mcp: refactors pkg for easy maintainability (#2928)

Signed-off-by: kapil <kapilsareen584@gmail.com>

.codecov.yaml

@@ -16,9 +16,12 @@ comment:
   behavior: default
 ignore:
   - "testdata"
-  - "**/zz_*generated*.go"
+  - "**/zz*_generated.go"
   - "templates"
   - "hack"
   - "test"
+  - "generate"
+  - "docs"
+  - "plugin"
+  - "schema"
   - "third_party"
-

.github/composite/go-setup/action.yaml

@@ -1,10 +0,0 @@
-name: "Golang setup"
-description: "Golang setup"
-
-runs:
-  using: "composite"
-  steps:
-    - uses: actions/setup-go@v5
-      with:
-        go-version: 1.22.x
-        check-latest: true

.github/workflows/ci.yaml

@@ -9,7 +9,7 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - name: Lint
         run: make check && make check-templates
       - name: Check that 'func.yaml schema' is up-to-date
@@ -26,7 +26,7 @@ jobs:
     steps:
       - run: git config --global core.autocrlf false
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - uses: actions/setup-java@v4
         with:
           java-version: ${{ matrix.java }}
@@ -38,10 +38,10 @@ jobs:
         run:  make test
       - name: Template Unit Tests
         run:  make test-templates
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v5
         with:
           files: ./coverage.txt
-          flags: unit-tests-${{ matrix.os }}
+          flags: unit-tests
           fail_ci_if_error: true
           verbose: true
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -54,18 +54,35 @@ jobs:
           echo "KUBECONFIG=${{ github.workspace }}/hack/bin/kubeconfig.yaml" >> "$GITHUB_ENV"
           echo "PATH=${{ github.workspace }}/hack/bin:$PATH" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - name: Install Binaries
         run: ./hack/install-binaries.sh
       - name: Allocate Cluster
-        run: ./hack/allocate.sh
+        run: |
+          attempt=0
+          max_attempts=5
+          until [ $attempt -ge $max_attempts ]
+          do
+            attempt=$((attempt+1))
+            echo "------------------ Attempt $attempt ------------------"
+            ./hack/allocate.sh && break
+            echo "------------------ failed, retrying... ------------------"
+            if [ $attempt -ge $max_attempts ]; then
+              echo "------------------ max # of retries reached, exiting ------------------"
+              exit 1
+            fi
+            ./hack/delete.sh
+            echo "------------------ sleep for 5 minutes ------------------"
+            sleep 300
+          done
+          echo "------------------ finished! attempt $attempt ------------------"
       - name: Local Registry
         run: ./hack/registry.sh
       - name: Setup testing images
         run: ./hack/setup-testing-images.sh
       - name: Integration Tests
         run: make test-integration
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v5
         with:
           files: ./coverage.txt
           flags: integration-tests
@@ -84,19 +101,36 @@ jobs:
           echo "KUBECONFIG=${{ github.workspace }}/hack/bin/kubeconfig.yaml" >> "$GITHUB_ENV"
           echo "PATH=${{ github.workspace }}/hack/bin:$PATH" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - name: Install Binaries
         run: ./hack/install-binaries.sh
       - name: Allocate Cluster
-        run: ./hack/allocate.sh
+        run: |
+          attempt=0
+          max_attempts=5
+          until [ $attempt -ge $max_attempts ]
+          do
+            attempt=$((attempt+1))
+            echo "------------------ Attempt $attempt ------------------"
+            ./hack/allocate.sh && break
+            echo "------------------ failed, retrying... ------------------"
+            if [ $attempt -ge $max_attempts ]; then
+              echo "------------------ max # of retries reached, exiting ------------------"
+              exit 1
+            fi
+            ./hack/delete.sh
+            echo "------------------ sleep for 5 minutes ------------------"
+            sleep 300
+          done
+          echo "------------------ finished! attempt $attempt ------------------"
       - name: Local Registry
         run: ./hack/registry.sh
       - name: E2E Test
         run: make test-e2e
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v5
         with:
           files: ./coverage.txt
-          flags: e2e-test
+          flags: e2e-tests
           fail_ci_if_error: true
           verbose: true
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -112,26 +146,41 @@ jobs:
           echo "KUBECONFIG=${{ github.workspace }}/hack/bin/kubeconfig.yaml" >> "$GITHUB_ENV"
           echo "PATH=${{ github.workspace }}/hack/bin:$PATH" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - uses: imjasonh/setup-ko@v0.6
       - name: Install Binaries
         run: ./hack/install-binaries.sh
       - name: Allocate Cluster
-        run: ./hack/allocate.sh
+        run: |
+          attempt=0
+          max_attempts=5
+          until [ $attempt -ge $max_attempts ]
+          do
+            attempt=$((attempt+1))
+            echo "------------------ Attempt $attempt ------------------"
+            ./hack/allocate.sh && break
+            echo "------------------ failed, retrying... ------------------"
+            if [ $attempt -ge $max_attempts ]; then
+              echo "------------------ max # of retries reached, exiting ------------------"
+              exit 1
+            fi
+            ./hack/delete.sh
+            echo "------------------ sleep for 5 minutes ------------------"
+            sleep 300
+          done
+          echo "------------------ finished! attempt $attempt ------------------"
       - name: Setup testing images
         run: ./hack/setup-testing-images.sh
-      - name: Deploy Tekton
-        run: ./hack/install-tekton.sh
       - name: Deploy Test Git Server
         run: ./hack/install-git-server.sh
       - name: E2E On Cluster Test
         env:
           E2E_RUNTIMES: ""
         run: make test-e2e-on-cluster
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v5
         with:
           files: ./coverage.txt
-          flags: e2e-test-oncluster
+          flags: e2e-tests
           fail_ci_if_error: true
           verbose: true
           token: ${{ secrets.CODECOV_TOKEN }}
@@ -141,7 +190,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       # Standard build tasks
       - name: Build
         run: make cross-platform
@@ -180,6 +229,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+      - uses: knative/actions/setup-go@main
+      - uses: docker/setup-qemu-action@v3
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
         with:
@@ -188,11 +239,14 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push
         run: |
+          for a in amd64 arm64 ppc64le s390x; do
+            CGO_ENABLED=0 GOARCH="$a" go build -o "func-util-$a" -trimpath -ldflags '-w -s' ./cmd/func-util
+          done
           docker buildx create --name multiarch --driver docker-container --use
           docker buildx build . -f Dockerfile.utils \
             --platform=linux/ppc64le,linux/s390x,linux/amd64,linux/arm64 \
             --push \
-            -t "ghcr.io/knative/func-utils:latest" \
+            -t "ghcr.io/knative/func-utils:v2" \
             --annotation index:org.opencontainers.image.description="Knative Func Utils Image" \
             --annotation index:org.opencontainers.image.source="https://github.com/knative/func" \
             --annotation index:org.opencontainers.image.vendor="https://github.com/knative/func" \
@@ -203,6 +257,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - uses: imjasonh/setup-ko@v0.6
       - run: ko build --platform=linux/ppc64le,linux/s390x,linux/amd64,linux/arm64 -B ./cmd/func

.github/workflows/schema.yaml

@@ -11,6 +11,6 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - name: Check that 'func.yaml schema' is up-to-date
         run: make schema-check

.github/workflows/test-e2e-oncluster-runtime.yaml

@@ -17,16 +17,31 @@ jobs:
           echo "KUBECONFIG=${{ github.workspace }}/hack/bin/kubeconfig.yaml" >> "$GITHUB_ENV"
           echo "PATH=${{ github.workspace }}/hack/bin:$PATH" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - uses: imjasonh/setup-ko@v0.6
       - name: Install Binaries
         run: ./hack/install-binaries.sh
       - name: Allocate Cluster
-        run: ./hack/allocate.sh
+        run: |
+          attempt=0
+          max_attempts=5
+          until [ $attempt -ge $max_attempts ]
+          do
+            attempt=$((attempt+1))
+            echo "------------------ Attempt $attempt ------------------"
+            ./hack/allocate.sh && break
+            echo "------------------ failed, retrying... ------------------"
+            if [ $attempt -ge $max_attempts ]; then
+              echo "------------------ max # of retries reached, exiting ------------------"
+              exit 1
+            fi
+            ./hack/delete.sh
+            echo "------------------ sleep for 5 minutes ------------------"
+            sleep 300
+          done
+          echo "------------------ finished! attempt $attempt ------------------"
       - name: Setup testing images
         run: ./hack/setup-testing-images.sh
-      - name: Deploy Tekton
-        run: ./hack/install-tekton.sh
       - name: Deploy Test Git Server
         run: ./hack/install-git-server.sh
       - name: E2E On Cluster Test (Runtimes)
@@ -47,7 +62,3 @@ jobs:
           echo "::group::cluster containers logs"
           stern '.*' --all-namespaces --no-follow
           echo "::endgroup::"
-      - uses: codecov/codecov-action@v4
-        with:
-          files: ./coverage.txt
-          flags: e2e-test-oncluster-runtime

.github/workflows/test-e2e-oncluster.yaml

@@ -15,25 +15,41 @@ jobs:
           echo "KUBECONFIG=${{ github.workspace }}/hack/bin/kubeconfig.yaml" >> "$GITHUB_ENV"
           echo "PATH=${{ github.workspace }}/hack/bin:$PATH" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - uses: imjasonh/setup-ko@v0.6
       - name: Install Binaries
         run: ./hack/install-binaries.sh
       - name: Allocate Cluster
-        run: ./hack/allocate.sh
+        run: |
+          attempt=0
+          max_attempts=5
+          until [ $attempt -ge $max_attempts ]
+          do
+            attempt=$((attempt+1))
+            echo "------------------ Attempt $attempt ------------------"
+            ./hack/allocate.sh && break
+            echo "------------------ failed, retrying... ------------------"
+            if [ $attempt -ge $max_attempts ]; then
+              echo "------------------ max # of retries reached, exiting ------------------"
+              exit 1
+            fi
+            ./hack/delete.sh
+            echo "------------------ sleep for 5 minutes ------------------"
+            sleep 300
+          done
+          echo "------------------ finished! attempt $attempt ------------------"
       - name: Setup testing images
         run: ./hack/setup-testing-images.sh
-      - name: Deploy Tekton
-        run: ./hack/install-tekton.sh
       - name: Deploy Test Git Server
         run: ./hack/install-git-server.sh
       - name: E2E On Cluster Test
         env:
           E2E_RUNTIMES: ""
+          E2E_REGISTRY_URL: registry.default.svc.cluster.local:5000
           FUNC_REPO_REF: ${{ github.event.pull_request.head.repo.full_name }}
           FUNC_REPO_BRANCH_REF: ${{ github.head_ref }}
         run: make test-e2e-on-cluster
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v5
         with:
           files: ./coverage.txt
-          flags: e2e-test-oncluster
+          flags: e2e-tests

.github/workflows/test-e2e-runtime.yaml

@@ -12,26 +12,67 @@ jobs:
     continue-on-error: true
     strategy:
       matrix:
-        runtime: ["node", "go", "python", "quarkus", "springboot", "typescript", "rust"]
-    runs-on: ubuntu-latest
+        os: [ "ubuntu-latest", "ubuntu-24.04-arm" ]
+        runtime: ["go", "quarkus"]
+        include:
+          - os: ubuntu-latest
+            runtime: node
+          - os: ubuntu-latest
+            runtime: typescript
+          - os: ubuntu-latest
+            runtime: springboot
+          - os: ubuntu-latest
+            runtime: rust
+          - os: ubuntu-24.04-arm
+            arch: arm64
+    runs-on: ${{ matrix.os }}
     steps:
       - name: Set Environment Variables
         run: |
           echo "KUBECONFIG=${{ github.workspace }}/hack/bin/kubeconfig.yaml" >> "$GITHUB_ENV"
           echo "PATH=${{ github.workspace }}/hack/bin:$PATH" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - name: Install Binaries
+        env:
+          ARCH: ${{ matrix.arch }}
         run: ./hack/install-binaries.sh
       - name: Allocate Cluster
-        run: ./hack/allocate.sh
+        run: |
+          attempt=0
+          max_attempts=5
+          until [ $attempt -ge $max_attempts ]
+          do
+            attempt=$((attempt+1))
+            echo "------------------ Attempt $attempt for ${{matrix.runtime}} ------------------"
+            ./hack/allocate.sh && break
+            echo "------------------ failed, retrying... ------------------"
+            if [ $attempt -ge $max_attempts ]; then
+              echo "------------------ max # of retries reached, exiting ------------------"
+              exit 1
+            fi
+            ./hack/delete.sh
+            echo "------------------ sleep for 5 minutes ------------------"
+            sleep 300
+          done
+          echo "------------------ finished! attempt $attempt ------------------"
       - name: Local Registry
         run: ./hack/registry.sh
       - name: Build
         run: make
       - name: E2E runtime for ${{ matrix.runtime }}
-        run: make test-e2e-runtime runtime=${{ matrix.runtime }}
-      - uses: codecov/codecov-action@v4
-        with:
-          files: ./coverage.txt
-          flags: e2e-test-runtime-${{ matrix.runtime }}
+        run: |
+          attempt=0
+          max_attempts=5
+          until [ $attempt -ge $max_attempts ]
+          do
+            attempt=$((attempt+1))
+            echo "------------------ Attempt $attempt for ${{matrix.runtime}} ------------------"
+            make test-e2e-runtime runtime=${{ matrix.runtime }} && break
+            echo "------------------ failed, retrying... ------------------"
+            if [ $attempt -ge $max_attempts ]; then
+              echo "------------------ max # of retries reached, exiting ------------------"
+              exit 1
+            fi
+          done
+          echo "------------------ finished! attempt $attempt ------------------"

.github/workflows/test-e2e.yaml

@@ -15,16 +15,33 @@ jobs:
           echo "KUBECONFIG=${{ github.workspace }}/hack/bin/kubeconfig.yaml" >> "$GITHUB_ENV"
           echo "PATH=${{ github.workspace }}/hack/bin:$PATH" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - name: Install Binaries
         run: ./hack/install-binaries.sh
       - name: Allocate Cluster
-        run: ./hack/allocate.sh
+        run: |
+          attempt=0
+          max_attempts=5
+          until [ $attempt -ge $max_attempts ]
+          do
+            attempt=$((attempt+1))
+            echo "------------------ Attempt $attempt ------------------"
+            ./hack/allocate.sh && break
+            echo "------------------ failed, retrying... ------------------"
+            if [ $attempt -ge $max_attempts ]; then
+              echo "------------------ max # of retries reached, exiting ------------------"
+              exit 1
+            fi
+            ./hack/delete.sh
+            echo "------------------ sleep for 5 minutes ------------------"
+            sleep 300
+          done
+          echo "------------------ finished! attempt $attempt ------------------"
       - name: Local Registry
         run: ./hack/registry.sh
       - name: E2E Test
         run: make test-e2e
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v5
         with:
           files: ./coverage.txt
-          flags: e2e-test
+          flags: e2e-tests

.github/workflows/test-embedded-fs.yaml

@@ -1,20 +1,20 @@
-name: Func Embedded FS Test
+name: Func Check Embedded FS
 
 on: [pull_request]
 
 jobs:
   test:
-    name: Func Embedded FS Test
+    name: Func Check Embedded FS
     strategy:
       matrix:
         os: ["ubuntu-latest"]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - name: Check embedded templates content
         run: |
-          if ! go test -run "^\QTestFileSystems\E$/^\Qembedded\E$" ./pkg/filesystem; then
+          if ! make check-embedded-fs; then
             echo "Content of templates directory and embedded FS (zz_filesystem_generated.go) doesn't match!"
             echo "Consult https:.github.com/knative/func/blob/main/docs/CONTRIBUTING.md#templates ."
             exit 1

.github/workflows/test-integration.yaml

@@ -21,24 +21,37 @@ jobs:
           echo "PATH=${{ github.workspace }}/hack/bin:$PATH" >> "$GITHUB_ENV"
           echo "TEKTON_TESTS_ENABLED=1" >> "$GITHUB_ENV"
           echo "GITLAB_TESTS_ENABLED=1" >> "$GITHUB_ENV"
-          echo "GITLAB_HOSTNAME=gitlab.127.0.0.1.sslip.io" >> "$GITHUB_ENV"
+          echo "GITLAB_HOSTNAME=gitlab.localtest.me" >> "$GITHUB_ENV"
           echo "GITLAB_ROOT_PASSWORD=$(< /dev/urandom tr -dc _A-Z-a-z-0-9 | head -c${1:-32})" >> "$GITHUB_ENV"
-          echo "PAC_CONTROLLER_HOSTNAME=pac-ctr.127.0.0.1.sslip.io" >> "$GITHUB_ENV"
+          echo "PAC_CONTROLLER_HOSTNAME=pac-ctr.localtest.me" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - uses: imjasonh/setup-ko@v0.6
       - name: Install Binaries
         run: ./hack/install-binaries.sh
+      - name: Allocate Cluster
+        run: |
+          attempt=0
+          max_attempts=5
+          until [ $attempt -ge $max_attempts ]
+          do
+            attempt=$((attempt+1))
+            echo "------------------ Attempt $attempt ------------------"
+            ./hack/allocate.sh && break
+            echo "------------------ failed, retrying... ------------------"
+            if [ $attempt -ge $max_attempts ]; then
+              echo "------------------ max # of retries reached, exiting ------------------"
+              exit 1
+            fi
+            ./hack/delete.sh
+            echo "------------------ sleep for 5 minutes ------------------"
+            sleep 300
+          done
+          echo "------------------ finished! attempt $attempt ------------------"
       - name: Local Registry
         run: ./hack/registry.sh
-      - name: Allocate Cluster
-        run: ./hack/allocate.sh
       - name: Setup testing images
         run: ./hack/setup-testing-images.sh
-      - name: Install Tekton
-        run: ./hack/install-tekton.sh
-      - name: Install Pipelines as Code
-        run: ./hack/install-pac.sh
       - name: Install Gitlab
         run: ./hack/install-gitlab.sh
       - name: Patch Hosts
@@ -65,7 +78,7 @@ jobs:
           name: cluster-logs
           path: ./cluster_log.txt
           retention-days: 7
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v5
         with:
           files: ./coverage.txt
           flags: integration-tests

.github/workflows/test-podman-next.yaml

@@ -0,0 +1,85 @@
+name: Func Podman Next Test
+
+on:
+  schedule:
+    - cron: '0 2 * * *'
+
+jobs:
+  test:
+    name: Podman Next Test
+    strategy:
+      matrix:
+        os: ["ubuntu-latest"]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - name: Remove Unnecessary Software
+        run: |
+          sudo rm -rf /usr/share/dotnet || true
+          sudo rm -rf /usr/local/lib/android || true
+          sudo rm -rf /opt/ghc || true
+      - name: Install Podman Next (Nightly Build)
+        env:
+          FEDORA_RELEASE: 41
+          BASE_ARCH: x86_64
+        run: |
+          sudo apt update 
+          sudo mkdir -p /etc/yum.repos.d
+          sudo apt install dnf -y
+          sudo apt install dnf-plugins-core -y
+          sudo apt install alien -y
+          sudo touch /etc/yum.repos.d/fedora.repo
+          sudo chmod 666 /etc/yum.repos.d/fedora.repo
+          cat << EOF >> /etc/yum.repos.d/fedora.repo
+          [fedora]
+          name=Fedora $FEDORA_RELEASE
+          metalink=https://mirrors.fedoraproject.org/metalink?repo=fedora-$FEDORA_RELEASE&arch=$BASE_ARCH
+          enabled=1
+          countme=1
+          metadata_expire=7d
+          repo_gpgcheck=0
+          type=rpm
+          gpgcheck=0
+          EOF
+          sudo chmod 644 /etc/yum.repos.d/fedora.repo
+          sudo dnf copr enable rhcontainerbot/podman-next fedora-$FEDORA_RELEASE-$BASE_ARCH --releasever=$FEDORA_RELEASE -y
+          sudo dnf download crun conmon podman --releasever=$FEDORA_RELEASE -y
+          sudo alien --to-deb $(ls -1 crun*.rpm) --install
+          sudo alien --to-deb $(ls -1 conmon*.rpm) --install
+          sudo alien --to-deb $(ls -1 podman*.rpm) --install
+          podman info
+      - name: Set Environment Variables
+        run: |
+          echo "KUBECONFIG=${{ github.workspace }}/hack/bin/kubeconfig.yaml" >> "$GITHUB_ENV"
+          echo "PATH=${{ github.workspace }}/hack/bin:$PATH" >> "$GITHUB_ENV"
+      - uses: actions/checkout@v4
+      - uses: knative/actions/setup-go@main
+      - name: Install Binaries
+        run: ./hack/install-binaries.sh
+      - name: Allocate Cluster
+        run: |
+          attempt=0
+          max_attempts=5
+          until [ $attempt -ge $max_attempts ]
+          do
+            attempt=$((attempt+1))
+            echo "------------------ Attempt $attempt ------------------"
+            ./hack/allocate.sh && break
+            echo "------------------ failed, retrying... ------------------"
+            if [ $attempt -ge $max_attempts ]; then
+              echo "------------------ max # of retries reached, exiting ------------------"
+              exit 1
+            fi
+            ./hack/delete.sh
+            echo "------------------ sleep for 5 minutes ------------------"
+            sleep 300
+          done
+          echo "------------------ finished! attempt $attempt ------------------"
+      - name: Local Registry
+        run: ./hack/registry.sh
+      - name: Setup testing images
+        run: ./hack/setup-testing-images.sh
+      - name: Integration Test Podman
+        env:
+          FUNC_REPO_REF: ${{ github.event.pull_request.head.repo.full_name }}
+          FUNC_REPO_BRANCH_REF: ${{ github.head_ref }}
+        run: ./hack/test-integration-podman.sh

.github/workflows/test-podman.yaml

@@ -15,26 +15,33 @@ jobs:
           echo "KUBECONFIG=${{ github.workspace }}/hack/bin/kubeconfig.yaml" >> "$GITHUB_ENV"
           echo "PATH=${{ github.workspace }}/hack/bin:$PATH" >> "$GITHUB_ENV"
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - name: Install Podman
         run: |
-          # TODO uncomment following once https:.github.com/containers/podman/pull/16781 is in the kubic repository
-          #. /etc/os-release
-          #sudo mkdir -p /etc/apt/keyrings
-          #curl -fsSL https://download.opensuse.org/repositories/devel:kubic:libcontainers:unstable/xUbuntu_${VERSION_ID}/Release.key \
-          #  | gpg --dearmor \
-          #  | sudo tee /etc/apt/keyrings/devel_kubic_libcontainers_unstable.gpg > /dev/null
-          #echo \
-          #  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/devel_kubic_libcontainers_unstable.gpg]\
-          #    https://download.opensuse.org/repositories/devel:kubic:libcontainers:unstable/xUbuntu_${VERSION_ID}/ /" \
-          #  | sudo tee /etc/apt/sources.list.d/devel:kubic:libcontainers:unstable.list > /dev/null
-          #sudo apt-get update -qq
-          sudo apt-get -qq -y install podman
+          sudo apt update
+          sudo apt install podman -y
           podman info
       - name: Install Binaries
         run: ./hack/install-binaries.sh
       - name: Allocate Cluster
-        run: ./hack/allocate.sh
+        run: |
+          attempt=0
+          max_attempts=5
+          until [ $attempt -ge $max_attempts ]
+          do
+            attempt=$((attempt+1))
+            echo "------------------ Attempt $attempt ------------------"
+            ./hack/allocate.sh && break
+            echo "------------------ failed, retrying... ------------------"
+            if [ $attempt -ge $max_attempts ]; then
+              echo "------------------ max # of retries reached, exiting ------------------"
+              exit 1
+            fi
+            ./hack/delete.sh
+            echo "------------------ sleep for 5 minutes ------------------"
+            sleep 300
+          done
+          echo "------------------ finished! attempt $attempt ------------------"
       - name: Local Registry
         run: ./hack/registry.sh
       - name: Setup testing images

.github/workflows/test-unit.yaml

@@ -24,7 +24,7 @@ jobs:
           echo "$(brew --prefix)/opt/gnu-sed/libexec/gnubin" >> $GITHUB_PATH
       - run: git config --global core.autocrlf false
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
       - uses: actions/setup-java@v4
         with:
           java-version: ${{ matrix.java }}
@@ -44,24 +44,7 @@ jobs:
       - name: Template Unit Tests
         if: matrix.os != 'ubuntu-latest'
         run: make test-templates
-      - name: "Archive code coverage results"
-        uses: actions/upload-artifact@v4
+      - uses: codecov/codecov-action@v5
         with:
-          name: coverage-${{ matrix.os }}
-          path: ./coverage.txt
-          retention-days: 1
-  upload-coverage:
-    needs: [test]
-    name: "Upload coverage"
-    runs-on: "ubuntu-latest"
-    steps:
-      - uses: actions/checkout@v4
-      - name: Download Coverage
-        run: |
-          gh run download -R ${{ github.repository }} ${{ github.run_id }}
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: codecov/codecov-action@v4
-        with:
-          files: ./coverage-ubuntu-latest/coverage.txt,./coverage-windows-latest/coverage.txt,./coverage-macos-latest/coverage.txt
+          files: ./coverage.txt
           flags: unit-tests

.github/workflows/update-builder.yaml

@@ -2,7 +2,7 @@ name: Update builder-jammy-full image
 
 on:
   schedule:
-    - cron: '0 */4 * * *'
+    - cron: '0 * * * *'
 
 jobs:
   build-and-push-image:
@@ -12,8 +12,20 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
+      - uses: knative/actions/setup-go@main
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
       - name: Build and Push
         env:
           GITHUB_TOKEN: ${{ github.token }}
-        run: go run ./hack/update-builder.go
+        run: |
+          docker run -d -p 5000:5000 --name registry registry:2.7
+          echo '{"insecure-registries" : "localhost:5000" }'  | \
+            sudo tee /etc/docker/daemon.json
+          mkdir -p "$HOME/.config/containers/"
+          echo -e '\n[[registry]]\nlocation = "localhost:5000"\ninsecure = true\n' >> \
+            "$HOME/.config/containers/registries.conf"
+          skopeo login ghcr.io -u gh-action -p "$GITHUB_TOKEN"
+          docker login ghcr.io -u gh-action -p "$GITHUB_TOKEN"
+          make wf-update-builder
+        

.github/workflows/update-ca-bundle.yaml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@v4
         with:
           node-version: 18
       - name: Install NPM deps.

.github/workflows/update-knative-hack.yaml

@@ -0,0 +1,24 @@
+name: Update Kn components in hack/ scripts
+
+permissions:
+  contents: write
+  pull-requests: write
+
+on:
+  schedule:
+  # every 4 hours
+  - cron: '0 */4 * * *'
+jobs:
+  update:
+    name: Update components
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-go@v5
+      with:
+        go-version: 1.23.0
+    - name: Run script
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: make wf-generate-kn-components
+

.github/workflows/update-quarkus-platform.yaml

@@ -14,8 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
-      - uses: actions/setup-node@v3
+      - uses: knative/actions/setup-go@main
+      - uses: actions/setup-node@v4
         with:
           node-version: 18
       - uses: actions/setup-java@v4

.github/workflows/update-springboot-platform.yaml

@@ -14,8 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: ./.github/composite/go-setup
-      - uses: actions/setup-node@v3
+      - uses: knative/actions/setup-go@main
+      - uses: actions/setup-node@v4
         with:
           node-version: 18
       - uses: actions/setup-java@v4

.gitignore

@@ -2,30 +2,38 @@
 /func
 /func_*
 /cmd/func.yaml
-/templates/typescript/cloudevents/build
-/templates/typescript/http/build
 /coverage.out
 /coverage.txt
 /.coverage
 /bin
 /target
 /hack/bin
-
-/e2e/testdata/default_home/go
-/e2e/testdata/default_home/.cache
+/.artifacts
 
+/pkg/functions/testdata/migrations/*/.gitignore
+/pkg/functions/testdata/default_home/go
+/pkg/functions/testdata/default_home/.cache
 /pkg/functions/testdata/migrations/*/.gitignore
 
-# Nodejs
+# Go
+/templates/go/cloudevents/go.sum
+
+# JS
 node_modules
+/templates/typescript/cloudevents/build
+/templates/typescript/http/build
 
 # Python
 __pycache__
+/templates/python/cloudevents/.venv
+/templates/python/http/.venv
 
-# VSCode
+# E2E Tests
+/e2e/testdata/default_home/go
+/e2e/testdata/default_home/.cache
+ 
+# Editors
 .vscode
-
-# IntelliJ
 .idea
 
 # Operating system temporary files

.golangci.yaml

@@ -1,31 +1,37 @@
-#
-# golangci-lint
-#
-# For defaults, see:
-# https://github.com/golangci/golangci-lint/blob/master/.golangci.example.yml
-#
-#
-#
-run:
-  timeout: 5m
-
+version: "2"
 linters:
   enable:
     - unconvert
     - prealloc
     - bodyclose
-
-issues:
-  exclude-rules:
-    - linters:
-        - staticcheck
-      # Error Text:
-      #   "SA9004: only the first constant in this group has an explicit type"
-      # Efect:
-      #   Allows short-hand first constant type declarations:
-      # Example:
-      #   const (
-      #     Name  Type = "value"
-      #     Name2      = "value2"
-      #   )
-      text: "SA9004:"
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - staticcheck
+        # Error Text:
+        #   "SA9004: only the first constant in this group has an explicit type"
+        # Efect:
+        #   Allows short-hand first constant type declarations:
+        # Example:
+        #   const (
+        #     Name  Type = "value"
+        #     Name2      = "value2"
+        #   )
+        text: 'SA9004:'
+    paths:
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  exclusions:
+    generated: lax
+    paths:
+      - third_party$
+      - builtin$
+      - examples$

Dockerfile.utils

@@ -1,29 +1,13 @@
-FROM --platform=$BUILDPLATFORM index.docker.io/library/golang:1.22.1-alpine3.19 AS builder
+FROM scratch
 
-ARG BUILDPLATFORM
-ARG TARGETPLATFORM
 ARG TARGETARCH
+ARG FUNC_UTIL_BINARY=func-util-$TARGETARCH
 
-WORKDIR /workspace
+ENV PATH=/
 
-COPY go.mod go.sum ./
-RUN go mod download -x
+COPY $FUNC_UTIL_BINARY /func-util
 
-COPY . .
-
-RUN GOARCH=$TARGETARCH go build -o func-util -trimpath -ldflags '-w -s' ./cmd/func-util
-
-#########################
-
-FROM index.docker.io/library/alpine:latest
-
-RUN apk add --no-cache tar
-
-COPY --from=builder /workspace/func-util /usr/local/bin/
-RUN ln -s /usr/local/bin/func-util /usr/local/bin/deploy && \
-    ln -s /usr/local/bin/func-util /usr/local/bin/scaffold && \
-    ln -s /usr/local/bin/func-util /usr/local/bin/s2i && \
-    ln -s /usr/local/bin/func-util /usr/local/bin/socat
+ADD func-util-symlinks.tgz /
 
 LABEL \
    org.opencontainers.image.description="Knative Func Utils Image" \

Makefile

@@ -28,27 +28,27 @@ VTAG         := $(shell [ -z $(VTAG) ] && echo $(ETAG) || echo $(VTAG))
 VERS         ?= $(shell git describe --tags --match 'v*')
 KVER         ?= $(shell git describe --tags --match 'knative-*')
 
-LDFLAGS      := -X knative.dev/func/pkg/app.vers=$(VERS) -X knative.dev/func/pkg/app.kver=$(KVER) -X knative.dev/func/pkg/app.hash=$(HASH)
+LDFLAGS      := -X knative.dev/func/pkg/version.Vers=$(VERS) -X knative.dev/func/pkg/version.Kver=$(KVER) -X knative.dev/func/pkg/version.Hash=$(HASH)
 
-FUNC_UTILS_IMG ?= ghcr.io/knative/func-utils:latest
+FUNC_UTILS_IMG ?= ghcr.io/knative/func-utils:v2
 LDFLAGS += -X knative.dev/func/pkg/k8s.SocatImage=$(FUNC_UTILS_IMG)
 LDFLAGS += -X knative.dev/func/pkg/k8s.TarImage=$(FUNC_UTILS_IMG)
-LDFLAGS += -X knative.dev/func/pkg/pipelines/tekton.DeployerImage=$(FUNC_UTILS_IMG)
+LDFLAGS += -X knative.dev/func/pkg/pipelines/tekton.FuncUtilImage=$(FUNC_UTILS_IMG)
 
 GOFLAGS      := "-ldflags=$(LDFLAGS)"
 export GOFLAGS
 
 MAKEFILE_DIR := $(dir $(abspath $(lastword $(MAKEFILE_LIST))))
 
-.PHONY: test docs
-
 # Default Targets
+.PHONY: all
 all: build docs
 	@echo '🎉 Build process completed!'
 
