Update release branch

.ccignore

@@ -0,0 +1 @@
+vendor/

.github/codeql/codeql-config.yaml

@@ -0,0 +1,8 @@
+paths:
+  - pkg
+  - cmd
+  - internal
+  - test
+paths-ignore:
+  - pkg/provisioner/provisioner.go
+  - cmd/cli/dryrun/dryrun.go

.github/copy-pr-bot.yaml

@@ -0,0 +1,3 @@
+# https://docs.gha-runners.nvidia.com/apps/copy-pr-bot/#configuration
+
+enabled: true

.github/dependabot.yml

@@ -3,12 +3,13 @@
 
 version: 2
 updates:
+# main branch
   - package-ecosystem: "gomod"
     target-branch: main
-    directory: "/"
+    directories:
+    - "/"
     schedule:
-      interval: "weekly"
-      day: "sunday"
+      interval: "daily"
     labels:
     - dependencies
     groups:
@@ -23,3 +24,12 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+
+  - package-ecosystem: "docker"
+    target-branch: main
+    directories:
+    - "/"
+    schedule:
+      interval: "daily"
+    labels:
+    - dependencies

.github/workflows/ci.yaml

@@ -0,0 +1,39 @@
+# Copyright 2025 NVIDIA CORPORATION
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: CI Pipeline
+
+on:
+  push:
+    branches:
+      - "pull-request/[0-9]+"
+      - main
+      - release-*
+
+jobs:
+    code-scanning:
+      uses: ./.github/workflows/code_scanning.yaml
+
+    golang:
+      uses: ./.github/workflows/golang.yaml
+
+    image:
+      uses: ./.github/workflows/image.yaml
+      needs: [golang, code-scanning]
+      secrets: inherit
+
+    e2e-test:
+      needs: golang
+      secrets: inherit
+      uses: ./.github/workflows/e2e.yaml

.github/workflows/code_scanning.yaml

@@ -0,0 +1,55 @@
+# Copyright 2024 NVIDIA CORPORATION
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: "CodeQL"
+
+on:
+  workflow_call: {}
+  pull_request:
+    types:
+      - opened
+      - synchronize
+    branches:
+      - main
+      - release-*
+  schedule:
+    - cron: '31 11 * * 4'
+
+jobs:
+  analyze:
+    name: Analyze Go code with CodeQL
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+    permissions:
+      security-events: write
+      packages: read
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        config-file: ./.github/codeql/codeql-config.yaml
+        languages: go
+        build-mode: manual
+
+    - shell: bash
+      run: |
+        make build-cli
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:go"

.github/workflows/e2e.yaml

@@ -0,0 +1,80 @@
+# Copyright 2024 NVIDIA CORPORATION
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: End-to-end Tests
+
+on:
+  workflow_call:
+    secrets:
+      AWS_ACCESS_KEY_ID:
+        required: true
+      AWS_SECRET_ACCESS_KEY:
+        required: true
+      AWS_SSH_KEY:
+        required: true
+
+jobs:
+  e2e-test:
+    runs-on: linux-amd64-cpu4
+    if: ${{ github.event.workflow_run.conclusion == 'success' }} && ${{ github.event.workflow_run.event == 'push' }}
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Install Go
+      uses: actions/setup-go@v5
+      with:
+        go-version: 'stable'
+        check-latest: true
+
+    - name: Install dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y make
+        make ginkgo
+
+    - name: Run e2e tests
+      env:
+        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        AWS_SSH_KEY: ${{ secrets.AWS_SSH_KEY }}
+        LOG_ARTIFACT_DIR: e2e_logs
+      run: |
+        e2e_ssh_key=$(mktemp)
+        echo "${{ secrets.AWS_SSH_KEY }}" > "$e2e_ssh_key"
+        chmod 600 "$e2e_ssh_key"
+        export E2E_SSH_KEY="$e2e_ssh_key"
+
+        make -f tests/Makefile test
+
+    - name: Archive Ginkgo logs
+      uses: actions/upload-artifact@v4
+      with:
+        name: ginkgo-logs
+        path: ginkgo.json
+        retention-days: 15
+
+  integration-test:
+    runs-on: linux-amd64-cpu4
+    if: ${{ github.event.workflow_run.conclusion == 'success' }} && ${{ github.event.workflow_run.event == 'push' }}
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+    - name: Set up Holodeck
+      uses: NVIDIA/holodeck@main
+      with:
+        aws_access_key_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
+        aws_secret_access_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+        aws_ssh_key: ${{ secrets.AWS_SSH_KEY }}
+        holodeck_config: "tests/data/test_aws.yml"