chore: move to GitHub Actions (cherry-pick observatorium/api#915)

.bingo/Variables.mk

@@ -35,11 +35,11 @@ $(GOJSONTOYAML): $(BINGO_DIR)/gojsontoyaml.mod
 	@echo "(re)installing $(GOBIN)/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c"
 	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=gojsontoyaml.mod -o=$(GOBIN)/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c "github.com/brancz/gojsontoyaml"
 
-GOLANGCI_LINT := $(GOBIN)/golangci-lint-v2.7.0
+GOLANGCI_LINT := $(GOBIN)/golangci-lint-v2.14.0
 $(GOLANGCI_LINT): $(BINGO_DIR)/golangci-lint.mod
 	@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
-	@echo "(re)installing $(GOBIN)/golangci-lint-v2.7.0"
-	@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=golangci-lint.mod -o=$(GOBIN)/golangci-lint-v2.7.0 "github.com/golangci/golangci-lint/v2/cmd/golangci-lint"
+	@echo "(re)installing $(GOBIN)/golangci-lint-v2.14.0"
+	@cd $(BINGO_DIR) && GOWORK=off GOTOOLCHAIN=go1.26.0 $(GO) build -mod=mod -modfile=golangci-lint.mod -o=$(GOBIN)/golangci-lint-v2.14.0 "github.com/golangci/golangci-lint/v2/cmd/golangci-lint"
 
 GOYACC := $(GOBIN)/goyacc-v0.1.5
 $(GOYACC): $(BINGO_DIR)/goyacc.mod

.bingo/golangci-lint.mod

@@ -1,7 +1,5 @@
 module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
 
-go 1.24.0
+go 1.26.0
 
-toolchain go1.24.10
-
-require github.com/golangci/golangci-lint/v2 v2.7.0 // cmd/golangci-lint
+require github.com/golangci/golangci-lint/v2 v2.14.0 // cmd/golangci-lint

.bingo/variables.env

@@ -14,7 +14,7 @@ DEX="${GOBIN}/dex-v0.0.0-20200512115545-709d4169d646"
 
 GOJSONTOYAML="${GOBIN}/gojsontoyaml-v0.0.0-20200602132005-3697ded27e8c"
 
-GOLANGCI_LINT="${GOBIN}/golangci-lint-v2.7.0"
+GOLANGCI_LINT="${GOBIN}/golangci-lint-v2.14.0"
 
 GOYACC="${GOBIN}/goyacc-v0.1.5"
 

.circleci/config.yml

@@ -2,7 +2,7 @@ version: 2
 jobs:
   build:
     docker:
-      - image: golang:1.24
+      - image: golang:1.26
     steps:
       - checkout
       - run: |
@@ -11,7 +11,7 @@ jobs:
 
   lint:
     docker:
-      - image: golang:1.24
+      - image: golang:1.26
     steps:
       - checkout
       - run: |
@@ -26,7 +26,7 @@ jobs:
       - run: |
           apt-get update && apt-get -y install xz-utils unzip openssl
           sudo rm -rf /usr/local/go
-          wget -qO- https://dl.google.com/go/go1.24.11.linux-amd64.tar.gz | sudo tar -C /usr/local -xzf -
+          wget -qO- https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz | sudo tar -C /usr/local -xzf -
           export PATH=$PATH:/usr/local/go/bin
           go version
           make test --always-make
@@ -38,14 +38,14 @@ jobs:
       - checkout
       - run: |
           sudo rm -rf /usr/local/go
-          wget -qO- https://dl.google.com/go/go1.24.11.linux-amd64.tar.gz | sudo tar -C /usr/local -xzf -
+          wget -qO- https://dl.google.com/go/go1.26.5.linux-amd64.tar.gz | sudo tar -C /usr/local -xzf -
           export PATH=$PATH:/usr/local/go/bin
           go version
           make test-e2e
 
   generate:
     docker:
-      - image: golang:1.24
+      - image: golang:1.26
     steps:
       - checkout
       - run: |

.github/workflows/ci.yaml

@@ -0,0 +1,66 @@
+name: CI
+
+on:
+  push:
+    branches: [rhobs-obs-api-konflux]
+  pull_request:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - run: |
+          make build
+          git diff --exit-code
+
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - run: make lint --always-make
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - run: make test --always-make
+
+  test-e2e:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - run: make test-e2e
+        env:
+          OCI_BIN: docker
+
+  generate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - run: |
+          make generate validate --always-make
+          make proto
+          git diff --exit-code

