The GitOps Toolkit source management component
Go to file
dependabot[bot] bc85b79a63
build(deps): bump the ci group across 1 directory with 10 updates
Bumps the ci group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [actions/checkout](https://github.com/actions/checkout) | `4.2.2` | `5.0.0` |
| [korthout/backport-action](https://github.com/korthout/backport-action) | `3.2.0` | `3.3.0` |
| [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) | `3.10.0` | `3.11.1` |
| [docker/build-push-action](https://github.com/docker/build-push-action) | `6.17.0` | `6.18.0` |
| [docker/login-action](https://github.com/docker/login-action) | `3.4.0` | `3.5.0` |
| [docker/metadata-action](https://github.com/docker/metadata-action) | `5.7.0` | `5.8.0` |
| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `3.8.2` | `3.9.2` |
| [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.20.0` | `0.20.5` |
| [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action) | `6.3.0` | `6.4.0` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3.28.18` | `3.29.11` |



Updates `actions/checkout` from 4.2.2 to 5.0.0
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](11bd71901b...08c6903cd8)

Updates `korthout/backport-action` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/korthout/backport-action/releases)
- [Commits](436145e922...ca4972adce)

Updates `docker/setup-buildx-action` from 3.10.0 to 3.11.1
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](b5ca514318...e468171a9d)

Updates `docker/build-push-action` from 6.17.0 to 6.18.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](1dc7386353...263435318d)

Updates `docker/login-action` from 3.4.0 to 3.5.0
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](74a5d14239...184bdaa072)

Updates `docker/metadata-action` from 5.7.0 to 5.8.0
- [Release notes](https://github.com/docker/metadata-action/releases)
- [Commits](902fa8ec7d...c1e51972af)

Updates `sigstore/cosign-installer` from 3.8.2 to 3.9.2
- [Release notes](https://github.com/sigstore/cosign-installer/releases)
- [Commits](3454372f43...d58896d6a1)

Updates `anchore/sbom-action` from 0.20.0 to 0.20.5
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](e11c554f70...da167eac91)

Updates `goreleaser/goreleaser-action` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/goreleaser/goreleaser-action/releases)
- [Commits](9c156ee8a1...e435ccd777)

Updates `github/codeql-action` from 3.28.18 to 3.29.11
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](ff0a06e83c...3c3833e0f8)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 5.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci
- dependency-name: korthout/backport-action
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
- dependency-name: docker/setup-buildx-action
  dependency-version: 3.11.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
- dependency-name: docker/build-push-action
  dependency-version: 6.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
- dependency-name: docker/login-action
  dependency-version: 3.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
- dependency-name: docker/metadata-action
  dependency-version: 5.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
- dependency-name: sigstore/cosign-installer
  dependency-version: 3.9.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
- dependency-name: anchore/sbom-action
  dependency-version: 0.20.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci
- dependency-name: goreleaser/goreleaser-action
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
- dependency-name: github/codeql-action
  dependency-version: 3.29.11
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-08-31 11:55:02 +00:00
.github build(deps): bump the ci group across 1 directory with 10 updates 2025-08-31 11:55:02 +00:00
api Regenerate CRDs with controller-gen v0.19 2025-08-31 10:29:36 +03:00
config Regenerate CRDs with controller-gen v0.19 2025-08-31 10:29:36 +03:00
docs [RFC-0010] Add multi-tenant workload identity support for Azure GitRepository 2025-08-15 10:10:00 -07:00
hack Regenerate CRDs with controller-gen v0.19 2025-08-31 10:29:36 +03:00
internal Migrate tests from gotest to gomega 2025-08-31 10:29:36 +03:00
tests Migrate tests from gotest to gomega 2025-08-31 10:29:36 +03:00
.dockerignore libgit2: Remove references to libgit2 from code 2022-12-12 15:34:28 +00:00
.gitignore Update libgit2 to 1.1.1-6 2022-02-07 13:00:57 +00:00
.goreleaser.yaml Adapt config to GoRelease v2 2024-06-11 09:35:42 +03:00
CHANGELOG.md Add changelog entry for v1.6.2 2025-06-27 11:04:25 +01:00
CODE_OF_CONDUCT.md Add governance files like DCO, MAINTAINERS, CoC 2020-04-12 23:54:35 +02:00
DCO Add governance files like DCO, MAINTAINERS, CoC 2020-04-12 23:54:35 +02:00
DEVELOPMENT.md Build with Go 1.25 2025-08-31 10:29:43 +03:00
Dockerfile Build with Go 1.25 2025-08-31 10:29:43 +03:00
LICENSE Initial commit 2020-04-05 11:55:46 +03:00
MAINTAINERS Add Dipti Pai to maintainers 2025-02-27 07:12:20 -08:00
Makefile Build with Go 1.25 2025-08-31 10:29:43 +03:00
PROJECT Promote OCIRepository API to v1 (GA) 2025-05-27 08:19:51 +03:00
README.md Promote OCIRepository API to v1 (GA) 2025-05-27 08:19:51 +03:00
go.mod Migrate tests from gotest to gomega 2025-08-31 10:29:36 +03:00
go.sum Migrate tests from gotest to gomega 2025-08-31 10:29:36 +03:00
main.go [RFC-0010] Add default-service-account for lockdown 2025-08-18 01:32:07 +09:00

README.md

Source controller

CII Best Practices e2e report license release

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. The source-controller implements the source.toolkit.fluxcd.io API and is a core component of the GitOps toolkit.

overview

APIs

Kind API Version
GitRepository source.toolkit.fluxcd.io/v1
OCIRepository source.toolkit.fluxcd.io/v1
HelmRepository source.toolkit.fluxcd.io/v1
HelmChart source.toolkit.fluxcd.io/v1
Bucket source.toolkit.fluxcd.io/v1

Features

  • authenticates to sources (SSH, user/password, API token, Workload Identity)
  • validates source authenticity (PGP, Cosign, Notation)
  • detects source changes based on update policies (semver)
  • fetches resources on-demand and on-a-schedule
  • packages the fetched resources into a well-known format (tar.gz, yaml)
  • makes the artifacts addressable by their source identifier (sha, version, ts)
  • makes the artifacts available in-cluster to interested 3rd parties
  • notifies interested 3rd parties of source changes and availability (status conditions, events, hooks)
  • reacts to Git, Helm and OCI artifacts push events (via notification-controller)

Guides

Roadmap

The roadmap for the Flux family of projects can be found at https://fluxcd.io/roadmap/.

Contributing

This project is Apache 2.0 licensed and accepts contributions via GitHub pull requests. To start contributing please see the development guide.