.kres.yaml

---
kind: auto.CommandConfig
name: omnictl
spec:
  disableImage: true
---
kind: auto.CommandConfig
name: acompat
spec:
  disableImage: true
---
kind: auto.CommandConfig
name: make-cookies
spec:
  disableImage: true
---
kind: auto.Helm
spec:
  enabled: true
  chartDir: deploy/helm/omni
  schemaDisabled: true
  chartVersionMajor: 2
  template:
    valuesFiles:
      - hack/test/helm/template-values.yaml
---
kind: auto.IntegrationTests
spec:
  tests:
    - path: internal/integration
      name: integration-test
      enableDockerImage: true
      imageName: omni-integration-test
      outputs:
        linux-amd64:
          GOOS: linux
          GOARCH: amd64
        linux-arm64:
          GOOS: linux
          GOARCH: arm64
        darwin-amd64:
          GOOS: darwin
          GOARCH: amd64
        darwin-arm64:
          GOOS: darwin
          GOARCH: arm64
---
kind: js.Chromatic
spec:
  enabled: true
  sopsExtractKey: '["secrets"]["CHROMATIC_PROJECT_TOKEN"]'
---
kind: common.GHWorkflow
spec:
  customRunnerGroup: large
---
kind: auto.CustomSteps
spec:
  steps:
    - name: docker-compose-up
      toplevel: true
    - name: docker-compose-down
      toplevel: true
    - name: mkcert-install
      toplevel: true
    - name: mkcert-generate
      toplevel: true
    - name: mkcert-uninstall
      toplevel: true
    - name: run-integration-test
      toplevel: true
    - name: run-integration-qemu
      toplevel: true
      dependants:
        - coverage
    - name: run-integration-talemu
      toplevel: true
      dependants:
        - coverage
    - name: run-e2e-qemu
      toplevel: true
    - name: run-e2e-helm
      toplevel: true
    - name: run-e2e-talemu
      toplevel: true
      dependants:
        - coverage
    - name: sign-images
      toplevel: true
---
kind: custom.Step
name: sign-images
spec:
  makefile:
    enabled: true
    phony: true
    variables:
      - name: IMAGE_SIGNER_IMAGE
        defaultValue: ghcr.io/siderolabs/image-signer:v0.3.2
    script:
      - |
        @test -n "$$GITHUB_TOKEN" || { echo "GITHUB_TOKEN must be set"; exit 1; }
        @TMP=$$(mktemp -d) && trap 'rm -rf $$TMP' EXIT && \
          printf '{"auths":{"ghcr.io":{"username":"x","password":"%s"}}}' "$$GITHUB_TOKEN" > $$TMP/config.json && \
          docker run --rm -p 127.0.0.1:8585:8585 \
            -v $$TMP:/dc:ro -e DOCKER_CONFIG=/dc \
            $(IMAGE_SIGNER_IMAGE) sign --timeout=15m \
            $(REGISTRY_AND_USERNAME)/omni:$(IMAGE_TAG)
---
kind: custom.Step
name: docker-compose-up
spec:
  makefile:
    enabled: true
    phony: true
    script:
      - >-
        ARTIFACTS="$(ARTIFACTS)"
        SHA="$(SHA)"
        TAG="$(TAG)"
        USERNAME="$(USERNAME)"
        REGISTRY="$(REGISTRY)"
        JS_TOOLCHAIN="$(JS_TOOLCHAIN)"
        PROTOBUF_TS_VERSION="$(PROTOBUF_TS_VERSION)"
        PROTOBUF_GRPC_GATEWAY_TS_VERSION="$(PROTOBUF_GRPC_GATEWAY_TS_VERSION)"
        NODE_BUILD_ARGS="$(NODE_BUILD_ARGS)"
        TOOLCHAIN="$(TOOLCHAIN)"
        CGO_ENABLED="$(CGO_ENABLED)"
        GO_BUILDFLAGS="$(GO_BUILDFLAGS)"
        GOLANGCILINT_VERSION="$(GOLANGCILINT_VERSION)"
        GOFUMPT_VERSION="$(GOFUMPT_VERSION)"
        GOIMPORTS_VERSION="$(GOIMPORTS_VERSION)"
        GOMOCK_VERSION="$(GOMOCK_VERSION)"
        PROTOBUF_GO_VERSION="$(PROTOBUF_GO_VERSION)"
        GRPC_GO_VERSION="$(GRPC_GO_VERSION)"
        GRPC_GATEWAY_VERSION="$(GRPC_GATEWAY_VERSION)"
