Repository: grafana/tanka
Pull request #937 (2023-10-23 09:29:08)

Bump k8s.io/apimachinery from 0.28.1 to 0.28.3
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some time.

Note: if you make any changes to this PR yourself, they will take precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps [k8s.io/apimachinery](https://github.com/kubernetes/apimachinery) from 0.28.1 to 0.28.3.
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/kubernetes/apimachinery/commit/ab8b4c89006575f912931de69fbd924e385f2923"><code>ab8b4c8</code></a> Merge pull request <a href="https://redirect.github.com/kubernetes/apimachinery/issues/121196">#121196</a><code>enj/automated-cherry-pick-of-#121120</code></li>
<li><a href="https://github.com/kubernetes/apimachinery/commit/68b03976c7ccbd9452289e29676e808e8bfeb35d"><code>68b0397</code></a> Prevent rapid reset http2 DOS on API server</li>
<li><a href="https://github.com/kubernetes/apimachinery/commit/1f3a244769ebb27f4cf28dfcb08ad1d85ac9f7ca"><code>1f3a244</code></a> Merge pull request <a href="https://redirect.github.com/kubernetes/apimachinery/issues/121128">#121128</a> from MadhavJivrajani/bump-x-net-128</li>
<li><a href="https://github.com/kubernetes/apimachinery/commit/1449f93c960f6a680f4eb699f44e81d71774794f"><code>1449f93</code></a> .: bump golang.org/x/net to v0.17.0</li>
<li><a href="https://github.com/kubernetes/apimachinery/commit/bc548d1d2406dffb44e1f6ea7ec1f4e9744cf170"><code>bc548d1</code></a> Merge pull request <a href="https://redirect.github.com/kubernetes/apimachinery/issues/120329">#120329</a><code>liggitt/automated-cherry-pick-of-#120327</code></li>
<li><a href="https://github.com/kubernetes/apimachinery/commit/3b64f7681deb73f9951291c809af7f762e991467"><code>3b64f76</code></a> Revert to json-patch 4.12.0</li>
<li>See full diff in <a href="https://github.com/kubernetes/apimachinery/compare/v0.28.1...v0.28.3">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=k8s.io/apimachinery&package-manager=go_modules&previous-version=0.28.1&new-version=0.28.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>

github-actions[bot]: [PR Preview Action](https://github.com/rossjrw/pr-preview-action) v1.4.4
:---:
:rocket: Deployed preview to https://grafana.github.io/tanka/pr-preview/pr-937/
on branch [`gh-pages`](https://github.com/grafana/tanka/tree/gh-pages) at 2023-10-23 09:33 UTC
<!-- Sticky Pull Request Commentpr-preview -->

Patch:
diff --git a/.drone/docker-manifest.tmpl b/.drone/docker-manifest.tmpl
deleted file mode 100644
index 2ec7d492..00000000
--- a/.drone/docker-manifest.tmpl
+++ /dev/null
@@ -1,22 +0,0 @@
-image: grafana/tanka:{{#if build.tag}}{{trimPrefix "v" build.tag}}{{else}}latest{{/if}}
-{{#if build.tags}}
-tags:
-{{#each build.tags}}
-  - {{this}}
-{{/each}}
-{{/if}}
-manifests:
-  - image: grafana/tanka:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}amd64
-    platform:
-      architecture: amd64
-      os: linux
-  - image: grafana/tanka:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}arm64
-    platform:
-      architecture: arm64
-      os: linux
-      variant: v8
-  - image: grafana/tanka:{{#if build.tag}}{{trimPrefix "v" build.tag}}-{{/if}}arm
-    platform:
-      architecture: arm
-      os: linux
-      variant: v7
diff --git a/.drone/drone.jsonnet b/.drone/drone.jsonnet
deleted file mode 100644
index a7a8382a..00000000
--- a/.drone/drone.jsonnet
+++ /dev/null
@@ -1,161 +0,0 @@
-local vault = import 'vault.libsonnet';
-
-local golang = 'golang:1.20';
-
-local volumes = [{ name: 'gopath', temp: {} }];
-local mounts = [{ name: 'gopath', path: '/go' }];
-
-local constraints = {
-  local withRef(ref) = {
-    trigger+: {
-      ref+: [ref],
-    },
-  },
-
-  tags: withRef('refs/tags/v*'),
-  mainPush: withRef('refs/heads/main'),
-  pullRequest: withRef('refs/pull/*/head'),
-};
-
-local go(name, commands) = {
-  name: name,
-  image: golang,
-  volumes: mounts,
-  commands: commands,
-};
-
-local make(target) = go(target, [
-  // Only download it once, then for every step, copy it to the right place.
