Merge pull request #1139 from nolar/upgrade-ubuntu

Upgrade Ubuntu in CI (and pin oscrypto to an unreleased bugfix)

Author: nolar

.github/workflows/ci.yaml

@@ -12,7 +12,7 @@ on:
 jobs:
   linters:
     name: Linting and static analysis
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 5  # usually 1-2, rarely 3 mins (because of installations)
     steps:
       - uses: actions/checkout@v4
@@ -43,7 +43,7 @@ jobs:
           - install-extras: "uvloop"
             python-version: "3.13"
     name: Python ${{ matrix.python-version }}${{ matrix.install-extras && ' ' || '' }}${{ matrix.install-extras }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 5  # usually 2-3 mins
     steps:
       - uses: actions/checkout@v4
@@ -83,7 +83,7 @@ jobs:
         install-extras: [ "", "full-auth" ]
         python-version: [ "pypy-3.8", "pypy-3.9", "pypy-3.10" ]
     name: Python ${{ matrix.python-version }}${{ matrix.install-extras && ' ' || '' }}${{ matrix.install-extras }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
@@ -105,7 +105,7 @@ jobs:
       matrix:
         k3s: [latest, v1.31, v1.30, v1.29]
     name: K3s ${{matrix.k3s}}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10  # usually 4-5 mins
     steps:
       - uses: actions/checkout@v4
@@ -122,7 +122,7 @@ jobs:
   coveralls-finish:
     name: Finalize coveralls.io
     needs: [unit-tests, pypy-tests, functional]
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/setup-python@v5
       - run: pip install coveralls

.github/workflows/thorough.yaml

@@ -16,7 +16,7 @@ on:
 jobs:
   linters:
     name: Linting and static analysis
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 5  # usually 1-2, rarely 3 mins (because of installations)
     steps:
       - uses: actions/checkout@v4
@@ -47,7 +47,7 @@ jobs:
           - install-extras: "uvloop"
             python-version: "3.12"
     name: Python ${{ matrix.python-version }}${{ matrix.install-extras && ' ' || '' }}${{ matrix.install-extras }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 5  # usually 2-3 mins
     steps:
       - uses: actions/checkout@v4
@@ -87,7 +87,7 @@ jobs:
         install-extras: [ "", "full-auth" ]
         python-version: [ "pypy-3.8", "pypy-3.9", "pypy-3.10" ]
     name: Python ${{ matrix.python-version }}${{ matrix.install-extras && ' ' || '' }}${{ matrix.install-extras }}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
@@ -109,7 +109,7 @@ jobs:
       matrix:
         k3s: [latest, v1.31, v1.30, v1.29]
     name: K3s ${{matrix.k3s}}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10  # usually 4-5 mins
     steps:
       - uses: actions/checkout@v4
@@ -129,7 +129,7 @@ jobs:
       matrix:
         k8s: [latest, v1.31.2, v1.30.6, v1.29.10]
     name: K8s ${{matrix.k8s}}
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     timeout-minutes: 10  # usually 4-5 mins
     env:
       K8S: ${{ matrix.k8s }}
@@ -145,7 +145,7 @@ jobs:
   coveralls-finish:
     name: Finalize coveralls.io
     needs: [unit-tests, pypy-tests, functional]
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/setup-python@v5
       - run: pip install coveralls

.readthedocs.yaml

@@ -3,7 +3,7 @@
 version: 2
 formats: all
 build:
-  os: ubuntu-22.04
+  os: ubuntu-24.04
   tools:
     python: "3"
 python:

requirements.txt

@@ -9,6 +9,16 @@ codecov
 coverage
 coveralls
 freezegun
+
+# Enforce the hotfix for Ubuntu 24.04 in CI. Otherwise, we are stuck in Ubuntu 22.04.
+# The bugfix is merged but not released: https://github.com/wbond/oscrypto/issues/78
+# Pinning this in the end operators is the decision of the operator developers,
+# including the protocols of accessing the repo or vendoring the dependency code.
+# The dev-mode dependency is used ONLY with an temporary & insecure self-signed CA for simplicity,
+# and ONLY with Ubuntu 24.04+. Therefore, it is not pinned in setup.py (e.g., works fine in 22.04).
+# In the worst case, configure the operator with a self-signed CA made in the OpenSSL CLI manually.
+git+https://github.com/wbond/oscrypto.git@1547f535001ba568b239b8797465536759c742a3
+
 import-linter
 isort
 lxml

setup.py

@@ -77,10 +77,11 @@
             'uvloop>=0.18.0; python_version>="3.12"',
         ],
         'dev': [
-            'pyngrok',          # 1.00 MB + downloaded binary
+            # NB: oscrypto is pinned for Ubuntu 24.04+ in requirements.txt - read the details there.
             'oscrypto',         # 2.80 MB (smaller than cryptography: 8.7 MB)
             'certbuilder',      # +0.1 MB (2.90 MB if alone)
             'certvalidator',    # +0.1 MB (2.90 MB if alone)
+            'pyngrok',          # 1.00 MB + downloaded binary
         ],
     },
     package_data={"kopf": ["py.typed"]},