        VTPROTOBUF_VERSION="$(VTPROTOBUF_VERSION)"
        DEEPCOPY_VERSION="$(DEEPCOPY_VERSION)"
        DIS_VULNCHECK_VERSION="$(DIS_VULNCHECK_VERSION)"
        TESTPKGS="$(TESTPKGS)"
        COMPOSE_DOCKER_CLI_BUILD=1
        DOCKER_BUILDKIT=1
        GO_LDFLAGS="$(GO_LDFLAGS)"
        GOTOOLCHAIN="$(GOTOOLCHAIN)"
        GOEXPERIMENT="$(GOEXPERIMENT)"
        SYFT_VERSION="$(SYFT_VERSION)"
        WITH_DEBUG="$(WITH_DEBUG)"
        docker compose --file ./hack/compose/docker-compose.yml --file ./hack/compose/docker-compose.override.yml up --build
---
kind: custom.Step
name: mkcert-generate
spec:
  makefile:
    enabled: true
    phony: true
    script:
      - >-
        go run ./hack/generate-certs -config ./hack/generate-certs.yml generate
---
kind: custom.Step
name: mkcert-install
spec:
  makefile:
    enabled: true
    phony: true
    script:
      - >-
        go run ./hack/generate-certs install
---
kind: custom.Step
name: mkcert-uninstall
spec:
  makefile:
    enabled: true
    phony: true
    script:
      - >-
        go run ./hack/generate-certs uninstall
---
kind: custom.Step
name: docker-compose-down
spec:
  makefile:
    enabled: true
    phony: true
    variables:
      - name: REMOVE_VOLUMES
        defaultValue: false
    script:
      - >-
        ARTIFACTS="$(ARTIFACTS)"
        SHA="$(SHA)"
        TAG="$(TAG)"
        USERNAME="$(USERNAME)"
        REGISTRY="$(REGISTRY)"
        JS_TOOLCHAIN="$(JS_TOOLCHAIN)"
        PROTOBUF_TS_VERSION="$(PROTOBUF_TS_VERSION)"
        PROTOBUF_GRPC_GATEWAY_TS_VERSION="$(PROTOBUF_GRPC_GATEWAY_TS_VERSION)"
        NODE_BUILD_ARGS="$(NODE_BUILD_ARGS)"
        TOOLCHAIN="$(TOOLCHAIN)"
        CGO_ENABLED="$(CGO_ENABLED)"
        GO_BUILDFLAGS="$(GO_BUILDFLAGS)"
        GOLANGCILINT_VERSION="$(GOLANGCILINT_VERSION)"
        GOFUMPT_VERSION="$(GOFUMPT_VERSION)"
        GOIMPORTS_VERSION="$(GOIMPORTS_VERSION)"
        GOMOCK_VERSION="$(GOMOCK_VERSION)"
        PROTOBUF_GO_VERSION="$(PROTOBUF_GO_VERSION)"
        GRPC_GO_VERSION="$(GRPC_GO_VERSION)"
        GRPC_GATEWAY_VERSION="$(GRPC_GATEWAY_VERSION)"
        VTPROTOBUF_VERSION="$(VTPROTOBUF_VERSION)"
        DEEPCOPY_VERSION="$(DEEPCOPY_VERSION)"
        DIS_VULNCHECK_VERSION="$(DIS_VULNCHECK_VERSION)"
        TESTPKGS="$(TESTPKGS)"
        COMPOSE_DOCKER_CLI_BUILD=1
        DOCKER_BUILDKIT=1
        GO_LDFLAGS="$(GO_LDFLAGS)"
        GOTOOLCHAIN="$(GOTOOLCHAIN)"
        GOEXPERIMENT="$(GOEXPERIMENT)"
        SYFT_VERSION="$(SYFT_VERSION)"
        WITH_DEBUG="$(WITH_DEBUG)"
        docker compose --file ./hack/compose/docker-compose.yml --file ./hack/compose/docker-compose.override.yml down --rmi local --remove-orphans --volumes=$(REMOVE_VOLUMES)
---
kind: custom.Step
name: run-integration-test
spec:
  sudoInCI: true
  makefile:
    enabled: true
    depends:
      - integration-test-linux-amd64
      - omnictl-linux-amd64
      - omni-linux-amd64
    script:
      - >-
        @hack/test/integration.sh
---
kind: custom.Step
name: run-e2e-qemu
spec:
  sudoInCI: true
  makeTarget: run-integration-test
  ghaction:
    condition: on-pull-request
    enabled: true
    sops: true
    parallelJob:
      name: e2e-qemu
      runnerGroup: large
      needsOverride: [default, lint, unit-tests]
    artifacts:
      enabled: true
      skipDefaultArtifacts: true
      additional: # save the integration test artifacts: Talos logs, support bundles, etc.