-  'if [ ! -f linux-amd64/helm ]; then',
-  '  wget -q https://get.helm.sh/helm-v3.9.0-linux-amd64.tar.gz',
-  '  tar -zxvf helm-v3.9.0-linux-amd64.tar.gz',
-  '  rm -f helm-v3.9.0-linux-amd64.tar.gz',
-  'fi',
-  'cp linux-amd64/helm /usr/local/bin/helm',
-  'go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0',
-  'make ' + target,
-]);
-
-local pipeline(name) = {
-  kind: 'pipeline',
-  name: name,
-  volumes: volumes,
-  steps: [],
-};
-
-local docker(arch, depends_on=[]) =
-  pipeline('docker-' + arch) {
-    platform: {
-      os: 'linux',
-      arch: arch,
-    },
-    steps: [
-      go('fetch-tags', ['git fetch origin --tags']),
-      make('static'),
-      {
-        name: 'container',
-        image: 'plugins/docker',
-        settings: {
-          repo: 'grafana/tanka',
-          auto_tag: true,
-          auto_tag_suffix: arch,
-          username: { from_secret: vault.dockerhub_username },
-          password: { from_secret: vault.dockerhub_password },
-        },
-      },
-    ],
-    depends_on: depends_on,
-  };
-
-[
-  pipeline('check') {
-    steps: [
-      go('download', ['go mod download']),
-      make('lint'),
-      make('test'),
-      make('cross') { name: 'build' },
-    ],
-  } + constraints.pullRequest + constraints.mainPush,
-
-  pipeline('benchmark against main') {
-    node: {
-      // To ensure that benchmarks are accurate, run this build on a node that doesn't do parallel builds.
-      type: 'no-parallel',
-    },
-    steps: [
-      go('benchmark', [
-        'go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0',
-        'go test -bench=. -benchmem -count=6 -run=^$ ./... | tee bench-pr.txt',
-        'git fetch origin main',
-        'git reset --hard origin/main',
-        'go test -bench=. -benchmem -count=6 -run=^$ ./... | tee bench-main.txt',
-        'go install golang.org/x/perf/cmd/...@latest',
-        'benchstat bench-main.txt bench-pr.txt',
-      ]),
-    ],
-  } + constraints.pullRequest,
-
-  pipeline('release') {
-    steps: [
-      go('fetch-tags', ['git fetch origin --tags']),
-      make('cross'),
-      {
-        name: 'publish',
-        image: 'plugins/github-release',
-        settings: {
-          title: '${DRONE_TAG}',
-          note: importstr 'release-note.md',
-          api_key: { from_secret: vault.grafanabot_public_account_token },
-          files: 'dist/*',
-          draft: true,
-        },
-      },
-    ],
-  } + { depends_on: ['check'] } + constraints.tags,
-
-  docker('amd64', depends_on=['check']) + constraints.tags + constraints.mainPush,
-  docker('arm64', depends_on=['check']) + constraints.tags + constraints.mainPush,
-
-  pipeline('manifest-main') {
-    steps: [
-      go('fetch-tags', [
-        'git fetch origin --tags',
-        'echo "main-$(git describe --tags)" > .tags',
-      ]),
-      {
-        name: 'manifest',
-        image: 'plugins/manifest:1.4.0',
-        settings: {
-          ignore_missing: true,
-          spec: '.drone/docker-manifest.tmpl',
-          username: { from_secret: vault.dockerhub_username },
-          password: { from_secret: vault.dockerhub_password },
-        },
-      },
-    ],
-  } + {
-    depends_on: [
-      'docker-amd64',
-      'docker-arm64',
-    ],
-  } + constraints.mainPush,
-
-  pipeline('manifest') {
-    steps: [{
-      name: 'manifest',
-      image: 'plugins/manifest:1.4.0',
-      settings: {
-        auto_tag: true,
-        ignore_missing: true,
-        spec: '.drone/docker-manifest.tmpl',