 # Help Text
 # Headings: lines with `##$` comment prefix
 # Targets:  printed if their line includes a `##` comment
+.PHONY: help
 help:
 	@echo 'Usage: make <OPTIONS> ... <TARGETS>'
 	@echo ''
@@ -60,6 +60,7 @@ help:
 ##@ Development
 ###############
 
+.PHONY: build
 build: $(BIN) ## (default) Build binary for current OS
 
 .PHONY: $(BIN)
@@ -76,30 +77,36 @@ check: $(BIN_GOLANGCI_LINT) ## Check code quality (lint)
 	cd test && $(BIN_GOLANGCI_LINT) run --timeout 300s
 
 $(BIN_GOLANGCI_LINT):
-	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b ./bin v1.59.1
+	curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b ./bin v2.0.2
 
 .PHONY: generate/zz_filesystem_generated.go
-generate/zz_filesystem_generated.go: clean_templates templates/certs/ca-certificates.crt
+generate/zz_filesystem_generated.go: clean_templates
 	go generate pkg/functions/templates_embedded.go
 
 .PHONY: clean_templates
 clean_templates:
 	# Removing temporary template files
+	@rm -rf templates/**/.DS_Store
 	@rm -rf templates/node/cloudevents/node_modules
 	@rm -rf templates/node/http/node_modules
-	@rm -rf templates/python/cloudevents/__pycache__
-	@rm -rf templates/python/http/__pycache__
-	@rm -rf templates/typescript/cloudevents/node_modules
-	@rm -rf templates/typescript/http/node_modules
-	@rm -rf templates/typescript/cloudevents/build
-	@rm -rf templates/typescript/http/build
-	@rm -rf templates/rust/cloudevents/target
-	@rm -rf templates/rust/http/target
+	@rm -rf templates/python/cloudevents/.venv
+	@rm -rf templates/python/cloudevents/.pytest_cache
+	@rm -rf templates/python/cloudevents/function/__pycache__
+	@rm -rf templates/python/cloudevents/tests/__pycache__
+	@rm -rf templates/python/http/.venv
+	@rm -rf templates/python/http/.pytest_cache
+	@rm -rf templates/python/http/function/__pycache__
+	@rm -rf templates/python/http/tests/__pycache__
 	@rm -rf templates/quarkus/cloudevents/target
 	@rm -rf templates/quarkus/http/target
+	@rm -rf templates/rust/cloudevents/target
+	@rm -rf templates/rust/http/target
 	@rm -rf templates/springboot/cloudevents/target
 	@rm -rf templates/springboot/http/target
-	@rm -f templates/**/.DS_Store
+	@rm -rf templates/typescript/cloudevents/build
+	@rm -rf templates/typescript/cloudevents/node_modules
+	@rm -rf templates/typescript/http/build
+	@rm -rf templates/typescript/http/node_modules
 
 .PHONY: clean
 clean: clean_templates ## Remove generated artifacts such as binaries and schemas
@@ -117,6 +124,7 @@ docs:
 ##@ Prow Integration
 #############
 
+.PHONY: presubmit-unit-tests
 presubmit-unit-tests: ## Run prow presubmit unit tests locally
 	docker run --platform linux/amd64 -it --rm -v$(MAKEFILE_DIR):/src/ us-docker.pkg.dev/knative-tests/images/prow-tests:v20230616-086ddd644 sh -c 'cd /src && runner.sh ./test/presubmit-tests.sh --unit-tests'
 
@@ -125,6 +133,10 @@ presubmit-unit-tests: ## Run prow presubmit unit tests locally
 ##@ Templates
 #############
 
+.PHONY: check-embedded-fs
+check-embedded-fs: ## Check the embedded templates FS
+	go test -run "^\QTestFileSystems\E$$/^\Qembedded\E$$" ./pkg/filesystem
+
 # TODO: add linters for other templates
 .PHONY: check-templates
 check-templates: check-go check-rust ## Run template source code checks
@@ -141,32 +153,39 @@ check-rust: ## Check Rust templates' source
 	cd templates/rust/cloudevents && cargo clippy && cargo clean
 	cd templates/rust/http && cargo clippy && cargo clean
 
+.PHONY: test-templates
 test-templates: test-go test-node test-python test-quarkus test-springboot test-rust test-typescript ## Run all template tests
 
+.PHONY: test-go
 test-go: ## Test Go templates
 	cd templates/go/cloudevents && go mod tidy && go test
 	cd templates/go/http && go mod tidy && go test
 
+.PHONY: test-node
 test-node: ## Test Node templates
 	cd templates/node/cloudevents && npm ci && npm test && rm -rf node_modules
 	cd templates/node/http && npm ci && npm test && rm -rf node_modules
 
-test-python: ## Test Python templates
-	cd templates/python/cloudevents && pip3 install -r requirements.txt && python3 test_func.py && rm -rf __pycache__
-	cd templates/python/http && python3 test_func.py && rm -rf __pycache__
+.PHONY: test-python
+test-python: ## Test Python templates and Scaffolding
+	test/test_python.sh
 
+.PHONY: test-quarkus
 test-quarkus: ## Test Quarkus templates
 	cd templates/quarkus/cloudevents && ./mvnw -q test && ./mvnw clean && rm .mvn/wrapper/maven-wrapper.jar
 	cd templates/quarkus/http && ./mvnw -q test && ./mvnw clean && rm .mvn/wrapper/maven-wrapper.jar
 
+.PHONY: test-springboot
 test-springboot: ## Test Spring Boot templates
 	cd templates/springboot/cloudevents && ./mvnw -q test && ./mvnw clean && rm .mvn/wrapper/maven-wrapper.jar
 	cd templates/springboot/http && ./mvnw -q test && ./mvnw clean && rm .mvn/wrapper/maven-wrapper.jar
 
+.PHONY: test-rust
 test-rust: ## Test Rust templates
 	cd templates/rust/cloudevents && cargo -q test && cargo clean
 	cd templates/rust/http && cargo -q test && cargo clean
 
+.PHONY: test-typescript
 test-typescript: ## Test Typescript templates
 	cd templates/typescript/cloudevents && npm ci && npm test && rm -rf node_modules build
 	cd templates/typescript/http && npm ci && npm test && rm -rf node_modules build
@@ -176,15 +195,18 @@ test-typescript: ## Test Typescript templates
 ###############
 
 # Pulls runtimes then rebuilds the embedded filesystem
-update-runtimes:  pull-runtimes generate/zz_filesystem_generated.go ## Update Scaffolding Runtimes
+.PHONY: update-runtimes
+update-runtimes:  update-runtime-go generate/zz_filesystem_generated.go ## Update Scaffolding Runtimes
 
-pull-runtimes:
+.PHONY: update-runtime-go
+update-runtime-go:
 	cd templates/go/scaffolding/instanced-http && go get -u knative.dev/func-go/http
 	cd templates/go/scaffolding/static-http && go get -u knative.dev/func-go/http
 	cd templates/go/scaffolding/instanced-cloudevents && go get -u knative.dev/func-go/cloudevents
 	cd templates/go/scaffolding/static-cloudevents && go get -u knative.dev/func-go/cloudevents
 
-.PHONY: cert
+
+.PHONY: certs
 certs: templates/certs/ca-certificates.crt ## Update root certificates
 
 .PHONY: templates/certs/ca-certificates.crt
@@ -196,20 +218,23 @@ templates/certs/ca-certificates.crt:
 ##@ Extended Testing (cluster required)
 ###################
 
+.PHONY: test-integration
 test-integration: ## Run integration tests using an available cluster.
 	go test -tags integration -timeout 30m --coverprofile=coverage.txt ./... -v
 
 .PHONY: func-instrumented
-
-func-instrumented: ## Func binary that is instrumented for e2e tests
+func-instrumented: # func binary instrumented with coverage reporting
 	env CGO_ENABLED=1 go build -cover -o func ./cmd/$(BIN)
 
+.PHONY: test-e2e
 test-e2e: func-instrumented ## Run end-to-end tests using an available cluster.
 	./test/e2e_extended_tests.sh
 
+.PHONY: test-e2e-runtime
 test-e2e-runtime: func-instrumented ## Run end-to-end lifecycle tests using an available cluster for a single runtime.
 	./test/e2e_lifecycle_tests.sh $(runtime)
 
+.PHONY: test-e2e-on-cluster
 test-e2e-on-cluster: func-instrumented ## Run end-to-end on-cluster build tests using an available cluster.
 	./test/e2e_oncluster_tests.sh
 
@@ -217,38 +242,46 @@ test-e2e-on-cluster: func-instrumented ## Run end-to-end on-cluster build tests
 ##@ Release Artifacts
 ######################
 
+.PHONY: cross-platform
 cross-platform: darwin-arm64 darwin-amd64 linux-amd64 linux-arm64 linux-ppc64le linux-s390x windows ## Build all distributable (cross-platform) binaries
 
+.PHONY: darwin-arm64
 darwin-arm64: $(BIN_DARWIN_ARM64) ## Build for mac M1
 
 $(BIN_DARWIN_ARM64): generate/zz_filesystem_generated.go
 	env CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 go build -o $(BIN_DARWIN_ARM64) -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/$(BIN)
 
+.PHONY: darwn-amd64
 darwin-amd64: $(BIN_DARWIN_AMD64) ## Build for Darwin (macOS)
 
 $(BIN_DARWIN_AMD64): generate/zz_filesystem_generated.go
 	env CGO_ENABLED=0 GOOS=darwin GOARCH=amd64 go build -o $(BIN_DARWIN_AMD64) -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/$(BIN)
 
+.PHONY: linux-amd64
 linux-amd64: $(BIN_LINUX_AMD64) ## Build for Linux amd64
 
 $(BIN_LINUX_AMD64): generate/zz_filesystem_generated.go
 	env CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o $(BIN_LINUX_AMD64) -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/$(BIN)
 
+.PHONY: linux-arm64
 linux-arm64: $(BIN_LINUX_ARM64) ## Build for Linux arm64
 
 $(BIN_LINUX_ARM64): generate/zz_filesystem_generated.go
 	env CGO_ENABLED=0 GOOS=linux GOARCH=arm64 go build -o $(BIN_LINUX_ARM64) -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/$(BIN)
 
+.PHONY: linux-ppc64le
 linux-ppc64le: $(BIN_LINUX_PPC64LE) ## Build for Linux ppc64le
 
 $(BIN_LINUX_PPC64LE): generate/zz_filesystem_generated.go
 	env CGO_ENABLED=0 GOOS=linux GOARCH=ppc64le go build -o $(BIN_LINUX_PPC64LE) -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/$(BIN)
 
+.PHONY: linux-s390x
 linux-s390x: $(BIN_LINUX_S390X) ## Build for Linux s390x
 
 $(BIN_LINUX_S390X): generate/zz_filesystem_generated.go
 	env CGO_ENABLED=0 GOOS=linux GOARCH=s390x go build -o $(BIN_LINUX_S390X) -trimpath -ldflags "$(LDFLAGS) -w -s" ./cmd/$(BIN)
 
+.PHONY: windows
 windows: $(BIN_WINDOWS) ## Build for Windows
 
 $(BIN_WINDOWS): generate/zz_filesystem_generated.go
@@ -258,10 +291,12 @@ $(BIN_WINDOWS): generate/zz_filesystem_generated.go
 ##@ Schemas
 ######################
 
+.PHONY: schema-generate
 schema-generate: schema/func_yaml-schema.json ## Generate func.yaml schema
 schema/func_yaml-schema.json: pkg/functions/function.go pkg/functions/function_*.go
 	go run schema/generator/main.go
 
+.PHONY: schema-check
 schema-check: ## Check that func.yaml schema is up-to-date
 	mv schema/func_yaml-schema.json schema/func_yaml-schema-previous.json
 	make schema-generate
@@ -269,3 +304,27 @@ schema-check: ## Check that func.yaml schema is up-to-date
 	(echo "\n\nFunction config schema 'schema/func_yaml-schema.json' is obsolete, please run 'make schema-generate'.\n\n"; rm -rf schema/func_yaml-schema-previous.json; exit 1)
 	rm -rf schema/func_yaml-schema-previous.json
 
+######################
+##@ Hack scripting
+######################
+
+### Local section - Can be run locally!
+
+.PHONY: generate-kn-components-local
+generate-kn-components-local: ## Generate knative components locally
+	cd hack && go run ./cmd/update-knative-components "local"
+
+.PHONY: test-hack
+test-hack:
+	cd hack && go test ./... -v
+
+### Automated section - This gets run in workflows, scripts etc.
+.PHONY: wf-generate-kn-components
+wf-generate-kn-components: # Generate kn components - used in automation
+	cd hack && go run ./cmd/update-knative-components
+
+.PHONY: update-builder
+wf-update-builder: # Used in automation
+	cd hack && go run ./cmd/update-builder
+
+### end of automation section

OWNERS_ALIASES

@@ -6,18 +6,14 @@ aliases:
   - itsmurugappan
   client-wg-leads:
   - dsimansk
-  - rhuss
   client-writers:
   - dsimansk
-  - rhuss
   - vyasgun
   docs-reviewers:
   - nainaz
-  - retocode
   - skonto
   docs-writers:
   - csantanapr
-  - retocode
   - skonto
   eventing-reviewers:
   - Leo6Leo
@@ -25,6 +21,7 @@ aliases:
   - cali0707
   - creydr
   eventing-wg-leads:
+  - creydr
   - pierDipi
   eventing-writers:
   - Leo6Leo
@@ -51,24 +48,23 @@ aliases:
   knative-admin:
   - aliok
   - cardil
-  - davidhadas
   - dprotaso
   - dsimansk
   - evankanderson
+  - gauron99
   - knative-automation
   - knative-prow-releaser-robot
   - knative-prow-robot
   - knative-prow-updater-robot
   - knative-test-reporter-robot
-  - nainaz
-  - psschwei
-  - retocode
-  - salaboy
+  - matzew
+  - nrrso
   - skonto
   - upodroid
   knative-release-leads:
+  - dprotaso
   - dsimansk
-  - retocode
+  - gauron99
   - skonto
   knative-robots:
   - knative-automation
@@ -105,32 +101,24 @@ aliases:
   - davidhadas
   - evankanderson
   serving-approvers:
-  - ReToCode
+  - dsimansk
   - skonto
   serving-reviewers:
-  - izabelacg
-  - retocode
   - skonto
   serving-triage:
-  - izabelacg
-  - retocode
   - skonto
   serving-wg-leads:
   - dprotaso
   serving-writers:
-  - ReToCode
   - dprotaso
+  - dsimansk
   - skonto
   steering-committee:
   - aliok
-  - davidhadas
   - dprotaso
-  - dsimansk
   - evankanderson
-  - nainaz
-  - psschwei
-  - salaboy
-  technical-oversight-committee: []
+  - matzew
+  - nrrso
   ux-wg-leads:
   - cali0707
   - leo6leo

README.md

@@ -25,3 +25,7 @@ We are always looking for contributions from the Function Developer community.
 For a list of all help wanted issues in Knative, take a look at [CLOTRIBUTOR](https://clotributor.dev/search?project=knative&page=1).
 
 The `func` Working Group meets @ 10:00 US Eastern every Tuesday, we'd love to have you! For more information, see the invitation on the [Knative Team Calendar](https://calendar.google.com/calendar/u/0/embed?src=knative.team_9q83bg07qs5b9rrslp5jor4l6s@group.calendar.google.com).
+
+## Roadmap
+
+Our project roadmap can be found: https://github.com/orgs/knative/projects/49

cmd/build.go

@@ -69,8 +69,8 @@ EXAMPLES
 `,
 		SuggestFor: []string{"biuld", "buidl", "built"},
 		PreRunE: bindEnv("image", "path", "builder", "registry", "confirm",
-			"push", "builder-image", "platform", "verbose", "build-timestamp",
-			"registry-insecure", "username", "password", "token"),
+			"push", "builder-image", "base-image", "platform", "verbose",
+			"build-timestamp", "registry-insecure", "username", "password", "token"),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runBuild(cmd, args, newClient)
 		},
@@ -110,6 +110,8 @@ EXAMPLES
 	builderImage := f.Build.BuilderImages[f.Build.Builder]
 	cmd.Flags().StringP("builder-image", "", builderImage,
 		"Specify a custom builder image for use by the builder other than its default. ($FUNC_BUILDER_IMAGE)")
+	cmd.Flags().StringP("base-image", "", f.Build.BaseImage,
+		"Override the base image for your function (host builder only)")
 	cmd.Flags().StringP("image", "i", f.Image,
 		"Full image name in the form [registry]/[namespace]/[name]:[tag] (optional). This option takes precedence over --registry ($FUNC_IMAGE)")
 
@@ -130,10 +132,7 @@ EXAMPLES
 
 	// Temporarily Hidden Basic Auth Flags
 	// Username, Password and Token flags, which plumb through basic auth, are
-	// currently only available on the experimental "host" builder, which is
-	// itself behind a feature flag FUNC_ENABLE_HOST_BUILDER.  So set these
-	// flags to hidden until it's out of preview and they are plumbed through
-	// the docker pusher as well.
+	// currently only available on the "host" builder.
 	_ = cmd.Flags().MarkHidden("username")
 	_ = cmd.Flags().MarkHidden("password")
 	_ = cmd.Flags().MarkHidden("token")
@@ -165,13 +164,13 @@ func runBuild(cmd *cobra.Command, _ []string, newClient ClientFactory) (err erro
 	if err = cfg.Validate(); err != nil { // Perform any pre-validation
 		return
 	}
-	if f, err = fn.NewFunction(cfg.Path); err != nil {
+	if f, err = fn.NewFunction(cfg.Path); err != nil { // Read in the Function
 		return
 	}
 	if !f.Initialized() {
 		return fn.NewErrNotInitialized(f.Root)
 	}
-	f = cfg.Configure(f) // Updates f at path to include build request values
+	f = cfg.Configure(f) // Returns an f updated with values from the config (flags, envs, etc)
 
 	cmd.SetContext(cfg.WithValues(cmd.Context())) // Some optional settings are passed via context
 
@@ -184,7 +183,7 @@ func runBuild(cmd *cobra.Command, _ []string, newClient ClientFactory) (err erro
 	defer done()
 
 	// Build
-	buildOptions, err := cfg.buildOptions()
+	buildOptions, err := cfg.buildOptions() // build-specific options from the finalized cfg
 	if err != nil {
 		return
 	}
@@ -226,6 +225,10 @@ type buildConfig struct {
 	// image name derivation based on registry and function name)
 	Image string
 
+	// BaseImage is an image to build a function upon (host builder only)
+	// TODO: gauron99 -- make option to add a path to dockerfile ?
+	BaseImage string
+
 	// Path of the function implementation on local disk. Defaults to current
 	// working directory of the process.
 	Path string
@@ -263,6 +266,7 @@ func newBuildConfig() buildConfig {
 			RegistryInsecure: viper.GetBool("registry-insecure"),
 		},
 		BuilderImage:  viper.GetString("builder-image"),
+		BaseImage:     viper.GetString("base-image"),
 		Image:         viper.GetString("image"),
 		Path:          viper.GetString("path"),
 		Platform:      viper.GetString("platform"),
@@ -284,6 +288,7 @@ func (c buildConfig) Configure(f fn.Function) fn.Function {
 		f.Build.BuilderImages[f.Build.Builder] = c.BuilderImage
 	}
 	f.Image = c.Image
+	f.Build.BaseImage = c.BaseImage
 	// Path, Platform and Push are not part of a function's state.
 	return f
 }
@@ -359,10 +364,14 @@ func (c buildConfig) Validate() (err error) {
 
 	// Platform is only supported with the S2I builder at this time
 	if c.Platform != "" && c.Builder != builders.S2I {
-		err = errors.New("Only S2I builds currently support specifying platform")
+		err = errors.New("only S2I builds currently support specifying platform")
 		return
 	}
 
+	// BaseImage is only supported with the host builder
+	if c.BaseImage != "" && c.Builder != "host" {
+		err = errors.New("only host builds support specifying the base image")
+	}
 	return
 }
 
@@ -383,22 +392,23 @@ func (c buildConfig) Validate() (err error) {
 // deployment is not the contiainer, but rather the running service.
 func (c buildConfig) clientOptions() ([]fn.Option, error) {
 	o := []fn.Option{fn.WithRegistry(c.Registry)}
-	if c.Builder == builders.Host {
+	switch c.Builder {
+	case builders.Host:
 		o = append(o,
 			fn.WithBuilder(oci.NewBuilder(builders.Host, c.Verbose)),
 			fn.WithPusher(oci.NewPusher(c.RegistryInsecure, false, c.Verbose)))
-	} else if c.Builder == builders.Pack {
+	case builders.Pack:
 		o = append(o,
 			fn.WithBuilder(pack.NewBuilder(
 				pack.WithName(builders.Pack),
 				pack.WithTimestamp(c.WithTimestamp),
 				pack.WithVerbose(c.Verbose))))
-	} else if c.Builder == builders.S2I {
+	case builders.S2I:
 		o = append(o,
 			fn.WithBuilder(s2i.NewBuilder(
 				s2i.WithName(builders.S2I),
 				s2i.WithVerbose(c.Verbose))))
-	} else {
+	default:
 		return o, builders.ErrUnknownBuilder{Name: c.Builder, Known: KnownBuilders()}
 	}
 	return o, nil

cmd/build_test.go

@@ -95,6 +95,12 @@ func TestBuild_Authentication(t *testing.T) {
 	testAuthentication(NewBuildCmd, t)
 }
 
+// TestBuild_BaseImage ensures that base image is used only with the right
+// builders and propagates into f.Build.BaseImage
+func TestBuild_BaseImage(t *testing.T) {
+	testBaseImage(NewBuildCmd, t)
+}
+
 // TestBuild_Push ensures that the build command properly pushes and respects
 // the --push flag.
 // - Push triggered after a successful build

cmd/config.go

@@ -111,33 +111,36 @@ func runConfigCmd(cmd *cobra.Command, args []string) (err error) {
 
 	switch answers.SelectedOperation {
 	case "Add":
-		if answers.SelectedConfig == "Volumes" {
+		switch answers.SelectedConfig {
+		case "Volumes":
 			err = runAddVolumesPrompt(cmd.Context(), function)
-		} else if answers.SelectedConfig == "Environment variables" {
+		case "Environment variables":
 			err = runAddEnvsPrompt(cmd.Context(), function)
-		} else if answers.SelectedConfig == "Labels" {
+		case "Labels":
 			err = runAddLabelsPrompt(cmd.Context(), function, defaultLoaderSaver)
-		} else if answers.SelectedConfig == "Git" {
+		case "Git":
 			err = runConfigGitSetCmd(cmd, NewClient)
 		}
 	case "Remove":
-		if answers.SelectedConfig == "Volumes" {
+		switch answers.SelectedConfig {
+		case "Volumes":
 			err = runRemoveVolumesPrompt(function)
-		} else if answers.SelectedConfig == "Environment variables" {
+		case "Environment variables":
 			err = runRemoveEnvsPrompt(function)
-		} else if answers.SelectedConfig == "Labels" {
+		case "Labels":
 			err = runRemoveLabelsPrompt(function, defaultLoaderSaver)
-		} else if answers.SelectedConfig == "Git" {
+		case "Git":
 			err = runConfigGitRemoveCmd(cmd, NewClient)
 		}
 	case "List":
-		if answers.SelectedConfig == "Volumes" {
+		switch answers.SelectedConfig {
+		case "Volumes":
 			listVolumes(function)
-		} else if answers.SelectedConfig == "Environment variables" {
+		case "Environment variables":
 			err = listEnvs(function, cmd.OutOrStdout(), Human)
-		} else if answers.SelectedConfig == "Labels" {
-			listLabels(function)
-		} else if answers.SelectedConfig == "Git" {
+		case "Labels":
+			err = listLabels(function, cmd.OutOrStdout(), Human)
+		case "Git":
 			err = runConfigGitCmd(cmd, NewClient)
 		}
 	}

cmd/config_envs.go

@@ -48,7 +48,7 @@ the current directory or from the directory specified with --path.
 	cmd.Flags().StringP("output", "o", "human", "Output format (human|json) ($FUNC_OUTPUT)")
 
 	configEnvsAddCmd := NewConfigEnvsAddCmd(loadSaver)
-	configEnvsRemoveCmd := NewConfigEnvsRemoveCmd()
+	configEnvsRemoveCmd := NewConfigEnvsRemoveCmd(loadSaver)
 
 	addPathFlag(cmd)
 	addPathFlag(configEnvsAddCmd)
@@ -139,8 +139,8 @@ set environment variable from a secret
 	return cmd
 }
 
-func NewConfigEnvsRemoveCmd() *cobra.Command {
-	return &cobra.Command{
+func NewConfigEnvsRemoveCmd(loadSaver functionLoaderSaver) *cobra.Command {
+	cmd := &cobra.Command{
 		Use:   "remove",
 		Short: "Remove environment variable from the function configuration",
 		Long: `Remove environment variable from the function configuration
@@ -150,17 +150,40 @@ in the current directory or from the directory specified with --path.
 `,
 		Aliases:    []string{"rm"},
 		SuggestFor: []string{"del", "delete", "rmeove"},
-		PreRunE:    bindEnv("path", "verbose"),
+		PreRunE:    bindEnv("path", "name", "verbose"),
 		RunE: func(cmd *cobra.Command, args []string) (err error) {
-			function, err := initConfigCommand(defaultLoaderSaver)
+			function, err := initConfigCommand(loadSaver)
 			if err != nil {
 				return
 			}
 
+			var name string
+			if cmd.Flags().Changed("name") {
+				s, e := cmd.Flags().GetString("name")
+				if e != nil {
+					return e
+				}
+				name = s
+			}
+
+			if name != "" {
+				envs := []fn.Env{}
+				for _, v := range function.Run.Envs {
+					if *v.Name != name {
+						envs = append(envs, v)
+					}
+				}
+				function.Run.Envs = envs
+				return loadSaver.Save(function)
+			}
+
 			return runRemoveEnvsPrompt(function)
 		},
 	}
 
+	cmd.Flags().StringP("name", "", "", "Name of the environment variable.")
+	return cmd
+
 }
 
 func listEnvs(f fn.Function, w io.Writer, outputFormat Format) error {

cmd/config_labels.go

@@ -2,10 +2,13 @@ package cmd
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
+	"io"
 	"os"
 
 	"github.com/AlecAivazis/survey/v2"
+	"github.com/ory/viper"
 	"github.com/spf13/cobra"
 
 	"knative.dev/func/pkg/config"
@@ -24,16 +27,14 @@ the current directory or from the directory specified with --path.
 `,
 		Aliases:    []string{"label"},
 		SuggestFor: []string{"albels", "abels"},
-		PreRunE:    bindEnv("path", "verbose"),
+		PreRunE:    bindEnv("path", "output", "verbose"),
 		RunE: func(cmd *cobra.Command, args []string) (err error) {
 			function, err := initConfigCommand(loaderSaver)
 			if err != nil {
 				return
 			}
 
-			listLabels(function)
-
-			return
+			return listLabels(function, cmd.OutOrStdout(), Format(viper.GetString("output")))
 		},
 	}
 
@@ -42,20 +43,54 @@ the current directory or from the directory specified with --path.
 		Short: "Add labels to the function configuration",
 		Long: `Add labels to the function configuration
 
-Interactive prompt to add labels to the function project in the current
-directory or from the directory specified with --path.
+If label is not set explicitly by flag, interactive prompt is used.
 
 The label can be set directly from a value or from an environment variable on
 the local machine.
 `,
+		Example: `# set label directly
+{{rootCmdUse}} config labels add --name=Foo --value=Bar
+
+# set label from local env $FOO
+{{rootCmdUse}} config labels add --name=Foo --value='{{"{{"}} env:FOO {{"}}"}}'`,
 		SuggestFor: []string{"ad", "create", "insert", "append"},
-		PreRunE:    bindEnv("path", "verbose"),
+		PreRunE:    bindEnv("path", "name", "value", "verbose"),
 		RunE: func(cmd *cobra.Command, args []string) (err error) {
 			function, err := initConfigCommand(loaderSaver)
 			if err != nil {
 				return
 			}
 
+			var np *string
+			var vp *string
+
+			if cmd.Flags().Changed("name") {
+				s, e := cmd.Flags().GetString("name")
+				if e != nil {
+					return e
+				}
+				np = &s
+			}
+			if cmd.Flags().Changed("value") {
+				s, e := cmd.Flags().GetString("value")
+				if e != nil {
+					return e
+				}
+				vp = &s
+			}
+
+			if np != nil && vp != nil {
+				if err := utils.ValidateLabelKey(*np); err != nil {
+					return err
+				}
+				if err := utils.ValidateLabelValue(*vp); err != nil {
+					return err
+				}
+
+				function.Deploy.Labels = append(function.Deploy.Labels, fn.Label{Key: np, Value: vp})
+				return loaderSaver.Save(function)
+			}
+
 			return runAddLabelsPrompt(cmd.Context(), function, loaderSaver)
 		},
 	}
@@ -70,13 +105,33 @@ directory or from the directory specified with --path.
 `,
 		Aliases:    []string{"rm"},
 		SuggestFor: []string{"del", "delete", "rmeove"},
-		PreRunE:    bindEnv("path", "verbose"),
+		PreRunE:    bindEnv("path", "name", "verbose"),
 		RunE: func(cmd *cobra.Command, args []string) (err error) {
 			function, err := initConfigCommand(loaderSaver)
 			if err != nil {
 				return
 			}
 
+			var name string
+			if cmd.Flags().Changed("name") {
+				s, e := cmd.Flags().GetString("name")
+				if e != nil {
+					return e
+				}
+				name = s
+			}
+
+			if name != "" {
+				labels := []fn.Label{}
+				for _, v := range function.Deploy.Labels {
+					if v.Key == nil || *v.Key != name {
+						labels = append(labels, v)
+					}
+				}
+				function.Deploy.Labels = labels
+				return loaderSaver.Save(function)
+			}
+
 			return runRemoveLabelsPrompt(function, loaderSaver)
 		},
 	}
@@ -86,6 +141,12 @@ directory or from the directory specified with --path.
 		fmt.Fprintf(configLabelsCmd.OutOrStdout(), "error loading config at '%v'. %v\n", config.File(), err)
 	}
 
+	// Add flags
+	configLabelsCmd.Flags().StringP("output", "o", "human", "Output format (human|json)")
+	configLabelsAddCmd.Flags().StringP("name", "", "", "Name of the label.")
+	configLabelsAddCmd.Flags().StringP("value", "", "", "Value of the label.")
+	configLabelsRemoveCmd.Flags().StringP("name", "", "", "Name of the label.")
+
 	addPathFlag(configLabelsCmd)
 	addPathFlag(configLabelsAddCmd)
 	addPathFlag(configLabelsRemoveCmd)
@@ -99,15 +160,27 @@ directory or from the directory specified with --path.
 	return configLabelsCmd
 }
 
-func listLabels(f fn.Function) {
-	if len(f.Deploy.Labels) == 0 {
-		fmt.Println("There aren't any configured labels")
-		return
-	}
+func listLabels(f fn.Function, w io.Writer, outputFormat Format) error {
+	switch outputFormat {
+	case Human:
+		if len(f.Deploy.Labels) == 0 {
+			_, err := fmt.Fprintln(w, "No labels defined")
+			return err
+		}
 
-	fmt.Println("Configured labels:")
-	for _, e := range f.Deploy.Labels {
-		fmt.Println(" - ", e.String())
+		fmt.Fprintln(w, "Labels:")
+		for _, e := range f.Deploy.Labels {
+			_, err := fmt.Fprintln(w, " - ", e.String())
+			if err != nil {
+				return err
+			}
+		}
+		return nil
+	case JSON:
+		enc := json.NewEncoder(w)
+		return enc.Encode(f.Deploy.Labels)
+	default:
+		return fmt.Errorf("invalid format: %v", outputFormat)
 	}
 }
 

cmd/config_labels_test.go

@@ -172,9 +172,9 @@ func TestListLabels(t *testing.T) {
 	}()
 
 	expected := []string{
-		`Configured labels:`,
-		`-  Label with key "a" and value "b"`,
-		`-  Label with key "c" and value "d"`,
+		`Labels:`,
+		` -  Label with key "a" and value "b"`,
+		` -  Label with key "c" and value "d"`,
 	}
 
 	// prevents the ExpectString() function from waiting indefinitely

cmd/config_volumes.go

@@ -66,19 +66,49 @@ func NewConfigVolumesAddCmd() *cobra.Command {
 
 Interactive prompt to add Secrets and ConfigMaps as Volume mounts to the function project
 in the current directory or from the directory specified with --path.
+
+For non-interactive usage, use flags to specify the volume type and configuration.
 `,
+		Example: `# Add a ConfigMap volume
+{{rootCmdUse}} config volumes add --type=configmap --source=my-config --path=/etc/config
+
+# Add a Secret volume
+{{rootCmdUse}} config volumes add --type=secret --source=my-secret --path=/etc/secret
+
+# Add a PersistentVolumeClaim volume
+{{rootCmdUse}} config volumes add --type=pvc --source=my-pvc --path=/data
+{{rootCmdUse}} config volumes add --type=pvc --source=my-pvc --path=/data --read-only
+
+# Add an EmptyDir volume
+{{rootCmdUse}} config volumes add --type=emptydir --path=/tmp/cache
+{{rootCmdUse}} config volumes add --type=emptydir --path=/tmp/cache --size=1Gi --medium=Memory`,
 		SuggestFor: []string{"ad", "create", "insert", "append"},
-		PreRunE:    bindEnv("path", "verbose"),
+		PreRunE:    bindEnv("path", "verbose", "type", "source", "mount-path", "read-only", "size", "medium"),
 		RunE: func(cmd *cobra.Command, args []string) (err error) {
 			function, err := initConfigCommand(defaultLoaderSaver)
 			if err != nil {
 				return
 			}
 
+			// Check if flags are provided for non-interactive mode
+			volumeType, _ := cmd.Flags().GetString("type")
+			if volumeType != "" {
+				return runAddVolume(cmd, function)
+			}
+
+			// Fall back to interactive mode
 			return runAddVolumesPrompt(cmd.Context(), function)
 		},
 	}
 
+	// Add flags for non-interactive mode
+	cmd.Flags().StringP("type", "t", "", "Volume type: configmap, secret, pvc, or emptydir")
+	cmd.Flags().StringP("source", "s", "", "Name of the ConfigMap, Secret, or PVC to mount (not used for emptydir)")
+	cmd.Flags().StringP("mount-path", "m", "", "Path where the volume should be mounted in the container")
+	cmd.Flags().BoolP("read-only", "r", false, "Mount volume as read-only (only for PVC)")
+	cmd.Flags().StringP("size", "", "", "Maximum size limit for EmptyDir volume (e.g., 1Gi)")
+	cmd.Flags().StringP("medium", "", "", "Storage medium for EmptyDir volume: 'Memory' or '' (default)")
+
 	return cmd
 }
 
@@ -90,20 +120,34 @@ func NewConfigVolumesRemoveCmd() *cobra.Command {
 
 Interactive prompt to remove Volume mounts from the function project
 in the current directory or from the directory specified with --path.
+
+For non-interactive usage, use the --mount-path flag to specify which volume to remove.
 `,
+		Example: `# Remove a volume by its mount path
+{{rootCmdUse}} config volumes remove --mount-path=/etc/config`,
 		Aliases:    []string{"rm"},
 		SuggestFor: []string{"del", "delete", "rmeove"},
-		PreRunE:    bindEnv("path", "verbose"),
+		PreRunE:    bindEnv("path", "verbose", "mount-path"),
 		RunE: func(cmd *cobra.Command, args []string) (err error) {
 			function, err := initConfigCommand(defaultLoaderSaver)
 			if err != nil {
 				return
 			}
 
+			// Check if mount-path flag is provided for non-interactive mode
+			mountPath, _ := cmd.Flags().GetString("mount-path")
+			if mountPath != "" {
+				return runRemoveVolume(cmd, function, mountPath)
+			}
+
+			// Fall back to interactive mode
 			return runRemoveVolumesPrompt(function)
 		},
 	}
 
+	// Add flag for non-interactive mode
+	cmd.Flags().StringP("mount-path", "m", "", "Path of the volume mount to remove")
+
 	return cmd
 }
 
@@ -286,3 +330,104 @@ func runRemoveVolumesPrompt(f fn.Function) (err error) {
 
 	return
 }
+
+// runAddVolume handles adding volumes using command line flags
+func runAddVolume(cmd *cobra.Command, f fn.Function) error {
+	var (
+		volumeType, _ = cmd.Flags().GetString("type")
+		source, _     = cmd.Flags().GetString("source")
+		mountPath, _  = cmd.Flags().GetString("mount-path")
+		readOnly, _   = cmd.Flags().GetBool("read-only")
+		sizeLimit, _  = cmd.Flags().GetString("size")
+		medium, _     = cmd.Flags().GetString("medium")
+	)
+
+	// Validate mount path
+	if mountPath == "" {
+		return fmt.Errorf("--mount-path is required")
+	}
+	if !strings.HasPrefix(mountPath, "/") {
+		return fmt.Errorf("mount path must be an absolute path (start with /)")
+	}
+
+	// Create the volume based on type
+	newVolume := fn.Volume{Path: &mountPath}
+
+	// All volumeTypes except emptydir require a source
+	if volumeType != "emptydir" && source == "" {
+		return fmt.Errorf("--source is required for %s volumes", volumeType)
+	}
+
+	switch volumeType {
+	case "configmap":
+		newVolume.ConfigMap = &source
+	case "secret":
+		newVolume.Secret = &source
+	case "pvc":
+		newVolume.PersistentVolumeClaim = &fn.PersistentVolumeClaim{
+			ClaimName: &source,
+			ReadOnly:  readOnly,
+		}
+		if readOnly {
+			fmt.Fprintf(cmd.OutOrStderr(), "PersistentVolumeClaim will be mounted as read-only")
+		}
+		fmt.Fprintf(cmd.OutOrStderr(), "Please ensure the PersistentVolumeClaim extension flag is enabled:\nhttps://knative.dev/docs/serving/configuration/feature-flags/\n")
+	case "emptydir":
+		emptyDir := &fn.EmptyDir{}
+		if sizeLimit != "" {
+			emptyDir.SizeLimit = &sizeLimit
+		}
+		if medium != "" {
+			if medium != fn.StorageMediumMemory && medium != fn.StorageMediumDefault {
+				return fmt.Errorf("invalid medium: must be 'Memory' or empty")
+			}
+			emptyDir.Medium = medium
+		}
+		newVolume.EmptyDir = emptyDir
+		fmt.Fprintf(cmd.OutOrStderr(), "Please make sure to enable the EmptyDir extension flag:\nhttps://knative.dev/docs/serving/configuration/feature-flags/\n")
+
+	default:
+		return fmt.Errorf("invalid volume type: %s (must be one of: configmap, secret, pvc, emptydir)", volumeType)
+	}
+
+	// Add the volume to the function
+	f.Run.Volumes = append(f.Run.Volumes, newVolume)
+
+	// Save the function
+	err := f.Write()
+	if err == nil {
+		fmt.Printf("Volume entry was added to the function configuration\n")
+		fmt.Printf("Added: %s\n", newVolume.String())
+	}
+	return err
+}
+
+// runRemoveVolume handles removing volumes by mount path
+func runRemoveVolume(cmd *cobra.Command, f fn.Function, mountPath string) error {
+	if !strings.HasPrefix(mountPath, "/") {
+		return fmt.Errorf("mount path must be an absolute path (start with /)")
+	}
+
+	// Find and remove the volume with the specified path
+	var newVolumes []fn.Volume
+	removed := false
+	for _, v := range f.Run.Volumes {
+		if v.Path != nil && *v.Path == mountPath {
+			removed = true
+		} else {
+			newVolumes = append(newVolumes, v)
+		}
+	}
+
+	if !removed {
+		return fmt.Errorf("no volume found with mount path: %s", mountPath)
+	}
+
+	f.Run.Volumes = newVolumes
+	err := f.Write()
+	if err == nil {
+		fmt.Fprintf(cmd.OutOrStderr(), "Volume entry was removed from the function configuration\n")
+		fmt.Fprintf(cmd.OutOrStderr(), "Removed volume at path: %s\n", mountPath)
+	}
+	return err
+}

cmd/create.go

@@ -534,7 +534,7 @@ func newHelpTemplate(cmd *cobra.Command) *template.Template {
 	fm := template.FuncMap{
 		"indent": func(i int, c string, v string) string {
 			indentation := strings.Repeat(c, i)
-			return indentation + strings.Replace(v, "\n", "\n"+indentation, -1)
+			return indentation + strings.ReplaceAll(v, "\n", "\n"+indentation)
 		},
 	}
 	t.Funcs(fm)

cmd/delete.go

@@ -105,7 +105,7 @@ func newDeleteConfig(cmd *cobra.Command, args []string) (cfg deleteConfig, err e
 		// logicially inconsistent to supply only a namespace.
 		// Either use the function's local state in its entirety, or specify
 		// both a name and a namespace to ignore any local function source.
-		err = fmt.Errorf("must also specify a name when specifying namespace.")
+		err = fmt.Errorf("must also specify a name when specifying namespace")
 	}
 	if cfg.Name != "" && cmd.Flags().Changed("path") {
 		// logically inconsistent to provide both a name and a path to source.