        - name: e2e-qemu
          always: true
          continueOnError: true
          paths:
            - ${{ github.workspace }}/integration-test
    environment:
      TEST_CLASS: e2e-qemu
      WITH_DEBUG: true
      WITH_RACE: true
---
kind: custom.Step
name: run-e2e-helm
spec:
  sudoInCI: true
  makeTarget: run-integration-test
  ghaction:
    condition: on-pull-request
    enabled: true
    sops: true
    parallelJob:
      name: e2e-helm
      runnerGroup: large
      needsOverride: [default, lint, unit-tests]
    artifacts:
      enabled: true
      skipDefaultArtifacts: true
      additional:
        - name: e2e-helm
          always: true
          continueOnError: true
          paths:
            - ${{ github.workspace }}/integration-test
    environment:
      TEST_CLASS: e2e-helm
      TEMP_REGISTRY: registry.dev.siderolabs.io
      WITH_DEBUG: true
---
kind: custom.Step
name: run-e2e-talemu
spec:
  sudoInCI: true
  makeTarget: run-integration-test
  ghaction:
    condition: on-pull-request
    enabled: true
    sops: true
    parallelJob:
      name: e2e-talemu
      runnerGroup: large
      needsOverride: [default, lint, unit-tests]
    coverage:
      inputPaths:
        - coverage-emulator.txt
    artifacts:
      enabled: true
      skipDefaultArtifacts: true
      additional: # save the integration test artifacts: Talos logs, support bundles, etc.
        - name: e2e-talemu
          always: true
          continueOnError: true
          paths:
            - ${{ github.workspace }}/integration-test
    environment:
      TEST_CLASS: e2e-talemu
      WITH_DEBUG: true
      WITH_RACE: true
---
kind: custom.Step
name: run-integration-talemu
spec:
  sudoInCI: true
  makeTarget: run-integration-test
  ghaction:
    condition: on-pull-request
    enabled: true
    sops: true
    parallelJob:
      name: integration-talemu
      runnerGroup: large
      needsOverride: [default, lint, unit-tests]
    coverage:
      inputPaths:
        - coverage-emulator.txt
        - coverage-integration.txt
    artifacts:
      enabled: true
      skipDefaultArtifacts: true
      additional: # save the integration test artifacts: Talos logs, support bundles, etc.
        - name: integration-talemu
          always: true
          continueOnError: true
          paths:
            - ${{ github.workspace }}/integration-test
    environment:
      TEST_CLASS: integration-talemu
      TALEMU_TEST_ARGS: --test.run TestIntegration/Suites/(ImmediateClusterDestruction|EncryptedCluster|SingleNodeCluster|ScaleUpAndDown|ScaleUpAndDownMachineClassBasedMachineSets|TalosUpgrades|KubernetesUpgrades|MaintenanceUpgrade|ClusterTemplate|ScaleUpAndDownAutoProvisionMachineSets|AccountLimits)$
      WITH_DEBUG: true
      WITH_RACE: true
---
kind: custom.Step
name: run-integration-qemu
spec:
  sudoInCI: true
  makeTarget: run-integration-test
  ghaction:
    condition: on-pull-request
    enabled: true
    sops: true
    parallelJob:
      name: integration-qemu
      runnerGroup: large
      needsOverride: [default, lint, unit-tests]
    coverage:
      inputPaths:
        - coverage-integration.txt
    artifacts:
      enabled: true
      extraPaths:
        - "!_out/etcd"
        - "!_out/secondary-storage/**"
      additional: # save the integration test artifacts: Talos logs, support bundles, etc.