-        username: { from_secret: vault.dockerhub_username },
-        password: { from_secret: vault.dockerhub_password },
-      },
-    }],
-  } + {
-    depends_on: [
-      'docker-amd64',
-      'docker-arm64',
-    ],
-  } + constraints.tags + constraints.mainPush,
-] + vault.secrets
diff --git a/.drone/drone.yml b/.drone/drone.yml
deleted file mode 100644
index 143da179..00000000
--- a/.drone/drone.yml
+++ /dev/null
@@ -1,318 +0,0 @@
----
-kind: pipeline
-name: check
-steps:
-- commands:
-  - go mod download
-  image: golang:1.20
-  name: download
-  volumes:
-  - name: gopath
-    path: /go
-- commands:
-  - if [ ! -f linux-amd64/helm ]; then
-  - '  wget -q https://get.helm.sh/helm-v3.9.0-linux-amd64.tar.gz'
-  - '  tar -zxvf helm-v3.9.0-linux-amd64.tar.gz'
-  - '  rm -f helm-v3.9.0-linux-amd64.tar.gz'
-  - fi
-  - cp linux-amd64/helm /usr/local/bin/helm
-  - go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0
-  - make lint
-  image: golang:1.20
-  name: lint
-  volumes:
-  - name: gopath
-    path: /go
-- commands:
-  - if [ ! -f linux-amd64/helm ]; then
-  - '  wget -q https://get.helm.sh/helm-v3.9.0-linux-amd64.tar.gz'
-  - '  tar -zxvf helm-v3.9.0-linux-amd64.tar.gz'
-  - '  rm -f helm-v3.9.0-linux-amd64.tar.gz'
-  - fi
-  - cp linux-amd64/helm /usr/local/bin/helm
-  - go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0
-  - make test
-  image: golang:1.20
-  name: test
-  volumes:
-  - name: gopath
-    path: /go
-- commands:
-  - if [ ! -f linux-amd64/helm ]; then
-  - '  wget -q https://get.helm.sh/helm-v3.9.0-linux-amd64.tar.gz'
-  - '  tar -zxvf helm-v3.9.0-linux-amd64.tar.gz'
-  - '  rm -f helm-v3.9.0-linux-amd64.tar.gz'
-  - fi
-  - cp linux-amd64/helm /usr/local/bin/helm
-  - go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0
-  - make cross
-  image: golang:1.20
-  name: build
-  volumes:
-  - name: gopath
-    path: /go
-trigger:
-  ref:
-  - refs/pull/*/head
-  - refs/heads/main
-volumes:
-- name: gopath
-  temp: {}
----
-kind: pipeline
-name: benchmark against main
-node:
-  type: no-parallel
-steps:
-- commands:
-  - go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0
-  - go test -bench=. -benchmem -count=6 -run=^$ ./... | tee bench-pr.txt
-  - git fetch origin main
-  - git reset --hard origin/main
-  - go test -bench=. -benchmem -count=6 -run=^$ ./... | tee bench-main.txt
-  - go install golang.org/x/perf/cmd/...@latest
-  - benchstat bench-main.txt bench-pr.txt
-  image: golang:1.20
-  name: benchmark
-  volumes:
-  - name: gopath
-    path: /go
-trigger:
-  ref:
-  - refs/pull/*/head
-volumes:
-- name: gopath
-  temp: {}
----
-depends_on:
-- check
-kind: pipeline
-name: release
-steps:
-- commands:
-  - git fetch origin --tags
-  image: golang:1.20
-  name: fetch-tags
-  volumes:
-  - name: gopath
-    path: /go
-- commands:
-  - if [ ! -f linux-amd64/helm ]; then
-  - '  wget -q https://get.helm.sh/helm-v3.9.0-linux-amd64.tar.gz'
-  - '  tar -zxvf helm-v3.9.0-linux-amd64.tar.gz'
-  - '  rm -f helm-v3.9.0-linux-amd64.tar.gz'
-  - fi
-  - cp linux-amd64/helm /usr/local/bin/helm
-  - go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0
-  - make cross
-  image: golang:1.20
-  name: cross
-  volumes:
-  - name: gopath
-    path: /go
-- image: plugins/github-release
-  name: publish
-  settings:
-    api_key:
-      from_secret: grafanabot_pat
-    draft: true
-    files: dist/*
-    note: |
-      This is release ${DRONE_TAG} of Tanka (`tk`). Check out the [CHANGELOG](https://github.com/grafana/tanka/blob/main/CHANGELOG.md) for detailed release notes.