cmd/deploy.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"os/exec"
 	"strconv"
 	"strings"
 
@@ -35,7 +36,7 @@ SYNOPSIS
 	             [-b|--build] [--builder] [--builder-image] [-p|--push]
 	             [--domain] [--platform] [--build-timestamp] [--pvc-size]
 	             [--service-account] [-c|--confirm] [-v|--verbose]
-	             [--registry-insecure]
+	             [--registry-insecure] [--remote-storage-class]
 
 DESCRIPTION
 
@@ -127,7 +128,11 @@ EXAMPLES
 
 `,
 		SuggestFor: []string{"delpoy", "deplyo"},
-		PreRunE:    bindEnv("build", "build-timestamp", "builder", "builder-image", "confirm", "domain", "env", "git-branch", "git-dir", "git-url", "image", "namespace", "path", "platform", "push", "pvc-size", "service-account", "registry", "registry-insecure", "remote", "username", "password", "token", "verbose"),
+		PreRunE: bindEnv("build", "build-timestamp", "builder", "builder-image",
+			"base-image", "confirm", "domain", "env", "git-branch", "git-dir",
+			"git-url", "image", "namespace", "path", "platform", "push", "pvc-size",
+			"service-account", "registry", "registry-insecure", "remote",
+			"username", "password", "token", "verbose", "remote-storage-class"),
 		RunE: func(cmd *cobra.Command, args []string) error {
 			return runDeploy(cmd, newClient)
 		},
@@ -162,6 +167,8 @@ EXAMPLES
 	builderImage := f.Build.BuilderImages[f.Build.Builder]
 	cmd.Flags().String("builder-image", builderImage,
 		"Specify a custom builder image for use by the builder other than its default. ($FUNC_BUILDER_IMAGE)")
+	cmd.Flags().StringP("base-image", "", f.Build.BaseImage,
+		"Override the base image for your function (host builder only)")
 	cmd.Flags().StringP("image", "i", f.Image,
 		"Full image name in the form [registry]/[namespace]/[name]:[tag]@[digest]. This option takes precedence over --registry. Specifying digest is optional, but if it is given, 'build' and 'push' phases are disabled. ($FUNC_IMAGE)")
 
@@ -179,6 +186,8 @@ EXAMPLES
 		"Directory in the Git repository containing the function (default is the root) ($FUNC_GIT_DIR)")
 	cmd.Flags().BoolP("remote", "R", f.Local.Remote,
 		"Trigger a remote deployment. Default is to deploy and build from the local system ($FUNC_REMOTE)")
+	cmd.Flags().StringP("remote-storage-class", "", f.Build.RemoteStorageClass,
+		"Specify a storage class to use for the volume on-cluster during remote builds")
 	cmd.Flags().String("pvc-size", f.Build.PVCSize,
 		"When triggering a remote deployment, set a custom volume size to allocate for the build operation ($FUNC_PVC_SIZE)")
 	cmd.Flags().String("service-account", f.Deploy.ServiceAccountName,
@@ -205,10 +214,7 @@ EXAMPLES
 
 	// Temporarily Hidden Basic Auth Flags
 	// Username, Password and Token flags, which plumb through basic auth, are
-	// currently only available on the experimental "host" builder, which is
-	// itself behind a feature flag FUNC_ENABLE_HOST_BUILDER.  So set these
-	// flags to hidden until it's out of preview and they are plumbed through
-	// the docker pusher as well.
+	// currently only available on "host" builder.
 	_ = cmd.Flags().MarkHidden("username")
 	_ = cmd.Flags().MarkHidden("password")
 	_ = cmd.Flags().MarkHidden("token")
@@ -244,14 +250,24 @@ func runDeploy(cmd *cobra.Command, newClient ClientFactory) (err error) {
 	if f, err = fn.NewFunction(cfg.Path); err != nil {
 		return
 	}
-	if !f.Initialized() {
-		return fn.NewErrNotInitialized(f.Root)
-	}
 	if f, err = cfg.Configure(f); err != nil { // Updates f with deploy cfg
 		return
 	}
 	cmd.SetContext(cfg.WithValues(cmd.Context())) // Some optional settings are passed via context
 
+	if !f.Initialized() {
+		if !cfg.Remote || f.Build.Git.URL == "" {
+			// Only error if this is not a fully remote build
+			return fn.NewErrNotInitialized(f.Root)
+		} else {
+			// TODO: this case is not supported because the pipeline
+			// implementation requires the function's name, which is in the
+			// remote repository.  We should inspect the remote repository.
+			// For now, give a more helpful error.
+			return errors.New("please ensure the function's source is also available locally")
+		}
+	}
+
 	changingNamespace := func(f fn.Function) bool {
 		// We're changing namespace if:
 		return f.Deploy.Namespace != "" && // it's already deployed
@@ -380,7 +396,7 @@ func build(cmd *cobra.Command, flag string, f fn.Function, client *fn.Client, bu
 			return f, false, err
 		}
 	} else if _, err = strconv.ParseBool(flag); err != nil {
-		return f, false, fmt.Errorf("--build ($FUNC_BUILD) %q not recognized.  Should be 'auto' or a truthy value such as 'true', 'false', '0', or '1'.", flag)
+		return f, false, fmt.Errorf("invalid value for the build flag (%q), valid value is either 'auto' or a boolean", flag)
 	} else if !build {
 		return f, false, nil
 	}
@@ -431,18 +447,7 @@ func KnownBuilders() builders.Known {
 	// However, future third-party integrations may support less than, or more
 	// builders, and certain environmental considerations may alter this list.
 
-	// Also a good place to stick feature-flags; to wit:
-	enable_host, _ := strconv.ParseBool(os.Getenv("FUNC_ENABLE_HOST_BUILDER"))
-	if !enable_host {
-		bb := []string{}
-		for _, b := range builders.All() {
-			if b != builders.Host {
-				bb = append(bb, b)
-			}
-		}
-		return bb
-	}
-
+	// Also a good place to stick feature-flags.
 	return builders.All()
 }
 
@@ -517,6 +522,10 @@ type deployConfig struct {
 	// be triggered in a remote environment rather than run locally.
 	Remote bool
 
+	// RemoteStorageClass defines the storage class to use for the remote
+	// volume when building on-cluster.
+	RemoteStorageClass string
+
 	// PVCSize configures the PVC size used by the pipeline if --remote flag is set.
 	PVCSize string
 
@@ -538,6 +547,7 @@ func newDeployConfig(cmd *cobra.Command) deployConfig {
 		GitURL:             viper.GetString("git-url"),
 		Namespace:          viper.GetString("namespace"),
 		Remote:             viper.GetBool("remote"),
+		RemoteStorageClass: viper.GetString("remote-storage-class"),
 		PVCSize:            viper.GetString("pvc-size"),
 		Timestamp:          viper.GetBool("build-timestamp"),
 		ServiceAccountName: viper.GetString("service-account"),
@@ -573,6 +583,7 @@ func (c deployConfig) Configure(f fn.Function) (fn.Function, error) {
 	f.Build.Git.URL = c.GitURL
 	f.Build.Git.ContextDir = c.GitDir
 	f.Build.Git.Revision = c.GitBranch // TODO: should match; perhaps "refSpec"
+	f.Build.RemoteStorageClass = c.RemoteStorageClass
 	f.Deploy.ServiceAccountName = c.ServiceAccountName
 	f.Local.Remote = c.Remote
 
@@ -784,6 +795,36 @@ func printDeployMessages(out io.Writer, f fn.Function) {
 	if !f.Local.Remote && (f.Build.Git.URL != "" || f.Build.Git.Revision != "" || f.Build.Git.ContextDir != "") {
 		fmt.Fprintf(out, "Warning: git settings are only applicable when running with --remote.  Local source code will be used.")
 	}
+
+	// Git Branch Mismatch
+	// -------------------
+	// When doing a remote build with --git-branch, warn if the local branch
+	// doesn't match, as this can lead to confusion about which func.yaml is used.
+	if f.Local.Remote && f.Build.Git.URL != "" && f.Build.Git.Revision != "" {
+		// Doing a remote build, specified a git repository to pull from, and
+		// specified a reference within that remote.
+		currentBranch, err := getCurrentGitBranch()
+		if err != nil {
+			fmt.Fprintf(out, "Warning: unable to verify local and remote references match. %v\n", err)
+		} else if currentBranch != f.Build.Git.Revision {
+			fmt.Fprintf(out, "Warning: Local git branch '%s' does not match --git-branch '%s'. The local func.yaml will be used for function metadata (name, runtime, etc). Ensure your local branch matches the remote branch to avoid deployment issues.\n", currentBranch, f.Build.Git.Revision)
+		}
+	}
+}
+
+// getCurrentGitBranch returns the current git branch name
+func getCurrentGitBranch() (string, error) {
+	gitCmd := os.Getenv("FUNC_GIT")
+	if gitCmd == "" {
+		gitCmd = "git"
+	}
+
+	cmd := exec.Command(gitCmd, "rev-parse", "--abbrev-ref", "HEAD")
+	output, err := cmd.Output()
+	if err != nil {
+		return "", err
+	}
+	return strings.TrimSpace(string(output)), nil
 }
 
 // isDigested checks that the given image reference has a digest. Invalid

cmd/deploy_test.go

@@ -842,7 +842,7 @@ func TestDeploy_ImageWithDigestErrors(t *testing.T) {
 func TestDeploy_ImageWithDigestDoesntPopulateBuild(t *testing.T) {
 	root := FromTempDirectory(t)
 	// image with digest (well almost, atleast in length and syntax)
-	const img = "docker.io/4141gauron3268@sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
+	const img = "example.com/username@sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
 	// Create a new Function in the temp directory
 	_, err := fn.New().Init(fn.Function{Runtime: "go", Root: root})
 	if err != nil {
@@ -1531,7 +1531,6 @@ func testAuthentication(cmdFn commandConstructor, t *testing.T) {
 	}
 
 	cmd := cmdFn(NewTestClient(fn.WithPusher(pusher)))
-	t.Setenv("FUNC_ENABLE_HOST_BUILDER", "true") // host builder is currently behind this feature flag
 	cmd.SetArgs([]string{"--builder", "host", "--username", testUser, "--password", testPass})
 	if err := cmd.Execute(); err != nil {
 		t.Fatal(err)
@@ -2171,3 +2170,75 @@ func Test_isDigested(t *testing.T) {
 		t.Fatal("did not report image reference has digest")
 	}
 }
+
+func TestDeploy_BaseImage(t *testing.T) {
+	testBaseImage(NewDeployCmd, t)
+}
+
+func testBaseImage(cmdFn commandConstructor, t *testing.T) {
+	const baseImage = "example.com/repo/baseImage"
+	tests := []struct {
+		name    string
+		runtime string
+		builder string
+		expErr  bool
+	}{
+		{
+			name:    "should-succeed: python-runtime with host-builder",
+			runtime: "python",
+			builder: "host",
+		},
+		{
+			name:    "should-succeed: go-runtime with host-builder",
+			runtime: "go",
+			builder: "host",
+		},
+		{
+			name:    "should-fail: python-runtime with pack-builder",
+			runtime: "python",
+			builder: "pack",
+			expErr:  true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			root := FromTempDirectory(t)
+
+			// func init
+			f := fn.Function{Runtime: tt.runtime, Root: root}
+			_, err := fn.New().Init(f)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			//create cmd
+			cmd := cmdFn(NewTestClient(
+				fn.WithBuilder(mock.NewBuilder()),
+				fn.WithDeployer(mock.NewDeployer()),
+				fn.WithRegistry(TestRegistry),
+			))
+
+			// create flags for cmd
+			args := []string{
+				fmt.Sprintf("--builder=%s", tt.builder),
+				fmt.Sprintf("--base-image=%s", baseImage),
+			}
+
+			cmd.SetArgs(args)
+			err = cmd.Execute()
+
+			// ASSERT
+
+			// got error but expected success
+			if err != nil && !tt.expErr {
+				err = fmt.Errorf("Expected the test to succeed but instead got: %w", err)
+				t.Fatal(err)
+			}
+
+			// succeeded but expected fail
+			if err == nil && tt.expErr {
+				t.Fatal(fmt.Errorf("Expected error but test succeeded"))
+			}
+		})
+	}
+}

cmd/describe.go

@@ -3,6 +3,7 @@ package cmd
 import (
 	"encoding/json"
 	"encoding/xml"
+	"errors"
 	"fmt"
 	"io"
 	"os"
@@ -81,6 +82,9 @@ func runDescribe(cmd *cobra.Command, args []string, newClient ClientFactory) (er
 		if err != nil {
 			return err
 		}
+		if !f.Initialized() {
+			return errors.New("function not found at this path and no name provided")
+		}
 		details, err = client.Describe(cmd.Context(), "", "", f)
 		if err != nil {
 			return err
@@ -118,7 +122,7 @@ func newDescribeConfig(cmd *cobra.Command, args []string) (cfg describeConfig, e
 		// logicially inconsistent to supply only a namespace.
 		// Either use the function's local state in its entirety, or specify
 		// both a name and a namespace to ignore any local function source.
-		err = fmt.Errorf("must also specify a name when specifying namespace.")
+		err = fmt.Errorf("must also specify a name when specifying namespace")
 	}
 	if cfg.Name != "" && cmd.Flags().Changed("path") {
 		// logically inconsistent to provide both a name and a path to source.
@@ -153,6 +157,13 @@ func (i info) Human(w io.Writer) error {
 			fmt.Fprintf(w, "  %v %v %v\n", s.Source, s.Type, s.Broker)
 		}
 	}
+
+	if len(i.Labels) > 0 {
+		fmt.Fprintln(w, "Labels:")
+		for k, v := range i.Labels {
+			fmt.Fprintf(w, "  %v: %v\n", k, v)
+		}
+	}
 	return nil
 }
 
@@ -170,6 +181,12 @@ func (i info) Plain(w io.Writer) error {
 			fmt.Fprintf(w, "Subscription %v %v %v\n", s.Source, s.Type, s.Broker)
 		}
 	}
+
+	if len(i.Labels) > 0 {
+		for k, v := range i.Labels {
+			fmt.Fprintf(w, "Label %v %v\n", k, v)
+		}
+	}
 	return nil
 }
 

cmd/describe_test.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"context"
+	"strings"
 	"testing"
 
 	fn "knative.dev/func/pkg/functions"
@@ -9,6 +10,58 @@ import (
 	. "knative.dev/func/pkg/testing"
 )
 
+// TestDescribe_Default ensures that running describe when there is no
+// function in the given directory fails correctly.
+func TestDescribe_Default(t *testing.T) {
+	_ = FromTempDirectory(t)
+	describer := mock.NewDescriber()
+
+	cmd := NewDescribeCmd(NewTestClient(fn.WithDescriber(describer)))
+	cmd.SetArgs([]string{})
+	err := cmd.Execute()
+
+	if err == nil {
+		t.Fatal("describing a nonexistent function should error")
+	}
+	if !strings.Contains(err.Error(), "function not found at this path and no name provided") {
+		t.Fatalf("Unexpected error text returned: %v", err)
+	}
+	if describer.DescribeInvoked {
+		t.Fatal("Describer incorrectly invoked")
+	}
+}
+
+// TestDescribe_Undeployed ensures that describing a function which exists,
+// but has not been deployed, does not error but rather delegates to the
+// deployer which will presumably describe it as being !deployed (See deployer
+// test suite)
+func TestDescribe_Undeployed(t *testing.T) {
+	root := FromTempDirectory(t)
+
+	client := fn.New()
+	_, err := client.Init(fn.Function{
+		Name:     "testfunc",
+		Runtime:  "go",
+		Registry: TestRegistry,
+		Root:     root,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	describer := mock.NewDescriber()
+
+	cmd := NewDescribeCmd(NewTestClient(fn.WithDescriber(describer)))
+	cmd.SetArgs([]string{})
+	if err := cmd.Execute(); err != nil {
+		t.Fatal(err)
+	}
+
+	if !describer.DescribeInvoked {
+		t.Fatal("Describer should have been invoked for any initialized function")
+	}
+}
+
 // TestDescribe_ByName ensures that describing a function by name invokes
 // the describer appropriately.
 func TestDescribe_ByName(t *testing.T) {

cmd/environment.go

@@ -16,6 +16,7 @@ import (
 	"knative.dev/func/pkg/config"
 	"knative.dev/func/pkg/functions"
 	"knative.dev/func/pkg/k8s"
+	"knative.dev/func/pkg/pipelines/tekton"
 )
 
 var format string = "json"
@@ -60,6 +61,10 @@ type Environment struct {
 	SpecVersion          string
 	SocatImage           string
 	TarImage             string
+	FuncUtilsImage       string
+	DeployerImage        string
+	ScaffoldImage        string
+	S2IImage             string
 	Languages            []string
 	DefaultImageBuilders map[string]map[string]string
 	Templates            map[string][]string
@@ -128,6 +133,10 @@ func runEnvironment(cmd *cobra.Command, newClient ClientFactory, v *Version) (er
 		SpecVersion:          functions.LastSpecVersion(),
 		SocatImage:           k8s.SocatImage,
 		TarImage:             k8s.TarImage,
+		FuncUtilsImage:       tekton.FuncUtilImage,
+		DeployerImage:        tekton.DeployerImage,
+		ScaffoldImage:        tekton.ScaffoldImage,
+		S2IImage:             tekton.S2IImage,
 		Languages:            r,
 		DefaultImageBuilders: builderimagesdefault,
 		Templates:            t,

cmd/format.go

@@ -44,7 +44,7 @@ func write(out io.Writer, s Formatter, formatName string) {
 	case URL:
 		err = s.URL(out)
 	default:
-		err = fmt.Errorf("format not recognized: %v\n", formatName)
+		err = fmt.Errorf("format not recognized: %v", formatName)
 	}
 	if err != nil {
 		panic(err)

cmd/func-util/main.go

@@ -10,8 +10,11 @@ import (
 	"os"
 	"os/signal"
 	"path/filepath"
+	"slices"
 	"syscall"
 
+	"golang.org/x/sys/unix"
+
 	"github.com/openshift/source-to-image/pkg/cmd/cli"
 	"k8s.io/klog/v2"
 
@@ -20,6 +23,7 @@ import (
 	"knative.dev/func/pkg/k8s"
 	"knative.dev/func/pkg/knative"
 	"knative.dev/func/pkg/scaffolding"
+	"knative.dev/func/pkg/tar"
 )
 
 func main() {
@@ -35,7 +39,7 @@ func main() {
 		os.Exit(137)
 	}()
 
-	var cmd func(context.Context) error = unknown
+	var cmd = unknown
 
 	switch filepath.Base(os.Args[0]) {
 	case "deploy":
@@ -46,6 +50,10 @@ func main() {
 		cmd = s2iCmd
 	case "socat":
 		cmd = socat
+	case "sh":
+		cmd = sh
+	case "s2i-generate":
+		cmd = s2iGenerate
 	}
 
 	err := cmd(ctx)
@@ -56,7 +64,7 @@ func main() {
 }
 
 func unknown(_ context.Context) error {
-	return fmt.Errorf("unknown command: " + os.Args[0])
+	return fmt.Errorf("unknown command: %q", os.Args[0])
 }
 
 func socat(ctx context.Context) error {
@@ -78,7 +86,7 @@ func scaffold(ctx context.Context) error {
 		return fmt.Errorf("cannot load func project: %w", err)
 	}
 
-	if f.Runtime != "go" {
+	if f.Runtime != "go" && f.Runtime != "python" {
 		// Scaffolding is for now supported/needed only for Go.
 		return nil
 	}
@@ -100,7 +108,17 @@ func scaffold(ctx context.Context) error {
 		return fmt.Errorf("unable to create .s2i bin dir. %w", err)
 	}
 
-	if err := os.WriteFile(filepath.Join(f.Root, ".s2i", "bin", "assemble"), []byte(s2i.GoAssembler), 0755); err != nil {
+	var asm string
+	switch f.Runtime {
+	case "go":
+		asm = s2i.GoAssembler
+	case "python":
+		asm = s2i.PythonAssembler
+	default:
+		panic("unreachable")
+	}
+
+	if err := os.WriteFile(filepath.Join(f.Root, ".s2i", "bin", "assemble"), []byte(asm), 0755); err != nil {
 		return fmt.Errorf("unable to write go assembler. %w", err)
 	}
 
@@ -167,3 +185,18 @@ func (d deployDecorator) UpdateLabels(function fn.Function, labels map[string]st
 	}
 	return labels
 }
+
+func sh(ctx context.Context) error {
+	if !slices.Equal(os.Args[1:], []string{"-c", "umask 0000 && exec tar -xmf -"}) {
+		return fmt.Errorf("this is a fake sh (only for backward compatiblility purposes)")
+	}
+
+	wd, err := os.Getwd()
+	if err != nil {
+		return fmt.Errorf("cannot get working directory: %w", err)
+	}
+
+	unix.Umask(0)
+
+	return tar.Extract(os.Stdin, wd)
+}

cmd/func-util/s2i_generate.go

@@ -0,0 +1,143 @@
+//go:build exclude_graphdriver_btrfs || !cgo
+// +build exclude_graphdriver_btrfs !cgo
+
+package main
+
+import (
+	"context"
+	"fmt"
+	"net/url"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/openshift/source-to-image/pkg/api"
+	"github.com/openshift/source-to-image/pkg/build"
+	"github.com/openshift/source-to-image/pkg/build/strategies"
+	"github.com/openshift/source-to-image/pkg/scm/git"
+	"github.com/spf13/cobra"
+
+	fn "knative.dev/func/pkg/functions"
+)
+
+func s2iGenerate(ctx context.Context) error {
+	cmd := newS2IGenerateCmd()
+	err := cmd.ExecuteContext(ctx)
+	if err != nil {
+		return fmt.Errorf("cannot s2i generate: %w", err)
+	}
+	return nil
+}
+
+type genConfig struct {
+	target         string
+	pathContext    string
+	builderImage   string
+	registry       string
+	imageScriptUrl string
+	logLevel       string
+	envVars        []string
+}
+
+func newS2IGenerateCmd() *cobra.Command {
+	var config genConfig
+
+	genCmd := &cobra.Command{
+		RunE: func(cmd *cobra.Command, args []string) error {
+			config.envVars = args
+			return runS2IGenerate(cmd.Context(), config)
+		},
+	}
+	genCmd.Flags().StringVar(&config.target, "target", "/gen-source", "")
+	genCmd.Flags().StringVar(&config.pathContext, "path-context", ".", "")
+	genCmd.Flags().StringVar(&config.builderImage, "builder-image", "", "")
+	genCmd.Flags().StringVar(&config.registry, "registry", "", "")
+	genCmd.Flags().StringVar(&config.imageScriptUrl, "image-script-url", "image:///usr/libexec/s2i", "")
+	genCmd.Flags().StringVar(&config.logLevel, "log-level", "0", "")
+
+	return genCmd
+}
+
+func runS2IGenerate(ctx context.Context, c genConfig) error {
+
+	wd, err := os.Getwd()
+	if err != nil {
+		return fmt.Errorf("cannot get working directory: %w", err)
+	}
+
+	funcRoot := filepath.Join(wd, c.pathContext)
+
+	// replace registry in func.yaml
+	f, err := fn.NewFunction(funcRoot)
+	if err != nil {
+		return fmt.Errorf("cannot load function: %w", err)
+	}
+	f.Registry = c.registry
+	err = f.Write()
+	if err != nil {
+		return fmt.Errorf("cannot write function: %w", err)
+	}
+
+	// append node_modules into .s2iignore
+	s2iIgnorePath := filepath.Join(funcRoot, ".s2iignore")
+	if fi, _ := os.Stat(s2iIgnorePath); fi != nil {
+		var file *os.File
+
+		file, err = os.OpenFile(s2iIgnorePath, os.O_APPEND|os.O_WRONLY, 0644)
+		if err != nil {
+			return fmt.Errorf("cannot open s2i ignore file for append: %w", err)
+		}
+		defer func(file *os.File) {
+			_ = file.Close()
+
+		}(file)
+
+		_, err = file.Write([]byte("\nnode_modules"))
+		if err != nil {
+			return fmt.Errorf("cannot append node_modules directory to s2i ignore file: %w", err)
+		}
+	}
+
+	// prepare envvars
+	var envs = make([]api.EnvironmentSpec, 0, len(c.envVars))
+	for _, e := range c.envVars {
+		var es api.EnvironmentSpec
+		part := strings.SplitN(e, "=", 2)
+		switch len(part) {
+		case 1:
+			es.Name = part[0]
+		case 2:
+			es.Name = part[0]
+			es.Value = part[1]
+		default:
+			continue
+		}
+		if es.Name != "" {
+			envs = append(envs, es)
+		}
+	}
+
+	s2iConfig := api.Config{
+		Source: &git.URL{
+			URL:  url.URL{Path: funcRoot},
+			Type: git.URLTypeLocal,
+		},
+		BuilderImage:    c.builderImage,
+		ImageScriptsURL: c.imageScriptUrl,
+		KeepSymlinks:    true,
+		Environment:     envs,
+		AsDockerfile:    filepath.Join(c.target, "Dockerfile.gen"),
+	}
+
+	builder, _, err := strategies.Strategy(nil, &s2iConfig, build.Overrides{})
+	if err != nil {
+		return fmt.Errorf("cannot create builder: %w", err)
+	}
+
+	_, err = builder.Build(&s2iConfig)
+	if err != nil {
+		return fmt.Errorf("cannot build: %w", err)
+	}
+
+	return nil
+}

cmd/invoke.go

@@ -1,7 +1,6 @@
 package cmd
 
 import (
-	"encoding/base64"
 	"fmt"
 	"os"
 	"strings"
@@ -173,7 +172,7 @@ func runInvoke(cmd *cobra.Command, _ []string, newClient ClientFactory) (err err
 		if err != nil {
 			return err
 		}
-		m.Data = base64.StdEncoding.EncodeToString(content)
+		m.Data = content
 	}
 
 	// Invoke
@@ -218,7 +217,7 @@ type invokeConfig struct {
 	ID          string
 	Source      string
 	Type        string
-	Data        string
+	Data        []byte
 	ContentType string
 	File        string
 	Confirm     bool
@@ -234,7 +233,7 @@ func newInvokeConfig() (cfg invokeConfig, err error) {
 		ID:          viper.GetString("id"),
 		Source:      viper.GetString("source"),
 		Type:        viper.GetString("type"),
-		Data:        viper.GetString("data"),
+		Data:        []byte(viper.GetString("data")),
 		ContentType: viper.GetString("content-type"),
 		File:        viper.GetString("file"),
 		Confirm:     viper.GetBool("confirm"),
@@ -248,7 +247,7 @@ func newInvokeConfig() (cfg invokeConfig, err error) {
 		if err != nil {
 			return cfg, err
 		}
-		cfg.Data = string(b)
+		cfg.Data = b
 	}
 
 	// if not in confirm/prompting mode, the cfg structure is complete.
@@ -369,7 +368,7 @@ func (c invokeConfig) prompt() (invokeConfig, error) {
 				Name: "Data",
 				Prompt: &survey.Input{
 					Message: "Data Content",
-					Default: c.Data,
+					Default: string(c.Data),
 				},
 			},
 		}
@@ -390,7 +389,8 @@ func (c invokeConfig) prompt() (invokeConfig, error) {
 				Message: contentTypeMessage,
 				Default: c.ContentType,
 			},
-		}}
+		},
+	}
 	if err := survey.Ask(qs, &c); err != nil {
 		return c, err
 	}
@@ -402,7 +402,8 @@ func (c invokeConfig) prompt() (invokeConfig, error) {
 				Message: "Allow insecure server connections when using SSL",
 				Default: c.Insecure,
 			},
-		}}
+		},
+	}
 	if err := survey.Ask(qs, &c); err != nil {
 		return c, err
 	}

cmd/invoke_test.go

@@ -30,7 +30,7 @@ func TestInvoke(t *testing.T) {
 	// Mock Runner
 	// Starts a service which sets invoked=1 on any request
 	runner := mock.NewRunner()
-	runner.RunFn = func(ctx context.Context, f fn.Function, _ time.Duration) (job *fn.Job, err error) {
+	runner.RunFn = func(ctx context.Context, f fn.Function, _ string, _ time.Duration) (job *fn.Job, err error) {
 		var (
 			l net.Listener
 			h = http.NewServeMux()

cmd/list.go

@@ -130,7 +130,7 @@ func newListConfig(cmd *cobra.Command) (cfg listConfig, err error) {
 
 	// specifying both -A and --namespace is logically inconsistent
 	if cmd.Flags().Changed("namespace") && viper.GetBool("all-namespaces") {
-		err = errors.New("Both --namespace and --all-namespaces specified.")
+		err = errors.New("both --namespace and --all-namespaces specified")
 	}
 
 	return

cmd/mcp.go

@@ -0,0 +1,46 @@
+package cmd
+
+import (
+	"log"
+
+	"github.com/spf13/cobra"
+	"knative.dev/func/pkg/mcp"
+)
+
+func NewMCPServerCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "mcp",
+		Short: "Start MCP server",
+		Long: `
+NAME
+	{{rootCmdUse}} mcp - start a Model Context Protocol (MCP) server
+
+SYNOPSIS
+	{{rootCmdUse}} mcp [flags]
+
+DESCRIPTION
+	Starts a Model Context Protocol (MCP) server over standard input/output (stdio) transport.
+	This implementation aims to support tools for deploying and creating serverless functions.
+	
+	Note: This command is still under development.
+
+EXAMPLES
+
+	o Run an MCP server:
+		{{rootCmdUse}} mcp
+`,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			return runMCPServer(cmd, args)
+		},
+	}
+	return cmd
+}
+
+func runMCPServer(cmd *cobra.Command, args []string) error {
+	s := mcp.NewServer()
+	if err := s.Start(); err != nil {
+		log.Fatalf("Server error: %v", err)
+		return err
+	}
+	return nil
+}

cmd/prompt/prompt.go

@@ -15,16 +15,15 @@ import (
 	"knative.dev/func/pkg/docker/creds"
 )
 
-func NewPromptForCredentials(in io.Reader, out, errOut io.Writer) func(registry string) (docker.Credentials, error) {
+func NewPromptForCredentials(in io.Reader, out, errOut io.Writer) func(repository string) (docker.Credentials, error) {
 	firstTime := true
-	return func(registry string) (docker.Credentials, error) {
+	return func(repository string) (docker.Credentials, error) {
 		var result docker.Credentials
-
 		if firstTime {
 			firstTime = false
-			fmt.Fprintf(out, "Please provide credentials for image registry (%s).\n", registry)
+			fmt.Fprintf(out, "Please provide credentials for image repository '%s'.\n", repository)
 		} else {
-			fmt.Fprintln(out, "Incorrect credentials, please try again.")
+			fmt.Fprintf(out, "Incorrect credentials for repository '%s'. Please make sure the repository is correct and try again.\n", repository)
 		}
 
 		var qs = []*survey.Question{

cmd/repository.go

@@ -529,7 +529,7 @@ func runRepositoryRemove(_ *cobra.Command, args []string, newClient ClientFactor
 	}
 
 	if len(repositories) == 0 {
-		return errors.New("No repositories installed. use 'add' to install")
+		return errors.New("no repositories installed. use 'add' to install")
 	}
 
 	// Confirm (interactive prompt mode)

cmd/root.go

@@ -107,6 +107,12 @@ Learn more about Knative at: https://knative.dev`, cfg.Name),
 				NewEnvironmentCmd(newClient, &cfg.Version),
 			},
 		},
+		{
+			Header: "MCP Commands:",
+			Commands: []*cobra.Command{
+				NewMCPServerCmd(),
+			},
+		},
 		{
 			Header: "Other Commands:",
 			Commands: []*cobra.Command{
@@ -303,7 +309,7 @@ func mergeEnvs(envs []fn.Env, envToUpdate *util.OrderedMap, envToRemove []string
 
 	errMsg := fn.ValidateEnvs(envs)
 	if len(errMsg) > 0 {
-		return []fn.Env{}, 0, fmt.Errorf(strings.Join(errMsg, "\n"))
+		return []fn.Env{}, 0, fmt.Errorf("error(s) while validating envs: %s", strings.Join(errMsg, "\n"))
 	}
 
 	return envs, counter, nil

cmd/run.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"context"
+	"encoding/json"
 	"errors"
 	"fmt"
 	"os"
@@ -14,6 +15,7 @@ import (
 	"knative.dev/func/pkg/config"
 	"knative.dev/func/pkg/docker"
 	fn "knative.dev/func/pkg/functions"
+	"knative.dev/func/pkg/oci"
 )
 
 func NewRunCmd(newClient ClientFactory) *cobra.Command {
@@ -27,7 +29,7 @@ NAME
 SYNOPSIS
 	{{rootCmdUse}} run [-t|--container] [-r|--registry] [-i|--image] [-e|--env]
 	             [--build] [-b|--builder] [--builder-image] [-c|--confirm]
-	             [-v|--verbose]
+	             [--address] [--json] [-v|--verbose]
 
 DESCRIPTION
 	Run the function locally.
@@ -38,9 +40,14 @@ DESCRIPTION
 	  The --container flag indicates that the function's container should be
 	  run rather than running the source code directly.  This may require that
 	  the function's container first be rebuilt.  Building the container on or
-	  off can be altered using the --build flag.  The default value --build=auto
-	  indicates the system should automatically build the container only if
-	  necessary.
+	  off can be altered using the --build flag.  The value --build=auto
+	  can be used to indicate the function should be run in a container, with
+	  the container automatically built if necessary.
+
+	  The --container flag defaults to true if the builder defined for the
+	  function is a containerized builder such as Pack or S2I, and in the case
+	  where the function's runtime requires containerized builds (is not yet
+	  supported by the Host builder.
 