        - name: integration-qemu
          always: true
          continueOnError: true
          paths:
            - ${{ github.workspace }}/integration-test
    environment:
      TEST_CLASS: integration-qemu
      INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/(CleanState|Auth|DefaultCluster|CLICommands)$"
      WITH_DEBUG: true
      WITH_RACE: true
    jobs:
      - name: e2e-short-secureboot
        needsOverride:
          [integration-talemu, integration-qemu, e2e-qemu, e2e-talemu, e2e-helm]
        crons:
          - "30 1 * * *"
        runnerGroup: large
        triggerLabels:
          - integration/e2e-short-secureboot
        artifacts:
          skipArtifactDownload: true
        environmentOverride:
          INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/(CleanState|TalosImageGeneration|ImmediateClusterDestruction|DefaultCluster|EncryptedCluster|SingleNodeCluster|Auth)$"
          ENABLE_SECUREBOOT: true
      - name: e2e-short
        needsOverride:
          [integration-talemu, integration-qemu, e2e-qemu, e2e-talemu, e2e-helm]
        crons:
          - "30 1 * * *"
        runnerGroup: large
        triggerLabels:
          - integration/e2e
          - integration/e2e-short
        artifacts:
          skipArtifactDownload: true
        environmentOverride:
          INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/(CleanState|TalosImageGeneration|ImmediateClusterDestruction|DefaultCluster|EncryptedCluster|SingleNodeCluster|Auth)$"
      - name: e2e-scaling
        needsOverride:
          [integration-talemu, integration-qemu, e2e-qemu, e2e-talemu, e2e-helm]
        crons:
          - "30 1 * * *"
        runnerGroup: large
        triggerLabels:
          - integration/e2e
          - integration/e2e-scaling
        artifacts:
          skipArtifactDownload: true
        environmentOverride:
          INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/(CleanState|ScaleUpAndDown|ScaleUpAndDownMachineClassBasedMachineSets|RollingUpdateParallelism)$"
      - name: e2e-forced-removal
        needsOverride:
          [integration-talemu, integration-qemu, e2e-qemu, e2e-talemu, e2e-helm]
        crons:
          - "30 1 * * *"
        runnerGroup: large
        triggerLabels:
          - integration/e2e
          - integration/e2e-forced-removal
        artifacts:
          skipArtifactDownload: true
        environmentOverride:
          INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/(CleanState|ForcedMachineRemoval|ReplaceControlPlanes|ConfigPatching|KubernetesNodeAudit)$"
      - name: e2e-upgrades
        needsOverride:
          [integration-talemu, integration-qemu, e2e-qemu, e2e-talemu, e2e-helm]
        crons:
          - "30 1 * * *"
        runnerGroup: large
        triggerLabels:
          - integration/e2e
          - integration/e2e-upgrades
        artifacts:
          skipArtifactDownload: true
        environmentOverride:
          TEST_CLASS: integration-qemu
          INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/(CleanState|TalosUpgrades|KubernetesUpgrades)$"
      - name: e2e-misc-upgrades
        needsOverride:
          [integration-talemu, integration-qemu, e2e-qemu, e2e-talemu, e2e-helm]
        crons:
          - "30 1 * * *"
        runnerGroup: large
        triggerLabels:
          - integration/e2e
          - integration/e2e-upgrades
          - integration/e2e-misc-upgrades
        artifacts:
          skipArtifactDownload: true
        environmentOverride:
          TEST_CLASS: integration-qemu
          INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/(CleanState|KernelArgsUpdate|MaintenanceUpgrade)$"
      - name: e2e-templates
        needsOverride:
          [integration-talemu, integration-qemu, e2e-qemu, e2e-talemu, e2e-helm]
        crons:
          - "30 1 * * *"
        runnerGroup: large
        triggerLabels:
          - integration/e2e
          - integration/e2e-templates
        artifacts:
          skipArtifactDownload: true
        environmentOverride:
          TEST_CLASS: integration-qemu
          INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/(CleanState|ClusterTemplate)$"
      - name: e2e-backups
        needsOverride:
          [integration-talemu, integration-qemu, e2e-qemu, e2e-talemu, e2e-helm]
        crons:
          - "30 1 * * *"
        runnerGroup: large
        triggerLabels:
          - integration/e2e
          - integration/e2e-backups
        artifacts:
          skipArtifactDownload: true
        environmentOverride:
          TEST_CLASS: integration-qemu
          INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/(CleanState|EtcdBackupAndRestore)$"
      - name: e2e-workload-proxy
        needsOverride:
          [integration-talemu, integration-qemu, e2e-qemu, e2e-talemu, e2e-helm]
        crons:
          - "30 1 * * *"
        runnerGroup: large
        triggerLabels:
          - integration/e2e
          - integration/e2e-workload-proxy
        artifacts:
          skipArtifactDownload: true
        environmentOverride:
          TEST_CLASS: integration-qemu
          INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/(CleanState|WorkloadProxy)$"
      - name: e2e-omni-upgrade
        needsOverride:
          [integration-talemu, integration-qemu, e2e-qemu, e2e-talemu, e2e-helm]
        crons:
          - "30 1 * * *"
        runnerGroup: large
        triggerLabels:
          - integration/e2e
          - integration/e2e-omni-upgrade
        artifacts:
          skipArtifactDownload: true
        environmentOverride:
          TEST_CLASS: integration-qemu
          INTEGRATION_PREPARE_TEST_ARGS: "--test.run TestIntegration/Suites/(CleanState|OmniUpgradePrepare)$"
          INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/(OmniUpgradeVerify)$"
          WITH_QEMU_TALOS_VERSION_OVERRIDE: true
      - name: e2e-cluster-import
        needsOverride:
          [integration-talemu, integration-qemu, e2e-qemu, e2e-talemu, e2e-helm]
        crons:
          - "30 1 * * *"
        runnerGroup: large
        triggerLabels:
          - integration/e2e
          - integration/e2e-cluster-import
        artifacts:
          skipArtifactDownload: true
        environmentOverride:
          TEST_CLASS: integration-qemu
          INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/ClusterImport"
          CREATE_QEMU_MACHINES: false
          CREATE_TALOS_CLUSTER: true
      - name: e2e-minor-talos-upgrade
        needsOverride:
          [integration-talemu, integration-qemu, e2e-qemu, e2e-talemu, e2e-helm]
        crons:
          - "30 1 * * *"
        runnerGroup: large
        triggerLabels:
          - integration/e2e
          - integration/e2e-upgrades
        artifacts:
          skipArtifactDownload: true
        environmentOverride:
          TEST_CLASS: integration-qemu
          INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/(CleanState|TalosUpgradesMinor)$"
          WITH_QEMU_TALOS_VERSION_OVERRIDE: true
      - name: e2e-rotate-ca
        needsOverride:
          [integration-talemu, integration-qemu, e2e-qemu, e2e-talemu, e2e-helm]
        crons:
          - "30 1 * * *"
        runnerGroup: large
        triggerLabels:
          - integration/e2e
          - integration/e2e-rotate-ca
        artifacts:
          skipArtifactDownload: true
        environmentOverride:
          INTEGRATION_RUN_E2E_TEST: "false"
          INTEGRATION_TEST_ARGS: "--test.run TestIntegration/Suites/(CleanState|RotateCA)$"
          RUN_TALEMU_TESTS: false
---
kind: common.Build
spec:
  ignoredPaths:
    - "hack/generate-certs.yml"
    - "hack/generate-certs/ca-root"
    - "hack/generate-certs/certs"
    - "hack/compose/docker-compose.override.yml"
    - go.work.sum
---
kind: common.SOPS
spec:
  enabled: true
  config: |-
    creation_rules:
      - age: age1xrpa9ujxxcj2u2gzfrzv8mxak4rts94a6y60ypurv6rs5cpr4e4sg95f0k
        # order: Andrey, Noel, Artem, Utku, Edward
        pgp: >-
          4F8E31286D7997C9625C6F7B322C6F63F594CE7C,
          CC51116A94490FA6FB3C18EB2401FCAE863A06CA,
          77D901DDCB59376D9E4131279BAC0E08F5067BB8,
          11177A43C6E3752E682AC690DBD13117B0A14E93,
          484DF208A16D4E209D686E9D65558E016966977A
---
kind: golang.Build
name: omni
spec:
  outputs:
    linux-amd64:
      GOOS: linux
      GOARCH: amd64
    linux-arm64:
      GOOS: linux
      GOARCH: arm64
    darwin-amd64:
      GOOS: darwin
      GOARCH: amd64
    darwin-arm64:
      GOOS: darwin
      GOARCH: arm64
---
kind: golang.Build
name: omnictl
spec:
  outputs:
    linux-amd64:
      GOOS: linux
      GOARCH: amd64
    linux-arm64:
      GOOS: linux
      GOARCH: arm64
    darwin-amd64:
      GOOS: darwin
      GOARCH: amd64
    darwin-arm64:
      GOOS: darwin
      GOARCH: arm64
    windows-amd64.exe:
      GOOS: windows
      GOARCH: amd64
---
kind: golang.Generate
spec:
  versionPackagePath: internal/version
  licenseText: |
    Copyright (c) 2026 Sidero Labs, Inc.