-      ## Install instructions
-
-      #### Binary:
-      ```bash
-      # download the binary (adapt os and arch as needed)
-      $ curl -fSL -o "/usr/local/bin/tk" "https://github.com/grafana/tanka/releases/download/${DRONE_TAG}/tk-linux-amd64"
-
-      # make it executable
-      $ chmod a+x "/usr/local/bin/tk"
-
-      # have fun :)
-      $ tk --help
-      ```
-
-      #### Docker container:
-      https://hub.docker.com/r/grafana/tanka
-      ```bash
-      $ docker pull grafana/tanka:${DRONE_TAG#v}
-      ```
-    title: ${DRONE_TAG}
-trigger:
-  ref:
-  - refs/tags/v*
-volumes:
-- name: gopath
-  temp: {}
----
-depends_on:
-- check
-kind: pipeline
-name: docker-amd64
-platform:
-  arch: amd64
-  os: linux
-steps:
-- commands:
-  - git fetch origin --tags
-  image: golang:1.20
-  name: fetch-tags
-  volumes:
-  - name: gopath
-    path: /go
-- commands:
-  - if [ ! -f linux-amd64/helm ]; then
-  - '  wget -q https://get.helm.sh/helm-v3.9.0-linux-amd64.tar.gz'
-  - '  tar -zxvf helm-v3.9.0-linux-amd64.tar.gz'
-  - '  rm -f helm-v3.9.0-linux-amd64.tar.gz'
-  - fi
-  - cp linux-amd64/helm /usr/local/bin/helm
-  - go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0
-  - make static
-  image: golang:1.20
-  name: static
-  volumes:
-  - name: gopath
-    path: /go
-- image: plugins/docker
-  name: container
-  settings:
-    auto_tag: true
-    auto_tag_suffix: amd64
-    password:
-      from_secret: dockerhub_password
-    repo: grafana/tanka
-    username:
-      from_secret: dockerhub_username
-trigger:
-  ref:
-  - refs/tags/v*
-  - refs/heads/main
-volumes:
-- name: gopath
-  temp: {}
----
-depends_on:
-- check
-kind: pipeline
-name: docker-arm64
-platform:
-  arch: arm64
-  os: linux
-steps:
-- commands:
-  - git fetch origin --tags
-  image: golang:1.20
-  name: fetch-tags
-  volumes:
-  - name: gopath
-    path: /go
-- commands:
-  - if [ ! -f linux-amd64/helm ]; then
-  - '  wget -q https://get.helm.sh/helm-v3.9.0-linux-amd64.tar.gz'
-  - '  tar -zxvf helm-v3.9.0-linux-amd64.tar.gz'
-  - '  rm -f helm-v3.9.0-linux-amd64.tar.gz'
-  - fi
-  - cp linux-amd64/helm /usr/local/bin/helm
-  - go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0
-  - make static
-  image: golang:1.20
-  name: static
-  volumes:
-  - name: gopath
-    path: /go
-- image: plugins/docker
-  name: container
-  settings:
-    auto_tag: true
-    auto_tag_suffix: arm64
-    password:
-      from_secret: dockerhub_password
-    repo: grafana/tanka
-    username:
-      from_secret: dockerhub_username
-trigger:
-  ref:
-  - refs/tags/v*
-  - refs/heads/main
-volumes:
-- name: gopath
-  temp: {}
----
-depends_on:
-- docker-amd64
-- docker-arm64
-kind: pipeline
-name: manifest-main
-steps:
-- commands:
-  - git fetch origin --tags
-  - echo "main-$(git describe --tags)" > .tags
-  image: golang:1.20
-  name: fetch-tags
-  volumes:
-  - name: gopath
-    path: /go
-- image: plugins/manifest:1.4.0
-  name: manifest
-  settings:
-    ignore_missing: true
-    password:
-      from_secret: dockerhub_password
-    spec: .drone/docker-manifest.tmpl
-    username:
-      from_secret: dockerhub_username
-trigger:
-  ref:
-  - refs/heads/main
-volumes:
-- name: gopath
-  temp: {}
----
-depends_on:
-- docker-amd64
-- docker-arm64
-kind: pipeline
-name: manifest
-steps:
-- image: plugins/manifest:1.4.0
-  name: manifest
-  settings:
-    auto_tag: true
-    ignore_missing: true
-    password:
-      from_secret: dockerhub_password
-    spec: .drone/docker-manifest.tmpl
-    username:
-      from_secret: dockerhub_username
-trigger:
-  ref:
-  - refs/tags/v*
-  - refs/heads/main
-volumes:
-- name: gopath
-  temp: {}
----
-get:
-  name: pat
-  path: infra/data/ci/github/grafanabot
-kind: secret
-name: grafanabot_pat
----
-get:
-  name: username