 	Process Scaffolding
 	  This is an Experimental Feature currently available only to Go projects.
@@ -62,9 +69,17 @@ EXAMPLES
 
 	o Run the function locally on the host with no containerization (Go only).
 	  $ {{rootCmdUse}} run --container=false
+
+	o Run the function locally on a specific address.
+	  $ {{rootCmdUse}} run --address='[::]:8081'
+
+	o Run the function locally and output JSON with the service address.
+	  $ {{rootCmdUse}} run --json
 `,
 		SuggestFor: []string{"rnu"},
-		PreRunE:    bindEnv("build", "builder", "builder-image", "confirm", "container", "env", "image", "path", "registry", "start-timeout", "verbose"),
+		PreRunE: bindEnv("build", "builder", "builder-image", "base-image",
+			"confirm", "container", "env", "image", "path", "registry",
+			"start-timeout", "verbose", "address", "json"),
 		RunE: func(cmd *cobra.Command, _ []string) error {
 			return runRun(cmd, newClient)
 		},
@@ -96,6 +111,8 @@ EXAMPLES
 	builderImage := f.Build.BuilderImages[f.Build.Builder]
 	cmd.Flags().String("builder-image", builderImage,
 		"Specify a custom builder image for use by the builder other than its default. ($FUNC_BUILDER_IMAGE)")
+	cmd.Flags().StringP("base-image", "", f.Build.BaseImage,
+		"Override the base image for your function (host builder only)")
 	cmd.Flags().StringP("image", "i", f.Image,
 		"Full image name in the form [registry]/[namespace]/[name]:[tag]. This option takes precedence over --registry. Specifying tag is optional. ($FUNC_IMAGE)")
 	cmd.Flags().StringArrayP("env", "e", []string{},
@@ -103,6 +120,8 @@ EXAMPLES
 			"You may provide this flag multiple times for setting multiple environment variables. "+
 			"To unset, specify the environment variable name followed by a \"-\" (e.g., NAME-).")
 	cmd.Flags().Duration("start-timeout", f.Run.StartTimeout, fmt.Sprintf("time this function needs in order to start. If not provided, the client default %v will be in effect. ($FUNC_START_TIMEOUT)", fn.DefaultStartTimeout))
+	cmd.Flags().BoolP("container", "t", runContainerizedByDefault(f),
+		"Run the function in a container. ($FUNC_CONTAINER)")
 
 	// TODO: Without the "Host" builder enabled, this code-path is unreachable,
 	// so remove hidden flag when either the Host builder path is available,
@@ -116,8 +135,9 @@ EXAMPLES
 	cmd.Flags().String("build", "auto",
 		"Build the function. [auto|true|false]. ($FUNC_BUILD)")
 	cmd.Flags().Lookup("build").NoOptDefVal = "true" // register `--build` as equivalient to `--build=true`
-	cmd.Flags().BoolP("container", "t", true,
-		"Run the function in a container. ($FUNC_CONTAINER)")
+	cmd.Flags().String("address", "",
+		"Interface and port on which to bind and listen. Default is 127.0.0.1:8080, or an available port if 8080 is not available. ($FUNC_ADDRESS)")
+	cmd.Flags().Bool("json", false, "Output as JSON. ($FUNC_JSON)")
 
 	// Oft-shared flags:
 	addConfirmFlag(cmd, cfg.Confirm)
@@ -136,14 +156,17 @@ EXAMPLES
 	return cmd
 }
 
+func runContainerizedByDefault(f fn.Function) bool {
+	return f.Build.Builder == "pack" || f.Build.Builder == "s2i" || !oci.IsSupported(f.Runtime)
+}
+
 func runRun(cmd *cobra.Command, newClient ClientFactory) (err error) {
 	var (
 		cfg runConfig
 		f   fn.Function
 	)
-	if cfg, err = newRunConfig(cmd).Prompt(); err != nil {
-		return
-	}
+	cfg = newRunConfig(cmd) // Will add Prompt on upcoming UX refactor
+
 	if f, err = fn.NewFunction(cfg.Path); err != nil {
 		return
 	}
@@ -157,6 +180,11 @@ func runRun(cmd *cobra.Command, newClient ClientFactory) (err error) {
 		return
 	}
 
+	// Ignore the verbose flag if JSON output
+	if cfg.JSON {
+		cfg.Verbose = false
+	}
+
 	// Client
 	clientOptions, err := cfg.clientOptions()
 	if err != nil {
@@ -225,7 +253,7 @@ func runRun(cmd *cobra.Command, newClient ClientFactory) (err error) {
 	// For the former, build is required and a container runtime.  For the
 	// latter, scaffolding is first applied and the local host must be
 	// configured to build/run the language of the function.
-	job, err := client.Run(cmd.Context(), f)
+	job, err := client.Run(cmd.Context(), f, fn.RunWithAddress(cfg.Address))
 	if err != nil {
 		return
 	}
@@ -235,7 +263,27 @@ func runRun(cmd *cobra.Command, newClient ClientFactory) (err error) {
 		}
 	}()
 
-	fmt.Fprintf(cmd.OutOrStderr(), "Running on host port %v\n", job.Port)
+	// Output based on format
+	if cfg.JSON {
+		// Create JSON output structure
+		output := struct {
+			Address string `json:"address"`
+			Host    string `json:"host"`
+			Port    string `json:"port"`
+		}{
+			Address: fmt.Sprintf("http://%s:%s", job.Host, job.Port),
+			Host:    job.Host,
+			Port:    job.Port,
+		}
+
+		jsonData, err := json.Marshal(output)
+		if err != nil {
+			return fmt.Errorf("failed to marshal JSON output: %w", err)
+		}
+		fmt.Fprintln(cmd.OutOrStdout(), string(jsonData))
+	} else {
+		fmt.Fprintf(cmd.OutOrStderr(), "Running on host port %v\n", job.Port)
+	}
 
 	select {
 	case <-cmd.Context().Done():
@@ -276,6 +324,12 @@ type runConfig struct {
 	// StartTimeout optionally adjusts the startup timeout from the client's
 	// default of fn.DefaultStartTimeout.
 	StartTimeout time.Duration
+
+	// Address is the interface and port to bind (e.g. "0.0.0.0:8081")
+	Address string
+
+	// JSON output format
+	JSON bool
 }
 
 func newRunConfig(cmd *cobra.Command) (c runConfig) {
@@ -285,6 +339,8 @@ func newRunConfig(cmd *cobra.Command) (c runConfig) {
 		Env:          viper.GetStringSlice("env"),
 		Container:    viper.GetBool("container"),
 		StartTimeout: viper.GetDuration("start-timeout"),
+		Address:      viper.GetString("address"),
+		JSON:         viper.GetBool("json"),
 	}
 	// NOTE: .Env should be viper.GetStringSlice, but this returns unparsed
 	// results and appears to be an open issue since 2017:
@@ -340,15 +396,8 @@ func (c runConfig) Validate(cmd *cobra.Command, f fn.Function) (err error) {
 		}
 	}
 
-	// There is currently no local host runner implemented, so specifying
-	// --container=false should return an informative error for runtimes other
-	// than Go  that is more helpful than the cryptic, though correct, error
-	// from the Client that it was instantated without a runner.
-	// TODO: modify this check when the local host runner is available to
-	// only generate this error when --container==false && the --language is
-	// not yet implemented.
-	if !c.Container && f.Runtime != "go" {
-		return errors.New("the ability to run functions outside of a container via 'func run' is coming soon.")
+	if !c.Container && !oci.IsSupported(f.Runtime) {
+		return fmt.Errorf("the %q runtime currently requires being run in a container", f.Runtime)
 	}
 
 	// When the docker runner respects the StartTimeout, this validation check

cmd/run_test.go

@@ -21,6 +21,7 @@ func TestRun_Run(t *testing.T) {
 		runError     error                               // Set the runner to yield this error
 		buildInvoked bool                                // should Builder.Build be invoked?
 		runInvoked   bool                                // should Runner.Run be invoked?
+		jsonOutput   bool                                // expect JSON output format
 	}{
 		{
 			name:         "run and build by default",
@@ -100,6 +101,14 @@ func TestRun_Run(t *testing.T) {
 			buildInvoked: true,
 			runInvoked:   false,
 		},
+		{
+			name:         "run with json output",
+			desc:         "Should output JSON format when --json flag is used",
+			args:         []string{"--json"},
+			buildInvoked: true,
+			runInvoked:   true,
+			jsonOutput:   true,
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -107,7 +116,7 @@ func TestRun_Run(t *testing.T) {
 
 			runner := mock.NewRunner()
 			if tt.runError != nil {
-				runner.RunFn = func(context.Context, fn.Function, time.Duration) (*fn.Job, error) { return nil, tt.runError }
+				runner.RunFn = func(context.Context, fn.Function, string, time.Duration) (*fn.Job, error) { return nil, tt.runError }
 			}
 
 			builder := mock.NewBuilder()
@@ -220,7 +229,7 @@ func TestRun_Images(t *testing.T) {
 			runner := mock.NewRunner()
 
 			if tt.runError != nil {
-				runner.RunFn = func(context.Context, fn.Function, time.Duration) (*fn.Job, error) { return nil, tt.runError }
+				runner.RunFn = func(context.Context, fn.Function, string, time.Duration) (*fn.Job, error) { return nil, tt.runError }
 			}
 
 			builder := mock.NewBuilder()
@@ -324,7 +333,7 @@ func TestRun_CorrectImage(t *testing.T) {
 			root := FromTempDirectory(t)
 			runner := mock.NewRunner()
 
-			runner.RunFn = func(_ context.Context, f fn.Function, _ time.Duration) (*fn.Job, error) {
+			runner.RunFn = func(_ context.Context, f fn.Function, _ string, _ time.Duration) (*fn.Job, error) {
 				// TODO: add if for empty image? -- should fail beforehand
 				if f.Build.Image != tt.image {
 					return nil, fmt.Errorf("Expected image: %v but got: %v", tt.image, f.Build.Image)
@@ -386,3 +395,209 @@ func TestRun_CorrectImage(t *testing.T) {
 		})
 	}
 }
+
+// TestRun_DirectOverride tests that an --image passed after a function has
+// already been build, the given --image with digest will override built function
+func TestRun_DirectOverride(t *testing.T) {
+	const overrideImage = "registry/myrepo/myimage@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+	root := FromTempDirectory(t)
+	runner := mock.NewRunner()
+
+	runner.RunFn = func(_ context.Context, f fn.Function, _ string, _ time.Duration) (*fn.Job, error) {
+		if f.Build.Image != overrideImage {
+			return nil, fmt.Errorf("Expected image to be overridden with '%v' but got: '%v'", overrideImage, f.Build.Image)
+		}
+		errs := make(chan error, 1)
+		stop := func() error { return nil }
+		return fn.NewJob(f, "127.0.0.1", "8080", errs, stop, false)
+	}
+
+	builder1 := mock.NewBuilder()
+
+	// SETUP THE ENVIRONMENT & SITUATION
+	// create function
+	_, err := fn.New().Init(fn.Function{Root: root, Runtime: "go"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// build function
+	cmdBuild := NewBuildCmd(NewTestClient(fn.WithBuilder(builder1), fn.WithRegistry("example.com/ns-to-override")))
+	if err := cmdBuild.Execute(); err != nil {
+		t.Fatal(err)
+	}
+
+	// fetch the functions state
+	_, err = fn.NewFunction(root)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// builder for 'func run' -- shall not be invoked
+	builder2 := mock.NewBuilder()
+	builder2.BuildFn = func(f fn.Function) error {
+		return fmt.Errorf("should not be invoked")
+	}
+
+	// RUN THE ACTUAL TESTED COMMAND
+	cmd := NewRunCmd(NewTestClient(
+		fn.WithRunner(runner),
+		fn.WithBuilder(builder2),
+		fn.WithRegistry("ghcr.com/reg"),
+	))
+	cmd.SetArgs([]string{fmt.Sprintf("--image=%s", overrideImage)})
+
+	// run function with above argument
+	ctx, cancel := context.WithCancel(context.Background())
+	runErrCh := make(chan error, 1)
+	go func() {
+		_, err := cmd.ExecuteContextC(ctx)
+		if err != nil {
+			runErrCh <- err // error was not expected
+			return
+		}
+
+		// Ensure invocation doesnt happen for the second time as the image was
+		// provided with a digest (should not build)
+		if builder2.BuildInvoked {
+			runErrCh <- fmt.Errorf("Function was not expected to build again but it did")
+		}
+
+		close(runErrCh) // release the waiting parent process
+	}()
+	cancel() // trigger the return of cmd.ExecuteContextC in the routine
+	<-ctx.Done()
+	if err := <-runErrCh; err != nil { // wait for completion of assertions
+		t.Fatal(err)
+	}
+}
+
+// TestRun_Address ensures that the --address flag is passed to the runner.
+func TestRun_Address(t *testing.T) {
+	root := FromTempDirectory(t)
+	_, err := fn.New().Init(fn.Function{Root: root, Runtime: "go"})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	testAddr := "0.0.0.0:1234"
+
+	runner := mock.NewRunner()
+	runner.RunFn = func(_ context.Context, f fn.Function, addr string, _ time.Duration) (*fn.Job, error) {
+		if addr != testAddr {
+			return nil, fmt.Errorf("Expected address '%v' but got: '%v'", testAddr, addr)
+		}
+		errs := make(chan error, 1)
+		stop := func() error { return nil }
+		return fn.NewJob(f, "127.0.0.1", "8080", errs, stop, false)
+	}
+
+	// RUN THE ACTUAL TESTED COMMAND
+	cmd := NewRunCmd(NewTestClient(
+		fn.WithRunner(runner),
+		fn.WithRegistry("ghcr.com/reg"),
+	))
+	cmd.SetArgs([]string{"--address", testAddr})
+
+	ctx, cancel := context.WithCancel(context.Background())
+	runErrCh := make(chan error, 1)
+	go func() {
+		_, err := cmd.ExecuteContextC(ctx)
+		if err != nil {
+			runErrCh <- err // error was not expected
+			return
+		}
+		close(runErrCh) // release the waiting parent process
+	}()
+	cancel() // trigger the return of cmd.ExecuteContextC in the routine
+	<-ctx.Done()
+	if err := <-runErrCh; err != nil { // wait for completion of assertions
+		t.Fatal(err)
+	}
+}
+
+// TestRun_BaseImage ensures that running func run --base-image with various
+// other
+func TestRun_BaseImage(t *testing.T) {
+	const baseImage = "example.com/repo/baseImage"
+	tests := []struct {
+		name        string
+		runtime     string
+		builder     string
+		expectError bool
+	}{
+		{
+			name:    "should-succeed: python-runtime with host-builder",
+			runtime: "python",
+			builder: "host",
+		},
+		{
+			name:    "should-succeed: go-runtime with host-builder",
+			runtime: "go",
+			builder: "host",
+		},
+		{
+			name:        "should-fail: python-runtime with pack-builder",
+			runtime:     "python",
+			builder:     "pack",
+			expectError: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			root := FromTempDirectory(t)
+			runner := mock.NewRunner()
+
+			runner.RunFn = func(_ context.Context, f fn.Function, _ string, _ time.Duration) (*fn.Job, error) {
+				errs := make(chan error, 1)
+				stop := func() error { return nil }
+				return fn.NewJob(f, "127.0.0.1", "8080", errs, stop, false)
+			}
+
+			builder := mock.NewBuilder()
+			//if tt.expectError {
+			//	builder.BuildFn = func(f fn.Function) error { return fmt.Errorf("expected error") }
+			//}
+
+			cmd := NewRunCmd(NewTestClient(
+				fn.WithRunner(runner),
+				fn.WithBuilder(builder),
+				fn.WithRegistry(TestRegistry),
+			))
+			args := []string{"--build=true", fmt.Sprintf("--builder=%s", tt.builder), fmt.Sprintf("--base-image=%s", baseImage)}
+			cmd.SetArgs(args)
+
+			// set test case's function instance
+			_, err := fn.New().Init(fn.Function{Root: root, Runtime: tt.runtime})
+			if err != nil {
+				t.Fatal(err)
+			}
+			ctx, cancel := context.WithCancel(context.Background())
+			runErrCh := make(chan error, 1)
+			go func() {
+				t0 := tt // capture tt into closure
+				_, err := cmd.ExecuteContextC(ctx)
+				if err != nil && t0.expectError {
+					// This is an expected error, so simply continue execution ignoring
+					// the error (send nil on the channel to release the parent routine
+					runErrCh <- nil
+					return
+				} else if err != nil {
+					runErrCh <- err // error not expected
+					return
+				}
+
+				// No errors, but an error was expected:
+				if t0.expectError {
+					runErrCh <- fmt.Errorf("Expected error but got '%v'\n", err)
+				}
+				close(runErrCh) // release the waiting parent process
+			}()
+			cancel() // trigger the return of cmd.ExecuteContextC in the routine
+			<-ctx.Done()
+			if err := <-runErrCh; err != nil { // wait for completion of assertions
+				t.Fatal(err)
+			}
+		})
+	}
+}

cmd/subscribe.go

@@ -95,6 +95,11 @@ func updateOrAddSubscription(subscriptions []fn.KnativeSubscription, cfg subscib
 	for i, subscription := range subscriptions {
 		if subscription.Source == cfg.Source {
 			found = true
+
+			if subscription.Filters == nil {
+				subscription.Filters = make(map[string]string)
+			}
+
 			// Update filters. Override if the key already exists.
 			for newKey, newValue := range newFilters {
 				subscription.Filters[newKey] = newValue

cmd/templates_test.go

@@ -27,9 +27,7 @@ go           http
 node         cloudevents
 node         http
 python       cloudevents
-python       flask
 python       http
-python       wsgi
 quarkus      cloudevents
 quarkus      http
 rust         cloudevents
@@ -67,9 +65,7 @@ func TestTemplates_JSON(t *testing.T) {
   ],
   "python": [
     "cloudevents",
-    "flask",
-    "http",
-    "wsgi"
+    "http"
   ],
   "quarkus": [
     "cloudevents",

docs/CONTRIBUTING.md

@@ -29,7 +29,7 @@ The source of these templates is `./templates`; a directory subdivided by langua
 For example, the Go HTTP template is located in `./templates/go/http`.
 The client library and CLI are self-contained
 by encoding this directory as a ZIP byte array in the `./generate/zz_filesystem_generated.go` file.
-Therefore, any updates to templates requires re-generating this file.
+Therefore, any updates to templates require re-generating this file.
 
 When changes are made to files in the `./templates` directory,
 regenerate `./generate/zz_filesystem_generated.go` by running `make generate/zz_filesystem_generated.go`.
@@ -76,7 +76,7 @@ exit 0
 
 If you would like to run integration tests prior to opening a pull request against origin, you can enable Actions in your fork of this repository and create a pull request to your own main branch.
 
-If you would like to run integraiton tests locally, or would like to use the CLI / Client Library directly against a local cluster, the cluster allocation script can be used locally as well, by following the steps below.
+If you would like to run integration tests locally, or would like to use the CLI / Client Library directly against a local cluster, the cluster allocation script can be used locally as well, by following the steps below.
 
 
 ###  Prerequisites
@@ -93,16 +93,16 @@ Allocate a new local cluster by running `hack/allocate.sh`.
 
 ### Registry
 
-The allocation script sets up a local container registry and connects it to the cluster.  This registry must be set as trusted and its address entered in the local hosts file.  This is a one-time configuration and on Linux can be accomplished by running `hack/registry.sh`.
+The allocation script sets up a local container registry and connects it to the cluster.  This registry must be set as trusted and its address entered in the local `hosts` file.  This is a one-time configuration and on Linux can be accomplished by running `hack/registry.sh`.
 
-On other systems, add `127.0.0.1 kind-registry` to your local hosts file and `"insecure-registries" = ["kind-registry:50000"]` to your docker daemon config (`docker/daemon.json`).
+On other systems, add `127.0.0.1 kind-registry` to your local `hosts` file and `"insecure-registries" = ["kind-registry:50000"]` to your docker daemon config (`docker/daemon.json`).
 
 
 ### Using the Cluster
 
 Once the cluster has been allocated, the `func` CLI (or client library) will automatically use it (see the [Kubeconfig Docs](https://kubernetes.io/docs/concepts/configuration/organize-cluster-access-kubeconfig/) for more)
 
-Functions will be available at the address `[Function Name].default.127.0.0.1.sslip.io`
+Functions will be available at the address `[Function Name].default.localtest.me`
 
 To run integration tests, use `make test-integration`.
 

docs/building-functions/on_cluster_build.md

@@ -3,7 +3,11 @@
 This guide describes how you can build a Function on Cluster with Tekton Pipelines. The on cluster build is enabled by fetching Function source code from a remote Git repository. Buildpacks or S2I builder strategy can be used to build the Function image.
 
 ## Prerequisite
-1. Install Tekton Pipelines on the cluster. Please refer to [Tekton Pipelines documentation](https://github.com/tektoncd/pipeline/blob/main/docs/install.md) or run the following command:
+1. Install Tekton Pipelines on the cluster.
+
+   **Note:** If you're using `./hack/allocate.sh` for development/testing, Tekton and PAC are automatically installed.
+
+   For production environments, please refer to [Tekton Pipelines documentation](https://github.com/tektoncd/pipeline/blob/main/docs/install.md) or run the following command:
 ```bash
 kubectl apply -f https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.49.0/release.yaml
 ```

docs/generator/main.go

@@ -21,7 +21,7 @@ var (
 	fm = template.FuncMap{
 		"indent": func(i int, c string, v string) string {
 			indentation := strings.Repeat(c, i)
-			return indentation + strings.Replace(v, "\n", "\n"+indentation, -1)
+			return indentation + strings.ReplaceAll(v, "\n", "\n"+indentation)
 		},
 		"rootCmdUse": func() string {
 			return rootName

docs/reference/func.md

@@ -34,6 +34,7 @@ Learn more about Knative at: https://knative.dev
 * [func invoke](func_invoke.md)	 - Invoke a local or remote function
 * [func languages](func_languages.md)	 - List available function language runtimes
 * [func list](func_list.md)	 - List deployed functions
+* [func mcp](func_mcp.md)	 - Start MCP server
 * [func repository](func_repository.md)	 - Manage installed template repositories
 * [func run](func_run.md)	 - Run the function locally
 * [func subscribe](func_subscribe.md)	 - Subscribe a function to events

docs/reference/func_build.md

@@ -57,8 +57,9 @@ func build
 ### Options
 
 ```
+      --base-image string      Override the base image for your function (host builder only)
       --build-timestamp        Use the actual time as the created time for the docker image. This is only useful for buildpacks builder.
-  -b, --builder string         Builder to use when creating the function's container. Currently supported builders are "pack" and "s2i". ($FUNC_BUILDER) (default "pack")
+  -b, --builder string         Builder to use when creating the function's container. Currently supported builders are "host", "pack" and "s2i". ($FUNC_BUILDER) (default "pack")
       --builder-image string   Specify a custom builder image for use by the builder other than its default. ($FUNC_BUILDER_IMAGE)
   -c, --confirm                Prompt to confirm options interactively ($FUNC_CONFIRM)
   -h, --help                   help for build

docs/reference/func_config_envs_remove.md

@@ -18,6 +18,7 @@ func config envs remove
 
 ```
   -h, --help          help for remove
+      --name string   Name of the environment variable.
   -p, --path string   Path to the function.  Default is current directory ($FUNC_PATH)
   -v, --verbose       Print verbose logs ($FUNC_VERBOSE)
 ```

docs/reference/func_config_git_set.md

@@ -17,7 +17,7 @@ func config git set
 ### Options
 
 ```
-  -b, --builder string             Builder to use when creating the function's container. Currently supported builders are "pack" and "s2i". (default "pack")
+  -b, --builder string             Builder to use when creating the function's container. Currently supported builders are "host", "pack" and "s2i". (default "pack")
       --builder-image string       Specify a custom builder image for use by the builder other than its default. ($FUNC_BUILDER_IMAGE)
       --config-cluster             Configure cluster resources (credentials and config on the cluster).
       --config-local               Configure local resources (pipeline templates).

docs/reference/func_config_labels.md

@@ -17,9 +17,10 @@ func config labels
 ### Options
 
 ```
-  -h, --help          help for labels
-  -p, --path string   Path to the function.  Default is current directory ($FUNC_PATH)
-  -v, --verbose       Print verbose logs ($FUNC_VERBOSE)
+  -h, --help            help for labels
+  -o, --output string   Output format (human|json) (default "human")
+  -p, --path string     Path to the function.  Default is current directory ($FUNC_PATH)
+  -v, --verbose         Print verbose logs ($FUNC_VERBOSE)
 ```
 
 ### SEE ALSO

docs/reference/func_config_labels_add.md

@@ -6,8 +6,7 @@ Add labels to the function configuration
 
 Add labels to the function configuration
 
-Interactive prompt to add labels to the function project in the current
-directory or from the directory specified with --path.
+If label is not set explicitly by flag, interactive prompt is used.
 
 The label can be set directly from a value or from an environment variable on
 the local machine.
@@ -17,12 +16,24 @@ the local machine.
 func config labels add
 ```
 
+### Examples
+
+```
+# set label directly
+func config labels add --name=Foo --value=Bar
+
+# set label from local env $FOO
+func config labels add --name=Foo --value='{{ env:FOO }}'
+```
+
 ### Options
 
 ```
-  -h, --help          help for add
-  -p, --path string   Path to the function.  Default is current directory ($FUNC_PATH)
-  -v, --verbose       Print verbose logs ($FUNC_VERBOSE)
+  -h, --help           help for add
+      --name string    Name of the label.
+  -p, --path string    Path to the function.  Default is current directory ($FUNC_PATH)
+      --value string   Value of the label.
+  -v, --verbose        Print verbose logs ($FUNC_VERBOSE)
 ```
 
 ### SEE ALSO

docs/reference/func_config_labels_remove.md

@@ -18,6 +18,7 @@ func config labels remove
 
 ```
   -h, --help          help for remove
+      --name string   Name of the label.
   -p, --path string   Path to the function.  Default is current directory ($FUNC_PATH)
   -v, --verbose       Print verbose logs ($FUNC_VERBOSE)
 ```

docs/reference/func_config_volumes_add.md

@@ -9,17 +9,43 @@ Add volume to the function configuration
 Interactive prompt to add Secrets and ConfigMaps as Volume mounts to the function project
 in the current directory or from the directory specified with --path.
 
+For non-interactive usage, use flags to specify the volume type and configuration.
+
 
 ```
 func config volumes add
 ```
 
+### Examples
+
+```
+# Add a ConfigMap volume
+func config volumes add --type=configmap --source=my-config --path=/etc/config
+
+# Add a Secret volume
+func config volumes add --type=secret --source=my-secret --path=/etc/secret
+
+# Add a PersistentVolumeClaim volume
+func config volumes add --type=pvc --source=my-pvc --path=/data
+func config volumes add --type=pvc --source=my-pvc --path=/data --read-only
+
+# Add an EmptyDir volume
+func config volumes add --type=emptydir --path=/tmp/cache
+func config volumes add --type=emptydir --path=/tmp/cache --size=1Gi --medium=Memory
+```
+
 ### Options
 
 ```
-  -h, --help          help for add
-  -p, --path string   Path to the function.  Default is current directory ($FUNC_PATH)
-  -v, --verbose       Print verbose logs ($FUNC_VERBOSE)
+  -h, --help                help for add
+      --medium string       Storage medium for EmptyDir volume: 'Memory' or '' (default)
+  -m, --mount-path string   Path where the volume should be mounted in the container
+  -p, --path string         Path to the function.  Default is current directory ($FUNC_PATH)
+  -r, --read-only           Mount volume as read-only (only for PVC)
+      --size string         Maximum size limit for EmptyDir volume (e.g., 1Gi)
+  -s, --source string       Name of the ConfigMap, Secret, or PVC to mount (not used for emptydir)
+  -t, --type string         Volume type: configmap, secret, pvc, or emptydir
+  -v, --verbose             Print verbose logs ($FUNC_VERBOSE)
 ```
 
 ### SEE ALSO

docs/reference/func_config_volumes_remove.md

@@ -9,17 +9,27 @@ Remove volume from the function configuration
 Interactive prompt to remove Volume mounts from the function project
 in the current directory or from the directory specified with --path.
 
+For non-interactive usage, use the --mount-path flag to specify which volume to remove.
+
 
 ```
 func config volumes remove
 ```
 
+### Examples
+
+```
+# Remove a volume by its mount path
+func config volumes remove --mount-path=/etc/config
+```
+
 ### Options
 
 ```
-  -h, --help          help for remove
-  -p, --path string   Path to the function.  Default is current directory ($FUNC_PATH)
-  -v, --verbose       Print verbose logs ($FUNC_VERBOSE)
+  -h, --help                help for remove
+  -m, --mount-path string   Path of the volume mount to remove
+  -p, --path string         Path to the function.  Default is current directory ($FUNC_PATH)
+  -v, --verbose             Print verbose logs ($FUNC_VERBOSE)
 ```
 
 ### SEE ALSO

docs/reference/func_create.md

@@ -34,9 +34,7 @@ DESCRIPTION
 	  node         cloudevents
 	  node         http
 	  python       cloudevents
-	  python       flask
 	  python       http
-	  python       wsgi
 	  quarkus      cloudevents
 	  quarkus      http
 	  rust         cloudevents

docs/reference/func_deploy.md

@@ -14,7 +14,7 @@ SYNOPSIS
 	             [-b|--build] [--builder] [--builder-image] [-p|--push]
 	             [--domain] [--platform] [--build-timestamp] [--pvc-size]
 	             [--service-account] [-c|--confirm] [-v|--verbose]
-	             [--registry-insecure]
+	             [--registry-insecure] [--remote-storage-class]
 
 DESCRIPTION
 
@@ -113,28 +113,30 @@ func deploy
 ### Options
 
 ```
-      --build string[="true"]    Build the function. [auto|true|false]. ($FUNC_BUILD) (default "auto")
-      --build-timestamp          Use the actual time as the created time for the docker image. This is only useful for buildpacks builder.
-  -b, --builder string           Builder to use when creating the function's container. Currently supported builders are "pack" and "s2i". (default "pack")
-      --builder-image string     Specify a custom builder image for use by the builder other than its default. ($FUNC_BUILDER_IMAGE)
-  -c, --confirm                  Prompt to confirm options interactively ($FUNC_CONFIRM)
-      --domain string            Domain to use for the function's route.  Cluster must be configured with domain matching for the given domain (ignored if unrecognized) ($FUNC_DOMAIN)
-  -e, --env stringArray          Environment variable to set in the form NAME=VALUE. You may provide this flag multiple times for setting multiple environment variables. To unset, specify the environment variable name followed by a "-" (e.g., NAME-).
-  -t, --git-branch string        Git revision (branch) to be used when deploying via the Git repository ($FUNC_GIT_BRANCH)
-  -d, --git-dir string           Directory in the Git repository containing the function (default is the root) ($FUNC_GIT_DIR)
-  -g, --git-url string           Repository url containing the function to build ($FUNC_GIT_URL)
-  -h, --help                     help for deploy
-  -i, --image string             Full image name in the form [registry]/[namespace]/[name]:[tag]@[digest]. This option takes precedence over --registry. Specifying digest is optional, but if it is given, 'build' and 'push' phases are disabled. ($FUNC_IMAGE)
-  -n, --namespace string         Deploy into a specific namespace. Will use the function's current namespace by default if already deployed, and the currently active context if it can be determined. ($FUNC_NAMESPACE) (default "default")
-  -p, --path string              Path to the function.  Default is current directory ($FUNC_PATH)
-      --platform string          Optionally specify a specific platform to build for (e.g. linux/amd64). ($FUNC_PLATFORM)
-  -u, --push                     Push the function image to registry before deploying. ($FUNC_PUSH) (default true)
-      --pvc-size string          When triggering a remote deployment, set a custom volume size to allocate for the build operation ($FUNC_PVC_SIZE)
-  -r, --registry string          Container registry + registry namespace. (ex 'ghcr.io/myuser').  The full image name is automatically determined using this along with function name. ($FUNC_REGISTRY)
-      --registry-insecure        Skip TLS certificate verification when communicating in HTTPS with the registry ($FUNC_REGISTRY_INSECURE)
-  -R, --remote                   Trigger a remote deployment. Default is to deploy and build from the local system ($FUNC_REMOTE)
-      --service-account string   Service account to be used in the deployed function ($FUNC_SERVICE_ACCOUNT)
-  -v, --verbose                  Print verbose logs ($FUNC_VERBOSE)
+      --base-image string             Override the base image for your function (host builder only)
+      --build string[="true"]         Build the function. [auto|true|false]. ($FUNC_BUILD) (default "auto")
+      --build-timestamp               Use the actual time as the created time for the docker image. This is only useful for buildpacks builder.
+  -b, --builder string                Builder to use when creating the function's container. Currently supported builders are "host", "pack" and "s2i". (default "pack")
+      --builder-image string          Specify a custom builder image for use by the builder other than its default. ($FUNC_BUILDER_IMAGE)
+  -c, --confirm                       Prompt to confirm options interactively ($FUNC_CONFIRM)
+      --domain string                 Domain to use for the function's route.  Cluster must be configured with domain matching for the given domain (ignored if unrecognized) ($FUNC_DOMAIN)
+  -e, --env stringArray               Environment variable to set in the form NAME=VALUE. You may provide this flag multiple times for setting multiple environment variables. To unset, specify the environment variable name followed by a "-" (e.g., NAME-).
+  -t, --git-branch string             Git revision (branch) to be used when deploying via the Git repository ($FUNC_GIT_BRANCH)
+  -d, --git-dir string                Directory in the Git repository containing the function (default is the root) ($FUNC_GIT_DIR)
+  -g, --git-url string                Repository url containing the function to build ($FUNC_GIT_URL)
+  -h, --help                          help for deploy
+  -i, --image string                  Full image name in the form [registry]/[namespace]/[name]:[tag]@[digest]. This option takes precedence over --registry. Specifying digest is optional, but if it is given, 'build' and 'push' phases are disabled. ($FUNC_IMAGE)
+  -n, --namespace string              Deploy into a specific namespace. Will use the function's current namespace by default if already deployed, and the currently active context if it can be determined. ($FUNC_NAMESPACE) (default "default")
+  -p, --path string                   Path to the function.  Default is current directory ($FUNC_PATH)
+      --platform string               Optionally specify a specific platform to build for (e.g. linux/amd64). ($FUNC_PLATFORM)
+  -u, --push                          Push the function image to registry before deploying. ($FUNC_PUSH) (default true)
+      --pvc-size string               When triggering a remote deployment, set a custom volume size to allocate for the build operation ($FUNC_PVC_SIZE)
+  -r, --registry string               Container registry + registry namespace. (ex 'ghcr.io/myuser').  The full image name is automatically determined using this along with function name. ($FUNC_REGISTRY)
+      --registry-insecure             Skip TLS certificate verification when communicating in HTTPS with the registry ($FUNC_REGISTRY_INSECURE)
+  -R, --remote                        Trigger a remote deployment. Default is to deploy and build from the local system ($FUNC_REMOTE)
+      --remote-storage-class string   Specify a storage class to use for the volume on-cluster during remote builds
+      --service-account string        Service account to be used in the deployed function ($FUNC_SERVICE_ACCOUNT)
+  -v, --verbose                       Print verbose logs ($FUNC_VERBOSE)
 ```
 
 ### SEE ALSO

docs/reference/func_mcp.md

@@ -0,0 +1,39 @@
+## func mcp
+
+Start MCP server
+
+### Synopsis
+
+
+NAME
+	func mcp - start a Model Context Protocol (MCP) server
+
+SYNOPSIS
+	func mcp [flags]
+
+DESCRIPTION
+	Starts a Model Context Protocol (MCP) server over standard input/output (stdio) transport.
+	This implementation aims to support tools for deploying and creating serverless functions.
+
+	Note: This command is still under development.
+
+EXAMPLES
+
+	o Run an MCP server:
+		func mcp
+
+
+```
+func mcp
+```
+
+### Options
+
+```
+  -h, --help   help for mcp
+```
+
+### SEE ALSO
+
+* [func](func.md)	 - func manages Knative Functions
+

docs/reference/func_run.md

@@ -11,7 +11,7 @@ NAME
 SYNOPSIS
 	func run [-t|--container] [-r|--registry] [-i|--image] [-e|--env]
 	             [--build] [-b|--builder] [--builder-image] [-c|--confirm]
-	             [-v|--verbose]
+	             [--address] [--json] [-v|--verbose]
 
 DESCRIPTION
 	Run the function locally.
@@ -22,9 +22,14 @@ DESCRIPTION
 	  The --container flag indicates that the function's container should be
 	  run rather than running the source code directly.  This may require that
 	  the function's container first be rebuilt.  Building the container on or
-	  off can be altered using the --build flag.  The default value --build=auto
-	  indicates the system should automatically build the container only if
-	  necessary.
+	  off can be altered using the --build flag.  The value --build=auto
+	  can be used to indicate the function should be run in a container, with
+	  the container automatically built if necessary.
+
+	  The --container flag defaults to true if the builder defined for the
+	  function is a containerized builder such as Pack or S2I, and in the case
+	  where the function's runtime requires containerized builds (is not yet
+	  supported by the Host builder.
 
 	Process Scaffolding
 	  This is an Experimental Feature currently available only to Go projects.
@@ -47,6 +52,12 @@ EXAMPLES
 	o Run the function locally on the host with no containerization (Go only).
 	  $ func run --container=false
 
+	o Run the function locally on a specific address.
+	  $ func run --address='[::]:8081'
+
+	o Run the function locally and output JSON with the service address.
+	  $ func run --json
+
 
