K8SPG-647: Fix major-upgrade test

.e2eignore

@@ -7,4 +7,5 @@ CONTRIBUTING.md
 LICENSE.md
 README.md
 .gitignore
-release_versions
+release_versions
+.e2eignore

.github/CODEOWNERS

@@ -1,3 +1,3 @@
-* @hors @egegunes @pooknull @nmarukovich @gkech
-/e2e-tests/ @ptankov @jvpasinatto @eleo007
-Jenkinsfile @ptankov @jvpasinatto @eleo007
+* @hors @egegunes @pooknull @nmarukovich @gkech @mayankshah1607 @oksana-grishchenko
+/e2e-tests/ @jvpasinatto @eleo007 @valmiranogueira @egegunes @pooknull @nmarukovich @gkech @mayankshah1607 @oksana-grishchenko
+Jenkinsfile @jvpasinatto @eleo007 @valmiranogueira

.github/copilot-instructions.md

@@ -0,0 +1,75 @@
+# GitHub Copilot Code Review Instructions
+
+## Review Philosophy
+
+- Only comment when you have HIGH CONFIDENCE (>80%) that an issue exists
+- Be concise
+- Focus on actionable feedback, not observations
+- If you're uncertain, stay silent—false positives reduce trust
+
+## Project Context
+
+Kubernetes Operator for PostgreSQL (Operator SDK, controller-runtime). Go + YAML. Key paths: `internal/`, `percona/`, `pkg/apis` and `e2e-tests/`.
+
+## Priority Areas
+
+### Security
+
+- Hardcoded secrets, credentials, or API keys
+- SQL injection—use parameterized queries, never string concatenation
+- Missing or overly broad RBAC (`+kubebuilder:rbac` on reconcile functions)
+- Logging of secrets or sensitive data
+- Unvalidated user input before DB operations
+
+### Correctness
+
+- Logic errors that could cause panics or incorrect behavior
+- Race conditions, resource leaks (files, connections, memory)
+- Incorrect or missing error propagation
+- Error wrapping that doesn't add useful context
+- Redundant comments that restate what the code shows
+
+### Imports and Dependencies
+
+- Use standard import aliases: `corev1`, `appsv1`, `metav1`, `apierrors`, etc. (per `.golangci.yaml`)
+- Import order: standard, default, `github.com/percona` prefix
+
+### Controller / Reconcile Logic
+
+- Add `+kubebuilder:rbac` above reconcile functions that create/update K8s resources
+- Set controller/owner references for owned resources
+- Idempotent reconcile; handle `apierrors.IsConflict` with requeue
+
+### Logging
+
+- Prefer `logging.FromContext(ctx)` for loggers
+- Use structured fields: `log.Info("message", "key", value)`
+- Add logging for important operator actions (reconcile steps, errors, retries)
+
+### Testing
+
+- New features: expect unit tests and/or E2E (KUTTL) where appropriate
+- Unit tests should use `assert` and `require` from `github.com/stretchr/testify` wherever applicable
+- Utilize table driven tests when possible
+- Test names should describe the scenario
+
+## Response Format
+
+When you identify an issue:
+
+1. **Problem** (1 sentence)
+2. **Why it matters** (1 sentence, only if not obvious)
+3. **Fix** (concrete suggestion or code snippet)
+
+Example:
+```
+1. **Problem**: This map access can panic if the map is nil.
+2. **Why it matters**: A panic can crash the operator and disrupt reconciliation.
+3. **Fix**: Initialize the map before use, e.g. `m := make(map[string]string)` before assigning or reading.
+```
+
+## When to Stay Silent
+
+- You're uncertain whether something is an issue
+- The concern is stylistic and the code is acceptable
+- The fix would be a matter of preference, not correctness or security