-  path: infra/data/ci/docker_hub
-kind: secret
-name: dockerhub_username
----
-get:
-  name: password
-  path: infra/data/ci/docker_hub
-kind: secret
-name: dockerhub_password
----
-kind: signature
-hmac: d6e20fdf35f6a2177b563a0db363b55872b276a880165349685c1f6aa1641495
-
-...
diff --git a/.drone/release-note.md b/.drone/release-note.md
deleted file mode 100644
index 3c9d47e7..00000000
--- a/.drone/release-note.md
+++ /dev/null
@@ -1,20 +0,0 @@
-This is release ${DRONE_TAG} of Tanka (`tk`). Check out the [CHANGELOG](https://github.com/grafana/tanka/blob/main/CHANGELOG.md) for detailed release notes.
-## Install instructions
-
-#### Binary:
-```bash
-# download the binary (adapt os and arch as needed)
-$ curl -fSL -o "/usr/local/bin/tk" "https://github.com/grafana/tanka/releases/download/${DRONE_TAG}/tk-linux-amd64"
-
-# make it executable
-$ chmod a+x "/usr/local/bin/tk"
-
-# have fun :)
-$ tk --help
-```
-
-#### Docker container:
-https://hub.docker.com/r/grafana/tanka
-```bash
-$ docker pull grafana/tanka:${DRONE_TAG#v}
-```
diff --git a/.drone/vault.libsonnet b/.drone/vault.libsonnet
deleted file mode 100644
index ce08d436..00000000
--- a/.drone/vault.libsonnet
+++ /dev/null
@@ -1,20 +0,0 @@
-local secret(name, vault_path, key) = {
-  kind: 'secret',
-  name: name,
-  get: {
-    path: vault_path,
-    name: key,
-  },
-};
-
-{
-  dockerhub_username: 'dockerhub_username',
-  dockerhub_password: 'dockerhub_password',
-  grafanabot_public_account_token: 'grafanabot_pat',
-
-  secrets: [
-    secret($.grafanabot_public_account_token, 'infra/data/ci/github/grafanabot', 'pat'),
-    secret($.dockerhub_username, 'infra/data/ci/docker_hub', 'username'),
-    secret($.dockerhub_password, 'infra/data/ci/docker_hub', 'password'),
-  ],
-}
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
new file mode 100644
index 00000000..b0fbe9c6
--- /dev/null
+++ b/.github/workflows/docker.yml
@@ -0,0 +1,136 @@
+# See https://docs.docker.com/build/ci/github-actions/multi-platform/
+name: Docker
+
+on:
+  push:
+    branches:
+      - main
+    tags:
+      - v*
+  pull_request:
+    branches:
+      - '*'
+
+permissions:
+  contents: read
+  id-token: write
+
+env:
+  REGISTRY_IMAGE: grafana/tanka
+  # Docker image tags. See https://github.com/docker/metadata-action for format
+  TAGS_CONFIG: |
+    type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+    type=sha,prefix={{branch}}-,format=short,enable=${{ github.ref == 'refs/heads/main' }}
+    type=semver,pattern={{version}}
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm64
+    
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY_IMAGE }}
+          tags: ${{ env.TAGS_CONFIG }}
+
+      # Setup buildx
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # Login to Docker Hub
+      - name: Get Secrets
+        if: github.event_name != 'pull_request'
+        uses: grafana/shared-workflows/actions/get-vault-secrets@main
+        with:
+          # Secrets placed in the ci/common/<path> path in Vault
+          common_secrets: |
+            DOCKERHUB_USERNAME=dockerhub:username
+            DOCKERHUB_TOKEN=dockerhub:password
+
+      - name: Login to Docker Hub
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ env.DOCKERHUB_USERNAME }}
+          password: ${{ env.DOCKERHUB_TOKEN }}
+  
+      - name: Build and push by digest
+        id: build
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          labels: ${{ steps.meta.outputs.labels }}
+          outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' }}
+
+      - name: Export digest
+        if: github.event_name != 'pull_request'
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"          
+      - name: Upload digest
+        if: github.event_name != 'pull_request'