.golangci.yml

@@ -11,7 +11,6 @@ output:
 linters:
   enable:
     - copyloopvar
-    - goconst
     - godot
     - misspell # spell checker
     - promlinter
@@ -26,8 +25,6 @@ linters:
     funlen:
       lines: 140
       statements: 60
-    goconst:
-      min-occurrences: 5
     lll:
       line-length: 160
     misspell:
@@ -39,6 +36,11 @@ linters:
       - common-false-positives
       - legacy
       - std-error-handling
+    rules:
+      # Suppress SA1019 for httputil.ReverseProxy.Director deprecated in Go 1.26.
+      # Migration to Rewrite is tracked separately.
+      - linters: [staticcheck]
+        text: "SA1019:.*Director"
     paths:
       - third_party$
       - builtin$

Dockerfile

@@ -1,4 +1,4 @@
-FROM --platform=$BUILDPLATFORM golang:1.24-alpine as builder
+FROM --platform=$BUILDPLATFORM golang:1.26-alpine as builder
 
 ARG TARGETOS
 ARG TARGETARCH

Dockerfile.e2e-test

@@ -1,4 +1,4 @@
-FROM golang:1.24-alpine as builder
+FROM golang:1.26-alpine as builder
 
 RUN apk add --update --no-cache ca-certificates tzdata git make bash && update-ca-certificates
 

README.md

@@ -172,6 +172,8 @@ Usage of ./observatorium-api:
     	Global server read timeout. (default 12m0s)
   -tenants.config string
     	Path to the tenants file. (default "tenants.yaml")
+  -throttle.enable
+    	Enable load shedding
   -tls.cipher-suites string
     	Comma-separated list of cipher suites for the server. Values are from tls package constants (https://golang.org/pkg/crypto/tls/#pkg-constants). If omitted, the default Go cipher suites will be used. Note that TLS 1.3 ciphersuites are not configurable.
   -tls.client-auth-type string

api/logs/v1/http.go

@@ -189,51 +189,51 @@ func NewHandler(read, tail, write, rules *url.URL, rulesReadOnly bool, tlsOption
 			r.Use(c.readMiddlewares...)
 			r.Handle(queryRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "query"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+queryRoute, proxyRead),
+				proxyRead,
 			))
 			r.Handle(queryRangeRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "query_range"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+queryRangeRoute, proxyRead),
+				proxyRead,
 			))
 			r.Handle(labelRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "label"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+labelRoute, proxyRead),
+				proxyRead,
 			))
 			r.Handle(labelsRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "labels"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+labelsRoute, proxyRead),
+				proxyRead,
 			))
 			r.Handle(volumeRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "volume"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+volumeRoute, proxyRead),
+				proxyRead,
 			))
 			r.Handle(volumeRangeRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "volume_range"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+volumeRangeRoute, proxyRead),
+				proxyRead,
 			))
 			r.Handle(labelValuesRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "label_values"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+labelValuesRoute, proxyRead),
+				proxyRead,
 			))
 			r.Handle(seriesRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "series"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+seriesRoute, proxyRead),
+				proxyRead,
 			))
 			r.Handle(promQueryRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "query"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+promQueryRoute, proxyRead),
+				proxyRead,
 			))
 			r.Handle(promLabelRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "label"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+promLabelRoute, proxyRead),
+				proxyRead,
 			))
 			r.Handle(promLabelValuesRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "label_values"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+promLabelValuesRoute, proxyRead),
+				proxyRead,
 			))
 			r.Handle(promSeriesRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "series"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+promSeriesRoute, proxyRead),
+				proxyRead,
 			))
 		})
 	}
@@ -275,35 +275,35 @@ func NewHandler(read, tail, write, rules *url.URL, rulesReadOnly bool, tlsOption
 			r.Use(c.rulesReadMiddlewares...)
 			r.Get(rulesRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "rules"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+rulesRoute, proxyRules),
+				proxyRules,
 			))
 			r.Get(rulesPerNamespaceRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "rules"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+rulesPerNamespaceRoute, proxyRules),
+				proxyRules,
 			))
 			r.Get(rulesPerGroupNameRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "rules"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+rulesPerGroupNameRoute, proxyRules),
+				proxyRules,
 			))
 			r.Get(prometheusRulesRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "rules"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+prometheusRulesRoute, proxyPrometheusReadRules),
+				proxyPrometheusReadRules,
 			))
 			r.Get(prometheusAlertsRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "alerts"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+prometheusAlertsRoute, proxyPrometheusReadRules),
+				proxyPrometheusReadRules,
 			))
 			r.Get(promRulesRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "rules"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+promRulesRoute, proxyRules),
+				proxyRules,
 			))
 			r.Get(promRulesPerNamespaceRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "rules"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+promRulesPerNamespaceRoute, proxyRules),
+				proxyRules,
 			))
 			r.Get(promRulesPerGroupNameRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "rules"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+promRulesPerGroupNameRoute, proxyRules),
+				proxyRules,
 			))
 		})
 