 ```
 func run
@@ -55,14 +66,17 @@ func run
 ### Options
 
 ```
+      --address string          Interface and port on which to bind and listen. Default is 127.0.0.1:8080, or an available port if 8080 is not available. ($FUNC_ADDRESS)
+      --base-image string       Override the base image for your function (host builder only)
       --build string[="true"]   Build the function. [auto|true|false]. ($FUNC_BUILD) (default "auto")
-  -b, --builder string          Builder to use when creating the function's container. Currently supported builders are "pack" and "s2i". (default "pack")
+  -b, --builder string          Builder to use when creating the function's container. Currently supported builders are "host", "pack" and "s2i". (default "pack")
       --builder-image string    Specify a custom builder image for use by the builder other than its default. ($FUNC_BUILDER_IMAGE)
   -c, --confirm                 Prompt to confirm options interactively ($FUNC_CONFIRM)
   -t, --container               Run the function in a container. ($FUNC_CONTAINER) (default true)
   -e, --env stringArray         Environment variable to set in the form NAME=VALUE. You may provide this flag multiple times for setting multiple environment variables. To unset, specify the environment variable name followed by a "-" (e.g., NAME-).
   -h, --help                    help for run
   -i, --image string            Full image name in the form [registry]/[namespace]/[name]:[tag]. This option takes precedence over --registry. Specifying tag is optional. ($FUNC_IMAGE)
+      --json                    Output as JSON. ($FUNC_JSON)
   -p, --path string             Path to the function.  Default is current directory ($FUNC_PATH)
   -r, --registry string         Container registry + registry namespace. (ex 'ghcr.io/myuser').  The full image name is automatically determined using this along with function name. ($FUNC_REGISTRY)
   -v, --verbose                 Print verbose logs ($FUNC_VERBOSE)

go.mod

@@ -1,9 +1,9 @@
 module knative.dev/func
 
-go 1.22.0
+go 1.24.0
 
 // this is required bacause of bad dep in github.com/openshift-pipelines/pipelines-as-code
-replace k8s.io/client-go => k8s.io/client-go v0.29.3
+replace github.com/imdario/mergo => dario.cat/mergo v1.0.1
 
 require (
 	github.com/AlecAivazis/survey/v2 v2.3.7
@@ -11,122 +11,127 @@ require (
 	github.com/Microsoft/go-winio v0.6.2
 	github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2
 	github.com/alecthomas/jsonschema v0.0.0-20220216202328-9eeeec9d044b
-	github.com/buildpacks/pack v0.34.2
+	github.com/blang/semver/v4 v4.0.0
+	github.com/buildpacks/pack v0.36.4
 	github.com/chainguard-dev/git-urls v1.0.2
 	github.com/cloudevents/sdk-go/v2 v2.15.2
-	github.com/containerd/containerd v1.7.17
-	github.com/containers/image/v5 v5.31.0
+	github.com/containerd/errdefs v0.3.0
+	github.com/containerd/platforms v0.2.1
+	github.com/containers/image/v5 v5.31.1
 	github.com/coreos/go-semver v0.3.1
 	github.com/creack/pty v1.1.21
-	github.com/docker/cli v26.1.3+incompatible
-	github.com/docker/docker v26.1.5+incompatible
-	github.com/docker/docker-credential-helpers v0.8.1
+	github.com/docker/cli v27.5.1+incompatible
+	github.com/docker/docker v27.5.0+incompatible
+	github.com/docker/docker-credential-helpers v0.8.2
 	github.com/docker/go-connections v0.5.0
-	github.com/go-git/go-billy/v5 v5.5.0
-	github.com/go-git/go-git/v5 v5.12.0
-	github.com/google/go-cmp v0.6.0
-	github.com/google/go-containerregistry v0.19.1
-	github.com/google/go-github/v49 v49.1.0
+	github.com/go-git/go-billy/v5 v5.6.1
+	github.com/go-git/go-git/v5 v5.13.1
+	github.com/google/go-cmp v0.7.0
+	github.com/google/go-containerregistry v0.20.3
+	github.com/google/go-github/v68 v68.0.0
 	github.com/google/uuid v1.6.0
 	github.com/hectane/go-acl v0.0.0-20190604041725-da78bae5fc95
 	github.com/heroku/color v0.0.6
 	github.com/hinshun/vt10x v0.0.0-20220228203356-1ab2cad5fd82
-	github.com/manifestival/client-go-client v0.5.0
+	github.com/manifestival/client-go-client v0.6.0
 	github.com/manifestival/manifestival v0.7.2
+	github.com/mark3labs/mcp-go v0.30.0
 	github.com/opencontainers/image-spec v1.1.0
-	github.com/openshift-pipelines/pipelines-as-code v0.27.0
-	github.com/openshift/source-to-image v1.4.1-0.20240605122348-f94ff357628b
+	github.com/openshift-pipelines/pipelines-as-code v0.31.0
+	github.com/openshift/source-to-image v1.5.0
 	github.com/ory/viper v1.7.5
 	github.com/paketo-buildpacks/libpak v1.70.0
 	github.com/pelletier/go-toml v1.9.5
 	github.com/pkg/errors v0.9.1
 	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06
 	github.com/schollz/progressbar/v3 v3.13.1
-	github.com/spf13/cobra v1.8.0
-	github.com/spf13/pflag v1.0.5
+	github.com/spf13/cobra v1.8.1
+	github.com/spf13/pflag v1.0.6
 	github.com/tektoncd/cli v0.37.0
-	github.com/tektoncd/pipeline v0.60.1
+	github.com/tektoncd/pipeline v0.65.1
 	github.com/xanzy/go-gitlab v0.102.0
-	golang.org/x/crypto v0.28.0
-	golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa
-	golang.org/x/net v0.30.0
-	golang.org/x/oauth2 v0.22.0
-	golang.org/x/sync v0.8.0
-	golang.org/x/term v0.25.0
+	golang.org/x/crypto v0.39.0
+	golang.org/x/net v0.41.0
+	golang.org/x/oauth2 v0.30.0
+	golang.org/x/sync v0.15.0
+	golang.org/x/sys v0.33.0
+	golang.org/x/term v0.32.0
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
 	gotest.tools/v3 v3.5.1
-	k8s.io/api v0.30.3
-	k8s.io/apimachinery v0.30.3
-	k8s.io/client-go v1.5.2
+	k8s.io/api v0.33.1
+	k8s.io/apimachinery v0.33.1
+	k8s.io/client-go v0.33.1
 	k8s.io/klog/v2 v2.130.1
-	knative.dev/client/pkg v0.0.0-20241022160900-b3b6b8603082
-	knative.dev/eventing v0.43.0
-	knative.dev/hack v0.0.0-20241010131451-05b2fb30cb4d
-	knative.dev/pkg v0.0.0-20241021183759-9b9d535af5ad
-	knative.dev/serving v0.43.0
+	knative.dev/client/pkg v0.0.0-20250617200959-1c3b47ce739a
+	knative.dev/eventing v0.45.1-0.20250625134405-5bcf8011acc8
+	knative.dev/hack v0.0.0-20250514121446-f525e187efdc
+	knative.dev/pkg v0.0.0-20250627014006-8481e7eef7f6
+	knative.dev/serving v0.45.1-0.20250627133507-aa58baffad69
 )
 
 require (
-	cloud.google.com/go/compute/metadata v0.5.0 // indirect
+	cel.dev/expr v0.23.0 // indirect
+	cloud.google.com/go/compute/metadata v0.6.0 // indirect
 	contrib.go.opencensus.io/exporter/ocagent v0.7.1-0.20200907061046-05415f1de66d // indirect
 	contrib.go.opencensus.io/exporter/prometheus v0.4.2 // indirect
 	dario.cat/mergo v1.0.0 // indirect
 	github.com/Azure/azure-sdk-for-go v68.0.0+incompatible // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/Azure/go-autorest v14.2.0+incompatible // indirect
-	github.com/Azure/go-autorest/autorest v0.11.29 // indirect
-	github.com/Azure/go-autorest/autorest/adal v0.9.23 // indirect
-	github.com/Azure/go-autorest/autorest/azure/auth v0.5.12 // indirect
-	github.com/Azure/go-autorest/autorest/azure/cli v0.4.6 // indirect
-	github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
-	github.com/Azure/go-autorest/logger v0.2.1 // indirect
-	github.com/Azure/go-autorest/tracing v0.6.0 // indirect
-	github.com/BurntSushi/toml v1.3.2 // indirect
+	github.com/Azure/go-autorest/autorest v0.11.30 // indirect
+	github.com/Azure/go-autorest/autorest/adal v0.9.24 // indirect
+	github.com/Azure/go-autorest/autorest/azure/auth v0.5.13 // indirect
+	github.com/Azure/go-autorest/autorest/azure/cli v0.4.7 // indirect
+	github.com/Azure/go-autorest/autorest/date v0.3.1 // indirect
+	github.com/Azure/go-autorest/logger v0.2.2 // indirect
+	github.com/Azure/go-autorest/tracing v0.6.1 // indirect
+	github.com/BurntSushi/toml v1.4.0 // indirect
+	github.com/GoogleContainerTools/kaniko v1.23.2 // indirect
 	github.com/Masterminds/semver/v3 v3.2.1 // indirect
-	github.com/Microsoft/hcsshim v0.12.3 // indirect
-	github.com/ProtonMail/go-crypto v1.0.0 // indirect
+	github.com/Microsoft/hcsshim v0.12.7 // indirect
+	github.com/ProtonMail/go-crypto v1.1.3 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
 	github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 // indirect
-	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/apex/log v1.9.0 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.26.0 // indirect
-	github.com/aws/aws-sdk-go-v2/config v1.27.9 // indirect
-	github.com/aws/aws-sdk-go-v2/credentials v1.17.9 // indirect
-	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.0 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.0 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ecr v1.24.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.21.5 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.11.1 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.11.6 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sso v1.20.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.23.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/sts v1.28.5 // indirect
-	github.com/aws/smithy-go v1.20.1 // indirect
-	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20231213181459-b0fcec718dc6 // indirect
+	github.com/aws/aws-sdk-go-v2 v1.36.1 // indirect
+	github.com/aws/aws-sdk-go-v2/config v1.29.6 // indirect
+	github.com/aws/aws-sdk-go-v2/credentials v1.17.59 // indirect
+	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.16.28 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.3.32 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.6.32 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecr v1.40.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.31.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.2 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sso v1.24.15 // indirect
+	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.28.14 // indirect
+	github.com/aws/aws-sdk-go-v2/service/sts v1.33.14 // indirect
+	github.com/aws/smithy-go v1.22.2 // indirect
+	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.0.0-20250205235911-d2398ba46815 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blendle/zapdriver v1.3.1 // indirect
 	github.com/buildpacks/imgutil v0.0.0-20240605145725-186f89b2d168 // indirect
 	github.com/buildpacks/libcnb v1.30.3 // indirect
-	github.com/buildpacks/lifecycle v0.19.6 // indirect
+	github.com/buildpacks/lifecycle v0.20.4 // indirect
 	github.com/census-instrumentation/opencensus-proto v0.4.1 // indirect
+	github.com/cert-manager/cert-manager v1.16.3 // indirect
 	github.com/cespare/xxhash v1.1.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/chrismellard/docker-credential-acr-env v0.0.0-20230304212654-82a0ddb27589 // indirect
 	github.com/cloudevents/sdk-go/sql/v2 v2.15.2 // indirect
 	github.com/cloudflare/circl v1.3.7 // indirect
 	github.com/containerd/cgroups/v3 v3.0.3 // indirect
-	github.com/containerd/errdefs v0.1.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/stargz-snapshotter/estargz v0.15.1 // indirect
-	github.com/containerd/typeurl/v2 v2.1.1 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
+	github.com/containerd/typeurl/v2 v2.2.0 // indirect
 	github.com/containers/libtrust v0.0.0-20230121012942-c1716e8a8d01 // indirect
-	github.com/containers/ocicrypt v1.1.10 // indirect
+	github.com/containers/ocicrypt v1.2.0 // indirect
 	github.com/containers/storage v1.54.0 // indirect
-	github.com/cpuguy83/go-md2man/v2 v2.0.3 // indirect
-	github.com/cyphar/filepath-securejoin v0.2.5 // indirect
+	github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect
+	github.com/cyphar/filepath-securejoin v0.3.6 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/dgraph-io/ristretto v0.0.1 // indirect
 	github.com/dimchansky/utfbom v1.1.1 // indirect
@@ -135,39 +140,37 @@ require (
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/emicklei/go-restful/v3 v3.12.1 // indirect
+	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/evanphx/json-patch v5.9.0+incompatible // indirect
-	github.com/evanphx/json-patch/v5 v5.9.0 // indirect
+	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
 	github.com/fatih/color v1.16.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/gdamore/encoding v1.0.0 // indirect
-	github.com/gdamore/tcell/v2 v2.7.4 // indirect
+	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
+	github.com/gdamore/encoding v1.0.1 // indirect
+	github.com/gdamore/tcell/v2 v2.8.0 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-kit/log v0.2.1 // indirect
-	github.com/go-logfmt/logfmt v0.6.0 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/jsonpointer v0.21.0 // indirect
+	github.com/go-openapi/jsonpointer v0.21.1 // indirect
 	github.com/go-openapi/jsonreference v0.21.0 // indirect
-	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
+	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang-jwt/jwt/v4 v4.5.0 // indirect
+	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/btree v1.1.2 // indirect
-	github.com/google/cel-go v0.20.1 // indirect
-	github.com/google/gnostic-models v0.6.9-0.20230804172637-c7be7c783f49 // indirect
+	github.com/google/btree v1.1.3 // indirect
+	github.com/google/cel-go v0.23.2 // indirect
+	github.com/google/gnostic-models v0.6.9 // indirect
 	github.com/google/go-intervals v0.0.2 // indirect
 	github.com/google/go-querystring v1.1.0 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
-	github.com/gorilla/websocket v1.5.3 // indirect
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.21.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
 	github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
@@ -176,25 +179,24 @@ require (
 	github.com/hashicorp/golang-lru v1.0.2 // indirect
 	github.com/hashicorp/hcl v1.0.1-vault-5 // indirect
 	github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0 // indirect
-	github.com/imdario/mergo v0.3.16 // indirect
+	github.com/imdario/mergo v1.0.1 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
-	github.com/jmespath/go-jmespath v0.4.1-0.20220621161143-b0104c826a24 // indirect
 	github.com/jonboulle/clockwork v0.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 // indirect
 	github.com/kelseyhightower/envconfig v1.4.0 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.17.8 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/klauspost/pgzip v1.2.6 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/magiconair/properties v1.8.7 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-runewidth v0.0.15 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d // indirect
 	github.com/mistifyio/go-zfs/v3 v3.0.1 // indirect
 	github.com/mitchellh/colorstring v0.0.0-20190213212951-d06e56a500db // indirect
@@ -202,13 +204,14 @@ require (
 	github.com/mitchellh/hashstructure/v2 v2.0.2 // indirect
 	github.com/mitchellh/ioprogress v0.0.0-20180201004757-6a23b12fa88e // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/moby/buildkit v0.13.2 // indirect
+	github.com/moby/buildkit v0.16.0 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/patternmatcher v0.6.0 // indirect
-	github.com/moby/spdystream v0.2.0 // indirect
-	github.com/moby/sys/mountinfo v0.7.1 // indirect
+	github.com/moby/spdystream v0.5.0 // indirect
+	github.com/moby/sys/mountinfo v0.7.2 // indirect
 	github.com/moby/sys/sequential v0.5.0 // indirect
-	github.com/moby/sys/user v0.1.0 // indirect
+	github.com/moby/sys/user v0.3.0 // indirect
+	github.com/moby/sys/userns v0.1.0 // indirect
 	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
@@ -216,20 +219,20 @@ require (
 	github.com/morikuni/aec v1.0.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
-	github.com/onsi/gomega v1.34.1 // indirect
+	github.com/onsi/gomega v1.36.2 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/runtime-spec v1.2.0 // indirect
 	github.com/opencontainers/selinux v1.11.0 // indirect
 	github.com/openzipkin/zipkin-go v0.4.3 // indirect
 	github.com/ostreedev/ostree-go v0.0.0-20210805093236-719684c64e4f // indirect
-	github.com/pelletier/go-toml/v2 v2.1.0 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.1 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pjbgf/sha1cd v0.3.0 // indirect
-	github.com/prometheus/client_golang v1.19.1 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.55.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/prometheus/statsd_exporter v0.26.1 // indirect
+	github.com/prometheus/client_golang v1.22.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.65.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
+	github.com/prometheus/statsd_exporter v0.28.0 // indirect
 	github.com/rickb777/date v1.20.2 // indirect
 	github.com/rickb777/plural v1.4.1 // indirect
 	github.com/rivo/tview v0.0.0-20220307222120-9994674d60a8 // indirect
@@ -240,57 +243,65 @@ require (
 	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/skeema/knownhosts v1.2.2 // indirect
+	github.com/skeema/knownhosts v1.3.0 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
 	github.com/spf13/afero v1.11.0 // indirect
-	github.com/spf13/cast v1.6.0 // indirect
+	github.com/spf13/cast v1.7.1 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
 	github.com/spf13/viper v1.18.2 // indirect
 	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/sylabs/sif/v2 v2.16.0 // indirect
+	github.com/sylabs/sif/v2 v2.18.0 // indirect
 	github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
 	github.com/tchap/go-patricia/v2 v2.3.1 // indirect
 	github.com/tektoncd/triggers v0.27.0 // indirect
+	github.com/tonistiigi/go-csvvalue v0.0.0-20240710180619-ddb21b71c0b4 // indirect
 	github.com/ulikunitz/xz v0.5.12 // indirect
-	github.com/vbatts/tar-split v0.11.5 // indirect
+	github.com/vbatts/tar-split v0.11.6 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
+	github.com/yosida95/uritemplate/v3 v3.0.2 // indirect
 	go.opencensus.io v0.24.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.50.0 // indirect
-	go.opentelemetry.io/otel v1.27.0 // indirect
-	go.opentelemetry.io/otel/metric v1.27.0 // indirect
-	go.opentelemetry.io/otel/trace v1.27.0 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.58.0 // indirect
+	go.opentelemetry.io/otel v1.37.0 // indirect
+	go.opentelemetry.io/otel/metric v1.37.0 // indirect
+	go.opentelemetry.io/otel/trace v1.37.0 // indirect
 	go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
-	golang.org/x/mod v0.21.0 // indirect
-	golang.org/x/sys v0.26.0 // indirect
-	golang.org/x/text v0.19.0 // indirect
-	golang.org/x/time v0.6.0 // indirect
-	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/api v0.183.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240814211410-ddb44dafa142 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142 // indirect
-	google.golang.org/grpc v1.67.1 // indirect
-	google.golang.org/protobuf v1.35.1 // indirect
+	go.yaml.in/yaml/v2 v2.4.2 // indirect
+	go.yaml.in/yaml/v3 v3.0.3 // indirect
+	golang.org/x/exp v0.0.0-20250210185358-939b2ce775ac // indirect
+	golang.org/x/mod v0.25.0 // indirect
+	golang.org/x/text v0.26.0 // indirect
+	golang.org/x/time v0.11.0 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
+	google.golang.org/api v0.204.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
+	google.golang.org/grpc v1.73.0 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
-	k8s.io/apiextensions-apiserver v0.30.3 // indirect
-	k8s.io/apiserver v0.30.3 // indirect
-	k8s.io/cli-runtime v0.29.2 // indirect
-	k8s.io/kube-openapi v0.0.0-20240808142205-8e686545bdb8 // indirect
-	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 // indirect
-	knative.dev/client-pkg v0.0.0-20241022130700-7b4bb48ac250 // indirect
-	knative.dev/networking v0.0.0-20241022012959-60e29ff520dc // indirect
-	sigs.k8s.io/controller-runtime v0.7.2 // indirect
-	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/kustomize/api v0.13.5-0.20230601165947-6ce0bf390ce3 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.14.3-0.20230601165947-6ce0bf390ce3 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
-	sigs.k8s.io/yaml v1.4.0 // indirect
+	k8s.io/apiextensions-apiserver v0.33.1 // indirect
+	k8s.io/apiserver v0.33.1 // indirect
+	k8s.io/cli-runtime v0.31.4 // indirect
+	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
+	k8s.io/utils v0.0.0-20250321185631-1f6e0b77f77e // indirect
+	knative.dev/networking v0.0.0-20250616174156-f950c0c1a0a8 // indirect
+	sigs.k8s.io/controller-runtime v0.20.4 // indirect
+	sigs.k8s.io/gateway-api v1.1.0 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/kustomize/api v0.17.2 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.17.1 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
+	sigs.k8s.io/yaml v1.5.0 // indirect
 )

hack/allocate.sh

@@ -20,17 +20,9 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-source "$(dirname "$(realpath "$0")")/common.sh"
-
-
-set_versions() {
-  # Note: Kubernetes Version node image per Kind releases (full hash is suggested):
-  # https://github.com/kubernetes-sigs/kind/releases
-  kind_node_version=v1.29.2@sha256:51a1434a5397193442f0be2a297b488b6c919ce8a3931be0ce822606ea5ca245
-  knative_serving_version="v$(get_latest_release_version "knative" "serving")"
-  knative_eventing_version="v$(get_latest_release_version "knative" "eventing")"
-  contour_version="v$(get_latest_release_version "knative-extensions" "net-contour")"
-}
+source "$(cd "$(dirname "$0")" && pwd)/common.sh"
+# this is where versions of common components are (like knative)
+source "$(cd "$(dirname "$0")" && pwd)/component-versions.sh"
 
 main() {
   echo "${blue}Allocating${reset}"
@@ -45,12 +37,14 @@ main() {
   echo "evt:  Eventing and Namespace"
   echo "reg:  Local Registry"
   echo "dpr:  Dapr Runtime"
+  echo "tkt:  Tekton Pipelines"
   echo ""
 
   ( set -o pipefail; (serving && dns && networking) 2>&1 | sed  -e 's/^/svr /')&
   ( set -o pipefail; (eventing && namespace) 2>&1 | sed  -e 's/^/evt /')&
   ( set -o pipefail; registry 2>&1 | sed  -e 's/^/reg /') &
   ( set -o pipefail; dapr_runtime 2>&1 | sed  -e 's/^/dpr /')&
+  ( set -o pipefail; (tekton && pac) 2>&1 | sed  -e 's/^/tkt /')&
 
   local job
   for job in $(jobs -p); do
@@ -62,46 +56,6 @@ main() {
   echo -e "\n${green}🎉 DONE${reset}\n"
 }
 
-# Retrieve latest version from given Knative repository tags
-# On 'main' branch the latest released version is returned
-# On 'release-x.y' branch the latest patch version for 'x.y.*' is returned
-# Similar to hack/library.sh get_latest_knative_yaml_source()
-function get_latest_release_version() {
-    local org_name="$1"
-    local repo_name="$2"
-    local major_minor=""
-    if is_release_branch; then
-      local branch_name
-      branch_name="$(current_branch)"
-      major_minor="${branch_name##release-}"
-    fi
-    local version
-    version="$(git ls-remote --tags --ref https://github.com/"${org_name}"/"${repo_name}".git \
-      | grep "${major_minor}" \
-      | cut -d '-' -f2 \
-      | cut -d 'v' -f2 \
-      | sort -Vr \
-      | head -n 1)"
-    echo "${version}"
-}
-
-# Returns whether the current branch is a release branch.
-function is_release_branch() {
-  [[ $(current_branch) =~ ^release-[0-9\.]+$ ]]
-}
-
-# Returns the current branch.
-# Taken from knative/hack. The function covers Knative CI use cases and local variant.
-function current_branch() {
-  local branch_name=""
-  # Get the branch name from Prow's env var, see https://github.com/kubernetes/test-infra/blob/master/prow/jobs.md.
-  # Otherwise, try getting the current branch from git.
-  (( ${IS_PROW:-} )) && branch_name="${PULL_BASE_REF:-}"
-  [[ -z "${branch_name}" ]] && branch_name="${GITHUB_BASE_REF:-}"
-  [[ -z "${branch_name}" ]] && branch_name="$(git rev-parse --abbrev-ref HEAD)"
-  echo "${branch_name}"
-}
-
 kubernetes() {
   cat <<EOF | $KIND create cluster --name=func --kubeconfig="${KUBECONFIG}" --wait=60s --config=-
 kind: Cluster
@@ -113,7 +67,7 @@ nodes:
     - containerPort: 80
       hostPort: 80
       listenAddress: "127.0.0.1"
-    - containerPort: 433
+    - containerPort: 443
       hostPort: 443
       listenAddress: "127.0.0.1"
     - containerPort: 30022
@@ -161,7 +115,7 @@ dns() {
     $KUBECTL patch configmap/config-domain \
     --namespace knative-serving \
     --type merge \
-    --patch '{"data":{"127.0.0.1.sslip.io":""}}' && break
+    --patch '{"data":{"localtest.me":""}}' && break
 
     (( i+=1 ))
     if (( i>=n )); then
@@ -174,6 +128,17 @@ dns() {
   echo "${green}✅ DNS${reset}"
 }
 
+arr2yaml() {
+  echo -n '['
+  local e
+  local s=""
+  for e in "$@"; do
+    printf '%s"%s"' "$s" "$e";
+    s=", "
+  done
+  echo -n ']'
+}
+
 loadbalancer() {
   echo "${blue}Installing Load Balancer (Metallb)${reset}"
   $KUBECTL apply -f "https://raw.githubusercontent.com/metallb/metallb/v0.13.7/config/manifests/metallb-native.yaml"
@@ -184,7 +149,22 @@ loadbalancer() {
     --timeout=300s
 
   local kind_addr
+  local kind_addr6
+  local addr_array
+
   kind_addr="$($CONTAINER_ENGINE container inspect func-control-plane | jq '.[0].NetworkSettings.Networks.kind.IPAddress' -r)"
+  kind_addr6="$($CONTAINER_ENGINE container inspect func-control-plane | jq '.[0].NetworkSettings.Networks.kind.GlobalIPv6Address' -r)"
+
+  addr_array=()
+
+  if [[ -n "$kind_addr" ]]; then
+    addr_array+=("$kind_addr/32");
+  fi
+
+  if [[ -n "$kind_addr6" ]]; then
+    addr_array+=("$kind_addr6/128");
+  fi
+
 
   echo "Setting up address pool."
   $KUBECTL apply -f - <<EOF
@@ -194,8 +174,7 @@ metadata:
   name: example
   namespace: metallb-system
 spec:
-  addresses:
-  - ${kind_addr}-${kind_addr}
+  addresses: $(arr2yaml "${addr_array[@]}")
 ---
 apiVersion: metallb.io/v1beta1
 kind: L2Advertisement
@@ -226,6 +205,9 @@ networking() {
     --type merge \
     --patch '{"data":{"ingress-class":"contour.ingress.networking.knative.dev"}}'
 
+  echo "Patching contour to prefer duals-tack"
+  kubectl patch -n contour-external svc/envoy --type merge --patch '{"spec":{"ipFamilyPolicy":"PreferDualStack"}}'
+
   $KUBECTL wait pod --for=condition=Ready -l '!job-name' -n contour-external --timeout=10m
   $KUBECTL wait pod --for=condition=Ready -l '!job-name' -n knative-serving --timeout=10m
   echo "${green}✅ Ingress${reset}"
@@ -305,7 +287,7 @@ namespace() {
   # Default Broker
   $KUBECTL apply -f - <<EOF
   apiVersion: eventing.knative.dev/v1
-  kind: broker
+  kind: Broker
   metadata:
    name: func-broker
    namespace: func
@@ -416,6 +398,70 @@ EOF
   echo "${green}✅ Dapr Runtime${reset}"
 }
 
+tekton() {
+  echo "${blue}Installing Tekton ${tekton_version} ${reset}"
+
+  tekton_release="previous/${tekton_version}"
+  namespace="${NAMESPACE:-default}"
+
+  $KUBECTL apply -f "https://storage.googleapis.com/tekton-releases/pipeline/${tekton_release}/release.yaml"
+  sleep 10
+  $KUBECTL wait pod --for=condition=Ready --timeout=180s -n tekton-pipelines -l "app=tekton-pipelines-controller"
+  $KUBECTL wait pod --for=condition=Ready --timeout=180s -n tekton-pipelines -l "app=tekton-pipelines-webhook"
+  sleep 10
+
+  $KUBECTL create clusterrolebinding "${namespace}:knative-serving-namespaced-admin" --clusterrole=knative-serving-namespaced-admin --serviceaccount="${namespace}:default"
+
+  # TEMPORARY WORKAROUND: Disable affinity assistant to prevent pod scheduling issues
+  # This is a workaround for issues where affinity assistant pod names don't match
+  # what's expected by task pods, causing them to fail scheduling.
+  # Related issues:
+  # - https://github.com/tektoncd/pipeline/issues/6740
+  # - https://github.com/tektoncd/pipeline/issues/7503
+  # TODO: Remove this workaround once the underlying Tekton issue is resolved
+  echo "${blue}- Disabling affinity assistant (temporary workaround)${reset}"
+  $KUBECTL patch configmap feature-flags -n tekton-pipelines \
+    -p '{"data":{"disable-affinity-assistant":"true", "coschedule":"disabled"}}' \
+    --type=merge
+
+  echo "${green}✅ Tekton${reset}"
+}
+
+pac() {
+  echo "${blue}Installing PAC (Pipelines-as-Code) ${pac_version} ${reset}"
+
+  local -r pac_ctr_host="${PAC_CONTROLLER_HOSTNAME:-pac-ctr.localtest.me}"
+
+  # Install Pipelines as Code
+  $KUBECTL apply -f "https://raw.githubusercontent.com/openshift-pipelines/pipelines-as-code/release-${pac_version}/release.k8s.yaml"
+  sleep 5
+  $KUBECTL wait pod --for=condition=Ready -l '!job-name' -n pipelines-as-code --timeout=5m
+
+  # Install ingress for the PaC controller. This is used by VCS Webhooks.
+  $KUBECTL apply -f - << EOF
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: pipelines-as-code
+  namespace: pipelines-as-code
+spec:
+  ingressClassName: contour-external
+  rules:
+  - host: ${pac_ctr_host}
+    http:
+      paths:
+      - backend:
+          service:
+            name: pipelines-as-code-controller
+            port:
+              number: 8080
+        pathType: Prefix
+        path: /
+EOF
+  echo "the Pipeline as Code controller is available at: http://${pac_ctr_host}"
+  echo "${green}✅ PAC${reset}"
+}
+
 next_steps() {
   echo -e ""
   echo -e "${blue}Next Steps${reset}"
@@ -424,7 +470,10 @@ next_steps() {
   echo -e "${grey}REGISTRY"
   echo -e "Before using the cluster for integration and E2E tests, please run \"${reset}registry.sh${grey}\" (Linux systems) which will configure podman or docker to communicate with the standalone container registry without TLS."
   echo -e ""
-  echo -e "For other operating systems, or to do this manually, edit the docker daemon config (/etc/docker/daemon.json on linux and ~/.docker/daemon.json on OSX), add:"
+  echo -e "For other operating systems, or to do this manually, edit the docker daemon config:"
+  echo -e "  - Linux: /etc/docker/daemon.json"
+  echo -e "  - macOS: ~/.docker/daemon.json (or via Docker Desktop settings)"
+  echo -e "Add the following configuration:"
   echo -e "${reset}{ \"insecure-registries\": [ \"localhost:50000\" ] }"
   echo -e ""
   echo -e "${grey}For podman, edit /etc/container/registries.conf to include:"

hack/cmd/update-knative-components/main.go

@@ -0,0 +1,384 @@
+// Package main implements a tool for automatically updating component
+// versions for use in the hack/* scripts.
+//
+// Files interacted with:
+//  1. The source-of-truth file at hack/component-versions.json
+//  2. Autogenerated script at hack/component-versions.sh
+//
+// Usage:
+//
+// Most of the time this file will be used in a workflow that will run
+// on scheduled basis checking if a new latest version of corresponding
+// components exists (check components in 'Versions' struct). Please note that
+// KindNode is NOT being updated programmatically at this time.
+// When new latest version is detected, the program will create a PR in
+// knative/func repository with the latest changes allowing the CI/CD workflows
+// to run automatically before using the latest in main branch.
+//
+// Alternative use: You can run this file from hack/ directory to locally
+// regenerate 2 files mentioned above (if you made some changes etc.) - you can
+// use the root Makefile for your convenience -- 'make regenerate-kn-components'
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"html/template"
+	"os"
+	"os/exec"
+	"os/signal"
+	"syscall"
+	"time"
+
+	github "github.com/google/go-github/v68/github"
+)
+
+const (
+	fileScript string = "component-versions.sh"
+	fileJson   string = "component-versions.json"
+
+	versionsScriptTemplate string = `#!/usr/bin/env bash
+
+# AUTOGENERATED FILE - edit versions in ./component-versions.json.
+# If you are adding components, modify this scripts' template in
+# ./cmd/update-knative-components/main.go.
+# You can regenerate locally with "make generate-kn-components-local".
+
+set_versions() {
+	# Note: Kubernetes Version node image per Kind releases (full hash is suggested):
+	# https://github.com/kubernetes-sigs/kind/releases
+	kind_node_version={{.KindNode}}
+
+	# gets updated programatically via workflow -> PR creation
+	knative_serving_version="{{.Serving}}"
+	knative_eventing_version="{{.Eventing}}"
+	contour_version="{{.Contour}}"
+	tekton_version="{{.Tekton}}"
+	pac_version="{{.Pac}}"
+}
+`
+)
+
+// all the components that are kept up to date
+type Versions struct {
+	KindNode string
+	Serving  string
+	Eventing string
+	Contour  string
+	Tekton   string
+	Pac      string
+}
+
+func main() {
+	// there is an optional "local" argument
+	if len(os.Args) == 2 && os.Args[1] == "local" { //leveraging lazy evals
+		fmt.Println("Generate argument received! Regenerating files locally...")
+		err := generateComponentVersions()
+		if err != nil {
+			fmt.Fprintf(os.Stderr, "error: %v", err)
+			os.Exit(1)
+		}
+		fmt.Println("done")
+		os.Exit(0)
+	}
+
+	// Set up context for possible signal inputs to not disrupt cleanup process.
+	// This is not gonna do much for workflows since they finish and shutdown
+	// but in case of local testing - dont leave left over resources on disk/RAM.
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	sigs := make(chan os.Signal, 1)
+	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
+	go func() {
+		<-sigs
+		cancel()
+		<-sigs
+		os.Exit(130)
+	}()
+
+	const prTitle = "chore: Update components' versions to latest"
+	client := github.NewClient(nil).WithAuthToken(os.Getenv("GITHUB_TOKEN"))
+
+	e, err := prExists(ctx, client, prTitle)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	if e {