+        uses: actions/upload-artifact@v3
+        with:
+          name: digests
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+  
+  merge:
+    runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request'
+    needs: 
+      - build
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v3
+        with:
+          name: digests
+          path: /tmp/digests
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+    
+      - name: Docker meta
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.REGISTRY_IMAGE }}
+          tags: ${{ env.TAGS_CONFIG }}
+
+      # Login to Docker Hub
+      - name: Get Secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@main
+        with:
+          # Secrets placed in the ci/common/<path> path in Vault
+          common_secrets: |
+            DOCKERHUB_USERNAME=dockerhub:username
+            DOCKERHUB_TOKEN=dockerhub:password
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ env.DOCKERHUB_USERNAME }}
+          password: ${{ env.DOCKERHUB_TOKEN }}
+
+      - name: Create manifest list and push
+        working-directory: /tmp/digests
+        run: |
+          docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)          
+      - name: Inspect image
+        run: |
+          docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}          
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..0a6abe7a
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,50 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - v*
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-tags: true
+      - uses: actions/setup-go@v2
+        with:
+          go-version: '1.20'
+      - run: make cross
+      - id: docker_tag
+        run: echo "DOCKER_TAG=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
+      - name: Release
+        uses: softprops/action-gh-release@v1
+        with:
+          body: |
+            This is release `${{ env.GITHUB_REF_NAME }}` of Tanka (`tk`). Check out the [CHANGELOG](https://github.com/grafana/tanka/blob/main/CHANGELOG.md) for detailed release notes.
+            ## Install instructions
+
+            #### Binary:
+            ```bash
+            # download the binary (adapt os and arch as needed)
+            $ curl -fSL -o "/usr/local/bin/tk" "https://github.com/grafana/tanka/releases/download/${{ env.GITHUB_REF_NAME }}/tk-linux-amd64"
+
+            # make it executable
+            $ chmod a+x "/usr/local/bin/tk"
+
+            # have fun :)
+            $ tk --help
+            ```
+
+            #### Docker container:
+            https://hub.docker.com/r/grafana/tanka
+            ```bash
+            $ docker pull grafana/tanka:${{ env.DOCKER_TAG }}
+            ```
+          draft: true
+          files: |
+            dist/*
diff --git a/Dockerfile b/Dockerfile
index 486ed33d..89e53c16 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -39,10 +39,15 @@ RUN export TAG=$(curl --silent "https://api.github.com/repos/kubernetes-sigs/kus
     curl -SL "https://github.com/kubernetes-sigs/kustomize/releases/download/${TAG}/kustomize_${VERSION_TAG}_${OS}_${ARCH}.tar.gz" > kustomize.tgz && \
     tar -xvf kustomize.tgz
 
+FROM golang:1.21.1 as build
+WORKDIR /app
+COPY . .
+RUN make static
+
 # assemble final container
 FROM alpine:3.18
 RUN apk add --no-cache coreutils diffutils less git openssh-client
-COPY tk /usr/local/bin/tk
+COPY --from=build /app/tk /usr/local/bin/tk
 COPY --from=kubectl /usr/local/bin/kubectl /usr/local/bin/kubectl
 COPY --from=jb /usr/local/bin/jb /usr/local/bin/jb
 COPY --from=helm /tmp/helm/helm /usr/local/bin/helm
diff --git a/Makefile b/Makefile
index 4dc47767..86c32d6e 100644
--- a/Makefile
+++ b/Makefile
@@ -38,9 +38,3 @@ cross: $(GOX)
 # Docker container
 container: static
 	docker build -t grafana/tanka .
