Sprint Responsible: 51

[jakobmoellerdev]

Responsibilities:

Release Responsible: Responsible for the ocm library release and for setting up corresponding issues to track the releases (and patches). You can find the release process documentation here. @jakobmoellerdev will support you!

Scrum Master: Responsible for moderating, taking meeting notes and follow up tasks for our regular scrum meetings! 📝

Support Coordinator: Responsible for monitoring our slack support channels #sap-tech-ocm #sap-ext-ocm-project and github issues!

Security Responsible: Responsible for monitoring and triaging security issues as described in the OCM Security Compliance / Triage Guidelines!

Dependabot Updates: Responsible for taking care of the dependabot updates for the main repositories! ⏫

Done Criteria

• Security Triage Efforts
• Release OCM as per Release Decision according to the Plan
  • Release created for last release candidate AND follow up PRs checked (ocm-website, ocm-piper-cli, brew, ...)
  • Bump PR for release branch merged
  • Release Branch Cutoff performed
  • Bump PR for main branch merged
  • Release Candidate created for Cutoff branch
• Merged / Handled Dependabot updates for org (checked / triaged)
• Clone this issue for the next Sprint and plan a handover for the next assignee in the rotation (assign the issue to the next person on rotation)

Follow ups

• ocm: Update github.com/mikefarah/yq/v4 #771
• chore(deps): update module github.com/aws/smithy-go to v1.23.2 open-component-model#1208 (see comment)
• Update and unignore github.com/sigstore/sigstore in open-component-model/ocm #780
• Sprint Responsible: 51 #759 (comment)

Releases

• Promoted v0.33.0
• Created v0.34.0-rc.1
  • Patched to v0.34.0-rc.2 (chore: [releases/0.34] cherry-pick: chore: bump docker/docker to latest version again (#1693) ocm#1695)
  • Patched to v0.34.0-rc.3 (chore: [releases/0.34] cherry-pick: chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 (#1691) ocm#1698)

Previous: #744

[frewilhelm]

• Bump was fixed chore(deps): bump github.com/docker/cli from 28.5.2+incompatible to 29.0.1+incompatible ocm#1680
• We will delay the merge of feat(transfer): Optimized approach for OCM transfer by implementing a concurrent worker pool ocm#1676 until next year
• We will probably freeze new releases until next year

[frewilhelm]

We ignore github.com/mikefarah/yq/v4 in the ocm-controllers for now because their new version uses go.yaml.in/yaml/v4 which is not compatible with ocm 0.32. ocm updates to go.yaml.in/yaml/v4 in 0.34(see open-component-model/ocm-controller#778)

We need to unignore github.com/mikefarah/yq/v4 in the future. Created a follow up for this #771

[frewilhelm]

• I ignored dependabot updates for https://github.com/open-component-model/git-controller and https://github.com/open-component-model/replication-controller because the repositories are archived.
• I ignored dependabot updates for https://github.com/open-component-model/service-model because the repository is not actively maintained and not relevant (for now)

[frewilhelm]

After open-component-model/ocm-integrationtest#59 was merged the integration tests started to fail because the new version of gardener-oci does not package tarutils. The colleagues are already informed and will prepare a fix.

Check open-component-model/ocm-integrationtest#64

Waiting for gardener/cc-utils#1457