+		fmt.Printf("PR already exists, nothing to do, exiting")
+		os.Exit(0)
+	}
+
+	projects := []struct {
+		owner, repo string
+	}{
+		{
+			owner: "knative",
+			repo:  "serving",
+		},
+		{
+			owner: "knative",
+			repo:  "eventing",
+		},
+		{
+			owner: "knative-extensions",
+			repo:  "net-contour",
+		},
+	}
+
+	// Get current versions used.
+	v, err := readVersions(fileJson)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+
+	updated := false
+	// cycle through all versions of components listed above, fetch their
+	// latest from github releases - cmp them - create PR for update if necessary
+	for _, p := range projects {
+		newV, err := getLatestVersion(ctx, client, p.owner, p.repo)
+		if err != nil {
+			err = fmt.Errorf("error while getting latest v of %s/%s: %v", p.owner, p.repo, err)
+			fmt.Fprintln(os.Stderr, err)
+			os.Exit(1)
+		}
+
+		// try to overwrite with possibly new versions
+		if updateVersion(&v, p.repo, newV) {
+			// if any of the files are updated, set true
+			updated = true
+		}
+	}
+
+	if !updated {
+		// nothing was updated, nothing to do
+		fmt.Printf("all good, no newer component releases, exiting\n")
+		os.Exit(0)
+	}
+
+	if err := writeFiles(v, fileScript, fileJson); err != nil {
+		err = fmt.Errorf("failed to write files: %v", err)
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+
+	fmt.Println("files updated!")
+
+	branchName := "update-components" + time.Now().Format(time.DateOnly)
+	err = prepareBranch(branchName)
+	if err != nil {
+		err = fmt.Errorf("failed to prep the branch: %v", err)
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+	err = createPR(ctx, client, prTitle, branchName)
+	if err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(1)
+	}
+}
+
+// read (unmarshal) component versions from .json
+func readVersions(file string) (v Versions, err error) {
+	fmt.Print("> Reading versions from file...")
+	data, err := os.ReadFile(file)
+	if err != nil {
+		return
+	}
+	err = json.Unmarshal(data, &v)
+	if err != nil {
+		return v, err
+	}
+	fmt.Println("done")
+	return v, nil
+}
+
+// attempt to update 'v' Versions to new 'val' for specific 'repo'
+// 'v' - structure that holds versions of components
+// 'repo' - points to a component repo that is being updated (example: serving)
+// 'val' - value of the latest release of that repo (pulled via GH API)
+func updateVersion(v *Versions, repo, val string) (updated bool) {
+	fmt.Printf("check for %s update...", repo)
+	if repo == "serving" && v.Serving != val {
+		v.Serving = val
+		updated = true
+	} else if repo == "eventing" && v.Eventing != val {
+		v.Eventing = val
+		updated = true
+	} else if repo == "net-contour" && v.Contour != val {
+		v.Contour = val
+		updated = true
+	}
+	if updated {
+		fmt.Printf("found! new:'%s'\n", val)
+	} else {
+		fmt.Println("nothing to do")
+	}
+	return
+}
+
+// Overwrite the 'source of truth' file - .json and regenerate new script
+// with new versions from 'v'.
+// Arguments 'script' & 'json' are paths to files for autogenerated script and
+// source (json) file respectively.
+func writeFiles(v Versions, script, json string) error {
+	fmt.Print("> Writing into files...")
+	// write to json
+	err := writeVersionsSource(v, json)
+	if err != nil {
+		return fmt.Errorf("failed to write to json: %v", err)
+	}
+	// write to script file
+	err = writeVersionsScript(v, script)
+	if err != nil {
+		return fmt.Errorf("failed to generate script: %v", err)
+	}
+	fmt.Println("done")
+	return nil
+}
+
+// write to 'source of truth' file (json) with updated versions
+func writeVersionsSource(v Versions, file string) error {
+	vB, err := json.MarshalIndent(v, "", "	")
+	if err != nil {
+		return fmt.Errorf("cant Marshal versions: %v", err)
+	}
+	f, err := os.Create(file)
+	if err != nil {
+		return err
+	}
+
+	defer f.Close()
+
+	_, err = f.Write(append(vB, '\n')) // append newline for reviewdog
+	return err
+}
+
+// write to autogenerated script file with newest Versions via templates pkg
+func writeVersionsScript(v Versions, file string) error {
+	tmpl, err := template.New("versions").Parse(versionsScriptTemplate)
+	if err != nil {
+		return err
+	}
+	f, err := os.Create(file)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	if err := tmpl.Execute(f, v); err != nil {
+		return err
+	}
+	return nil
+}
+
+// get latest version of owner/repo via GH API
+func getLatestVersion(ctx context.Context, client *github.Client, owner string, repo string) (v string, err error) {
+	fmt.Printf("> get latest '%s/%s'...", owner, repo)
+	rr, res, err := client.Repositories.GetLatestRelease(ctx, owner, repo)
+	if err != nil {
+		err = fmt.Errorf("error: request for latest %s release: %v", owner+"/"+repo, err)
+		return
+	}
+	if res.StatusCode < 200 && res.StatusCode > 299 {
+		err = fmt.Errorf("error: Return status code of request for latest %s release is %d", owner+"/"+repo, res.StatusCode)
+		return
+	}
+	v = *rr.Name
+	if v == "" {
+		return "", fmt.Errorf("internal error: returned latest release name is empty for '%s'", repo)
+	}
+	fmt.Println("done")
+	return v, nil
+}
+
+// prepare branch for PR via git commands
+// config user as knative bot -> create branch -> add changes -> commit -> push
+func prepareBranch(branchName string) error {
+	fmt.Println("> preparing branch")
+	cmd := exec.Command("bash", "-c", fmt.Sprintf(`
+		git config --local user.email "automation@knative.team" &&
+		git config --local user.name "Knative Automation" &&
+		git switch -c %s &&
+		git add %s %s &&
+		git commit -m "update components" &&
+		git push origin %s
+	`, branchName, fileScript, fileJson, branchName))
+
+	cmd.Stderr = os.Stderr
+	cmd.Stdout = os.Stdout
+	return cmd.Run()
+}
+
+// create a PR via GH API on the func repo with those new versions
+func createPR(ctx context.Context, client *github.Client, title string, branchName string) error {
+	fmt.Print("> creating PR...")
+	bodyText := "You might need to close & open this PR so all tests can run"
+	body := fmt.Sprintf("%s\n%s\n/assign @gauron99", title, bodyText)
+
+	newPR := github.NewPullRequest{
+		Title:               github.Ptr(title),
+		Base:                github.Ptr("main"),
+		Head:                github.Ptr(branchName),
+		Body:                github.Ptr(body),
+		MaintainerCanModify: github.Ptr(true),
+	}
+	pr, _, err := client.PullRequests.Create(ctx, "knative", "func", &newPR)
+	if err != nil {
+		fmt.Printf("PR looks like this:\n%#v\n", pr)
+		fmt.Printf("err: %s\n", err)
+		return err
+	}
+	fmt.Println("ready")
+	return nil
+}
+
+// Returns true when PR with given title already exists in knative/func repo
+// otherwise false.
+// Returns an error if occurred, otherwise nil.
+func prExists(ctx context.Context, c *github.Client, title string) (bool, error) {
+	perPage := 10
+	opt := &github.PullRequestListOptions{State: "open", ListOptions: github.ListOptions{PerPage: perPage}}
+	for {
+		list, resp, err := c.PullRequests.List(ctx, "knative", "func", opt)
+		if err != nil {
+			return false, fmt.Errorf("errror pulling PRs in knative/func: %s", err)
+		}
+		for _, pr := range list {
+			if pr.GetTitle() == title {
+				// gauron99 - currently cannot update already existing PR
+				return true, nil
+			}
+		}
+		if resp.NextPage == 0 {
+			// hit end of list
+			return false, nil
+		}
+		// otherwise, continue to the next page
+		opt.Page = resp.NextPage
+	}
+}
+
+// -------------------------------------------------------------------------- \\
+// -------------------------------------------------------------------------- \\
+// -------------------------------------------------------------------------- \\
+// -------------------------------------------------------------------------- \\
+
+// This is used when running this file with 1st argument "local".
+// Regenerate written files (source (.json) & autogenerated .sh file)
+// Generally you wont use this, but in case you make local changes to the
+// files, you can simply regenerate them with this
+func generateComponentVersions() error {
+	v, err := readVersions(fileJson)
+	if err != nil {
+		return fmt.Errorf("failed to read Versions from json: %v", err)
+	}
+	// generate
+	err = writeFiles(v, fileScript, fileJson)
+	if err != nil {
+		return fmt.Errorf("failed to write Versions: %v", err)
+	}
+	return nil
+}

hack/cmd/update-knative-components/main_test.go

@@ -0,0 +1,109 @@
+package main
+
+import (
+	"io/fs"
+	"os"
+	"path"
+	"testing"
+
+	"gotest.tools/v3/assert"
+)
+
+const expectedScript string = `#!/usr/bin/env bash
+
+# AUTOGENERATED FILE - edit versions in ./component-versions.json.
+# If you are adding components, modify this scripts' template in
+# ./cmd/update-knative-components/main.go.
+# You can regenerate locally with "make generate-kn-components-local".
+
+set_versions() {
+	# Note: Kubernetes Version node image per Kind releases (full hash is suggested):
+	# https://github.com/kubernetes-sigs/kind/releases
+	kind_node_version=v1.30
+
+	# gets updated programatically via workflow -> PR creation
+	knative_serving_version="v1.2.3"
+	knative_eventing_version="v1.4.5"
+	contour_version="v1.4.6"
+	tekton_version="v0.56.4"
+	pac_version="v0.24.6"
+}
+`
+
+const expectedJson string = `{
+	"KindNode": "v1.30",
+	"Serving": "v1.2.3",
+	"Eventing": "v1.4.5",
+	"Contour": "v1.4.6",
+	"Tekton": "v0.56.4",
+	"Pac": "v0.24.6"
+}
+`
+
+// TestRead should just successfully unmarshal ('v' struct & json compatibility)
+func TestRead(t *testing.T) {
+	dir := t.TempDir()
+
+	const jsonContent string = `{
+	"Serving": "v1.14",
+	"Eventing": "v1.15",
+	"Contour": "v1.61",
+	"KindNode": "1.3456",
+	"Tekton": "v0.50.0",
+	"Pac": "v0.20.0"
+}
+`
+	tmpJson := path.Join(dir, "json.json")
+	err := os.WriteFile(tmpJson, []byte(jsonContent), fs.ModePerm)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	_, err = readVersions(tmpJson)
+	if err != nil {
+		t.Fatalf("failed to read json: %v", err)
+	}
+}
+
+// TestWrite ensures that writing both files succeeds with the correct file
+// contents
+func TestWrite(t *testing.T) {
+	dir := t.TempDir()
+
+	tmpJson := path.Join(dir, "f.json")
+	tmpSh := path.Join(dir, "f.sh")
+
+	v := Versions{
+		Serving:  "v1.2.3",
+		Eventing: "v1.4.5",
+		Contour:  "v1.4.6",
+		KindNode: "v1.30",
+		Tekton:   "v0.56.4",
+		Pac:      "v0.24.6",
+	}
+
+	// write to script (generate it)
+	err := writeVersionsScript(v, tmpSh)
+	if err != nil {
+		t.Fatalf("failed to generate script: %v", err)
+	}
+	// assert
+	fsh, err := os.ReadFile(tmpSh)
+	if err != nil {
+		t.Fatalf("failed to read file: %v", err)
+	}
+	assert.Equal(t, string(fsh), expectedScript)
+
+	// write to json
+	err = writeVersionsSource(v, tmpJson)
+	if err != nil {
+		t.Fatalf("failed to write json: %v", err)
+	}
+
+	// assert
+	fjson, err := os.ReadFile(tmpJson)
+	if err != nil {
+		t.Fatalf("failed to read json: %v", err)
+	}
+	assert.Equal(t, string(fjson), expectedJson)
+}

hack/common.sh

@@ -29,11 +29,25 @@ find_executables() {
 }
 
 populate_environment() {
-  export ARCH="${ARCH:-amd64}"
+  # User's KUBECOFNIG and that used by these scripts should be isolated:
+  export KUBECONFIG="$(cd "$(dirname "$0")" && pwd)/bin/kubeconfig.yaml"
+  # Detect architecture, default to amd64 if unable to detect
+  if [[ -z "${ARCH:-}" ]]; then
+    local machine_arch=$(uname -m)
+    case $machine_arch in
+      x86_64) export ARCH="amd64" ;;
+      aarch64|arm64) export ARCH="arm64" ;;
+      *) export ARCH="amd64" ;;
+    esac
+  else
+    export ARCH="$ARCH"
+  fi
   export CONTAINER_ENGINE=${CONTAINER_ENGINE:-docker}
-  export KUBECONFIG="${KUBECONFIG:-$(dirname "$(realpath "$0")")/bin/kubeconfig.yaml}"
   export TERM="${TERM:-dumb}"
+
   echo "KUBECONFIG=${KUBECONFIG}"
+  echo "CONTAINER_ENGINE=${CONTAINER_ENGINE}"
+  echo "TERM=${TERM}"
 }
 
 define_colors() {
@@ -75,7 +89,7 @@ find_executable() {
 
   # Use the binary installed into hack/bin/ by allocate.sh if
   # it exists.
-  path=$(dirname "$(realpath "$0")")"/bin/$name"
+  path=$(cd "$(dirname "$0")" && pwd)"/bin/$name"
   if [[ -x "$path" ]]; then
     echo "$path" & return 0
   fi

hack/component-versions.json

@@ -0,0 +1,8 @@
+{
+	"KindNode": "v1.32.0@sha256:c48c62eac5da28cdadcf560d1d8616cfa6783b58f0d94cf63ad1bf49600cb027",
+	"Serving": "v1.18.1",
+	"Eventing": "v1.18.2",
+	"Contour": "v1.18.0",
+	"Tekton": "v1.1.0",
+	"Pac": "v0.35.2"
+}

hack/component-versions.sh

@@ -0,0 +1,19 @@
+#!/usr/bin/env bash
+
+# AUTOGENERATED FILE - edit versions in ./component-versions.json.
+# If you are adding components, modify this scripts' template in
+# ./cmd/update-knative-components/main.go.
+# You can regenerate locally with "make generate-kn-components-local".
+
+set_versions() {
+	# Note: Kubernetes Version node image per Kind releases (full hash is suggested):
+	# https://github.com/kubernetes-sigs/kind/releases
+	kind_node_version=v1.32.0@sha256:c48c62eac5da28cdadcf560d1d8616cfa6783b58f0d94cf63ad1bf49600cb027
+
+	# gets updated programatically via workflow -> PR creation
+	knative_serving_version="v1.18.1"
+	knative_eventing_version="v1.18.2"
+	contour_version="v1.18.0"
+	tekton_version="v1.1.0"
+	pac_version="v0.35.2"
+}

hack/install-binaries.sh

@@ -19,21 +19,23 @@
 source "$(dirname "$(realpath "$0")")/common.sh"
 
 install_binaries() {
-  assert_linux
+  assert_supported_os
+  set_os_arch_vars
   warn_architecture
 
   local root="$(dirname "$(realpath "$0")")"
   local bin="${root}/bin"
 
-  local kubectl_version=1.29.2
-  local kind_version=0.22.0
-  local dapr_version=1.11.0
-  local helm_version=3.12.0
-  local stern_version=1.25.0
-  local kn_version=1.13.0
+  local kubectl_version=1.33.1
+  local kind_version=0.29.0
+  local dapr_version=1.14.1
+  local helm_version=3.18.0
+  local stern_version=1.32.0
+  local kn_version=1.18.0
   local jq_version=1.7.1
 
   echo "${blue}Installing binaries${reset}"
+  echo "  OS:           ${OS}"
   echo "  Architecture: ${ARCH}"
   echo "  Destination:  ${bin}"
 
@@ -51,71 +53,97 @@ install_binaries() {
 
 }
 
-assert_linux() {
+assert_supported_os() {
   os_name=$(uname -s)
-  if [ "$os_name" != "Linux" ]; then
+  if [ "$os_name" != "Linux" ] && [ "$os_name" != "Darwin" ]; then
     echo "${yellow}----------------------------------------------------------------------${reset}"
-    echo "${yellow}This script currently only supports Linux${reset}"
+    echo "${yellow}This script only supports Linux and Darwin (macOS)${reset}"
     echo "Please install the dependencies manually"
     echo "${yellow}----------------------------------------------------------------------${reset}"
     exit 1
   fi
 }
 
+set_os_arch_vars() {
+  OS=$(uname -s | tr '[:upper:]' '[:lower:]')
+  ARCH_RAW=$(uname -m)
+  
+  # Map architecture names
+  case "${ARCH_RAW}" in
+    x86_64)
+      ARCH="amd64"
+      ;;
+    aarch64|arm64)
+      ARCH="arm64"
+      ;;
+    *)
+      ARCH="${ARCH_RAW}"
+      ;;
+  esac
+  
+  # Override with environment variable if set
+  ARCH="${ARCH:-$ARCH}"
+}
+
 warn_architecture() {
   arch=$(uname -m)
-  if [ "$arch" != "x86_64" ]; then
-    echo -e "${yellow}Detected untested architecture ${arch}.${reset}\n This script is only tested with amd64, but you can use the ARCH env variable to specify an architecture to be interpolated in download links."
+  if [ "$arch" != "x86_64" ] && [ "$arch" != "arm64" ] && [ "$arch" != "aarch64" ]; then
+    echo -e "${yellow}Detected untested architecture ${arch}.${reset}\n This script is tested with amd64 and arm64, but you can use the ARCH env variable to specify an architecture to be interpolated in download links."
   fi
 }
 
 install_kubectl() {
     echo '=== kubectl'
-    curl -sSLo "${bin}"/kubectl "https://storage.googleapis.com/kubernetes-release/release/v$kubectl_version/bin/linux/${ARCH}/kubectl"
+    curl -sSLo "${bin}"/kubectl "https://dl.k8s.io/v${kubectl_version}/bin/${OS}/${ARCH}/kubectl"
     chmod +x "${bin}"/kubectl
     "${bin}"/kubectl version --client=true
 }
 
 install_kind() {
     echo '=== kind'
-    curl -sSLo "${bin}"/kind "https://github.com/kubernetes-sigs/kind/releases/download/v$kind_version/kind-linux-${ARCH}"
+    curl -sSLo "${bin}"/kind "https://github.com/kubernetes-sigs/kind/releases/download/v$kind_version/kind-${OS}-${ARCH}"
     chmod +x "${bin}"/kind
     "${bin}"/kind version
 }
 
 install_dapr() {
     echo '=== dapr'
-    curl -sSL "https://github.com/dapr/cli/releases/download/v$dapr_version/dapr_linux_${ARCH}.tar.gz" | \
+    curl -sSL "https://github.com/dapr/cli/releases/download/v$dapr_version/dapr_${OS}_${ARCH}.tar.gz" | \
       tar fxz - -C "${bin}" dapr
     "${bin}"/dapr version
 }
 
 install_helm() {
   echo '=== helm'
-    curl -sSL "https://get.helm.sh/helm-v$helm_version-linux-${ARCH}.tar.gz" | \
-      tar fxz - -C "${bin}" linux-"${ARCH}"/helm
-    mv "${bin}/linux-${ARCH}"/helm "${bin}" && rmdir "${bin}/linux-${ARCH}"
+    curl -sSL "https://get.helm.sh/helm-v$helm_version-${OS}-${ARCH}.tar.gz" | \
+      tar fxz - -C "${bin}" ${OS}-"${ARCH}"/helm
+    mv "${bin}/${OS}-${ARCH}"/helm "${bin}" && rmdir "${bin}/${OS}-${ARCH}"
     "${bin}"/helm version
 }
 
 install_stern() {
   echo '=== stern'
-  curl -sSL "https://github.com/stern/stern/releases/download/v${stern_version}/stern_${stern_version}_linux_${ARCH}.tar.gz" | \
+  curl -sSL "https://github.com/stern/stern/releases/download/v${stern_version}/stern_${stern_version}_${OS}_${ARCH}.tar.gz" | \
     tar fxz - -C "${bin}" stern
   "${bin}"/stern -v
 }
 
 install_kn() {
   echo '=== kn'
-  curl -sSLo "${bin}"/kn "https://github.com/knative/client/releases/download/knative-v${kn_version}/kn-linux-${ARCH}"
+  curl -sSLo "${bin}"/kn "https://github.com/knative/client/releases/download/knative-v${kn_version}/kn-${OS}-${ARCH}"
   chmod +x "${bin}"/kn
   "${bin}"/kn version
 }
 
 install_jq() {
   echo '=== jq'
-                       # "https://github.com/jqlang/jq/releases/download/jq-1.7.1/jq-linux-amd64"
-  curl -sSLo "${bin}"/jq "https://github.com/jqlang/jq/releases/download/jq-${jq_version}/jq-linux-${ARCH}"
+  # jq uses different naming conventions for macOS
+  if [ "$OS" = "darwin" ]; then
+    JQ_OS="macos"
+  else
+    JQ_OS="linux"
+  fi
+  curl -sSLo "${bin}"/jq "https://github.com/jqlang/jq/releases/download/jq-${jq_version}/jq-${JQ_OS}-${ARCH}"
   chmod +x "${bin}"/jq
   "${bin}"/jq --version
 }

hack/install-git-server.sh

@@ -17,31 +17,79 @@ set -o nounset
 set -o pipefail
 
 git_server() {
-  echo "Creating Git Server Knative service..."
-  cat << EOF | kubectl apply -f -
-apiVersion: serving.knative.dev/v1
+  echo "Creating Git Server"
+
+  local name="func-git"
+
+  local namespace
+  namespace="$(kubectl config view --minify --output 'jsonpath={..namespace}')"
+  namespace="${namespace:-"default"}"
+
+
+  local ingress_class="contour-external"
+  local cluster_domain="localtest.me"
+  if kubectl api-versions | grep -q openshift.io; then
+    cluster_domain="$(kubectl get ingresses.config/cluster -o jsonpath='{.spec.domain}')"
+    ingress_class="openshift-default"
+  fi
+
+
+  local -r func_git_host="${name}.${namespace}.${cluster_domain}"
+
+  kubectl apply -f - <<EOF
+apiVersion: v1
+kind: Pod
+metadata:
+  name: "${name}"
+  namespace: "${namespace}"
+  labels:
+    app.kubernetes.io/name: "${name}"
+spec:
+  containers:
+    - name: "${name}"
+      image: ghcr.io/matejvasek/func/gitserver:latest
+      ports:
+        - containerPort: 8080
+          name: http
+---
+apiVersion: v1
 kind: Service
 metadata:
-  name: func-git
-  labels:
-    app: git
+  name: "${name}"
+  namespace: "${namespace}"
 spec:
-  template:
-    metadata:
-      annotations:
-        autoscaling.knative.dev/max-scale: "1"
-        autoscaling.knative.dev/min-scale: "1"
-        client.knative.dev/user-image: quay.io/mvasek/gitserver
-    spec:
-      containers:
-      - image: quay.io/mvasek/gitserver
-        ports:
-        - containerPort: 80
-        resources: {}
-status: {}
+  selector:
+    app.kubernetes.io/name: "${name}"
+  ports:
+    - name: http
+      protocol: TCP
+      port: 80
+      targetPort: http
+  type: ClusterIP
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: "${name}"
+  namespace: "${namespace}"
+spec:
+  ingressClassName: "${ingress_class}"
+  rules:
+    - host: "${func_git_host}"
+      http:
+        paths:
+          - backend:
+              service:
+                name: "${name}"
+                port:
+                  number: 80
+            pathType: Prefix
+            path: /
 EOF
 
-  kubectl wait ksvc --for=condition=RoutesReady --timeout=30s -l "app=git"
+  echo "starting func-git service at: ${func_git_host}"
+
+  kubectl wait --for=condition=Ready "pod/${name}" --timeout=30s
 }
 
 git_server

hack/install-gitlab.sh

@@ -21,7 +21,7 @@ source "$(dirname "$(realpath "$0")")/common.sh"
 function install_gitlab() {
   echo "${blue}Installing GitLab${reset}"
 
-  local -r gitlab_host="${GITLAB_HOSTNAME:-gitlab.127.0.0.1.sslip.io}"
+  local -r gitlab_host="${GITLAB_HOSTNAME:-gitlab.localtest.me}"
 
   $KUBECTL apply -f - <<EOF
 kind: Namespace
@@ -70,6 +70,7 @@ spec:
         - name: GITLAB_OMNIBUS_CONFIG
           value: |
             external_url 'http://${gitlab_host}'
+            nginx['listen_addresses'] = ["0.0.0.0", "[::]"]
             gitlab_rails['gitlab_shell_ssh_port'] = 30022
             gitlab_rails['gitlab_email_enabled'] = false
             puma['worker_processes'] = 0

hack/install-pac.sh

@@ -1,66 +0,0 @@
-#!/usr/bin/env bash
-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#
-# Installs the Pipelines-as-code controller
-#
-
-source "$(dirname "$(realpath "$0")")/common.sh"
-
-function install_pac() {
-    echo "${blue}Installing the Pipelines-as-Code Controller${reset}"
-
-    local -r pac_ctr_host="${PAC_CONTROLLER_HOSTNAME:-pac-ctr.127.0.0.1.sslip.io}"
-    local -r pac_version="v0.24.6"
-
-    # Install Pipelines as Code
-    $KUBECTL apply -f "https://raw.githubusercontent.com/openshift-pipelines/pipelines-as-code/release-${pac_version}/release.k8s.yaml"
-    sleep 5
-    $KUBECTL wait pod --for=condition=Ready -l '!job-name' -n pipelines-as-code --timeout=5m
-
-    # Install ingress for the PaC controller. This is used by VCS Webhooks.
-    $KUBECTL apply -f - << EOF
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: pipelines-as-code
-  namespace: pipelines-as-code
-spec:
-  ingressClassName: contour-external
-  rules:
-  - host: ${pac_ctr_host}
-    http:
-      paths:
-      - backend:
-          service:
-            name: pipelines-as-code-controller
-            port:
-              number: 8080
-        pathType: Prefix
-        path: /
-EOF
-  echo "the Pipeline as Code controller is available at: http://${pac_ctr_host}"
-  echo "${green}✅ PAC${reset}"
-}
-
-if [ "$0" = "${BASH_SOURCE[0]}" ]; then
-  set -o errexit
-  set -o nounset
-  set -o pipefail
-
-  function main() {
-      install_pac
-  }
-  main "$@"
-fi

hack/install-tekton.sh

@@ -1,50 +0,0 @@
-#!/usr/bin/env bash
-
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     https://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-#
-# Install Tekton and required tasks in the cluster
-#
-
-source "$(dirname "$(realpath "$0")")/common.sh"
-
-install_tekton() {
-  echo "${blue}Installing Tekton${reset}"
-
-  tekton_release="previous/v0.56.4"
-  namespace="${NAMESPACE:-default}"
-
-  $KUBECTL apply -f "https://storage.googleapis.com/tekton-releases/pipeline/${tekton_release}/release.yaml"
-  $KUBECTL patch cm/feature-flags -n tekton-pipelines --patch '{"data":{"disable-affinity-assistant":"true"}}'
-  sleep 10
-  $KUBECTL wait pod --for=condition=Ready --timeout=180s -n tekton-pipelines -l "app=tekton-pipelines-controller"
-  $KUBECTL wait pod --for=condition=Ready --timeout=180s -n tekton-pipelines -l "app=tekton-pipelines-webhook"
-  sleep 10
-
-  $KUBECTL create clusterrolebinding "${namespace}:knative-serving-namespaced-admin" --clusterrole=knative-serving-namespaced-admin --serviceaccount="${namespace}:default"
-
-  echo "${green}✅ Tekton${reset}"
-}
-
-# Invoke only when run directly
-# Be a library when sourced
-if [ "$0" = "${BASH_SOURCE[0]}" ]; then
-  set -o errexit
-  set -o nounset
-  set -o pipefail
-
-  function main() {
-    install_tekton
-  }
-  main "$@"
-fi

hack/patch-hosts.sh

@@ -13,7 +13,7 @@
 # limitations under the License.
 
 #
-# Create DNS A records for '127.0.0.1.sslip.io' and '*.127.0.0.1.sslip.io' pointing to the cluster node.
+# Create DNS A records for 'localtest.me' and '*.localtest.me' pointing to the cluster node.
 #
 
 source "$(dirname "$(realpath "$0")")/common.sh"
@@ -22,14 +22,34 @@ function patch_hosts() {
   echo "${blue}Configuring Magic DNS${reset}"
 
   local cluster_node_addr
+  local cluster_node_addr6
 
   cluster_node_addr="$(docker container inspect func-control-plane | jq ".[0].NetworkSettings.Networks.kind.IPAddress" -r)"
+  cluster_node_addr6="$(docker container inspect func-control-plane | jq ".[0].NetworkSettings.Networks.kind.GlobalIPv6Address" -r)"
+
+  local a_recs=""
+  local aaaa_recs=""
+
+  if [[ -n $cluster_node_addr ]]; then
+          a_recs="\
+localtest.me.            IN      A       ${cluster_node_addr}\n\
+*.localtest.me.          IN      A       ${cluster_node_addr}\n";
+  fi
+
+  if [[ -n $cluster_node_addr6 ]]; then
+          aaaa_recs="\
+localtest.me.            IN      AAAA    ${cluster_node_addr6}\n\
+*.localtest.me.          IN      AAAA    ${cluster_node_addr6}\n";
+  fi
 
   $KUBECTL patch cm/coredns -n kube-system --patch-file /dev/stdin <<EOF
 {
   "data": {
-    "Corefile": ".:53 {\n    errors\n    health {\n       lameduck 5s\n    }\n    ready\n    kubernetes cluster.local in-addr.arpa ip6.arpa {\n       pods insecure\n       fallthrough in-addr.arpa ip6.arpa\n       ttl 30\n    }\n    file /etc/coredns/example.db 127.0.0.1.sslip.io\n    prometheus :9153\n    forward . /etc/resolv.conf {\n       max_concurrent 1000\n    }\n    cache 30\n    loop\n    reload\n    loadbalance\n}\n",
-    "example.db": "; 127.0.0.1.sslip.io test file\n127.0.0.1.sslip.io.            IN      SOA     sns.dns.icann.org. noc.dns.icann.org. 2015082541 7200 3600 1209600 3600\n127.0.0.1.sslip.io.            IN      A       ${cluster_node_addr}\n*.127.0.0.1.sslip.io.          IN      A       ${cluster_node_addr}\n"
+    "Corefile": ".:53 {\n    errors\n    health {\n       lameduck 5s\n    }\n    ready\n    kubernetes cluster.local in-addr.arpa ip6.arpa {\n       pods insecure\n       fallthrough in-addr.arpa ip6.arpa\n       ttl 30\n    }\n    file /etc/coredns/example.db localtest.me\n    prometheus :9153\n    forward . /etc/resolv.conf {\n       max_concurrent 1000\n    }\n    cache 30\n    loop\n    reload\n    loadbalance\n}\n",
+    "example.db": "; localtest.me test file\n\
+localtest.me.            IN      SOA     sns.dns.icann.org. noc.dns.icann.org. 2015082541 7200 3600 1209600 3600\n\
+$a_recs\
+$aaaa_recs"
   }
 }
 EOF

hack/registry.sh

@@ -13,7 +13,7 @@
 # limitations under the License.
 
 #
-# - Registers registry with Docker as trusted (linux only)
+# - Registers registry with Docker as trusted (Linux and macOS)
 #
 
 set -o errexit
@@ -42,11 +42,16 @@ warn_nix() {
     if [[ -x $(command -v "nix") || -x $(command -v "nixos-rebuild") ]]; then
         if [ "$CONTAINER_ENGINE" == "docker" ]; then
           echo "${yellow}Warning: Nix detected${reset}"
-          echo "If Docker was configured using nix, this command will fail to find daemon.json. please configure the insecure registry by modifying your nix config:"
-          echo "  virtualisation.docker = {"
-          echo "    enable = true;"
-          echo "    daemon.settings.insecure-registries = [ \"localhost:50000\" ];"
-          echo "  };"
+          if [[ "$(uname)" == "Darwin" ]]; then
+            echo "If Docker Desktop was installed via Nix on macOS, you may need to manually configure the insecure registry."
+            echo "Please confirm \"localhost:50000\" is specified as an insecure registry in the docker config file."
+          else
+            echo "If Docker was configured using nix, this command will fail to find daemon.json. please configure the insecure registry by modifying your nix config:"
+            echo "  virtualisation.docker = {"
+            echo "    enable = true;"
+            echo "    daemon.settings.insecure-registries = [ \"localhost:50000\" ];"
+            echo "  };"
+          fi
         elif [ "$CONTAINER_ENGINE" == "podman" ]; then
           echo "${yellow}Warning: Nix detected${reset}"
           echo "If podman was configured via Nix, this command will likely fail.  At time of this writing, podman configured via the nix option 'virtualisation.podman' does not have an option for configuring insecure registries."
@@ -57,9 +62,35 @@ warn_nix() {
 }
 
 set_registry_insecure() {
-    patch=".\"insecure-registries\" = [\"localhost:50000\""]
-    sudo jq "$patch" /etc/docker/daemon.json > /tmp/daemon.json.tmp && sudo mv /tmp/daemon.json.tmp /etc/docker/daemon.json
-    sudo service docker restart
+    # Determine the daemon.json location based on OS
+    if [[ "$(uname)" == "Darwin" ]]; then
+        # macOS: Docker Desktop stores daemon.json in ~/.docker/
+        DAEMON_JSON="$HOME/.docker/daemon.json"
+        USE_SUDO=""
+    else
+        # Linux: daemon.json is in /etc/docker/
+        DAEMON_JSON="/etc/docker/daemon.json"
+        USE_SUDO="sudo"
+    fi
+
+    # Create daemon.json if it doesn't exist
+    if [ ! -f "$DAEMON_JSON" ]; then
+        echo "{}" | $USE_SUDO tee "$DAEMON_JSON" > /dev/null
+    fi
+
+    # Update daemon.json with insecure registry
+    patch=".\"insecure-registries\" = [\"localhost:50000\"]"
+    $USE_SUDO jq "$patch" "$DAEMON_JSON" > /tmp/daemon.json.tmp && $USE_SUDO mv /tmp/daemon.json.tmp "$DAEMON_JSON"
+    echo "OK $DAEMON_JSON"
+
+    # Restart Docker based on OS
+    if [[ "$(uname)" == "Darwin" ]]; then
+        # macOS: Restart Docker Desktop
+        echo "${yellow}*** If Docker Desktop is running, please restart it via the menu bar icon ***${reset}"
+    else
+        # Linux: Use service command
+        sudo service docker restart
+    fi
 }
 
 set_registry_insecure_podman() {
@@ -70,6 +101,12 @@ set_registry_insecure_podman() {
         # Append the new section to the file
         echo -e "\n[[registry-insecure-local]]\nlocation = \"localhost:50000\"\ninsecure = true" | sudo tee -a "$FILE" > /dev/null
     fi
+
+    # On macOS, set up SSH port forwarding so Podman VM can access host's localhost:50000
+    if [[ "$(uname)" == "Darwin" ]]; then
+        echo "Setting up port forwarding for Podman VM to access registry..."
+        podman machine ssh -- -L 50000:localhost:50000 -N -f
+    fi
 }
 
 if [ "$0" = "${BASH_SOURCE[0]}" ]; then

hack/setup-testing-images.sh

@@ -4,9 +4,11 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-FUNC_UTILS_IMG="localhost:50000/knative/func-utils:latest"
+FUNC_UTILS_IMG="localhost:50000/knative/func-utils:v2"
 
-docker build . -f Dockerfile.utils -t "${FUNC_UTILS_IMG}"
+CGO_ENABLED=0 go build -o "func-util" -trimpath -ldflags '-w -s' ./cmd/func-util
+
+docker build . -f Dockerfile.utils -t "${FUNC_UTILS_IMG}" --build-arg FUNC_UTIL_BINARY=func-util
 docker push "${FUNC_UTILS_IMG}"
 
 # Build custom buildah image for tests.

hack/test.sh

@@ -43,7 +43,7 @@ EOF
   kubectl wait --for=condition=Ready route echo -n func --timeout=600s
 
   echo "${blue}Invoking echo server${reset}"
-  curl http://echo.func.127.0.0.1.sslip.io/
+  curl http://echo.func.localtest.me/
 
   echo "${green}✅ Echo succeeded${reset}"
 }

hack/update-builder.go

@@ -1,612 +0,0 @@
-package main
-
-import (
-	"archive/tar"
-	"compress/gzip"
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"errors"
-	"fmt"
-	"io"
-	"net/http"
-	"os"
-	"os/signal"
-	"path/filepath"
-	"slices"
-	"strings"
-	"syscall"
-
-	"golang.org/x/oauth2"
-	"golang.org/x/term"
-
-	"github.com/buildpacks/pack/builder"
-	"github.com/buildpacks/pack/buildpackage"
-	pack "github.com/buildpacks/pack/pkg/client"
-	"github.com/buildpacks/pack/pkg/dist"
-	bpimage "github.com/buildpacks/pack/pkg/image"
-	"github.com/docker/docker/api/types/image"
-	"github.com/docker/docker/api/types/registry"
-	docker "github.com/docker/docker/client"
-	"github.com/docker/docker/pkg/jsonmessage"
-	"github.com/google/go-containerregistry/pkg/authn"
-	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/google/go-containerregistry/pkg/v1/remote"
-	"github.com/google/go-github/v49/github"
-	"github.com/paketo-buildpacks/libpak/carton"
-	"github.com/pelletier/go-toml"
-)
-
-func main() {
-	ctx, cancel := context.WithCancel(context.Background())
-	defer cancel()
-	sigs := make(chan os.Signal, 1)
-	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
-	go func() {
-		<-sigs
-		cancel()
-		<-sigs
-		os.Exit(130)
-	}()
-
-	var hadError bool
-	for _, variant := range []string{"tiny", "base", "full"} {
-		fmt.Println("::group::" + variant)
-		err := buildBuilderImage(ctx, variant)
-		if err != nil {
-			_, _ = fmt.Fprintf(os.Stderr, "ERROR: %v\n", err)
-			hadError = true
-		}
-		fmt.Println("::endgroup::")
-	}
-	if hadError {