    Use of this software is governed by the Business Source License
    included in the LICENSE file.
---
kind: golang.Generate
spec:
  baseSpecPath: /client/api
  goGenerateSpecs:
    - source: ./internal
      extraInputs:
        - deploy/helm/omni/config-overrides.yaml
        - deploy/helm/omni/values.yaml
      copy:
        - frontend/
        - internal/backend/runtime/omni/controllers/omni/
        - internal/pkg/config/
        - deploy/helm/omni/values.yaml
  vtProtobufEnabled: true
  specs:
    - source: client/api/common/omni.proto
      subdirectory: common
    - source: client/api/omni/resources/resources.proto
      subdirectory: omni/resources
      genGateway: true
    - source: client/api/omni/management/management.proto
      subdirectory: omni/management
      genGateway: true
    - source: client/api/omni/oidc/oidc.proto
      subdirectory: omni/oidc
      genGateway: true
    - source: client/api/omni/specs/auth.proto
      subdirectory: omni/specs
      genGateway: true
    - source: client/api/omni/specs/infra.proto
      subdirectory: omni/specs
      genGateway: true
    - source: client/api/omni/specs/virtual.proto
      subdirectory: omni/specs
      genGateway: true
    - source: client/api/omni/specs/ephemeral.proto
      subdirectory: omni/specs
      genGateway: true
    - source: client/api/omni/specs/oidc.proto # not used in the frontend
      subdirectory: omni/specs
      genGateway: true
    - source: client/api/omni/specs/omni.proto
      subdirectory: omni/specs
      genGateway: true
    - source: client/api/omni/specs/siderolink.proto
      subdirectory: omni/specs
      genGateway: true
    - source: client/api/omni/specs/system.proto
      subdirectory: omni/specs
      genGateway: true
    - source: https://raw.githubusercontent.com/googleapis/googleapis/master/google/rpc/status.proto
      subdirectory: google/rpc/
      genGateway: true
    - source: https://raw.githubusercontent.com/siderolabs/talos/b1a02f3681c7e361ee6a3ef3d230b47480b48408/api/common/common.proto
      subdirectory: common/
      genGateway: true
    - source: https://raw.githubusercontent.com/siderolabs/talos/b1a02f3681c7e361ee6a3ef3d230b47480b48408/api/machine/machine.proto
      subdirectory: talos/machine/
      genGateway: true
    - source: https://raw.githubusercontent.com/cosi-project/specification/a25fac056c642b32468b030387ab94c17bc3ba1d/proto/v1alpha1/resource.proto
      subdirectory: v1alpha1
      genGateway: true
---
kind: golang.GolangciLint
spec:
  buildTags:
    - integration
    - sidero.tools
  depguardExtraRules:
    prevent_sync_errgroup:
      list-mode: lax
      files:
        - $all
        - "!$test"
        - "!**/integration-test/**"
        - "!**/omnictl/**"
        - "!**/panichandler/**"
      deny:
        - pkg: golang.org/x/sync/errgroup
          desc: Use github.com/siderolabs/omni/client/pkg/panichandler.ErrGroup instead
---
kind: js.Build
spec:
  licenseText: |
    Copyright (c) 2026 Sidero Labs, Inc.

