chore: complete Alpha.2 v1 dependency cleanup - #2730
Draft
fseldow wants to merge 6 commits into
Draft
Conversation
fseldow
requested review from
akashsinghal,
binbin-li,
jimmyraywv,
luisdlp,
susanshi and
toddysm
as code owners
July 14, 2026 15:28
Contributor
There was a problem hiding this comment.
Pull request overview
Note
Copilot couldn't run its full agentic review because no GitHub Actions runner was available. Make sure your repository has a runner available to run Copilot's review, or add a copilot-setup-steps.yml file specifying one with the runs-on attribute. See the docs for more details.
Updates internal/logger to use Ratify v2’s local errors package instead of the legacy v1 module reference, removing the v1 dependency from runtime code.
Changes:
- Replaced the v1
errorsimport path withgithub.com/notaryproject/ratify/v2/errorsin the logger package.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Codecov Report❌ Patch coverage is ❌ Your patch check has failed because the patch coverage (63.58%) is below the target coverage (80.00%). You can increase the patch coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #2730 +/- ##
==========================================
- Coverage 76.37% 71.96% -4.41%
==========================================
Files 88 133 +45
Lines 4000 6268 +2268
==========================================
+ Hits 3055 4511 +1456
- Misses 799 1461 +662
- Partials 146 296 +150 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
fseldow
marked this pull request as draft
July 14, 2026 16:14
fseldow
changed the title
fseldow
changed the title
fseldow
force-pushed
the
fseldow/remove-v1-code-refs
branch
from
July 14, 2026 19:19
327807a to
13f4b46
Compare
fseldow
changed the title
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| case "PRIVATE KEY": | ||
| logger.GetLogger(ctx, logOpt).Warnf("azure keyvault certificate provider: certificate %s, version %s private key skipped. Please see doc to learn how to create a new certificate in keyvault with non exportable keys. https://learn.microsoft.com/en-us/azure/key-vault/certificates/how-to-export-certificate?tabs=azure-cli#exportable-and-non-exportable-keys", certName, version) | ||
| case "CERTIFICATE": | ||
| pemData := make([]byte, 0, len(block.Bytes)+64) |
| case "PRIVATE KEY": | ||
| logger.GetLogger(ctx, logOpt).Warnf("azure keyvault key management provider: certificate %s, version %s private key skipped. Please see doc to learn how to create a new certificate in keyvault with non exportable keys. https://learn.microsoft.com/en-us/azure/key-vault/certificates/how-to-export-certificate?tabs=azure-cli#exportable-and-non-exportable-keys", certName, version) | ||
| case "CERTIFICATE": | ||
| pemData := make([]byte, 0, len(block.Bytes)+64) |
fseldow
changed the title
This was referenced Jul 30, 2026
fseldow
force-pushed
the
fseldow/remove-v1-code-refs
branch
from
July 30, 2026 08:58
7092ec8 to
fb2c89b
Compare
Switch the runtime logger to use the local v2 errors package instead of importing errors from the v1 Ratify module. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Move legacy Ratify packages used by existing pkg/plugins functionality under the v2 module path so the repository no longer depends on github.com/ratify-project/ratify v1.x. Preserve existing functionality while removing the v1 package dependency. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Move legacy plugin/provider code to local v2 imports while removing old v1 CRD API/controller surfaces. This keeps non-CRD plugin and provider functionality without depending on github.com/ratify-project/ratify v1.x. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Remove an accidental BATS temporary file from the draft dependency cleanup PR. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Address lint and vulnerability scan issues introduced while moving legacy compatibility code under the v2 module path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
fseldow
force-pushed
the
fseldow/remove-v1-code-refs
branch
from
July 30, 2026 08:59
fb2c89b to
f0658cf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is a draft PR for the remaining Alpha.2 cleanup work after switching the Executor runtime to
ratify-go.github.com/ratify-project/ratify v1.xmodule dependency fromgo.mod/go.sumExecutorCRDapi/v1beta1api/unversionedpkg/controllerspkg/customresourcesgithub.com/notaryproject/ratify/v2module pathinternal/loggerto the local v2errorspackageValidation
go list ./...go test ./cmd/ratify-gatekeeper-provider ./internal/logger ./pkg/common/... ./pkg/referrerstore/... ./pkg/verifier/... ./pkg/keymanagementprovider/... ./pkg/certificateprovider/... ./configgolangci-lint run --timeout=10mlocally with Go 1.26 toolchain: 0 issuesgovulncheck ./...locally with Go 1.26.5 toolchain: no reachable vulnerabilitiesNotes
build-prremains red only because AKS e2e failed before test execution due to missing Azure login secrets (client-id/tenant-id) in the fork/upstream PR context.