-		os.Exit(1)
-	}
-}
-
-func buildBuilderImage(ctx context.Context, variant string) error {
-	buildDir, err := os.MkdirTemp("", "")
-	if err != nil {
-		return fmt.Errorf("cannot create temporary build directory: %w", err)
-	}
-	defer func(path string) {
-		_ = os.RemoveAll(path)
-	}(buildDir)
-
-	ghClient := newGHClient(ctx)
-	listOpts := &github.ListOptions{Page: 0, PerPage: 1}
-	releases, ghResp, err := ghClient.Repositories.ListReleases(ctx, "paketo-buildpacks", "builder-jammy-"+variant, listOpts)
-	if err != nil {
-		return fmt.Errorf("cannot get upstream builder release: %w", err)
-	}
-	defer func(Body io.ReadCloser) {
-		_ = Body.Close()
-	}(ghResp.Body)
-
-	if len(releases) <= 0 {
-		return fmt.Errorf("cannot get latest release")
-	}
-
-	release := releases[0]
-
-	if release.Name == nil {
-		return fmt.Errorf("the name of the release is not defined")
-	}
-	if release.TarballURL == nil {
-		return fmt.Errorf("the tarball url of the release is not defined")
-	}
-
-	newBuilderImage := "ghcr.io/knative/builder-jammy-" + variant
-	newBuilderImageTagged := newBuilderImage + ":" + *release.Name
-	newBuilderImageLatest := newBuilderImage + ":latest"
-	dockerUser := "gh-action"
-	dockerPassword := os.Getenv("GITHUB_TOKEN")
-
-	ref, err := name.ParseReference(newBuilderImageTagged)
-	if err != nil {
-		return fmt.Errorf("cannot parse reference to builder target: %w", err)
-	}
-	_, err = remote.Head(ref, remote.WithAuth(auth{dockerUser, dockerPassword}))
-	if err == nil {
-		fmt.Fprintln(os.Stderr, "The image has been already built.")
-		return nil
-	}
-
-	builderTomlPath := filepath.Join(buildDir, "builder.toml")
-	err = downloadBuilderToml(ctx, *release.TarballURL, builderTomlPath)
-	if err != nil {
-		return fmt.Errorf("cannot download builder toml: %w", err)
-	}
-
-	builderConfig, _, err := builder.ReadConfig(builderTomlPath)
-	if err != nil {
-		return fmt.Errorf("cannot parse builder.toml: %w", err)
-	}
-
-	err = updateJavaBuildpacks(ctx, &builderConfig)
-	if err != nil {
-		return fmt.Errorf("cannot patch java buildpacks: %w", err)
-	}
-	addGoAndRustBuildpacks(&builderConfig)
-
-	packClient, err := pack.NewClient()
-	if err != nil {
-		return fmt.Errorf("cannot create pack client: %w", err)
-	}
-	createBuilderOpts := pack.CreateBuilderOptions{
-		RelativeBaseDir: buildDir,
-		BuilderName:     newBuilderImageTagged,
-		Config:          builderConfig,
-		Publish:         false,
-		PullPolicy:      bpimage.PullIfNotPresent,
-		Labels: map[string]string{
-			"org.opencontainers.image.description": "Paketo Jammy builder enriched with Rust and Func-Go buildpacks.",
-			"org.opencontainers.image.source":      "https://github.com/knative/func",
-			"org.opencontainers.image.vendor":      "https://github.com/knative/func",
-			"org.opencontainers.image.url":         "https://github.com/knative/func/pkgs/container/builder-jammy-" + variant,
-			"org.opencontainers.image.version":     *release.Name,
-		},
-	}
-
-	err = packClient.CreateBuilder(ctx, createBuilderOpts)
-	if err != nil {
-		return fmt.Errorf("canont create builder: %w", err)
-	}
-
-	dockerClient, err := docker.NewClientWithOpts(docker.FromEnv, docker.WithAPIVersionNegotiation())
-	if err != nil {
-		return fmt.Errorf("cannot create docker client")
-	}
-	err = dockerClient.ImageTag(ctx, newBuilderImageTagged, newBuilderImageLatest)
-	if err != nil {
-		return fmt.Errorf("cannot tag latest: %w", err)
-	}
-
-	authConfig := registry.AuthConfig{
-		Username: dockerUser,
-		Password: dockerPassword,
-	}
-	bs, err := json.Marshal(&authConfig)
-	if err != nil {
-		return fmt.Errorf("cannot marshal credentials: %w", err)
-	}
-	imagePushOptions := image.PushOptions{
-		All:          false,
-		RegistryAuth: base64.StdEncoding.EncodeToString(bs),
-	}
-
-	pushImage := func(image string) error {
-		rc, err := dockerClient.ImagePush(ctx, image, imagePushOptions)
-		if err != nil {
-			return fmt.Errorf("cannot initialize image push: %w", err)
-		}
-		defer func(rc io.ReadCloser) {
-			_ = rc.Close()
-		}(rc)
-		fd := os.Stdout.Fd()
-		isTerminal := term.IsTerminal(int(os.Stdout.Fd()))
-		err = jsonmessage.DisplayJSONMessagesStream(rc, os.Stderr, fd, isTerminal, nil)
-		if err != nil {
-			return err
-		}
-		return nil
-	}
-
-	err = pushImage(newBuilderImageTagged)
-	if err != nil {
-		return fmt.Errorf("cannot push the image: %w", err)
-	}
-
-	err = pushImage(newBuilderImageLatest)
-	if err != nil {
-		return fmt.Errorf("cannot push the image: %w", err)
-	}
-
-	return nil
-}
-
-type buildpack struct {
-	repo      string
-	version   string
-	image     string
-	patchFunc func(packageDesc *buildpackage.Config, bpDesc *dist.BuildpackDescriptor)
-}
-
-func buildBuildpackImage(ctx context.Context, bp buildpack) error {
-	ghClient := newGHClient(ctx)
-
-	var (
-		release *github.RepositoryRelease
-		ghResp  *github.Response
-		err     error
-	)
-
-	if bp.version == "" {
-		release, ghResp, err = ghClient.Repositories.GetLatestRelease(ctx, "paketo-buildpacks", bp.repo)
-	} else {
-		release, ghResp, err = ghClient.Repositories.GetReleaseByTag(ctx, "paketo-buildpacks", bp.repo, "v"+bp.version)
-	}
-	if err != nil {
-		return fmt.Errorf("cannot get upstream builder release: %w", err)
-	}
-	defer func(Body io.ReadCloser) {
-		_ = Body.Close()
-	}(ghResp.Body)
-
-	if release.TarballURL == nil {
-		return fmt.Errorf("tarball url is nil")
-	}
-	if release.TagName == nil {
-		return fmt.Errorf("tag name is nil")
-	}
-
-	version := strings.TrimPrefix(*release.TagName, "v")
-
-	fmt.Println("src tar url:", *release.TarballURL)
-
-	imageNameTagged := bp.image + ":" + version
-	srcDir, err := os.MkdirTemp("", "src-*")
-	if err != nil {
-		return fmt.Errorf("cannot create temp dir: %w", err)
-	}
-
-	fmt.Println("imageNameTagged:", imageNameTagged)
-	fmt.Println("srcDir:", srcDir)
-
-	err = downloadTarball(*release.TarballURL, srcDir)
-	if err != nil {
-		return fmt.Errorf("cannot download source code: %w", err)
-	}
-
-	packageDir := filepath.Join(srcDir, "out")
-	p := carton.Package{
-		CacheLocation:           "",
-		DependencyFilters:       nil,
-		StrictDependencyFilters: false,
-		IncludeDependencies:     false,
-		Destination:             packageDir,
-		Source:                  srcDir,
-		Version:                 version,
-	}
-	eh := exitHandler{}
-	p.Create(carton.WithExitHandler(&eh))
-	if eh.err != nil {
-		return fmt.Errorf("cannot create package: %w", eh.err)
-	}
-	if eh.fail {
-		return fmt.Errorf("cannot create package")
-	}
-
-	// set URI and OS in package.toml
-	f, err := os.OpenFile(filepath.Join(srcDir, "package.toml"), os.O_CREATE|os.O_WRONLY|os.O_APPEND, 0644)
-	if err != nil {
-		return fmt.Errorf("cannot open package.toml: %w", err)
-	}
-	defer func(f *os.File) {
-		_ = f.Close()
-	}(f)
-	_, err = fmt.Fprintf(f, "[buildpack]\nuri = \"%s\"\n\n[platform]\nos = \"%s\"\n", packageDir, "linux")
-	_ = f.Close()
-	if err != nil {
-		return fmt.Errorf("cannot apped to package.toml: %w", err)
-	}
-
-	cfgReader := buildpackage.NewConfigReader()
-	cfg, err := cfgReader.Read(filepath.Join(srcDir, "package.toml"))
-	if err != nil {
-		return fmt.Errorf("cannot read buildpack config: %w", err)
-	}
-
-	if bp.patchFunc != nil {
-		var bpDesc dist.BuildpackDescriptor
-		var bs []byte
-		bpDescPath := filepath.Join(packageDir, "buildpack.toml")
-		bs, err = os.ReadFile(bpDescPath)
-		if err != nil {
-			return fmt.Errorf("cannot read buildpack.toml: %w", err)
-		}
-		err = toml.Unmarshal(bs, &bpDesc)
-		if err != nil {
-			return fmt.Errorf("cannot unmarshall buildpack descriptor: %w", err)
-		}
-		bp.patchFunc(&cfg, &bpDesc)
-		bs, err = toml.Marshal(&bpDesc)
-		if err != nil {
-			return fmt.Errorf("cannot marshal buildpack descriptor: %w", err)
-		}
-		err = os.WriteFile(bpDescPath, bs, 0644)
-		if err != nil {
-			return fmt.Errorf("cannot write buildpack.toml: %w", err)
-		}
-	}
-
-	pbo := pack.PackageBuildpackOptions{
-		RelativeBaseDir: packageDir,
-		Name:            imageNameTagged,
-		Format:          pack.FormatImage,
-		Config:          cfg,
-		Publish:         false,
-		PullPolicy:      bpimage.PullIfNotPresent,
-		Registry:        "",
-		Flatten:         false,
-		FlattenExclude:  nil,
-	}
-	packClient, err := pack.NewClient()
-	if err != nil {
-		return fmt.Errorf("cannot create pack client: %w", err)
-	}
-	err = packClient.PackageBuildpack(ctx, pbo)
-	if err != nil {
-		return fmt.Errorf("cannot package buildpack: %w", err)
-	}
-
-	return nil
-}
-
-type exitHandler struct {
-	err  error
-	fail bool
-}
-
-func (e *exitHandler) Error(err error) {
-	e.err = err
-}
-
-func (e *exitHandler) Fail() {
-	e.fail = true
-}
-
-func (e *exitHandler) Pass() {
-}
-
-type auth struct {
-	uname, pwd string
-}
-
-func (a auth) Authorization() (*authn.AuthConfig, error) {
-	return &authn.AuthConfig{
-		Username: a.uname,
-		Password: a.pwd,
-	}, nil
-}
-
-func downloadBuilderToml(ctx context.Context, tarballUrl, builderTomlPath string) error {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, tarballUrl, nil)
-	if err != nil {
-		return fmt.Errorf("cannot create request for release tarball: %w", err)
-	}
-	//nolint:bodyclose
-	resp, err := http.DefaultClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("cannot get release tarball: %w", err)
-	}
-	defer func(Body io.ReadCloser) {
-		_ = Body.Close()
-	}(resp.Body)
-
-	gr, err := gzip.NewReader(resp.Body)
-	if err != nil {
-		return fmt.Errorf("cannot create gzip stream from release tarball: %w", err)
-	}
-	defer func(gr *gzip.Reader) {
-		_ = gr.Close()
-	}(gr)
-	tr := tar.NewReader(gr)
-	for {
-		hdr, err := tr.Next()
-		if err != nil {
-			if errors.Is(err, io.EOF) {
-				break
-			}
-			return fmt.Errorf("error while processing release tarball: %w", err)
-		}
-
-		if hdr.FileInfo().Mode().Type() != 0 || !strings.HasSuffix(hdr.Name, "/builder.toml") {
-			continue
-		}
-		builderToml, err := os.OpenFile(builderTomlPath, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0644)
-		if err != nil {
-			return fmt.Errorf("cannot create builder.toml file: %w", err)
-		}
-		_, err = io.CopyN(builderToml, tr, hdr.Size)
-		if err != nil {
-			return fmt.Errorf("cannot copy data to builder.toml file: %w", err)
-		}
-		break
-	}
-
-	return nil
-}
-
-// Adds custom Rust and Go-Function buildpacks to the builder.
-func addGoAndRustBuildpacks(config *builder.Config) {
-	config.Description += "\nAddendum: this is modified builder that also contains Rust and Func-Go buildpacks."
-	additionalBuildpacks := []builder.ModuleConfig{
-		{
-			ModuleInfo: dist.ModuleInfo{
-				ID:      "paketo-community/rust",
-				Version: "0.47.0",
-			},
-			ImageOrURI: dist.ImageOrURI{
-				BuildpackURI: dist.BuildpackURI{URI: "docker://docker.io/paketocommunity/rust:0.47.0"},
-			},
-		},
-		{
-			ModuleInfo: dist.ModuleInfo{
-				ID:      "dev.knative-extensions.go",
-				Version: "0.0.6",
-			},
-			ImageOrURI: dist.ImageOrURI{
-				BuildpackURI: dist.BuildpackURI{URI: "ghcr.io/boson-project/go-function-buildpack:0.0.6"},
-			},
-		},
-	}
-
-	additionalGroups := []dist.OrderEntry{
-		{
-			Group: []dist.ModuleRef{
-				{
-					ModuleInfo: dist.ModuleInfo{
-						ID: "paketo-community/rust",
-					},
-				},
-			},
-		},
-		{
-			Group: []dist.ModuleRef{
-				{
-					ModuleInfo: dist.ModuleInfo{
-						ID: "paketo-buildpacks/go-dist",
-					},
-				},
-				{
-					ModuleInfo: dist.ModuleInfo{
-						ID: "dev.knative-extensions.go",
-					},
-				},
-			},
-		},
-	}
-
-	config.Buildpacks = append(additionalBuildpacks, config.Buildpacks...)
-	config.Order = append(additionalGroups, config.Order...)
-}
-
-// updated java and java-native-image buildpack to include quarkus buildpack
-func updateJavaBuildpacks(ctx context.Context, builderConfig *builder.Config) error {
-	var err error
-
-	for _, entry := range builderConfig.Order {
-		bp := strings.TrimPrefix(entry.Group[0].ID, "paketo-buildpacks/")
-		if bp == "java" || bp == "java-native-image" {
-			img := "ghcr.io/knative/buildpacks/" + bp
-			err = buildBuildpackImage(ctx, buildpack{
-				repo:      bp,
-				version:   entry.Group[0].Version,
-				image:     img,
-				patchFunc: addQuarkusBuildpack,
-			})
-			// TODO we might want to push these images to registry
-			// but it's not absolutely necessary since they are included in builder
-			if err != nil {
-				return fmt.Errorf("cannot build %q buildpack: %w", bp, err)
-			}
-			for i := range builderConfig.Buildpacks {
-				if strings.HasPrefix(builderConfig.Buildpacks[i].URI, "docker://gcr.io/paketo-buildpacks/"+bp+":") {
-					builderConfig.Buildpacks[i].URI = "docker://ghcr.io/knative/buildpacks/" + bp + ":" + entry.Group[0].Version
-				}
-			}
-		}
-	}
-	return nil
-}
-
-// patches "Java" or "Java Native Image" buildpacks to include Quarkus BP just before Maven BP
-func addQuarkusBuildpack(packageDesc *buildpackage.Config, bpDesc *dist.BuildpackDescriptor) {
-	ghClient := newGHClient(context.Background())
-
-	rr, resp, err := ghClient.Repositories.GetLatestRelease(context.TODO(), "paketo-buildpacks", "quarkus")
-	if err != nil {
-		panic(err)
-	}
-	defer func(Body io.ReadCloser) {
-		_ = Body.Close()
-	}(resp.Body)
-
-	latestQuarkusVersion := strings.TrimPrefix(*rr.TagName, "v")
-
-	packageDesc.Dependencies = append(packageDesc.Dependencies, dist.ImageOrURI{
-		BuildpackURI: dist.BuildpackURI{
-			URI: "docker://gcr.io/paketo-buildpacks/quarkus:" + latestQuarkusVersion,
-		},
-	})
-	quarkusBP := dist.ModuleRef{
-		ModuleInfo: dist.ModuleInfo{
-			ID:      "paketo-buildpacks/quarkus",
-			Version: latestQuarkusVersion,
-		},
-		Optional: true,
-	}
-	idx := slices.IndexFunc(bpDesc.WithOrder[0].Group, func(ref dist.ModuleRef) bool {
-		return ref.ID == "paketo-buildpacks/maven"
-	})
-	bpDesc.WithOrder[0].Group = slices.Insert(bpDesc.WithOrder[0].Group, idx, quarkusBP)
-}
-
-func downloadTarball(tarballUrl, destDir string) error {
-	//nolint:bodyclose
-	resp, err := http.Get(tarballUrl)
-	if err != nil {
-		return fmt.Errorf("cannot get tarball: %w", err)
-	}
-	defer func(Body io.ReadCloser) {
-		_ = Body.Close()
-	}(resp.Body)
-	if resp.StatusCode != 200 {
-		return fmt.Errorf("cannot get tarball: %s", resp.Status)
-	}
-	defer func(Body io.ReadCloser) {
-		_ = Body.Close()
-	}(resp.Body)
-
-	gzipReader, err := gzip.NewReader(resp.Body)
-	if err != nil {
-		return fmt.Errorf("cannot create gzip reader: %w", err)
-	}
-	defer func(gzipReader *gzip.Reader) {
-		_ = gzipReader.Close()
-	}(gzipReader)
-
-	tarReader := tar.NewReader(gzipReader)
-	var hdr *tar.Header
-	for {
-		hdr, err = tarReader.Next()
-		if err != nil {
-			if errors.Is(err, io.EOF) {
-				break
-			}
-			return fmt.Errorf("cannot read tar header: %w", err)
-		}
-		if strings.Contains(hdr.Name, "..") {
-			return fmt.Errorf("file name in tar header contains '..'")
-		}
-
-		n := filepath.Clean(filepath.Join(strings.Split(hdr.Name, "/")[1:]...))
-		if strings.HasPrefix(n, "..") {
-			return fmt.Errorf("path in tar header escapes")
-		}
-		dest := filepath.Join(destDir, n)
-
-		switch hdr.Typeflag {
-		case tar.TypeReg:
-			var f *os.File
-			f, err = os.OpenFile(dest, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, os.FileMode(hdr.Mode&0777))
-			if err != nil {
-				return fmt.Errorf("cannot create a file: %w", err)
-			}
-			_, err = io.Copy(f, tarReader)
-			_ = f.Close()
-			if err != nil {
-				return fmt.Errorf("cannot read from tar reader: %w", err)
-			}
-		case tar.TypeSymlink:
-			return fmt.Errorf("symlinks are not supported yet")
-		case tar.TypeDir:
-			err = os.MkdirAll(dest, 0755)
-			if err != nil {
-				return fmt.Errorf("cannmot create a directory: %w", err)
-			}
-		case tar.TypeXGlobalHeader:
-			// ignore this type
-		default:
-			return fmt.Errorf("unknown type: %x", hdr.Typeflag)
-		}
-	}
-	return nil
-}
-
-func newGHClient(ctx context.Context) *github.Client {
-	return github.NewClient(oauth2.NewClient(ctx, oauth2.StaticTokenSource(&oauth2.Token{
-		AccessToken: os.Getenv("GITHUB_TOKEN"),
-	})))
-}

pkg/app/app.go

@@ -10,12 +10,12 @@ import (
 	"syscall"
 
 	"github.com/AlecAivazis/survey/v2/terminal"
+
 	"knative.dev/func/cmd"
 	"knative.dev/func/pkg/docker"
+	"knative.dev/func/pkg/version"
 )
 
-var vers, kver, hash string
-
 func Main() {
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
@@ -32,9 +32,9 @@ func Main() {
 	cfg := cmd.RootCommandConfig{
 		Name: "func",
 		Version: cmd.Version{
-			Vers: vers,
-			Kver: kver,
-			Hash: hash,
+			Vers: version.Vers,
+			Kver: version.Kver,
+			Hash: version.Hash,
 		}}
 
 	if err := cmd.NewRootCmd(cfg).ExecuteContext(ctx); err != nil {

pkg/builders/builders_int_test.go

@@ -0,0 +1,473 @@
+//go:build integration
+
+package builders_test
+
+import (
+	"archive/tar"
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha1"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"syscall"
+	"testing"
+	"time"
+
+	"golang.org/x/term"
+
+	"github.com/docker/docker/api/types"
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/client"
+	"github.com/docker/docker/pkg/jsonmessage"
+	coreV1 "k8s.io/api/core/v1"
+	v1 "k8s.io/api/networking/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/intstr"
+
+	"knative.dev/func/pkg/builders/buildpacks"
+	"knative.dev/func/pkg/builders/s2i"
+	fn "knative.dev/func/pkg/functions"
+	"knative.dev/func/pkg/k8s"
+)
+
+func TestPrivateGitRepository(t *testing.T) {
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	sigs := make(chan os.Signal, 1)
+	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
+	go func() {
+		<-sigs
+		cancel()
+		<-sigs // second sigint/sigterm is treated as sigkill
+		os.Exit(137)
+	}()
+
+	certDir := createCertificate(t)
+	t.Log("certDir:", certDir)
+
+	servePrivateGit(ctx, t, certDir)
+	t.Log("git server initiated")
+
+	select {
+	case <-time.After(time.Second * 5):
+		break
+	case <-ctx.Done():
+		t.Fatal(ctx.Err())
+	}
+
+	gitCredsDir := t.TempDir()
+	err := os.WriteFile(filepath.Join(gitCredsDir, "type"), []byte(`git-credentials`), 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	gitCred := `url=https://git-private.localtest.me
+username=developer
+password=nbusr123
+`
+	err = os.WriteFile(filepath.Join(gitCredsDir, "credentials"), []byte(gitCred), 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	netrc := filepath.Join(t.TempDir(), ".netrc")
+	netrcContent := `machine git-private.localtest.me login developer password nbusr123`
+	err = os.WriteFile(netrc, []byte(netrcContent), 0644)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	f, err := fn.NewFunction(filepath.Join("testdata", "go-fn-with-private-deps"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	f.Build.BuildEnvs = []fn.Env{
+		{
+			Name:  ptr("GOPRIVATE"),
+			Value: ptr("*.localtest.me"),
+		},
+	}
+
+	testCases := []struct {
+		Name         string
+		Builder      fn.Builder
+		BuilderImage func(ctx context.Context, t *testing.T, certDir string) string
+		Envs         []fn.Env
+		Mounts       []fn.MountSpec
+	}{
+		{
+			Name:         "s2i",
+			Builder:      s2i.NewBuilder(s2i.WithVerbose(true)),
+			BuilderImage: buildPatchedS2IBuilder,
+			Mounts: []fn.MountSpec{
+				{
+					Source:      netrc,
+					Destination: "/opt/app-root/src/.netrc",
+				}},
+		},
+		{
+			Name:         "pack",
+			Builder:      buildpacks.NewBuilder(buildpacks.WithVerbose(true)),
+			BuilderImage: buildPatcheBuildpackBuilder,
+			Envs: []fn.Env{
+				{
+					Name:  ptr("SERVICE_BINDING_ROOT"),
+					Value: ptr("/bindings"),
+				},
+			},
+			Mounts: []fn.MountSpec{
+				{
+					Source:      gitCredsDir,
+					Destination: "/bindings/git-binding",
+				},
+			},
+		},
+	}
+
+	for _, tt := range testCases {
+		var f = f
+		t.Run(tt.Name, func(t *testing.T) {
+			f.Build.Image = "localhost:50000/go-app:test-" + tt.Name
+			f.Build.Builder = tt.Name
+			f.Build.BuilderImages = map[string]string{
+				tt.Name: tt.BuilderImage(ctx, t, certDir),
+			}
+			f.Build.Mounts = append(f.Build.Mounts, tt.Mounts...)
+			f.Build.BuildEnvs = append(f.Build.BuildEnvs, tt.Envs...)
+
+			err = tt.Builder.Build(ctx, f, nil)
+			if err != nil {
+				t.Fatal(err)
+			}
+		})
+	}
+}
+
+// Generates self-signed certificate used for our private git repository.
+func createCertificate(t *testing.T) string {
+	dir := t.TempDir()
+
+	certPrivKey, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ski := sha1.Sum(x509.MarshalPKCS1PublicKey(&certPrivKey.PublicKey))
+
+	cert := &x509.Certificate{
+		BasicConstraintsValid: true,
+		IsCA:                  true,
+		SerialNumber:          randSN(),
+		// openssl hash of this subject is 85c05568
+		// do not update the subject without also updating the hash referred from another places (e.g. Dockerfile)
+		// See also: https://github.com/paketo-buildpacks/ca-certificates/blob/v1.0.1/cacerts/certs.go#L132
+		Subject: pkix.Name{
+			CommonName: "git-private.localtest.me",
+		},
+		DNSNames:     []string{"git-private.localtest.me"},
+		NotBefore:    time.Now(),
+		NotAfter:     time.Now().AddDate(0, 0, 1),
+		SubjectKeyId: ski[:],
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
+		KeyUsage:     x509.KeyUsageDigitalSignature | x509.KeyUsageKeyEncipherment,
+	}
+
+	certBytes, err := x509.CreateCertificate(rand.Reader, cert, cert, &certPrivKey.PublicKey, certPrivKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	certPEM := new(bytes.Buffer)
+	err = pem.Encode(certPEM, &pem.Block{
+		Type:  "CERTIFICATE",
+		Bytes: certBytes,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	certPrivKeyPEM := new(bytes.Buffer)
+	err = pem.Encode(certPrivKeyPEM, &pem.Block{
+		Type:  "RSA PRIVATE KEY",
+		Bytes: x509.MarshalPKCS1PrivateKey(certPrivKey),
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = os.WriteFile(filepath.Join(dir, "cert.pem"), certPEM.Bytes(), 0444)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = os.WriteFile(filepath.Join(dir, "key.pem"), certPrivKeyPEM.Bytes(), 0400)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	return dir
+}
+
+var maxSN *big.Int = new(big.Int).Lsh(big.NewInt(1), 159)
+
+func randSN() *big.Int {
+	i, err := rand.Int(rand.Reader, maxSN)
+	if err != nil {
+		panic(err)
+	}
+	return i
+}
+
+// Builds a s2i Golang builder that trusts to our self-signed certificate (see createCertificate).
+func buildPatchedS2IBuilder(ctx context.Context, t *testing.T, certDir string) string {
+	tag := "localhost:50000/go-toolset:test"
+	dockerfile := `FROM registry.access.redhat.com/ubi8/go-toolset:latest
+COPY 85c05568.0 /etc/pki/ca-trust/source/anchors/
+USER 0:0
+RUN update-ca-trust
+USER 1001:0
+`
+	return buildPatchedBuilder(ctx, t, tag, dockerfile, certDir)
+}
+
+// Builds a tiny paketo builder that trusts to our self-signed certificate (see createCertificate).
+func buildPatcheBuildpackBuilder(ctx context.Context, t *testing.T, certDir string) string {
+	tag := "localhost:50000/builder-jammy-tin:test"
+	dockerfile := `FROM ghcr.io/knative/builder-jammy-tiny:latest
+COPY 85c05568.0 /etc/ssl/certs/
+`
+	return buildPatchedBuilder(ctx, t, tag, dockerfile, certDir)
+}
+
+// Builds an image with specified tag from specified dockerfile.
+// This function also injects self-signed as "85c05568.0" into the build context.
+func buildPatchedBuilder(ctx context.Context, t *testing.T, tag, dockerfile, certDir string) string {
+	cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation())
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	var buff bytes.Buffer
+	tw := tar.NewWriter(&buff)
+
+	err = tw.WriteHeader(&tar.Header{
+		Name: "Dockerfile",
+		Size: int64(len(dockerfile)),
+		Mode: 0644,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = tw.Write([]byte(dockerfile))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	cb, err := os.ReadFile(filepath.Join(certDir, "cert.pem"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = tw.WriteHeader(&tar.Header{
+		Name: "85c05568.0",
+		Size: int64(len(cb)),
+		Mode: 0644,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	_, err = tw.Write(cb)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = tw.Close()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ibo := types.ImageBuildOptions{
+		Tags: []string{tag},
+	}
+	ibr, err := cli.ImageBuild(ctx, &buff, ibo)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer ibr.Body.Close()
+
+	fd := os.Stderr.Fd()
+	isTerminal := term.IsTerminal(int(fd))
+	err = jsonmessage.DisplayJSONMessagesStream(ibr.Body, os.Stderr, fd, isTerminal, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	rc, err := cli.ImagePush(ctx, tag, image.PushOptions{RegistryAuth: "e30="})
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer rc.Close()
+
+	return tag
+}
+
+// This sets up a private git repository for testing.
+// The repository url is https://git-private.localtest.me/foo.git, and it is protected by basic authentication.
+// The credentials are developer:nbusr123.
+func servePrivateGit(ctx context.Context, t *testing.T, certDir string) {
+	const (
+		name  = "git-private"
+		host  = "git-private.localtest.me"
+		image = "ghcr.io/matejvasek/git-private:latest"
+	)
+
+	k8sClient, err := k8s.NewKubernetesClientset()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ns := coreV1.Namespace{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: name,
+		},
+	}
+	_, err = k8sClient.CoreV1().Namespaces().Create(ctx, &ns, metav1.CreateOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		_ = k8sClient.CoreV1().Namespaces().Delete(context.Background(), name, metav1.DeleteOptions{})
+	})
+
+	cert, err := os.ReadFile(filepath.Join(certDir, "cert.pem"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	key, err := os.ReadFile(filepath.Join(certDir, "key.pem"))
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	secret := coreV1.Secret{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: name,
+		},
+		Immutable: ptr(true),
+		Data: map[string][]byte{
+			coreV1.TLSCertKey:       cert,
+			coreV1.TLSPrivateKeyKey: key,
+		},
+		Type: coreV1.SecretTypeTLS,
+	}
+
+	_, err = k8sClient.CoreV1().Secrets(name).Create(ctx, &secret, metav1.CreateOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	pod := coreV1.Pod{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: name,
+			Labels:    map[string]string{"app.kubernetes.io/name": name},
+		},
+		Spec: coreV1.PodSpec{
+			Containers: []coreV1.Container{
+				{
+					Name:  name,
+					Image: image,
+					Ports: []coreV1.ContainerPort{
+						{
+							Name:          "http",
+							ContainerPort: 8080,
+						},
+					},
+				},
+			},
+		},
+	}
+	_, err = k8sClient.CoreV1().Pods(name).Create(ctx, &pod, metav1.CreateOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	svc := coreV1.Service{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: name,
+		},
+		Spec: coreV1.ServiceSpec{
+			Selector: map[string]string{
+				"app.kubernetes.io/name": name,
+			},
+			Ports: []coreV1.ServicePort{
+				{
+					Name:       "http",
+					Protocol:   "TCP",
+					Port:       80,
+					TargetPort: intstr.FromString("http"),
+				},
+			},
+			Type: coreV1.ServiceTypeClusterIP,
+		},
+	}
+	_, err = k8sClient.CoreV1().Services(name).Create(ctx, &svc, metav1.CreateOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	ingress := v1.Ingress{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      name,
+			Namespace: name,
+		},
+		Spec: v1.IngressSpec{
+			IngressClassName: ptr("contour-external"),
+			DefaultBackend:   nil,
+			TLS: []v1.IngressTLS{
+				{
+					Hosts:      []string{host},
+					SecretName: name,
+				},
+			},
+			Rules: []v1.IngressRule{
+				{
+					Host: host,
+					IngressRuleValue: v1.IngressRuleValue{
+						HTTP: &v1.HTTPIngressRuleValue{Paths: []v1.HTTPIngressPath{
+							{
+								Path:     "/",
+								PathType: ptr(v1.PathTypePrefix),
+								Backend: v1.IngressBackend{
+									Service: &v1.IngressServiceBackend{
+										Name: name,
+										Port: v1.ServiceBackendPort{
+											Name: "http",
+										},
+									},
+								},
+							},
+						}},
+					},
+				},
+			},
+		},
+	}
+	_, err = k8sClient.NetworkingV1().Ingresses(name).Create(ctx, &ingress, metav1.CreateOptions{})
+	if err != nil {
+		t.Fatal(err)
+	}
+}
+
+func ptr[T any](val T) *T {
+	return &val
+}

pkg/builders/buildpacks/builder.go

@@ -8,6 +8,7 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"regexp"
 	"runtime"
 	"strings"
 	"time"
@@ -50,6 +51,7 @@ var (
 		"docker.io/paketobuildpacks/",
 		"gcr.io/buildpacks/",
 		"ghcr.io/knative/",
+		"docker.io/heroku/",
 	}
 
 	defaultBuildpacks = map[string][]string{}
@@ -119,7 +121,7 @@ var DefaultLifecycleImage = "docker.io/buildpacksio/lifecycle:553c041"
 // Build the Function at path.
 func (b *Builder) Build(ctx context.Context, f fn.Function, platforms []fn.Platform) (err error) {
 	if len(platforms) != 0 {
-		return errors.New("the pack builder does not support specifying target platforms directly.")
+		return errors.New("the pack builder does not support specifying target platforms directly")
 	}
 
 	// Builder image from the function if defined, default otherwise.
@@ -152,6 +154,8 @@ func (b *Builder) Build(ctx context.Context, f fn.Function, platforms []fn.Platf
 	}
 	// Pack build options
 	opts := pack.BuildOptions{
+		GroupID:        -1,
+		UserID:         -1,
 		AppPath:        f.Root,
 		Image:          f.Build.Image,
 		LifecycleImage: DefaultLifecycleImage,
@@ -178,6 +182,16 @@ func (b *Builder) Build(ctx context.Context, f fn.Function, platforms []fn.Platf
 		opts.ContainerConfig.Network = "host"
 	}
 
+	if _, ok := opts.Env["BPE_DEFAULT_LISTEN_ADDRESS"]; !ok {
+		opts.Env["BPE_DEFAULT_LISTEN_ADDRESS"] = "[::]:8080"
+	}
+
+	var bindings = make([]string, 0, len(f.Build.Mounts))
+	for _, m := range f.Build.Mounts {
+		bindings = append(bindings, fmt.Sprintf("%s:%s", m.Source, m.Destination))
+	}
+	opts.ContainerConfig.Volumes = bindings
+
 	// only trust our known builders
 	opts.TrustBuilder = TrustBuilder
 
@@ -201,6 +215,10 @@ func (b *Builder) Build(ctx context.Context, f fn.Function, platforms []fn.Platf
 			return fmt.Errorf("podman 4.3 is not supported, use podman 4.2 or 4.4")
 		}
 
+		if f.Runtime == "python" {
+			cli = pyScaffoldInjector{cli}
+		}
+
 		// Client with a logger which is enabled if in Verbose mode and a dockerClient that supports SSH docker daemon connection.
 		if impl, err = pack.NewClient(pack.WithLogger(b.logger), pack.WithDockerClient(cli)); err != nil {
 			return fmt.Errorf("cannot create pack client: %w", err)
@@ -242,6 +260,9 @@ func isPodmanV43(ctx context.Context, cli client.CommonAPIClient) (b bool, err e
 // TrustBuilder determines whether the builder image should be trusted
 // based on a set of trusted builder image registry prefixes.
 func TrustBuilder(b string) bool {
+	if isLocalhost(b) {
+		return true
+	}
 	for _, v := range trustedBuilderImagePrefixes {
 		// Ensure that all entries in this list are terminated with a trailing "/"
 		if !strings.HasSuffix(v, "/") {
@@ -254,6 +275,14 @@ func TrustBuilder(b string) bool {
 	return false
 }
 
+func isLocalhost(img string) bool {
+	// Parsing logic is broken for localhost in go-containerregistry.
+	// See: https://github.com/google/go-containerregistry/issues/2048
+	// So I went for regex.
+	localhostRE := regexp.MustCompile(`^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?/.+$`)
+	return localhostRE.MatchString(img)
+}
+
 // Builder Image chooses the correct builder image or defaults.
 func BuilderImage(f fn.Function, builderName string) (string, error) {
 	return builders.Image(f, builderName, DefaultBuilderImages)

pkg/builders/buildpacks/builder_test.go

@@ -40,6 +40,22 @@ func TestBuild_BuilderImageTrusted(t *testing.T) {
 	}
 }
 
+func TestBuild_BuilderImageTrustedLocalhost(t *testing.T) {
+	for _, reg := range []string{
+		"localhost",
+		"localhost:5000",
+		"127.0.0.1",
+		"127.0.0.1:5000",
+		"[::1]",
+		"[::1]:5000"} {
+		t.Run(reg, func(t *testing.T) {
+			if !TrustBuilder(reg + "/project/builder:latest") {
+				t.Errorf("expected to be trusted: %q", reg)
+			}
+		})
+	}
+}
+
 // TestBuild_BuilderImageDefault ensures that a Function bing built which does not
 // define a Builder Image will get the internally-defined default.
 func TestBuild_BuilderImageDefault(t *testing.T) {

pkg/builders/buildpacks/scaffolding_injector.go

@@ -0,0 +1,163 @@
+package buildpacks
+
+import (
+	"archive/tar"
+	"context"
+	"errors"
+	"io"
+	"runtime"
+	"strings"
+
+	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/client"
+)
+
+// Hack implementation of DockerClient that overrides CopyToContainer method.
+// The CopyToContainer method hijacks the uploaded project stream and injects function scaffolding to it.
+// It basically moves content of /workspace to /workspace/fn and then setup scaffolding code directly in /workspace.
+type pyScaffoldInjector struct {
+	client.CommonAPIClient
+}
+
+func (s pyScaffoldInjector) CopyToContainer(ctx context.Context, ctr, p string, r io.Reader, opts container.CopyToContainerOptions) error {
+
+	if pc, _, _, ok := runtime.Caller(1); ok &&
+		!strings.Contains(runtime.FuncForPC(pc).Name(), "build.copyDir") {
+		// We are not called by "project dir copy" so we do simple direct forward call.