    Use of this software is governed by the Business Source License
    included in the LICENSE file.
---
kind: js.Protobuf
spec:
  baseSpecPath: /client/api
  files:
    - source: https://raw.githubusercontent.com/siderolabs/talos/v1.7.7/pkg/machinery/config/schemas/config.schema.json
      destination: frontend/src/schemas/config_1_7.schema.json
    - source: https://raw.githubusercontent.com/siderolabs/talos/v1.8.4/pkg/machinery/config/schemas/config.schema.json
      destination: frontend/src/schemas/config_1_8.schema.json
    - source: https://raw.githubusercontent.com/siderolabs/talos/v1.9.6/pkg/machinery/config/schemas/config.schema.json
      destination: frontend/src/schemas/config_1_9.schema.json
    - source: https://raw.githubusercontent.com/siderolabs/talos/v1.10.9/pkg/machinery/config/schemas/config.schema.json
      destination: frontend/src/schemas/config_1_10.schema.json
    - source: https://raw.githubusercontent.com/siderolabs/talos/v1.11.6/pkg/machinery/config/schemas/config.schema.json
      destination: frontend/src/schemas/config_1_11.schema.json
    - source: https://raw.githubusercontent.com/siderolabs/talos/v1.12.6/pkg/machinery/config/schemas/config.schema.json
      destination: frontend/src/schemas/config_1_12.schema.json
    - source: https://raw.githubusercontent.com/siderolabs/talos/v1.13.2/pkg/machinery/config/schemas/config.schema.json
      destination: frontend/src/schemas/config_1_13.schema.json
  destinationRoot: src/api
  specs:
    - source: client/api/common/omni.proto
      subdirectory: common
      genGateway: true
    - source: client/api/omni/resources/resources.proto
      subdirectory: omni/resources
      genGateway: true
    - source: client/api/omni/management/management.proto
      subdirectory: omni/management
      genGateway: true
    - source: client/api/omni/oidc/oidc.proto
      subdirectory: omni/oidc
      genGateway: true
    - source: https://raw.githubusercontent.com/siderolabs/go-api-signature/v0.3.12/api/auth/auth.proto
      subdirectory: omni/auth
      genGateway: true
    - source: client/api/omni/specs/omni.proto
      subdirectory: omni/specs
      genGateway: true
    - source: client/api/omni/specs/siderolink.proto
      subdirectory: omni/specs
      genGateway: true
    - source: client/api/omni/specs/system.proto
      subdirectory: omni/specs
      genGateway: true
    - source: client/api/omni/specs/auth.proto
      subdirectory: omni/specs
      genGateway: true
    - source: client/api/omni/specs/infra.proto
      subdirectory: omni/specs
      genGateway: true
    - source: client/api/omni/specs/virtual.proto
      subdirectory: omni/specs
      genGateway: true
    - source: client/api/omni/specs/ephemeral.proto
      subdirectory: omni/specs
      genGateway: true
    - source: https://raw.githubusercontent.com/googleapis/googleapis/master/google/rpc/status.proto
      subdirectory: google/rpc/
      genGateway: true
    - source: https://raw.githubusercontent.com/siderolabs/talos/b1a02f3681c7e361ee6a3ef3d230b47480b48408/api/machine/machine.proto
      subdirectory: talos/machine
      genGateway: true
    - source: https://raw.githubusercontent.com/protocolbuffers/protobuf/master/src/google/protobuf/any.proto
      subdirectory: google/protobuf/
      genGateway: true
    - source: https://raw.githubusercontent.com/protocolbuffers/protobuf/master/src/google/protobuf/duration.proto
      subdirectory: google/protobuf/
      genGateway: true
    - source: https://raw.githubusercontent.com/protocolbuffers/protobuf/master/src/google/protobuf/empty.proto
      subdirectory: google/protobuf/
      genGateway: true
    - source: https://raw.githubusercontent.com/protocolbuffers/protobuf/master/src/google/protobuf/timestamp.proto
      subdirectory: google/protobuf/
      genGateway: true
    - source: https://raw.githubusercontent.com/googleapis/googleapis/master/google/rpc/code.proto
      subdirectory: google/rpc/
      genGateway: true
    - source: https://raw.githubusercontent.com/siderolabs/talos/b1a02f3681c7e361ee6a3ef3d230b47480b48408/api/common/common.proto
      subdirectory: common/
      genGateway: true
    - source: https://raw.githubusercontent.com/cosi-project/specification/a25fac056c642b32468b030387ab94c17bc3ba1d/proto/v1alpha1/resource.proto
      subdirectory: v1alpha1
      genGateway: true
---
kind: common.Release
name: release
spec:
  artifacts:
    - omnictl-*
    - omni-*
---
kind: golang.SBOM
spec:
  enabled: true
---
kind: common.Image
name: image-omni
spec:
  extraEnvironment:
    PLATFORM: linux/amd64,linux/arm64
  copyFrom:
    - stage: omnictl-all
      name: omnictl-all
      destination: /omnictl/
---
kind: service.CodeCov
spec:
  enabled: true
  targetThreshold: 15
---
kind: common.Repository
spec:
  licenses:
    - id: BSL-1.1
      params:
        Licensor: Sidero Labs, Inc.