@@ -313,28 +313,28 @@ func NewHandler(read, tail, write, rules *url.URL, rulesReadOnly bool, tlsOption
 				r.Use(c.rulesWriteMiddlewares...)
 				r.Post(rulesPerNamespaceRoute, c.instrument.NewHandler(
 					prometheus.Labels{"group": "logsv1", "handler": "rules"},
-					otelhttp.WithRouteTag(c.spanRoutePrefix+rulesPerNamespaceRoute, proxyRules),
+					proxyRules,
 				))
 				r.Delete(rulesPerNamespaceRoute, c.instrument.NewHandler(
 					prometheus.Labels{"group": "logsv1", "handler": "rules"},
-					otelhttp.WithRouteTag(c.spanRoutePrefix+rulesPerNamespaceRoute, proxyRules),
+					proxyRules,
 				))
 				r.Delete(rulesPerGroupNameRoute, c.instrument.NewHandler(
 					prometheus.Labels{"group": "logsv1", "handler": "rules"},
-					otelhttp.WithRouteTag(c.spanRoutePrefix+rulesPerGroupNameRoute, proxyRules),
+					proxyRules,
 				))
 
 				r.Post(promRulesPerNamespaceRoute, c.instrument.NewHandler(
 					prometheus.Labels{"group": "logsv1", "handler": "rules"},
-					otelhttp.WithRouteTag(c.spanRoutePrefix+promRulesPerNamespaceRoute, proxyRules),
+					proxyRules,
 				))
 				r.Delete(promRulesPerNamespaceRoute, c.instrument.NewHandler(
 					prometheus.Labels{"group": "logsv1", "handler": "rules"},
-					otelhttp.WithRouteTag(c.spanRoutePrefix+promRulesPerNamespaceRoute, proxyRules),
+					proxyRules,
 				))
 				r.Delete(promRulesPerGroupNameRoute, c.instrument.NewHandler(
 					prometheus.Labels{"group": "logsv1", "handler": "rules"},
-					otelhttp.WithRouteTag(c.spanRoutePrefix+promRulesPerGroupNameRoute, proxyRules),
+					proxyRules,
 				))
 			})
 		}
@@ -367,11 +367,11 @@ func NewHandler(read, tail, write, rules *url.URL, rulesReadOnly bool, tlsOption
 			r.Use(c.readMiddlewares...)
 			r.Handle(tailRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "tail"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+tailRoute, tailRead),
+				tailRead,
 			))
 			r.Handle(promTailRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "prom_tail"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+promTailRoute, tailRead),
+				tailRead,
 			))
 		})
 	}
@@ -403,11 +403,11 @@ func NewHandler(read, tail, write, rules *url.URL, rulesReadOnly bool, tlsOption
 			r.Use(c.writeMiddlewares...)
 			r.Handle(otlpRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "otlp"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+otlpRoute, proxyWrite),
+				proxyWrite,
 			))
 			r.Handle(pushRoute, c.instrument.NewHandler(
 				prometheus.Labels{"group": "logsv1", "handler": "push"},
-				otelhttp.WithRouteTag(c.spanRoutePrefix+pushRoute, proxyWrite),
+				proxyWrite,
 			))
 		})
 	}

api/metrics/legacy/http.go

@@ -148,10 +148,7 @@ func NewHandler(url *url.URL, tlsOptions *tls.UpstreamOptions, opts ...HandlerOp
 		})
 		r.Use(c.queryMiddlewares...)
 		r.Handle(QueryRoute,
-			otelhttp.WithRouteTag(
-				c.spanRoutePrefix+QueryRoute,
-				legacyProxy,
-			),
+			legacyProxy,
 		)
 	})
 	r.Group(func(r chi.Router) {
@@ -163,10 +160,7 @@ func NewHandler(url *url.URL, tlsOptions *tls.UpstreamOptions, opts ...HandlerOp
 		})
 		r.Use(c.queryMiddlewares...)
 		r.Handle(QueryRangeRoute,
-			otelhttp.WithRouteTag(
-				c.spanRoutePrefix+QueryRangeRoute,
-				legacyProxy,
-			),
+			legacyProxy,
 		)
 	})
 

api/metrics/v1/alertmanager_enforcer.go

@@ -105,7 +105,7 @@ func WithEnforceTenancyOnSilenceMatchers(label string) func(http.Handler) http.H
 
 			var falsy bool
 			modified := models.Matchers{
-				&models.Matcher{Name: &(label), Value: &id, IsRegex: &falsy},
+				&models.Matcher{Name: &label, Value: &id, IsRegex: &falsy},
 			}
 			for _, m := range sil.Matchers {
 				if m.Name != nil && *m.Name == label {