[3005.x] Merge 3005.5 into 3005.x

.github/workflows/docs.yml

@@ -2,27 +2,36 @@ name: Docs
 
 on: [push, pull_request]
 
+permissions:
+  contents: read  # for dorny/paths-filter to fetch a list of changed files
+  pull-requests: read  # for dorny/paths-filter to read pull requests
+
 jobs:
   Salt:
     name: Build Salt Documentation
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "medium", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
-      image: python:3.8.6-slim-buster
+      image: ghcr.io/saltstack/salt-ci-containers/python:3.8
 
     steps:
 
     - name: Install System Deps
       run: |
-        echo "deb http://deb.debian.org/debian buster-backports main" >> /etc/apt/sources.list
         apt-get update
-        apt-get install -y enchant git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev xz-utils
-        apt-get install -y git/buster-backports
+        apt-get upgrade debian-keyring -y
+        echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list
+        apt-get update
+        apt-get install -y enchant-2 git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev xz-utils
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         fetch-depth: 0
 
+    - name: Add Git Safe Directory
+      run: |
+        git config --global --add safe.directory $(pwd)
+
     - name: Install Nox
       env:
         PIP_EXTRA_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
@@ -60,21 +69,26 @@ jobs:
 
   Manpages:
     name: Build Salt man Pages
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "medium", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
-      image: python:3.8.6-slim-buster
+      image: ghcr.io/saltstack/salt-ci-containers/python:3.8
 
     steps:
 
     - name: Install System Deps
       run: |
-        echo "deb http://deb.debian.org/debian buster-backports main" >> /etc/apt/sources.list
         apt-get update
-        apt-get install -y enchant git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
-        apt-get install -y git/buster-backports
+        apt-get upgrade debian-keyring -y
+        echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list
+        apt-get update
+        apt-get install -y enchant-2 git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
+
+    - uses: actions/checkout@v3
 
-    - uses: actions/checkout@v2
+    - name: Add Git Safe Directory
+      run: |
+        git config --global --add safe.directory $(pwd)
 
     - id: changed-files
       name: Get Changed Files

.github/workflows/lint.yml

@@ -2,24 +2,33 @@ name: Lint
 
 on: [push, pull_request]
 
+permissions:
+  contents: read  # for dorny/paths-filter to fetch a list of changed files
+  pull-requests: read  # for dorny/paths-filter to read pull requests
+
 jobs:
   Salt:
     name: Lint Salt's Source Code
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "medium", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
-      image: python:3.8.6-slim-buster
+      image: ghcr.io/saltstack/salt-ci-containers/python:3.8
 
     steps:
 
     - name: Install System Deps
       run: |
-        echo "deb http://deb.debian.org/debian buster-backports main" >> /etc/apt/sources.list
         apt-get update
-        apt-get install -y enchant git gcc make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
-        apt-get install -y git/buster-backports
+        apt-get upgrade debian-keyring -y
+        echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list
+        apt-get update
+        apt-get install -y enchant-2 git gcc make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
+
+    - name: Add Git Safe Directory
+      run: |
+        git config --global --add safe.directory $(pwd)
 
     - name: Install Nox
       env:
@@ -67,26 +76,32 @@ jobs:
 
   Tests:
     name: Lint Salt's Test Suite
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "medium", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
-      image: python:3.8.6-slim-buster
+      image: ghcr.io/saltstack/salt-ci-containers/python:3.8
 
     steps:
 
     - name: Install System Deps
       run: |
-        echo "deb http://deb.debian.org/debian buster-backports main" >> /etc/apt/sources.list
         apt-get update
-        apt-get install -y enchant git gcc make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
-        apt-get install -y git/buster-backports
+        apt-get upgrade debian-keyring -y
+        echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list
+        apt-get update
+        apt-get install -y enchant-2 git gcc make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
+
+    - uses: actions/checkout@v3
 
-    - uses: actions/checkout@v2
+    - name: Add Git Safe Directory
+      run: |
+        git config --global --add safe.directory $(pwd)
 
     - name: Install Nox
       env:
         PIP_EXTRA_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
       run: |
+        git config --global --add safe.directory $(pwd)
         python -m pip install --upgrade pip
         pip install nox
 

.github/workflows/pr-checks.yml

@@ -4,22 +4,27 @@ on:
   pull_request_target:
     types: [opened, synchronize]
 
+permissions:
+  contents: read  # for dorny/paths-filter to fetch a list of changed files
+  pull-requests: read  # for dorny/paths-filter to read pull requests
+
 jobs:
 
   Check-Changed-Files-Docstrings:
     name: Check Docstrings For Changed Files On PR
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
 
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v2
+      - uses: actions/checkout@v3
+      - uses: actions/setup-python@v4
         with:
           python-version: '3.9'
 
