Skip to content

chore(deps)!: update zarf to v0.87.0 - #1585

Merged
bradclawsie merged 20 commits into
mainfrom
renovate/zarf
Oct 5, 2026
Merged

chore(deps)!: update zarf to v0.87.0#1585
bradclawsie merged 20 commits into
mainfrom
renovate/zarf

Conversation

@renovate

@renovate renovate Bot commented Oct 1, 2026 •
edited by bradclawsie
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Age Confidence
ghcr.io/zarf-dev/packages/init minor v0.86.0 → v0.87.0 age confidence
github.com/zarf-dev/zarf require minor v0.86.0 → v0.87.0 age confidence
zarf-dev/zarf minor 0.86.0 → 0.87.0 age confidence
zarf-dev/zarf minor v0.86.0 → v0.87.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

zarf-dev/zarf (github.com/zarf-dev/zarf)

v0.87.0

⚠ BREAKING CHANGES
  • remove images and repositories from package secret during connected deploys (#​5402)
  • helm: only label pod templates of built-in workload kinds (#​5360)
  • disable artifact server by default (#​5417)
  • migrate SignBlobOptions to a pointer (#​5411)
  • package: move signing out of publish (#​5387)
  • switch to api.Package from v1alpha1.ZarfPackage throughout repository (#​5379)
  • public operational type (#​5345)
Features
Bug Fixes
  • assemble: cleanup temporary directory on error (#​5407) (d07690e)
  • create: run OnSuccess and OnFailure actions during create (#​5406) (dd7301b)
  • helm: handle charts that render resources inside list kinds (#​5344) (1f7bbc9)
  • helm: only label pod templates of built-in workload kinds (#​5360) (7be076a)
  • init: propagate secret updates on init mode changes (#​5398) (c18603a)
  • remove images and repositories from package secret during connected deploys (#​5402) (1653ca2)
  • replace github.com/defenseunicorns/pkg with local versions (#​5324) (379379a)
  • values: preserve inferred types across null overlays (#​5412) (9213afd)
Refactoring
  • switch to api.Package from v1alpha1.ZarfPackage throughout repository (#​5379) (9ce36bb)

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

BEGIN_COMMIT_OVERRIDE
chore(deps)!: update zarf to v0.87.0 (#1585)

BREAKING CHANGE: Zarf v0.87 breaking changes. See: https://github.com/zarf-dev/zarf/releases/tag/v0.87.0 (#1585) (ee139b9)
END_COMMIT_OVERRIDE

@renovate
chore(deps): update zarf to v0.87.0
ea6bcd7 
| datasource      | package                        | from    | to      |
| --------------- | ------------------------------ | ------- | ------- |
| docker          | ghcr.io/zarf-dev/packages/init | v0.86.0 | v0.87.0 |
| go              | github.com/zarf-dev/zarf       | v0.86.0 | v0.87.0 |
| github-releases | zarf-dev/zarf                  | v0.86.0 | v0.87.0 |
| github-tags     | zarf-dev/zarf                  | v0.86.0 | v0.87.0 |
@renovate
renovate Bot requested a review from a team as a code owner October 1, 2026 17:08
@bradclawsie

bradclawsie commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Zarf breaking changes for 0.87 and additional changes to make tests, CI happy

Some changes here are applied to Legacy. Until we retire it and remove it, I feel we should make changes there if they are real correctness issues.

Don't be too put off by the lines changed, most of this is in vendoring and zarf-dev dependencies we are pulling in.

@eoghanriley

eoghanriley commented Oct 1, 2026

Copy link
Copy Markdown
Contributor

Still working on reviewing but so far I see that we will need to create 2 follow on tickets, one for being version neutral with the zarf schema as this PR converts to v1alpha which isn't an immediate issue, and moving from defenseunicorns/oci to the zarf one

@bradclawsie

bradclawsie commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

and moving from defenseunicorns/oci to the zarf one

I had made a ticket for this myself this morning: https://linear.app/defense-unicorns/issue/CLI-356/replace-defenseunicornspkg-with-zarf-local-copy

Not knowing when this would happen. I asked Brandt this morning if the defenseunicorns/pkg repo was getting archived...it is, at some point. So its a good idea, although not 100% sure it has to be for this release if you're not feeling it.

eoghanriley
eoghanriley reviewed Oct 1, 2026
View reviewed changes
Comment thread pkg/legacy/utils/boci/oci.go Resolved
eoghanriley
eoghanriley reviewed Oct 1, 2026
View reviewed changes
Comment thread pkg/legacy/utils/boci/oci.go Resolved
chance-coleman
chance-coleman reviewed Oct 1, 2026
View reviewed changes

@chance-coleman chance-coleman left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A few questions, two may be blocking

