chore: sync with upstream goharbor/harbor

[github-actions]

Automated PR to sync 6 new commit(s) from upstream goharbor/harbor main branch.

Merge strategy: Our changes in next are preserved on conflicts (upstream changes are additive only).

Note: The .github folder is preserved and not synced from upstream.

---

Summary by cubic

Syncs our branch with upstream Harbor to add per-endpoint CA certificate support, Cosign-based release signature verification, and improvements to user/group search and OIDC group handling. This strengthens registry connectivity and fixes search accuracy.

• New Features

  • Registry endpoints can provide a PEM-encoded CA certificate. API and Swagger updated, DB migration adds ca_certificate, transport/adapters honor the custom CA, UI adds a CA Certificate field, and inputs are validated.
  • Release installers are signed with Cosign. README and docs include a simple verification guide.

• Bug Fixes

  • User and group search returns best matches via DB query; removed the unused MostMatchSorter. Handlers use SearchByName; tests added.
  • OIDC group parsing supports single-string group claims.
  • Minor stability tweaks: safer image removal in pushimage.sh, proxy-friendly Cosign/Helm tests, more robust job dashboard and log rotation tests, and small release utils fixes.

^{Written for commit 34e14a2. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
5.6% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[cubic-dev-ai]

4 issues found across 73 files

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="src/controller/event/handler/util/util.go">

<violation number="1" location="src/controller/event/handler/util/util.go:72">
P2: Handle the case where the repo name has no "/"; strings.Cut returns an empty string then, unlike the previous behavior which returned the full repo.</violation>
</file>

<file name="src/portal/src/i18n/lang/zh-cn-lang.json">

<violation number="1" location="src/portal/src/i18n/lang/zh-cn-lang.json:671">
P1: Missing comma after "PLACEHOLDER" breaks JSON syntax for this locale file.</violation>

<violation number="2" location="src/portal/src/i18n/lang/zh-cn-lang.json:672">
P1: Unescaped double quotes inside the tooltip string break JSON parsing.</violation>
</file>

<file name="src/server/v2.0/handler/user.go">

<violation number="1" location="src/server/v2.0/handler/user.go:281">
P2: SearchUsers no longer applies the requested page offset. SearchByName only limits the result size, so page>1 requests will return the same first page while the response links/total suggest pagination is honored.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Unescaped double quotes inside the tooltip string break JSON parsing.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/portal/src/i18n/lang/zh-cn-lang.json, line 672:

<comment>Unescaped double quotes inside the tooltip string break JSON parsing.</comment>

<file context>
@@ -668,6 +668,9 @@
         "CANNOT_EDIT": "当复制规则启用时目标无法修改。",
         "PLACEHOLDER": "未发现任何复制目标!"
+        "CA_CERTIFICATE": "CA 证书",
+        "CA_CERTIFICATE_TOOLTIP": "提供 PEM 编码的 CA 证书以验证仓库的 TLS 证书。留空将使用系统 CA 池。此字段仅在启用"验证远程证书"时可用。",
+        "CA_CERTIFICATE_HELPER": "可选。在此粘贴 PEM 编码的 CA 证书，以信任此端点的自签名或私有 CA 证书。如果留空，Harbor 将使用系统 CA 池。"
     },
</file context>

Suggested change

	"CA_CERTIFICATE_TOOLTIP": "提供 PEM 编码的 CA 证书以验证仓库的 TLS 证书。留空将使用系统 CA 池。此字段仅在启用"验证远程证书"时可用。",
	"CA_CERTIFICATE_TOOLTIP": "提供 PEM 编码的 CA 证书以验证仓库的 TLS 证书。留空将使用系统 CA 池。此字段仅在启用\"验证远程证书\"时可用。",

[cubic-dev-ai]

P1: Missing comma after "PLACEHOLDER" breaks JSON syntax for this locale file.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/portal/src/i18n/lang/zh-cn-lang.json, line 671:

<comment>Missing comma after "PLACEHOLDER" breaks JSON syntax for this locale file.</comment>

<file context>
@@ -668,6 +668,9 @@
         "DELETED_FAILED": "删除目标失败。",
         "CANNOT_EDIT": "当复制规则启用时目标无法修改。",
         "PLACEHOLDER": "未发现任何复制目标!"
+        "CA_CERTIFICATE": "CA 证书",
+        "CA_CERTIFICATE_TOOLTIP": "提供 PEM 编码的 CA 证书以验证仓库的 TLS 证书。留空将使用系统 CA 池。此字段仅在启用"验证远程证书"时可用。",
+        "CA_CERTIFICATE_HELPER": "可选。在此粘贴 PEM 编码的 CA 证书，以信任此端点的自签名或私有 CA 证书。如果留空，Harbor 将使用系统 CA 池。"
</file context>

[cubic-dev-ai]

P2: Handle the case where the repo name has no "/"; strings.Cut returns an empty string then, unlike the previous behavior which returned the full repo.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/controller/event/handler/util/util.go, line 72:

<comment>Handle the case where the repo name has no "/"; strings.Cut returns an empty string then, unlike the previous behavior which returned the full repo.</comment>

<file context>
@@ -69,8 +69,8 @@ func SendHookWithPolicies(ctx context.Context, policies []*policy_model.Policy,
 func GetNameFromImgRepoFullName(repo string) string {
-	idx := strings.Index(repo, "/")
-	return repo[idx+1:]
+	_, after, _ := strings.Cut(repo, "/")
+	return after
 }
</file context>

Suggested change

	_, after, _ := strings.Cut(repo, "/")
	return after
	_, after, found := strings.Cut(repo, "/")
	if !found {
	return repo
	}
	return after

[cubic-dev-ai]

P2: SearchUsers no longer applies the requested page offset. SearchByName only limits the result size, so page>1 requests will return the same first page while the response links/total suggest pagination is honored.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/server/v2.0/handler/user.go, line 281:

<comment>SearchUsers no longer applies the requested page offset. SearchByName only limits the result size, so page>1 requests will return the same first page while the response links/total suggest pagination is honored.</comment>

<file context>
@@ -279,7 +278,7 @@ func (u *usersAPI) SearchUsers(ctx context.Context, params operation.SearchUsers
 		return operation.NewSearchUsersOK().WithXTotalCount(0).WithPayload([]*models.UserSearchRespItem{})
 	}
-	l, err := u.ctl.List(ctx, query)
+	l, err := u.ctl.SearchByName(ctx, params.Username, int(*params.PageSize))
 	if err != nil {
 		return u.SendError(ctx, err)
</file context>