        LicensedWork: Omni
        Copyright: (c) 2026 Sidero Labs, Inc.
        ChangeDate: "2030-05-18"
        ChangeLicense: Mozilla Public License, version 2.0
        EnterpriseLink: https://www.siderolabs.com/contact/
        AdditionalUseGrant: You may make non-production use of the Licensed Work, including for testing and evaluation, or for personal use in a home lab environment. Any use of the Licensed Work in a production environment requires a commercial license from Sidero Labs.
      header: |
        // Copyright (c) 2026 Sidero Labs, Inc.
        //
        // Use of this software is governed by the Business Source License
        // included in the LICENSE file.

    - id: MPL-2.0
      root: client
      header: |
        // This Source Code Form is subject to the terms of the Mozilla Public
        // License, v. 2.0. If a copy of the MPL was not distributed with this
        // file, You can obtain one at http://mozilla.org/MPL/2.0/.
  licenseChecks:
    - root: "."
      header: |
        // Copyright (c) 2026 Sidero Labs, Inc.
        //
        // Use of this software is governed by the Business Source License
        // included in the LICENSE file.
      includeSuffixes:
        - .go
        - .ts
        - .js
      excludeSuffixes:
        - .pb.go
        - .pb.gw.go
        - .pb.ts
        - mockServiceWorker.js
        - typed-router.d.ts
        - .generated.go
      skipPaths:
        - .git
        - testdata/
        - client/
        - frontend/node_modules/
        - internal/pkg/kubernetes/resource/ # contains a file copied from kubectl

    - root: client
      header: |
        // This Source Code Form is subject to the terms of the Mozilla Public
        // License, v. 2.0. If a copy of the MPL was not distributed with this
        // file, You can obtain one at http://mozilla.org/MPL/2.0/

    - root: frontend/
      header: |
        <!--
        Copyright (c) 2026 Sidero Labs, Inc.

        Use of this software is governed by the Business Source License
        included in the LICENSE file.
        -->
      includeSuffixes:
        - .vue
      skipPaths:
        - node_modules/
  protectedBranches:
    - name: main
      enforceContexts:
        - e2e-short
        - e2e-scaling
        - e2e-templates
        - e2e-upgrades
        - e2e-backups
        - e2e-forced-removal
    - name: release-1.5
      enforceContexts:
        - e2e-short
        - e2e-scaling
        - e2e-templates
        - e2e-upgrades
        - e2e-backups
        - e2e-forced-removal
    - name: release-1.6
      enforceContexts:
        - e2e-short
        - e2e-scaling
        - e2e-templates
        - e2e-upgrades
        - e2e-backups
        - e2e-forced-removal
    - name: release-1.7
      enforceContexts:
        - e2e-short
        - e2e-scaling
        - e2e-templates
        - e2e-upgrades
        - e2e-backups
        - e2e-forced-removal
---
kind: golang.Toolchain
spec:
  defaultBuildTags:
    - memory.counters # enable memory counters in modernc.org/memory
    - libc.memexpvar # enable memexpvar in modernc.org/libc to export the counters