Comment thread pkg/bundle/zarf.go Resolved
Comment thread pkg/bundle/zarf.go Resolved
Comment thread .gitleaks.toml Resolved
eoghanriley
eoghanriley reviewed Oct 1, 2026
View reviewed changes
Comment thread pkg/bundle/zarf_test.go Resolved
eoghanriley
eoghanriley reviewed Oct 1, 2026
View reviewed changes
Comment thread pkg/legacy/bundle/common_test.go Resolved
eoghanriley
eoghanriley reviewed Oct 1, 2026
View reviewed changes
Comment thread pkg/legacy/bundler/fetcher/common.go Resolved
eoghanriley
eoghanriley reviewed Oct 1, 2026
View reviewed changes
Comment thread pkg/legacy/bundler/common.go Resolved
@renovate

renovate Bot commented Oct 1, 2026

Copy link
Copy Markdown
Contributor Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

eoghanriley
eoghanriley reviewed Oct 2, 2026
View reviewed changes
Comment thread pkg/legacy/utils/boci/oci.go Resolved
eoghanriley
eoghanriley reviewed Oct 2, 2026
View reviewed changes
Comment thread pkg/bundle/deploy.go Resolved
eoghanriley
eoghanriley reviewed Oct 2, 2026
View reviewed changes
Comment thread pkg/legacy/bundle/list.go Resolved
@bradclawsie

bradclawsie commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

@greptileai review

@bradclawsie

bradclawsie commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-03T18:25:16.698484Z aaa5ba4 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 2, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 17fcf5acd3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread pkg/bundle/zarf.go Resolved
@greptile-apps

greptile-apps Bot commented Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

RetriggerConfidence Score: 5/5

[High risk] Updates Zarf dependency to v0.87.0 with API changes.

The PR appears safe to merge based on the changes reviewed.

Summary

The PR updates UDS CLI to Zarf v0.87.0 and adapts package-definition, deployment, and OCI bundle paths to its APIs.

  • Adds a package-level cross-registry image-transfer test.
  • Updates deployment-state compatibility checks, examples, and command documentation.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Zarf package in source registry] --> B[Select package and image layers]
  B --> C[Copy selected blobs to bundle registry]
  C --> D[Publish bundle manifest]
  D --> E[Load bundle and image files]
Loading

Reviews (3) · Last reviewed commit: "test(legacy): verify bundled images load..."

greptile-apps[bot]
greptile-apps Bot reviewed Oct 2, 2026
View reviewed changes
Comment thread pkg/bundle/zarf.go Resolved
Comment thread pkg/legacy/bundler/pusher/remote_test.go Resolved
@bradclawsie

bradclawsie commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

@greptileai review

@bradclawsie

bradclawsie commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

@codex review

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Oct 3, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3e4ac85be9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread pkg/legacy/bundle/deploy.go Resolved
@bradclawsie

bradclawsie commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 3, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: aaa5ba4ea9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@bradclawsie bradclawsie mentioned this pull request Oct 3, 2026
Closed
3 of 5 tasks
@bradclawsie
bradclawsie marked this pull request as draft October 3, 2026 19:03
@bradclawsie

bradclawsie commented Oct 3, 2026

Copy link
Copy Markdown
Contributor

@greptileai review

@bradclawsie
bradclawsie marked this pull request as ready for review October 3, 2026 19:40
bradclawsie
bradclawsie reviewed Oct 3, 2026
View reviewed changes

@bradclawsie bradclawsie left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Comments to provide context for reviewers; read them in the file diff view.

Note that the breaking changes in this PR will require nudging the generated release notes; for reference: https://github.com/googleapis/release-please#how-can-i-fix-release-notes (thanks @slaskawi !)

Comment thread internal/zarf/layout.go Resolved
Comment thread internal/zarf/layout.go Resolved
Comment thread internal/zarf/remove.go Resolved
Comment thread internal/zarf/source.go Resolved
Comment thread pkg/bundle/zarf.go Resolved
Comment thread pkg/legacy/bundle/list_test.go Resolved
Comment thread pkg/legacy/bundler/fetcher/common.go Resolved
Comment thread pkg/legacy/bundler/pusher/remote.go Resolved
Comment thread pkg/legacy/bundler/pusher/remote_test.go Resolved
Comment thread pkg/legacy/utils/boci/oci.go Resolved
slaskawi
slaskawi reviewed Oct 5, 2026
View reviewed changes

@slaskawi slaskawi left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Added a few comments but I'm generally good with the direction

Comment thread docs/getting-started/quickstart.mdx Resolved
Comment thread internal/artifact/package_metadata.go Resolved
Comment thread pkg/bundle/zarf.go Resolved
@bradclawsie bradclawsie changed the title chore(deps): update zarf to v0.87.0 chore(deps)!: update zarf to v0.87.0 Oct 5, 2026
@bradclawsie
bradclawsie merged commit ee139b9 into main Oct 5, 2026
53 checks passed
@bradclawsie
bradclawsie deleted the renovate/zarf branch October 5, 2026 18:29
@github-actions github-actions Bot mentioned this pull request Oct 5, 2026
Merged
@bradclawsie
bradclawsie restored the renovate/zarf branch October 5, 2026 20:22
@github-actions github-actions Bot mentioned this pull request Oct 6, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@slaskawi slaskawi slaskawi left review comments
@greptile-apps greptile-apps[bot] greptile-apps[bot] left review comments
@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@eoghanriley eoghanriley eoghanriley approved these changes
@chance-coleman chance-coleman chance-coleman approved these changes
+1 more reviewer
@bradclawsie bradclawsie bradclawsie left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@bradclawsie @eoghanriley @slaskawi @chance-coleman