-
-# CI
-drone:
-	drone jsonnet --source .drone/drone.jsonnet --target .drone/drone.yml --stream --format
-	drone lint .drone/drone.yml
-	drone sign --save grafana/tanka .drone/drone.yml
diff --git a/README.md b/README.md
index e731de5e..94177345 100644
--- a/README.md
+++ b/README.md
@@ -7,9 +7,6 @@
 </p>
 
 <p align="center">
-  <a href="https://cloud.drone.io/grafana/tanka">
-    <img src="https://img.shields.io/drone/build/grafana/tanka?style=flat-square&server=https%3A%2F%2Fdrone.grafana.net">
-  </a>
   <a href="https://github.com/grafana/tanka/releases">
     <img src="https://img.shields.io/github/release/grafana/tanka?style=flat-square" />
   </a>
diff --git a/go.mod b/go.mod
index 5bee5f1d..4a16d96c 100644
--- a/go.mod
+++ b/go.mod
@@ -20,10 +20,10 @@ require (
 	github.com/stretchr/testify v1.8.4
 	github.com/thoas/go-funk v0.9.3
 	golang.org/x/term v0.11.0
-	golang.org/x/text v0.12.0
+	golang.org/x/text v0.13.0
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/apimachinery v0.28.1
+	k8s.io/apimachinery v0.28.3
 	k8s.io/utils v0.0.0-20230406110748-d93618cff8a2
 	sigs.k8s.io/yaml v1.3.0
 )
@@ -46,6 +46,6 @@ require (
 	github.com/shopspring/decimal v1.3.1 // indirect
 	github.com/spf13/cast v1.4.1 // indirect
 	golang.org/x/crypto v0.3.0 // indirect
-	golang.org/x/sys v0.11.0 // indirect
+	golang.org/x/sys v0.13.0 // indirect
 	k8s.io/klog/v2 v2.100.1 // indirect
 )
diff --git a/go.sum b/go.sum
index b7a18200..0d6e962a 100644
--- a/go.sum
+++ b/go.sum
@@ -109,8 +109,8 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.11.0 h1:eG7RXZHdqOJ1i+0lgLgCpSXAp6M3LYlAo6osgSi0xOM=
-golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
+golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
@@ -120,8 +120,8 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.12.0 h1:k+n5B8goJNdU7hSvEtMUz3d1Q6D/XW4COJSJR6fN0mc=
-golang.org/x/text v0.12.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
+golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k=
+golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
@@ -135,8 +135,8 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-k8s.io/apimachinery v0.28.1 h1:EJD40og3GizBSV3mkIoXQBsws32okPOy+MkRyzh6nPY=
-k8s.io/apimachinery v0.28.1/go.mod h1:X0xh/chESs2hP9koe+SdIAcXWcQ+RM5hy0ZynB+yEvw=
+k8s.io/apimachinery v0.28.3 h1:B1wYx8txOaCQG0HmYF6nbpU8dg6HvA06x5tEffvOe7A=
+k8s.io/apimachinery v0.28.3/go.mod h1:uQTKmIqs+rAYaq+DFaoD2X7pcjLOqbQX2AOiO0nIpb8=
 k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg=
 k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 h1:qY1Ad8PODbnymg2pRbkyMT/ylpTrCM8P2RJ0yroCyIk=


Test patch:
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
new file mode 100644
index 00000000..47af5a77
--- /dev/null
+++ b/.github/workflows/tests.yml
@@ -0,0 +1,42 @@
+name: Tests
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - '*'
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v2
+        with:
+          go-version: '1.20'
+      - run: make lint
+  
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v2
+        with:
+          go-version: '1.20'
+      - uses: azure/setup-helm@v3
+        with:
+          version: '3.13.1' 
+      - name: Install jsonnet
+        run: go install github.com/google/go-jsonnet/cmd/jsonnet@v0.20.0
+      - run: make test
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v2
+        with:
+          go-version: '1.20'
+      - run: make cross