🌱 Prepare for v2 beta1 release

[azeemshaikh38]

Commit created from this PR will be used to generate the pre-release of scorecard-action. I've decided to name the tag - v2.0.0-beta.1.

[justaugustus]

(Let's also see if we can drain the remaining dependabot updates before cutting the release)

[azeemshaikh38]

(Let's also see if we can drain the remaining dependabot updates before cutting the release)

Fair point. Looking into it.

[azeemshaikh38]

(Let's also see if we can drain the remaining dependabot updates before cutting the release)

Fair point. Looking into it.

Getting errors running go mod tidy:

go mod tidy
go: finding module for package go.opentelemetry.io/otel/metric/registry
go: finding module for package go.opentelemetry.io/otel/semconv
github.com/ossf/scorecard-action/signing imports
        github.com/sigstore/cosign/cmd/cosign/cli/sign imports
        github.com/sigstore/cosign/cmd/cosign/cli/fulcio/fulcioverifier/ctl imports
        github.com/google/certificate-transparency-go imports
        go.etcd.io/etcd/v3 imports
        go.etcd.io/etcd/tests/v3/integration imports
        go.etcd.io/etcd/server/v3/embed imports
        go.opentelemetry.io/otel/semconv: module go.opentelemetry.io/otel@latest found (v1.8.0), but does not contain package go.opentelemetry.io/otel/semconv
github.com/ossf/scorecard-action/signing imports
        github.com/sigstore/cosign/cmd/cosign/cli/sign imports
        github.com/sigstore/cosign/cmd/cosign/cli/fulcio/fulcioverifier/ctl imports
        github.com/google/certificate-transparency-go imports
        go.etcd.io/etcd/v3 imports
        go.etcd.io/etcd/tests/v3/integration imports
        go.etcd.io/etcd/server/v3/embed imports
        go.opentelemetry.io/otel/exporters/otlp imports
        go.opentelemetry.io/otel/sdk/metric/controller/basic imports
        go.opentelemetry.io/otel/metric/registry: module go.opentelemetry.io/otel/metric@latest found (v0.31.0), but does not contain package go.opentelemetry.io/otel/metric/registry

Anyone have an idea?

[naveensrinivasan]

(Let's also see if we can drain the remaining dependabot updates before cutting the release)

Fair point. Looking into it.

Getting errors running go mod tidy:

go mod tidy
go: finding module for package go.opentelemetry.io/otel/metric/registry
go: finding module for package go.opentelemetry.io/otel/semconv
github.com/ossf/scorecard-action/signing imports
        github.com/sigstore/cosign/cmd/cosign/cli/sign imports
        github.com/sigstore/cosign/cmd/cosign/cli/fulcio/fulcioverifier/ctl imports
        github.com/google/certificate-transparency-go imports
        go.etcd.io/etcd/v3 imports
        go.etcd.io/etcd/tests/v3/integration imports
        go.etcd.io/etcd/server/v3/embed imports
        go.opentelemetry.io/otel/semconv: module go.opentelemetry.io/otel@latest found (v1.8.0), but does not contain package go.opentelemetry.io/otel/semconv
github.com/ossf/scorecard-action/signing imports
        github.com/sigstore/cosign/cmd/cosign/cli/sign imports
        github.com/sigstore/cosign/cmd/cosign/cli/fulcio/fulcioverifier/ctl imports
        github.com/google/certificate-transparency-go imports
        go.etcd.io/etcd/v3 imports
        go.etcd.io/etcd/tests/v3/integration imports
        go.etcd.io/etcd/server/v3/embed imports
        go.opentelemetry.io/otel/exporters/otlp imports
        go.opentelemetry.io/otel/sdk/metric/controller/basic imports
        go.opentelemetry.io/otel/metric/registry: module go.opentelemetry.io/otel/metric@latest found (v0.31.0), but does not contain package go.opentelemetry.io/otel/metric/registry

Anyone have an idea?

Is this on your branch?

[azeemshaikh38]

Is this on your branch?

No, this is on HEAD.

[naveensrinivasan]

Is this on your branch?

No, this is on HEAD.

Looks like this is the problem open-telemetry/opentelemetry-go#2938 (comment)

[azeemshaikh38]

Is this on your branch?

No, this is on HEAD.

Looks like this is the problem open-telemetry/opentelemetry-go#2938 (comment)

Thanks, that's a great find! I'll try to see if I can use the comments there to resolve our dependency problem.

[naveensrinivasan]

Is this on your branch?

No, this is on HEAD.

Looks like this is the problem open-telemetry/opentelemetry-go#2938 (comment)

Thanks, that's a great find! I'll try to see if I can use the comments there to resolve our dependency problem.

It is a replace directive as the project has broken the API, and the downstream hasn't changed. This is dependency hell.

[naveensrinivasan]

(Let's also see if we can drain the remaining dependabot updates before cutting the release)

Fair point. Looking into it.

Most of them have been merged!

[azeemshaikh38]

(Let's also see if we can drain the remaining dependabot updates before cutting the release)

@justaugustus blocked on your approval. Dependabot alerts are now fixed.

[justaugustus]

@justaugustus blocked on your approval. Dependabot alerts are now fixed.

Azeem, can you investigate the unit test failures?
I believe it's related to the signing logic.

[azeemshaikh38]

@justaugustus blocked on your approval. Dependabot alerts are now fixed.

Azeem, can you investigate the unit test failures? I believe it's related to the signing logic.

They are intermittent failures since the issue is with the REST API the test talks to (its a mock request, so the failures are only happening on the test but prod works fine). The fix is going to be on the API side, no changes needed here. Will retry the test to get it to pass.

[azeemshaikh38]

@justaugustus blocked on your approval. Dependabot alerts are now fixed.

Azeem, can you investigate the unit test failures? I believe it's related to the signing logic.

Fixed now with the retry :)

[codecov]

Codecov Report

Merging #766 (6189f6e) into main (ccd0038) will not change coverage.
The diff coverage is 0.00%.

@@           Coverage Diff           @@
##             main     #766   +/-   ##
=======================================
  Coverage   63.63%   63.63%           
=======================================
  Files           4        4           
  Lines         231      231           
=======================================
  Hits          147      147           
  Misses         72       72           
  Partials       12       12           

Impacted Files	Coverage Δ
signing/signing.go	32.14% <0.00%> (ø)

[azeemshaikh38]

@justaugustus blocked on your approval. Dependabot alerts are now fixed.

Azeem, can you investigate the unit test failures? I believe it's related to the signing logic.

Fixed now with the retry :)

@justaugustus friendly ping.

[justaugustus]

@justaugustus friendly ping.

Thanks for the details on the failure.
Approved!