Repository: GoogleContainerTools/skaffold
Pull request #8980 (2023-07-31 12:32:55)

chore: bump github/codeql-action from 2.21.1 to 2.21.2
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 2.21.1 to 2.21.2.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's changelog</a>.</em></p>
<blockquote>
<h2>2.21.2 - 28 Jul 2023</h2>
<ul>
<li>Update default CodeQL bundle version to 2.14.1. <a href="https://redirect.github.com/github/codeql-action/pull/1797">#1797</a></li>
<li>Avoid duplicating the analysis summary within the logs. <a href="https://redirect.github.com/github/codeql-action/pull/1811">#1811</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/github/codeql-action/commit/0ba4244466797eb048eb91a6cd43d5c03ca8bd05"><code>0ba4244</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/1813">#1813</a> from github/update-v2.21.2-10c6bfee1</li>
<li><a href="https://github.com/github/codeql-action/commit/a9a416c8f416ad4eb757d9dfb734f7c7c2135b59"><code>a9a416c</code></a> Update changelog for v2.21.2</li>
<li><a href="https://github.com/github/codeql-action/commit/10c6bfee1203aaee088328bf6c8b5e1a68b10d52"><code>10c6bfe</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/1811">#1811</a> from github/henrymercer/print-summary-once</li>
<li><a href="https://github.com/github/codeql-action/commit/feea86eed3312cf8448c22bc5a887f26f4023c78"><code>feea86e</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/1810">#1810</a> from github/henrymercer/ci/use-platform-specific-bun...</li>
<li><a href="https://github.com/github/codeql-action/commit/2e6f8c08c115f4741890e32679542130a51f53d1"><code>2e6f8c0</code></a> Add changelog note</li>
<li><a href="https://github.com/github/codeql-action/commit/8342844ea722dd44af414e7eed5ced0e67fe5c44"><code>8342844</code></a> Only print the analysis summary once</li>
<li><a href="https://github.com/github/codeql-action/commit/679aac1b20947026d7575616383725ec2d5928cf"><code>679aac1</code></a> Use platform specific bundles in PR checks</li>
<li><a href="https://github.com/github/codeql-action/commit/de6681ceb7967227f8760bfad7bde8540662f894"><code>de6681c</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/1797">#1797</a> from github/update-bundle/codeql-bundle-v2.14.1</li>
<li><a href="https://github.com/github/codeql-action/commit/f6fe5c5c7031df5b91cc10eab7f02444d9880834"><code>f6fe5c5</code></a> Merge branch 'main' into update-bundle/codeql-bundle-v2.14.1</li>
<li><a href="https://github.com/github/codeql-action/commit/62762170e1531f7cbc3cfc2d654408173f80d3ca"><code>6276217</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/1808">#1808</a> from github/mergeback/v2.21.1-to-main-6ca1aa8c</li>
<li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/v2.21.1...v2.21.2">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=2.21.1&new-version=2.21.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index d6c941b7b..742e57c35 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -53,7 +53,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2.21.1
+      uses: github/codeql-action/init@v2.21.2
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -65,4 +65,4 @@ jobs:
        make out/skaffold
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2.21.1
+      uses: github/codeql-action/analyze@v2.21.2
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index defe25028..096c27d11 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -50,6 +50,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@v2.21.1 # v1.0.26
+        uses: github/codeql-action/upload-sarif@v2.21.2 # v1.0.26
         with:
           sarif_file: results.sarif
diff --git a/pkg/skaffold/render/renderer/kustomize/kustomize.go b/pkg/skaffold/render/renderer/kustomize/kustomize.go
index 624d8fcc1..b64d33820 100644
--- a/pkg/skaffold/render/renderer/kustomize/kustomize.go
+++ b/pkg/skaffold/render/renderer/kustomize/kustomize.go
@@ -479,12 +479,20 @@ func DependenciesForKustomization(dir string) ([]string, error) {
 
 	for _, patch := range content.Patches {
 		if patch.Path != "" {
+			local, _ := pathExistsLocally(patch.Path, dir)
+			if !local {
+				continue
+			}
 			deps = append(deps, filepath.Join(dir, patch.Path))
 		}
 	}
 
 	for _, jsonPatch := range content.PatchesJson6902 {
 		if jsonPatch.Path != "" {
+			local, _ := pathExistsLocally(jsonPatch.Path, dir)
+			if !local {
+				continue
+			}
 			deps = append(deps, filepath.Join(dir, jsonPatch.Path))
 		}
 	}


Test patch:
diff --git a/pkg/skaffold/deploy/kubectl/kustomize_test.go b/pkg/skaffold/deploy/kubectl/kustomize_test.go
index 499186ae7..24ca3567c 100644
--- a/pkg/skaffold/deploy/kubectl/kustomize_test.go
+++ b/pkg/skaffold/deploy/kubectl/kustomize_test.go
@@ -266,6 +266,9 @@ func TestDependenciesForKustomization(t *testing.T) {
 - path: patch1.yaml
   target:
     kind: Deployment`},
+			createFiles: map[string]string{
+				"patch1.yaml": "",
+			},
 			expected: []string{"kustomization.yaml", "patch1.yaml"},
 		},
 		{
@@ -282,8 +285,19 @@ func TestDependenciesForKustomization(t *testing.T) {
 			kustomizations: map[string]string{"kustomization.yaml": `patches: 
 - path: patch1.yaml 
 - path: path/patch2.yaml`},
+			createFiles: map[string]string{
+				"patch1.yaml":      "",
+				"path/patch2.yaml": "",
+			},
 			expected: []string{"kustomization.yaml", "patch1.yaml", "path/patch2.yaml"},
 		},
+		{
+			description: "ignore patches legacy, path doesn't exist",
+			kustomizations: map[string]string{"kustomization.yaml": `patches: 
+- path: patch1.yaml 
+- path: path/patch2.yaml`},
+			expected: []string{"kustomization.yaml"},
+		},
 		{
 			description:    "patchesStrategicMerge",
 			kustomizations: map[string]string{"kustomization.yaml": `patchesStrategicMerge: [patch1.yaml, "patch2.yaml", 'path/patch3.yaml']`},
@@ -306,8 +320,19 @@ func TestDependenciesForKustomization(t *testing.T) {
 			kustomizations: map[string]string{"kustomization.yaml": `patchesJson6902:
 - path: patch1.json
 - path: path/patch2.json`},
+			createFiles: map[string]string{
+				"patch1.json":      "",
+				"path/patch2.json": "",
+			},
 			expected: []string{"kustomization.yaml", "patch1.json", "path/patch2.json"},
 		},
+		{
+			description: "ignore patches json 6902 path doesn't exist",
+			kustomizations: map[string]string{"kustomization.yaml": `patchesJson6902:
+- path: patch1.json`,
+			},
+			expected: []string{"kustomization.yaml"},
+		},
 		{
 			description: "ignore patch without path",
 			kustomizations: map[string]string{"kustomization.yaml": `patchesJson6902: