Merge upstream conflicts

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,48 @@
+name: Bug report
+description: Create a report to help us improve
+labels:
+  - kind/bug
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thank you for taking the time to report a bug!
+        If this is a security issue please report it to the [Distributions Security Mailing List](mailto:cncf-distribution-security@lists.cncf.io).
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: Please give a clear and concise description of the bug
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Reproduce
+      description: Steps to reproduce the bug
+      placeholder: |
+        1. start registry version X ...
+        2. `docker push image:tag` ...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What is the expected behavior?
+      placeholder: |
+        E.g. "registry returns an incorrect API error"
+  - type: textarea
+    id: version
+    attributes:
+      label: registry version
+      description: Output of `registry --version`. Alternatively tell us the docker image tag.
+    validations:
+      required: true
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional Info
+      description: Additional info you want to provide such as logs, system info, environment, etc.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security and Vulnerabilities
+    url: https://github.com/distribution/distribution/blob/main/SECURITY.md
+    about: Please report any security issues or vulnerabilities responsibly to the distribution maintainers team. Please do not use the public issue tracker.
+  - name: Questions and Discussions
+    url: https://github.com/distribution/distribution/discussions/new/choose
+    about: Use Github Discussions to ask questions and/or open discussion topics.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,12 @@
+name: Feature request
+description: Missing functionality? Come tell us about it!
+labels:
+  - kind/feature
+body:
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: What is the feature you want to see?
+    validations:
+      required: true

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "dependencies"
+    cooldown:
+      default-days: 7
+    groups:
+      codeql-actions:
+        patterns:
+          - "github/codeql-action/*"
+      docker-actions:
+        patterns:
+          - "docker/*"

.github/labeler.yml

@@ -0,0 +1,65 @@
+area/api:
+  - changed-files:
+    - any-glob-to-any-file:
+      - registry/api/**
+      - registry/handlers/**
+area/auth:
+  - changed-files:
+    - any-glob-to-any-file:
+      - registry/auth/**
+area/build:
+  - changed-files:
+    - any-glob-to-any-file:
+      - Makefile
+      - Dockerfile
+      - docker-bake.hcl
+      - dockerfiles/**
+area/cache:
+  - changed-files:
+    - any-glob-to-any-file:
+      - registry/storage/cache/**
+area/ci:
+  - changed-files:
+    - any-glob-to-any-file:
+      - .github/**
+      - tests/**
+      - testutil/**
+area/config:
+  - changed-files:
+    - any-glob-to-any-file:
+      - configuration/**
+area/docs:
+  - changed-files:
+    - any-glob-to-any-file:
+      - README.md
+      - docs/**/*.md
+area/proxy:
+  - changed-files:
+    - any-glob-to-any-file:
+      - registry/proxy/**
+area/storage:
+  - changed-files:
+    - any-glob-to-any-file:
+      - registry/storage/**
+area/storage/azure:
+  - changed-files:
+    - any-glob-to-any-file:
+      - registry/storage/driver/azure/**
+area/storage/gcs:
+  - changed-files:
+    - any-glob-to-any-file:
+      - registry/storage/driver/gcs/**
+area/storage/s3:
+  - changed-files:
+    - any-glob-to-any-file:
+      - registry/storage/driver/s3-aws/**
+area/client:
+  - changed-files:
+    - any-glob-to-any-file:
+      - internal/client/**
+dependencies:
+  - changed-files:
+    - any-glob-to-any-file:
+      - vendor/**
+      - go.mod
+      - go.sum

.github/workflows/build.yml

@@ -1,5 +1,9 @@
 name: build
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 on:
   push:
     branches:
@@ -8,28 +12,78 @@ on:
     tags:
       - 'v*'
   pull_request:
-    branches:
-      - '*'
 
 env:
   DOCKERHUB_SLUG: distribution/distribution
+  GHCR_SLUG: ghcr.io/${{ github.repository }}
+
+permissions:
+  contents: read # to fetch code (actions/checkout)
 
 jobs:
+  test:
+    env:
+      # Setting GOTOOLCHAIN to local tells go
+      # to to use the bundled Go version rather
+      # than fetching the toolchain according to
+      # toolchain directive found in go.mod.
+      GOTOOLCHAIN: local
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        go:
+          - 1.26.x
+          - 1.27.1
+        target:
+          - test-coverage
+          - test-s3-storage
+          - test-azure-storage
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      -
+        name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version: ${{ matrix.go }}
+          cache: false
+      -
+        name: Test
+        run: |
+          make ${{ matrix.target }}
+      -
+        name: Codecov
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        with:
+          directory: ./
+
   build:
+    permissions:
+      contents: write # to create GitHub release (softprops/action-gh-release)
+      packages: write # so we can push the image to GHCR
+
     runs-on: ubuntu-latest
+    needs:
+      - test
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v3
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6
         with:
           images: |
             ${{ env.DOCKERHUB_SLUG }}
+            ${{ env.GHCR_SLUG }}
           ### versioning strategy
           ### push semver tag v3.2.1 on main (default branch)
           # distribution/distribution:3.2.1
@@ -48,50 +102,73 @@ jobs:
             type=edge
           labels: |
             org.opencontainers.image.title=Distribution
-            org.opencontainers.image.description=The toolkit to pack, ship, store, and deliver container content
+            org.opencontainers.image.description=The toolkit to pack, ship, store, and distribute container content
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v1
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       -
         name: Login to DockerHub
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
+      -
+        name: Log in to GitHub Container registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
       -
         name: Build artifacts
-        uses: docker/bake-action@v1
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
         with:
+          source: .
           targets: artifact-all
       -
-        name: Move artifacts
+        name: Rename provenance
+        run: |
+          for pdir in ./bin/*/; do
+            (
+              cd "$pdir"
+              binname=$(find . -name '*.tar.gz')
+              filename=$(basename "${binname%.tar.gz}")
+              mv "provenance.json" "${filename}.provenance.json"
+            )
+          done
+      -
+        name: Move and list artifacts
         run: |
           mv ./bin/**/* ./bin/
+          tree -nh ./bin
       -
         name: Upload artifacts
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: registry
           path: ./bin/*
           if-no-files-found: error
       -
         name: Build image
-        uses: docker/bake-action@v1
+        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
         with:
+          source: .
           files: |
             ./docker-bake.hcl
             ${{ steps.meta.outputs.bake-file }}
           targets: image-all
           push: ${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') }}
       -
         name: GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         if: startsWith(github.ref, 'refs/tags/')
         with:
           draft: true
           files: |
             bin/*.tar.gz
+            bin/*.provenance.json
             bin/*.sha256
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ github.token }}