+		return s.CommonAPIClient.CopyToContainer(ctx, ctr, p, r, opts)
+	}
+
+	pr, pw := io.Pipe()
+	go func() {
+		var err error
+		defer func() {
+			_ = pw.CloseWithError(err)
+		}()
+		tr := tar.NewReader(r)
+		tw := tar.NewWriter(pw)
+
+		for {
+			var hdr *tar.Header
+			hdr, err = tr.Next()
+
+			if err != nil {
+				if errors.Is(err, io.EOF) {
+					err = nil
+					break
+				}
+				return
+			}
+
+			if strings.HasPrefix(hdr.Name, "/workspace/") {
+				hdr.Name = strings.Replace(hdr.Name, "/workspace/", "/workspace/fn/", 1)
+			}
+
+			err = tw.WriteHeader(hdr)
+			if err != nil {
+				return
+			}
+			_, err = io.Copy(tw, tr)
+			if err != nil {
+				return
+			}
+		}
+		err = writePythonScaffolding(tw)
+		if err != nil {
+			return
+		}
+		err = tw.Close()
+	}()
+
+	return s.CommonAPIClient.CopyToContainer(ctx, ctr, p, pr, opts)
+}
+
+func writePythonScaffolding(tw *tar.Writer) error {
+	for _, f := range []struct {
+		path    string
+		content string
+	}{
+		{
+			path:    "pyproject.toml",
+			content: pyprojectToml,
+		},
+		{
+			path:    "service/main.py",
+			content: serviceMain,
+		},
+		{
+			path:    "service/__init__.py",
+			content: "",
+		},
+	} {
+		err := tw.WriteHeader(&tar.Header{
+			Name: "/workspace/" + f.path,
+			Size: int64(len(f.content)),
+			Mode: 0644,
+		})
+		if err != nil {
+			return err
+		}
+		_, err = tw.Write([]byte(f.content))
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+const pyprojectToml = `[project]
+name = "service"
+description = "an autogenerated service which runs a Function"
+version = "0.1.0"
+requires-python = ">=3.9"
+license = "MIT"
+dependencies = [
+    "func-python",
+    "function @ ./fn"
+]
+authors = [
+  { name="The Knative Authors", email="knative-dev@googlegroups.com"},
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.metadata]
+allow-direct-references = true
+
+[tool.poetry.dependencies]
+python = ">=3.9,<4.0"
+
+[tool.poetry.scripts]
+script = "service.main:main"
+`
+
+const serviceMain = `"""
+This code is glue between a user's Function and the middleware which will
+expose it as a network service.  This code is written on-demand when a
+Function is being built, deployed or run.  This will be included in the
+final container.
+"""
+import logging
+from func_python.cloudevent import serve
+
+logging.basicConfig(level=logging.INFO)
+
+try:
+    from function import new as handler  # type: ignore[import]
+except ImportError:
+    try:
+        from function import handle as handler  # type: ignore[import]
+    except ImportError:
+        logging.error("Function must export either 'new' or 'handle'")
+        raise
+
+
+def main():
+    logging.info("Functions middleware invoking user function")
+    serve(handler)
+
+if __name__ == "__main__":
+    main()
+`

pkg/builders/s2i/assemblers.go

@@ -6,15 +6,43 @@ import (
 	fn "knative.dev/func/pkg/functions"
 )
 
+/*
+Assemble Scripts Patched for Functions Support
+
+These are minimally patched assemblers taken from the S2I builders.   For
+example the Python assemble script can be extracted with:
+
+docker run --rm registry.access.redhat.com/ubi8/python-39 \
+  cat /usr/libexec/s2i/assemble > bin/assemble
+
+The scripts are modified slightly to support Functions as explained by
+their individual constants below.
+
+While there is unlikely to be incompatibilities going forward, this is still
+a support burden as these scripts should be updated periodically, at least
+once per major version of their underlying toolchain.
+
+Once Functions is stable and post 1.0, it would be worth exploring adding
+Functions support in the upstream base scripts themselves via environment
+variable.
+*/
+
+func assembler(f fn.Function) (string, error) {
+	switch f.Runtime {
+	case "go":
+		return GoAssembler, nil
+	case "python":
+		return PythonAssembler, nil
+	default:
+		return "", fmt.Errorf("no assembler defined for runtime %q", f.Runtime)
+	}
+}
+
 // GoAssembler
 //
 // Adapted from /usr/libexec/s2i/assemble within the UBI-8 go-toolchain
 // such that the "go build" command builds subdirectory .s2i/builds/last
 // (where main resides) rather than the root.
-// TODO: many apps use the pattern of having main in a subdirectory, for
-// example the idiomatic "./cmd/myapp/main.go".  It would therefore be
-// beneficial to submit a patch to the go-toolchain source allowing this
-// path to be customized with an environment variable instead
 const GoAssembler = `
 #!/bin/bash
 set -e
@@ -25,8 +53,7 @@ if [[ $(go list -f {{.Incomplete}}) == "true" ]]; then
         popd
         echo "Assembling GOPATH"
         export GOPATH=$(realpath $HOME/go)
-        mkdir -p $GOPATH/src/$IMPORT_URL
-        mv /tmp/src/* $GOPATH/src/$IMPORT_URL
+	    mkdir -p $GOPATH/src/$IMPORT_URL mv /tmp/src/* $GOPATH/src/$IMPORT_URL
         if [[ -d /tmp/artifacts/pkg ]]; then
             echo "Restoring previous build artifacts"
             mv /tmp/artifacts/pkg $GOPATH
@@ -46,20 +73,167 @@ if [[ $(go list -f {{.Incomplete}}) == "true" ]]; then
         popd
         exit
     fi
-    exec /$STI_SCRIPTS_PATH/usage
+    /$STI_SCRIPTS_PATH/usage
+    exit 1
 else
     pushd .s2i/builds/last
+    go mod tidy
     go build -o /opt/app-root/gobinary
     popd
     popd
 fi
 `
 
-func assembler(f fn.Function) (string, error) {
-	switch f.Runtime {
-	case "go":
-		return GoAssembler, nil
-	default:
-		return "", fmt.Errorf("no assembler defined for runtime %q", f.Runtime)
-	}
+// PythonAssembler
+//
+// Adapted from /usr/libexec/s2i/assemble within the UBI-8 python-toolchain
+// such that the the script executes from subdirectory .s2i/builds/last
+// (where main resides) rather than the root, and indicates the main is
+// likewise in .s2i/builds/last/service/main.py via Procfile.  See the comment
+// inline on line 50 of the script for where the directory change instruction
+// was added.
+const PythonAssembler = `
+#!/bin/bash
+
+function is_django_installed() {
+  python -c "import django" &>/dev/null
 }
+
+function should_collectstatic() {
+  is_django_installed && [[ -z "$DISABLE_COLLECTSTATIC" ]]
+}
+
+function virtualenv_bin() {
+    # New versions of Python (>3.6) should use venv module
+    # from stdlib instead of virtualenv package
+    python3.9 -m venv $1
+}
+
+# Install pipenv or micropipenv to the separate virtualenv to isolate it
+# from system Python packages and packages in the main
+# virtualenv. Executable is simlinked into ~/.local/bin
+# to be accessible. This approach is inspired by pipsi
+# (pip script installer).
+function install_tool() {
+  echo "---> Installing $1 packaging tool ..."
+  VENV_DIR=$HOME/.local/venvs/$1
+  virtualenv_bin "$VENV_DIR"
+  # First, try to install the tool without --isolated which means that if you
+  # have your own PyPI mirror, it will take it from there. If this try fails, try it
+  # again with --isolated which ignores external pip settings (env vars, config file)
+  # and installs the tool from PyPI (needs internet connetion)
+  # $1$2 combines package name with [extras] or version specifier if is defined as $2
+  if ! $VENV_DIR/bin/pip install -U $1$2; then
+    echo "WARNING: Installation of $1 failed, trying again from official PyPI with pip --isolated install"
+    $VENV_DIR/bin/pip install --isolated -U $1$2  # Combines package name with [extras] or version specifier if is defined as $2
+  fi
+  mkdir -p $HOME/.local/bin
+  ln -s $VENV_DIR/bin/$1 $HOME/.local/bin/$1
+}
+
+set -e
+
+# First of all, check that we don't have disallowed combination of ENVs
+if [[ ! -z "$ENABLE_PIPENV" && ! -z "$ENABLE_MICROPIPENV" ]]; then
+  echo "ERROR: Pipenv and micropipenv cannot be enabled at the same time!"
+  # podman/buildah does not relay this exit code but it will be fixed hopefully
+  # https://github.com/containers/buildah/issues/2305
+  exit 3
+fi
+
+shopt -s dotglob
+echo "---> Installing application source ..."
+mv /tmp/src/* "$HOME"
+
+# ---------------------------
+# MODIFICATIONS FOR FUNCTIONS
+echo "---> (Functions) Writing app.sh ..."
+cat << 'EOF' > app.sh
+#!/bin/bash
+set -e
+exec python .s2i/builds/last/service/main.py
+EOF
+chmod +x app.sh
+
+echo "---> (Functions) Changing directory to .s2i/builds/last ..."
+cd .s2i/builds/last
+# END MODIFICATION FOR FUNCTIONS
+# ------------------------------
+
+# set permissions for any installed artifacts
+fix-permissions /opt/app-root -P
+
+
+if [[ ! -z "$UPGRADE_PIP_TO_LATEST" ]]; then
+  echo "---> Upgrading pip, setuptools and wheel to latest version ..."
+  if ! pip install -U pip setuptools wheel; then
+    echo "WARNING: Installation of the latest pip, setuptools and wheel failed, trying again from official PyPI with pip --isolated install"
+    pip install --isolated -U pip setuptools wheel
+  fi
+fi
+
+if [[ ! -z "$ENABLE_PIPENV" ]]; then
+  if [[ ! -z "$PIN_PIPENV_VERSION" ]]; then
+    # Add == as a prefix to pipenv version, if defined
+    PIN_PIPENV_VERSION="==$PIN_PIPENV_VERSION"
+  fi
+  install_tool "pipenv" "$PIN_PIPENV_VERSION"
+  echo "---> Installing dependencies via pipenv ..."
+  if [[ -f Pipfile ]]; then
+    pipenv install --deploy
+  elif [[ -f requirements.txt ]]; then
+    pipenv install -r requirements.txt
+  fi
+  # pipenv check
+elif [[ ! -z "$ENABLE_MICROPIPENV" ]]; then
+  install_tool "micropipenv" "[toml]"
+  echo "---> Installing dependencies via micropipenv ..."
+  # micropipenv detects Pipfile.lock and requirements.txt in this order
+  micropipenv install --deploy
+elif [[ -f requirements.txt ]]; then
+  echo "---> Installing dependencies ..."
+  pip install -r requirements.txt
+fi
+
+if [[ ( -f setup.py || -f setup.cfg ) && -z "$DISABLE_SETUP_PY_PROCESSING" ]]; then
+  echo "---> Installing application (via setup.{py,cfg})..."
+  pip install .
+fi
+
+if [[ -f pyproject.toml && -z "$DISABLE_PYPROJECT_TOML_PROCESSING" ]]; then
+  echo "---> Installing application (via pyproject.toml)..."
+  pip install .
+fi
+
+if should_collectstatic; then
+  (
+    echo "---> Collecting Django static files ..."
+
+    APP_HOME=$(readlink -f "${APP_HOME:-.}")
+    # Change the working directory to APP_HOME
+    PYTHONPATH="$(pwd)${PYTHONPATH:+:$PYTHONPATH}"
+    cd "$APP_HOME"
+
+    # Look for 'manage.py' in the current directory
+    manage_file=./manage.py
+
+    if [[ ! -f "$manage_file" ]]; then
+      echo "WARNING: seems that you're using Django, but we could not find a 'manage.py' file."
+      echo "'manage.py collectstatic' ignored."
+      exit
+    fi
+
+    if ! python $manage_file collectstatic --dry-run --noinput &> /dev/null; then
+      echo "WARNING: could not run 'manage.py collectstatic'. To debug, run:"
+      echo "    $ python $manage_file collectstatic --noinput"
+      echo "Ignore this warning if you're not serving static files with Django."
+      exit
+    fi
+
+    python $manage_file collectstatic --noinput
+  )
+fi
+
+# set permissions for any installed artifacts
+fix-permissions /opt/app-root -P
+`

pkg/builders/s2i/builder.go

@@ -1,35 +1,22 @@
 package s2i
 
 import (
-	"archive/tar"
 	"context"
 	"errors"
 	"fmt"
-	"io"
-	"io/fs"
 	"net/url"
 	"os"
 	"path/filepath"
-	"regexp"
 	"runtime"
-	"slices"
 	"strings"
 
-	"github.com/docker/docker/api/types"
 	dockerClient "github.com/docker/docker/client"
-	"github.com/docker/docker/pkg/jsonmessage"
-	"github.com/google/go-containerregistry/pkg/name"
-	v1 "github.com/google/go-containerregistry/pkg/v1"
-	"github.com/google/go-containerregistry/pkg/v1/remote"
 	"github.com/openshift/source-to-image/pkg/api"
 	"github.com/openshift/source-to-image/pkg/api/validation"
 	"github.com/openshift/source-to-image/pkg/build"
 	"github.com/openshift/source-to-image/pkg/build/strategies"
 	s2idocker "github.com/openshift/source-to-image/pkg/docker"
 	"github.com/openshift/source-to-image/pkg/scm/git"
-	"golang.org/x/exp/maps"
-	"golang.org/x/term"
-
 	"knative.dev/func/pkg/builders"
 	"knative.dev/func/pkg/docker"
 	fn "knative.dev/func/pkg/functions"
@@ -54,18 +41,12 @@ var DefaultBuilderImages = map[string]string{
 	"typescript": DefaultNodeBuilder,
 }
 
-// DockerClient is subset of dockerClient.CommonAPIClient required by this package
-type DockerClient interface {
-	ImageBuild(ctx context.Context, context io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error)
-	ImageInspectWithRaw(ctx context.Context, image string) (types.ImageInspect, []byte, error)
-}
-
 // Builder of functions using the s2i subsystem.
 type Builder struct {
 	name    string
 	verbose bool
 	impl    build.Builder // S2I builder implementation (aka "Strategy")
-	cli     DockerClient
+	cli     s2idocker.Client
 }
 
 type Option func(*Builder)
@@ -92,7 +73,7 @@ func WithImpl(s build.Builder) Option {
 	}
 }
 
-func WithDockerClient(cli DockerClient) Option {
+func WithDockerClient(cli s2idocker.Client) Option {
 	return func(b *Builder) {
 		b.cli = cli
 	}
@@ -163,13 +144,6 @@ func (b *Builder) Build(ctx context.Context, f fn.Function, platforms []fn.Platf
 		}
 	}
 
-	// Build directory
-	tmp, err := os.MkdirTemp("", "func-s2i-build")
-	if err != nil {
-		return fmt.Errorf("cannot create temporary dir for s2i build: %w", err)
-	}
-	defer os.RemoveAll(tmp)
-
 	// Build Config
 	cfg := &api.Config{
 		Source: &git.URL{
@@ -183,7 +157,6 @@ func (b *Builder) Build(ctx context.Context, f fn.Function, platforms []fn.Platf
 		PreviousImagePullPolicy: api.DefaultPreviousImagePullPolicy,
 		RuntimeImagePullPolicy:  api.DefaultRuntimeImagePullPolicy,
 		DockerConfig:            s2idocker.GetDefaultDockerConfig(),
-		AsDockerfile:            filepath.Join(tmp, "Dockerfile"),
 	}
 
 	// Scaffold
@@ -191,19 +164,6 @@ func (b *Builder) Build(ctx context.Context, f fn.Function, platforms []fn.Platf
 		return
 	}
 
-	// Extract a an S2I script url from the image if provided and use
-	// this in the build config.
-	scriptURL, err := s2iScriptURL(ctx, client, cfg.BuilderImage)
-	if err != nil {
-		return fmt.Errorf("cannot get s2i script url: %w", err)
-	} else if scriptURL != "image:///usr/libexec/s2i" {
-		// Only set if the label found on the image is NOT the default.
-		// Otherwise this label, which is essentially a default fallback, will
-		// take precidence over any scripts provided in ./.s2i/bin, which are
-		// supposed to be the override to that default.
-		cfg.ScriptsURL = scriptURL
-	}
-
 	// Excludes
 	// Do not include .git, .env, .func or any language-specific cache directories
 	// (node_modules, etc) in the tar file sent to the builder, as this both
@@ -218,22 +178,32 @@ func (b *Builder) Build(ctx context.Context, f fn.Function, platforms []fn.Platf
 	if err != nil {
 		return err
 	}
+
+	buildEnvs["LISTEN_ADDRESS"] = "[::]:8080"
 	for k, v := range buildEnvs {
 		cfg.Environment = append(cfg.Environment, api.EnvironmentSpec{Name: k, Value: v})
 	}
 
+	for _, m := range f.Build.Mounts {
+		cfg.BuildVolumes = append(cfg.BuildVolumes, fmt.Sprintf("%s:%s:ro,Z", m.Source, m.Destination))
+	}
+
+	if runtime.GOOS == "linux" {
+		cfg.DockerNetworkMode = "host"
+	}
+
 	// Validate the config
 	if errs := validation.ValidateConfig(cfg); len(errs) > 0 {
 		for _, e := range errs {
 			fmt.Fprintf(os.Stderr, "ERROR: %s\n", e)
 		}
-		return errors.New("Unable to build via the s2i builder.")
+		return errors.New("unable to build via the s2i builder")
 	}
 
 	// Create the S2I builder instance if not overridden
 	var impl = b.impl
 	if impl == nil {
-		impl, _, err = strategies.Strategy(nil, cfg, build.Overrides{})
+		impl, _, err = strategies.Strategy(client, cfg, build.Overrides{})
 		if err != nil {
 			return fmt.Errorf("cannot create s2i builder: %w", err)
 		}
@@ -250,161 +220,7 @@ func (b *Builder) Build(ctx context.Context, f fn.Function, platforms []fn.Platf
 			fmt.Fprintln(os.Stderr, message)
 		}
 	}
-
-	pr, pw := io.Pipe()
-
-	// s2i apparently is not excluding the files in --as-dockerfile mode
-	exclude := regexp.MustCompile(cfg.ExcludeRegExp)
-
-	const up = ".." + string(os.PathSeparator)
-	go func() {
-		tw := tar.NewWriter(pw)
-		err := filepath.Walk(tmp, func(path string, fi fs.FileInfo, err error) error {
-			if err != nil {
-				return err
-			}
-
-			p, err := filepath.Rel(tmp, path)
-			if err != nil {
-				return fmt.Errorf("cannot get relative path: %w", err)
-			}
-			if p == "." {
-				return nil
-			}
-
-			p = filepath.ToSlash(p)
-
-			if exclude.MatchString(p) {
-				return nil
-			}
-
-			lnk := ""
-			if fi.Mode()&fs.ModeSymlink != 0 {
-				lnk, err = os.Readlink(path)
-				if err != nil {
-					return fmt.Errorf("cannot read link: %w", err)
-				}
-				if filepath.IsAbs(lnk) {
-					lnk, err = filepath.Rel(tmp, lnk)
-					if err != nil {
-						return fmt.Errorf("cannot get relative path for symlink: %w", err)
-					}
-					if strings.HasPrefix(lnk, up) || lnk == ".." {
-						return fmt.Errorf("link %q points outside source root", p)
-					}
-				}
-			}
-
-			hdr, err := tar.FileInfoHeader(fi, filepath.ToSlash(lnk))
-			if err != nil {
-				return fmt.Errorf("cannot create tar header: %w", err)
-			}
-			hdr.Name = p
-
-			if runtime.GOOS == "windows" {
-				// Windows does not have execute permission, we assume that all files are executable.
-				hdr.Mode |= 0111
-			}
-
-			err = tw.WriteHeader(hdr)
-			if err != nil {
-				return fmt.Errorf("cannot write header to thar stream: %w", err)
-			}
-			if fi.Mode().IsRegular() {
-				var r io.ReadCloser
-				r, err = os.Open(path)
-				if err != nil {
-					return fmt.Errorf("cannot open source file: %w", err)
-				}
-				defer r.Close()
-
-				_, err = io.Copy(tw, r)
-				if err != nil {
-					return fmt.Errorf("cannot copy file to tar stream :%w", err)
-				}
-			}
-
-			return nil
-		})
-		_ = tw.Close()
-		_ = pw.CloseWithError(err)
-	}()
-
-	opts := types.ImageBuildOptions{
-		Tags:       []string{f.Build.Image},
-		PullParent: true,
-	}
-
-	resp, err := client.ImageBuild(ctx, pr, opts)
-	if err != nil {
-		return fmt.Errorf("cannot build the app image: %w", err)
-	}
-	defer resp.Body.Close()
-
-	var out io.Writer = io.Discard
-	if b.verbose {
-		out = os.Stderr
-	}
-
-	var isTerminal bool
-	var fd uintptr
-	if outF, ok := out.(*os.File); ok {
-		fd = outF.Fd()
-		isTerminal = term.IsTerminal(int(outF.Fd()))
-	}
-
-	return jsonmessage.DisplayJSONMessagesStream(resp.Body, out, fd, isTerminal, nil)
-}
-
-func s2iScriptURL(ctx context.Context, cli DockerClient, image string) (string, error) {
-	img, _, err := cli.ImageInspectWithRaw(ctx, image)
-	if err != nil {
-		if dockerClient.IsErrNotFound(err) { // image is not in the daemon, get info directly from registry
-			var (
-				ref name.Reference
-				img v1.Image
-				cfg *v1.ConfigFile
-			)
-
-			ref, err = name.ParseReference(image)
-			if err != nil {
-				return "", fmt.Errorf("cannot parse image name: %w", err)
-			}
-			if _, ok := ref.(name.Tag); ok && !slices.Contains(maps.Values(DefaultBuilderImages), image) {
-				fmt.Fprintln(os.Stderr, "image referenced by tag which is discouraged: Tags are mutable and can point to a different artifact than the expected one")
-			}
-			img, err = remote.Image(ref)
-			if err != nil {
-				return "", fmt.Errorf("cannot get image from registry: %w", err)
-			}
-			cfg, err = img.ConfigFile()
-			if err != nil {
-				return "", fmt.Errorf("cannot get config for image: %w", err)
-			}
-
-			if cfg.Config.Labels != nil {
-				if u, ok := cfg.Config.Labels["io.openshift.s2i.scripts-url"]; ok {
-					return u, nil
-				}
-			}
-		}
-		return "", err
-	}
-
-	if img.Config != nil && img.Config.Labels != nil {
-		if u, ok := img.Config.Labels["io.openshift.s2i.scripts-url"]; ok {
-			return u, nil
-		}
-	}
-
-	//nolint:staticcheck
-	if img.ContainerConfig != nil && img.ContainerConfig.Labels != nil {
-		if u, ok := img.ContainerConfig.Labels["io.openshift.s2i.scripts-url"]; ok {
-			return u, nil
-		}
-	}
-
-	return "", nil
+	return nil
 }
 
 // Builder Image chooses the correct builder image or defaults.
@@ -417,8 +233,8 @@ func BuilderImage(f fn.Function, builderName string) (string, error) {
 // Returns a config with settings suitable for building runtimes which
 // support scaffolding.
 func scaffold(cfg *api.Config, f fn.Function) (*api.Config, error) {
-	// Scafffolding is currently only supported by the Go runtime
-	if f.Runtime != "go" {
+	// Scafffolding is currently only supported by the Go and Python runtimes
+	if f.Runtime != "go" && f.Runtime != "python" {
 		return cfg, nil
 	}
 

pkg/builders/s2i/builder_test.go

@@ -1,28 +1,17 @@
 package s2i_test
 
 import (
-	"archive/tar"
-	"bytes"
 	"context"
 	"errors"
-	"fmt"
 	"io"
-	"log"
-	"net"
-	"net/http"
-	"os"
-	"path/filepath"
-	"strings"
 	"testing"
 
-	"github.com/google/go-containerregistry/pkg/name"
-	"github.com/google/go-containerregistry/pkg/registry"
-	"github.com/google/go-containerregistry/pkg/v1/remote"
-	"github.com/google/go-containerregistry/pkg/v1/tarball"
-
 	"github.com/docker/docker/api/types"
 	"github.com/docker/docker/api/types/container"
+	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/errdefs"
+	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 
 	"github.com/openshift/source-to-image/pkg/api"
 
@@ -165,70 +154,6 @@ func Test_BuilderImageConfigurable(t *testing.T) {
 	}
 }
 
-// Test_BuildImageWithFuncIgnore ensures that ignored files are not added to
-// the func image
-func Test_BuildImageWithFuncIgnore(t *testing.T) {
-
-	funcIgnoreContent := []byte(`#testing Comments
-#testingComments.txt
-hello.txt
-`)
-	f := fn.Function{
-		Runtime: "node",
-	}
-	tempdir := t.TempDir()
-	f.Root = tempdir
-	//create a .funcignore file containing the details of the files to be ignored
-	err := os.WriteFile(filepath.Join(f.Root, ".funcignore"), funcIgnoreContent, 0644)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	// creating test files which should be ignored
-	err = os.WriteFile(filepath.Join(f.Root, "hello.txt"), []byte(""), 0644)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = os.WriteFile(filepath.Join(f.Root, "#testingComments.txt"), []byte(""), 0644)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	cli := mockDocker{
-		build: func(ctx context.Context, context io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error) {
-			tr := tar.NewReader(context)
-			for {
-				hdr, err := tr.Next()
-				if err != nil {
-					if errors.Is(err, io.EOF) {
-						break
-					}
-					return types.ImageBuildResponse{}, err
-				}
-
-				// If we find the undesired file, return an error
-				if filepath.Base(hdr.Name) == "hello.txt" {
-					return types.ImageBuildResponse{}, fmt.Errorf("test failed, found ignonered file %s:", filepath.Base(hdr.Name))
-				}
-				// If we find the undesired file, return an error
-				if filepath.Base(hdr.Name) == "#tesingComments.txt" {
-					return types.ImageBuildResponse{}, fmt.Errorf("test failed, found ignonered file %s:", filepath.Base(hdr.Name))
-				}
-
-			}
-			return types.ImageBuildResponse{
-				Body:   io.NopCloser(strings.NewReader(`{"stream": "OK!"}`)),
-				OSType: "linux",
-			}, nil
-		},
-	}
-	b := s2i.NewBuilder(s2i.WithName(builders.S2I), s2i.WithDockerClient(cli))
-	if err := b.Build(context.Background(), f, nil); err != nil {
-		t.Fatal(err)
-	}
-}
-
 // Test_Verbose ensures that the verbosity flag is propagated to the
 // S2I builder implementation.
 func Test_BuilderVerbose(t *testing.T) {
@@ -284,192 +209,15 @@ func Test_BuildEnvs(t *testing.T) {
 	}
 }
 
-func TestS2IScriptURL(t *testing.T) {
-	testRegistry := startRegistry(t)
-
-	// builder that is only in registry not in daemon
-	remoteBuilder := testRegistry + "/default/builder:remote"
-	// builder that is in daemon
-	localBuilder := "example.com/default/builder:local"
-
-	// begin push testing builder to registry
-	tag, err := name.NewTag(remoteBuilder)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	img, err := tarball.ImageFromPath(filepath.Join("testdata", "builder.tar"), nil)
-	if err != nil {
-		t.Fatal(err)
-	}
-
-	err = remote.Write(&tag, img)
-	if err != nil {
-		t.Fatal(err)
-	}
-	// end push testing builder to registry
-
-	scriptURL := "image:///usr/local/s2i"
-	cli := mockDocker{
-		inspect: func(ctx context.Context, image string) (types.ImageInspect, []byte, error) {
-			if image != localBuilder {
-				return types.ImageInspect{}, nil, notFoundErr{}
-			}
-			return types.ImageInspect{
-				Config: &container.Config{Labels: map[string]string{"io.openshift.s2i.scripts-url": scriptURL}},
-			}, nil, nil
-		},
-	}
-	impl := &mockImpl{
-		BuildFn: func(config *api.Config) (*api.Result, error) {
-			if config.ScriptsURL != scriptURL {
-				return nil, fmt.Errorf("unexepeted ScriptURL: %q", config.ScriptsURL)
-			}
-			return nil, nil
-		},
-	}
-
-	tests := []struct {
-		name         string
-		builderImage string
-	}{
-		{name: "builder in daemon", builderImage: localBuilder},
-		{name: "builder not in daemon", builderImage: remoteBuilder},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			f := fn.Function{
-				Runtime: "node",
-				Build: fn.BuildSpec{
-					BuilderImages: map[string]string{
-						builders.S2I: tt.builderImage,
-					},
-				},
-			}
-
-			b := s2i.NewBuilder(s2i.WithName(builders.S2I), s2i.WithImpl(impl), s2i.WithDockerClient(cli))
-			err = b.Build(context.Background(), f, nil)
-			if err != nil {
-				t.Error(err)
-			}
-		})
-	}
-
-}
-
-func startRegistry(t *testing.T) (addr string) {
-	s := http.Server{
-		Handler: registry.New(registry.Logger(log.New(io.Discard, "", 0))),
-	}
-	t.Cleanup(func() { s.Close() })
-
-	l, err := net.Listen("tcp", "localhost:0")
-	if err != nil {
-		t.Fatal(err)
-	}
-	addr = l.Addr().String()
-
-	go func() {
-		err = s.Serve(l)
-		if err != nil && !errors.Is(err, net.ErrClosed) {
-			fmt.Fprintln(os.Stderr, "ERROR: ", err)
-		}
-	}()
-
-	return addr
-}
-
-func TestBuildContextUpload(t *testing.T) {
-
-	dockerfileContent := []byte("FROM scratch\nLABEL A=42")
-	atxtContent := []byte("hello world!\n")
-
-	cli := mockDocker{
-		build: func(ctx context.Context, context io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error) {
-			tr := tar.NewReader(context)
-			for {
-				hdr, err := tr.Next()
-				if err != nil {
-					if errors.Is(err, io.EOF) {
-						break
-					}
-					return types.ImageBuildResponse{}, err
-				}
-				switch hdr.Name {
-				case ".":
-				case "Dockerfile":
-					bs, err := io.ReadAll(tr)
-					if err != nil {
-						return types.ImageBuildResponse{}, err
-					}
-					if !bytes.Equal(bs, dockerfileContent) {
-						return types.ImageBuildResponse{}, errors.New("bad content for Dockerfile")
-					}
-				case "a.txt":
-					bs, err := io.ReadAll(tr)
-					if err != nil {
-						return types.ImageBuildResponse{}, err
-					}
-					if !bytes.Equal(bs, atxtContent) {
-						return types.ImageBuildResponse{}, errors.New("bad content for a.txt")
-					}
-				default:
-					return types.ImageBuildResponse{}, fmt.Errorf("unexpected file or directory: %q", hdr.Name)
-				}
-			}
-			return types.ImageBuildResponse{
-				Body:   io.NopCloser(strings.NewReader(`{"stream": "OK!"}`)),
-				OSType: "linux",
-			}, nil
-		},
-	}
-
-	impl := &mockImpl{
-		BuildFn: func(config *api.Config) (*api.Result, error) {
-			err := os.WriteFile(config.AsDockerfile, dockerfileContent, 0644)
-			if err != nil {
-				return nil, err
-			}
-			err = os.WriteFile(filepath.Join(filepath.Dir(config.AsDockerfile), "a.txt"), atxtContent, 0644)
-			if err != nil {
-				return nil, err
-			}
-			err = os.Mkdir(filepath.Join(filepath.Dir(config.AsDockerfile), "node_modules"), 0755)
-			if err != nil {
-				return nil, err
-			}
-
-			return nil, nil
-		},
-	}
-
-	f := fn.Function{
-		Runtime: "node",
-	}
-	b := s2i.NewBuilder(s2i.WithImpl(impl), s2i.WithDockerClient(cli))
-	err := b.Build(context.Background(), f, nil)
-	if err != nil {
-		t.Error(err)
-	}
-}
-
 func TestBuildFail(t *testing.T) {
 	cli := mockDocker{
-		build: func(ctx context.Context, context io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error) {
-			return types.ImageBuildResponse{
-				Body:   io.NopCloser(strings.NewReader(`{"errorDetail": {"message": "Error: this is expected"}}`)),
-				OSType: "linux",
-			}, nil
+		inspect: func(ctx context.Context, image string) (types.ImageInspect, []byte, error) {
+			return types.ImageInspect{}, nil, errors.New("this is expected")
 		},
 	}
-	impl := &mockImpl{
-		BuildFn: func(config *api.Config) (*api.Result, error) {
-			return &api.Result{Success: true}, nil
-		},
-	}
-	b := s2i.NewBuilder(s2i.WithImpl(impl), s2i.WithDockerClient(cli))
+	b := s2i.NewBuilder(s2i.WithDockerClient(cli))
 	err := b.Build(context.Background(), fn.Function{Runtime: "node"}, nil)
-	if err == nil || !strings.Contains(err.Error(), "Error: this is expected") {
+	if err == nil {
 		t.Error("didn't get expected error")
 	}
 }
@@ -485,7 +233,6 @@ func (i *mockImpl) Build(cfg *api.Config) (*api.Result, error) {
 
 type mockDocker struct {
 	inspect func(ctx context.Context, image string) (types.ImageInspect, []byte, error)
-	build   func(ctx context.Context, context io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error)
 }
 
 func (m mockDocker) ImageInspectWithRaw(ctx context.Context, image string) (types.ImageInspect, []byte, error) {
@@ -497,15 +244,60 @@ func (m mockDocker) ImageInspectWithRaw(ctx context.Context, image string) (type
 }
 
 func (m mockDocker) ImageBuild(ctx context.Context, context io.Reader, options types.ImageBuildOptions) (types.ImageBuildResponse, error) {
-	if m.build != nil {
-		return m.build(ctx, context, options)
-	}
+	panic("implement me")
+}
 
-	_, _ = io.Copy(io.Discard, context)
-	return types.ImageBuildResponse{
-		Body:   io.NopCloser(strings.NewReader("")),
-		OSType: "linux",
-	}, nil
+func (m mockDocker) ContainerAttach(ctx context.Context, container string, options container.AttachOptions) (types.HijackedResponse, error) {
+	panic("implement me")
+}
+
+func (m mockDocker) ContainerCommit(ctx context.Context, container string, options container.CommitOptions) (types.IDResponse, error) {
+	panic("implement me")
+}
+
+func (m mockDocker) ContainerCreate(ctx context.Context, config *container.Config, hostConfig *container.HostConfig, networkingConfig *network.NetworkingConfig, platform *ocispec.Platform, containerName string) (container.CreateResponse, error) {
+	panic("implement me")
+}
+
+func (m mockDocker) ContainerInspect(ctx context.Context, container string) (types.ContainerJSON, error) {
+	panic("implement me")
+}
+
+func (m mockDocker) ContainerRemove(ctx context.Context, container string, options container.RemoveOptions) error {
+	panic("implement me")
+}
+
+func (m mockDocker) ContainerStart(ctx context.Context, container string, options container.StartOptions) error {
+	panic("implement me")
+}
+
+func (m mockDocker) ContainerKill(ctx context.Context, container, signal string) error {
+	panic("implement me")
+}
+
+func (m mockDocker) ContainerWait(ctx context.Context, container string, condition container.WaitCondition) (<-chan container.WaitResponse, <-chan error) {
+	panic("implement me")
+}
+
+func (m mockDocker) CopyToContainer(ctx context.Context, container, path string, content io.Reader, opts container.CopyToContainerOptions) error {
+	panic("implement me")
+}
+
+func (m mockDocker) CopyFromContainer(ctx context.Context, container, srcPath string) (io.ReadCloser, container.PathStat, error) {
+	panic("implement me")
+}
+
+func (m mockDocker) ImagePull(ctx context.Context, ref string, options image.PullOptions) (io.ReadCloser, error) {
+	panic("implement me")
+}
+
+func (m mockDocker) ImageRemove(ctx context.Context, image string, options image.RemoveOptions) ([]image.DeleteResponse, error) {
+	panic("implement me")
+}
+
+func (m mockDocker) ServerVersion(ctx context.Context) (types.Version, error) {
+
+	panic("implement me")
 }
 
 type notFoundErr struct {

pkg/builders/testdata/go-fn-with-private-deps/.funcignore

@@ -0,0 +1,5 @@
+
+# Use the .funcignore file to exclude files which should not be
+# tracked in the image build. To instruct the system not to track
+# files in the image build, add the regex pattern or file information
+# to this file.

pkg/builders/testdata/go-fn-with-private-deps/.gitignore

@@ -0,0 +1,5 @@
+
+# Functions use the .func directory for local runtime data which should
+# generally not be tracked in source control. To instruct the system to track
+# .func in source control, comment the following line (prefix it with '# ').
+/.func

pkg/builders/testdata/go-fn-with-private-deps/README.md

@@ -0,0 +1,20 @@
+# Go HTTP Function
+
+Welcome to your new Go Function! The boilerplate function code can be found in
+[`handle.go`](handle.go). This Function responds to HTTP requests.
+
+## Development
+
+Develop new features by adding a test to [`handle_test.go`](handle_test.go) for
+each feature, and confirm it works with `go test`.
+
+Update the running analog of the function using the `func` CLI or client
+library, and it can be invoked from your browser or from the command line:
+
+```console
+curl http://myfunction.example.com/
+```
+
+For more, see [the complete documentation]('https://github.com/knative/func/tree/main/docs')
+
+