPOINT_FILE="${SCRIPT_DIR}/git-http-backend-entrypoint.sh"
+NGINX_TEMPLATE="${SCRIPT_DIR}/git-http-backend-nginx.conf"
+WRAPPER_FILE="${SCRIPT_DIR}/git-http-backend-wrapper.sh"
+
+for cmd in kubectl envsubst; do
+  if ! command -v "$cmd" >/dev/null 2>&1; then
+    echo "error: required command '$cmd' not found in PATH" >&2
+    exit 1
+  fi
+done
+
+ensure_namespace() {
+  kubectl create namespace "$1" --dry-run=client -o yaml | kubectl apply -f -
+}
+
+apply_basic_auth_secret() {
+  kubectl -n "$1" create secret generic git-http-backend-auth \
+    --type=kubernetes.io/basic-auth \
+    --from-literal=username="$2" \
+    --from-literal=password="$3" \
+    --dry-run=client -o yaml | kubectl apply -f -
+}
+
+apply_configmap() {
+  kubectl -n "$1" create configmap git-http-backend-config \
+    --from-file=entrypoint.sh="$2" \
+    --from-file=nginx.conf.template="$3" \
+    --from-file=git-http-backend-wrapper.sh="$4" \
+    --dry-run=client -o yaml | kubectl apply -f -
+}
+
+apply_workload() {
+  export NAMESPACE IMAGE SERVER_TEMP_DIR
+  envsubst '${NAMESPACE} ${IMAGE} ${SERVER_TEMP_DIR}' <"$1" | kubectl apply -f -
+}
+
+ensure_namespace "$NAMESPACE"
+apply_basic_auth_secret "$NAMESPACE" "$GIT_USERNAME" "$GIT_PASSWORD"
+apply_configmap "$NAMESPACE" "$ENTRYPOINT_FILE" "$NGINX_TEMPLATE" "$WRAPPER_FILE"
+apply_workload "$MANIFEST_TEMPLATE"
+
+kubectl rollout restart deployment/git-http-backend -n "$NAMESPACE" >/dev/null 2>&1 || true
+
+kubectl rollout status deployment/git-http-backend -n "$NAMESPACE" --timeout=240s