       - name: Install Dependencies
         env:
           PIP_EXTRA_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
         run: |
+          git config --global --add safe.directory $(pwd)
           python -m pip install --upgrade pip
           pip install pre-commit pygithub
 

.github/workflows/pre-commit.yml

@@ -2,33 +2,43 @@ name: Pre-Commit
 
 on: [push, pull_request]
 
+permissions:
+  contents: read  # for dorny/paths-filter to fetch a list of changed files
+  pull-requests: read  # for dorny/paths-filter to read pull requests
+
 jobs:
   Pre-Commit:
     name: Run Pre-Commit Against Salt
 
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
-      image: python:3.8.6-slim-buster
+      image: ghcr.io/saltstack/salt-ci-containers/python:3.8
 
     steps:
 
     - name: Install System Deps
       run: |
-        echo "deb http://deb.debian.org/debian buster-backports main" >> /etc/apt/sources.list
         apt-get update
-        apt-get install -y enchant git gcc make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
-        apt-get install -y git/buster-backports
+        apt-get upgrade debian-keyring -y
+        echo "deb http://deb.debian.org/debian bookworm-backports main" >> /etc/apt/sources.list
+        apt-get update
+        apt-get install -y enchant-2 git gcc make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
+
+    - name: Add Git Safe Directory
+      run: |
+        git config --global --add safe.directory $(pwd)
 
     - name: Install Pre-Commit
       env:
         PIP_EXTRA_INDEX_URL: https://pypi-proxy.saltstack.net/root/local/+simple/
       run: |
+        git config --global --add safe.directory $(pwd)
         python -m pip install --upgrade pip
         pip install pre-commit
-        pre-commit install --install-hooks
+        pre-commit install --install-hooks || cat /root/.cache/pre-commit/pre-commit.log
 
     - id: changed-files
       name: Get Changed Files

.github/workflows/release-tag.yml

@@ -19,7 +19,7 @@ on:
 jobs:
   GenerateTagRelease:
     name: Generate Tag and Github Release
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
     steps:
     - uses: dev-drprasad/[email protected]
       if: github.event.inputs.reTag == 'true'
@@ -29,7 +29,7 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         repository: ${{ github.event.inputs.saltRepo }}
         ref: ${{ github.event.inputs.saltBranch }}
@@ -42,11 +42,11 @@ jobs:
         custom_tag: ${{ github.event.inputs.saltVersion }}
 
     - name: Set up Python 3.8
-      uses: actions/setup-python@v1
+      uses: actions/setup-python@v4
       with:
         python-version: 3.8
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Install pypa/build
       run: |
         python -m pip install build --user

.github/workflows/release.yml

@@ -15,10 +15,14 @@ on:
         default: "master"
         required: false
 
+permissions:
+  contents: read  # for dorny/paths-filter to fetch a list of changed files
+  pull-requests: read  # for dorny/paths-filter to read pull requests
+
 jobs:
   SaltChangelog:
     name: Build Salt Changelog
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
       image: python:3.8.6-slim-buster
@@ -32,7 +36,7 @@ jobs:
         apt-get install -y enchant git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev xz-utils
         apt-get install -y git/buster-backports
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.branch }}
         fetch-depth: 0
@@ -81,7 +85,7 @@ jobs:
 
   Manpages:
     name: Build Salt man Pages
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
       image: python:3.8.6-slim-buster
@@ -96,7 +100,7 @@ jobs:
         apt-get install -y enchant git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev
         apt-get install -y git/buster-backports
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.branch }}
 
@@ -144,7 +148,7 @@ jobs:
   PullRequest:
     needs: [SaltChangelog, Manpages]
     name: Create Pull Request
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
 
     container:
       image: python:3.8.6-slim-buster
@@ -157,7 +161,7 @@ jobs:
         apt-get install -y enchant git gcc imagemagick make zlib1g-dev libc-dev libffi-dev g++ libxml2 libxml2-dev libxslt-dev libcurl4-openssl-dev libssl-dev libgnutls28-dev xz-utils
         apt-get install -y git/buster-backports
 
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
       with:
         ref: ${{ github.event.inputs.branch }}
         fetch-depth: 0

.github/workflows/triage.yml

@@ -7,13 +7,13 @@ on:
 jobs:
   label-and-assign:
     name: Triage New Issue
-    runs-on: ubuntu-latest
+    runs-on: ${{ github.event.repository.private && fromJSON('["self-hosted", "linux", "x86_64"]') || 'ubuntu-latest' }}
     steps:
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3
 
       - name: Set up Python
-        uses: actions/setup-python@v2
+        uses: actions/setup-python@v4
         with:
           python-version: 3.8
 

.github/workflows/twine-check.yml

@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-20.04
 
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
     - name: Setup Python
-      uses: actions/setup-python@v2
+      uses: actions/setup-python@v4
       with:
         python-version: '3.8'