.github/linters/go.mod

@@ -1,3 +1,3 @@
 module linters
 
-go 1.23.4
+go 1.26.0

.github/workflows/reviewdog.yml

@@ -5,12 +5,12 @@ jobs:
     name: runner / suggester / golangci-lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
-          go-version: '^1.23'
-      - uses: actions/checkout@v4
+          go-version: '^1.26.0'
+      - uses: actions/checkout@v6
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v6
+        uses: golangci/golangci-lint-action@v9
         with:
           version: latest
           only-new-issues: true
@@ -20,10 +20,10 @@ jobs:
     name: runner / suggester / goimports-reviser
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
         with:
-          go-version: '^1.23'
+          go-version: '^1.26.0'
       - run: go install -v github.com/incu6us/goimports-reviser/v3@latest
       - run: $(go env GOPATH)/bin/goimports-reviser -imports-order "std,general,company,project" -company-prefixes "github.com/percona" ./...
       - uses: reviewdog/action-suggester@v1
@@ -34,7 +34,7 @@ jobs:
     name: runner / suggester / gofmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - run: gofmt -w -s $(find . -not -path "*/vendor/*" -name "*.go")
       - uses: reviewdog/action-suggester@v1
         with:
@@ -44,10 +44,10 @@ jobs:
     name: runner / suggester / shfmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
         with:
-          go-version: '^1.23'
+          go-version: '^1.26.0'
       - run: go install mvdan.cc/sh/v3/cmd/shfmt@latest
       - run: $(go env GOPATH)/bin/shfmt -bn -ci -s -w .
       - name: suggester / shfmt
@@ -60,7 +60,7 @@ jobs:
     name: runner / shellcheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: reviewdog/action-shellcheck@v1
         with:
           github_token: ${{ secrets.github_token }}
@@ -70,7 +70,7 @@ jobs:
     name: runner / misspell
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: reviewdog/action-misspell@v1
         with:
           github_token: ${{ secrets.github_token }}
@@ -81,7 +81,7 @@ jobs:
     name: runner / alex
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
       - uses: reviewdog/action-alex@v1
         with:
           github_token: ${{ secrets.github_token }}
@@ -92,7 +92,14 @@ jobs:
     name: runner / manifests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - run: |
+      - uses: actions/checkout@v6
+      - name: check on release branch
+        if: ${{ contains(github.base_ref, 'release-') }}
+        run: |
+          make generate VERSION="$(cat percona/version/version.txt)" IMAGE_TAG_BASE="percona/percona-postgresql-operator"
+          git diff --exit-code
+      - name: check on non release branches
+        if: ${{ ! contains(github.base_ref, 'release-') }}
+        run: |
           make generate VERSION=main
           git diff --exit-code

.github/workflows/scan.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
@@ -30,32 +30,10 @@ jobs:
           export DOCKER_DEFAULT_PLATFORM='linux/arm64'
           make build-docker-image
 
-      - name: Run Trivy vulnerability scanner image (linux/arm64)
-        uses: aquasecurity/trivy-action@0.30.0
-        with:
-          image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-arm64'
-          format: 'table'
-          exit-code: '1'
-          ignore-unfixed: true
-          vuln-type: 'os,library'
-          severity: 'CRITICAL,HIGH'
-          version: 'v0.57.1'
-
       - name: Build an image from Dockerfile (linux/amd64)
         run: |
           export IMAGE=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-amd64
           export DOCKER_PUSH=0
           export DOCKER_SQUASH=0
           export DOCKER_DEFAULT_PLATFORM='linux/amd64'
           make build-docker-image
-
-      - name: Run Trivy vulnerability scanner image (linux/amd64)
-        uses: aquasecurity/trivy-action@0.30.0
-        with:
-          image-ref: '${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}-amd64'
-          format: 'table'
-          exit-code: '1'
-          ignore-unfixed: true
-          vuln-type: 'os,library'
-          severity: 'CRITICAL,HIGH'
-          version: 'v0.57.1'

.github/workflows/test.yml

@@ -6,13 +6,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone the code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v6
         with:
-          go-version: '^1.23'
-      - uses: actions/checkout@v4
+          go-version: '^1.26.0'
+      - uses: actions/checkout@v6
       - name: Basic tests
         run: make check
       - name: envtest
-        run: ENVTEST_K8S_VERSION=1.32 make check-envtest
+        run: ENVTEST_K8S_VERSION=1.35 make check-envtest

.golangci.next.yaml

@@ -10,7 +10,6 @@ linters:
   enable:
     - contextcheck
     - err113
-    - errchkjson
     - gocritic
     - godot
     - godox
@@ -28,13 +27,16 @@ linters:
     - wastedassign
 
 issues:
+  exclude-rules:
+    # We call external linters when they are installed: Flake8, ShellCheck, etc.
+    - linters: [gosec]
+      path: '_test[.]go$'
+      text: 'G204: Subprocess launched with variable'
+
   # https://github.com/golangci/golangci-lint/issues/2239
   exclude-use-default: false
 
 linters-settings:
-  errchkjson:
-    check-error-free-encoding: true
-
   thelper:
     # https://github.com/kulti/thelper/issues/27
     tb:   { begin: true, first: true }