chore: sync with upstream goharbor/harbor

[github-actions]

Automated PR to sync 14 new commit(s) from upstream goharbor/harbor main branch.

Merge strategy: Our changes in next are preserved on conflicts (upstream changes are additive only).

Note: The .github folder is preserved and not synced from upstream.

---

Summary by cubic

Sync with upstream Harbor main to add per-endpoint CA certificate support for registries, Cosign release signature verification docs, and improvements to search and OIDC group handling.

• New Features

  • Registry endpoints can include a PEM CA certificate; validated in API and used by HTTP transports across adapters. UI adds an optional CA certificate field. Schema adds registry.ca_certificate. Backward compatible.
  • API/swagger updates: ca_certificate fields on registry models; use NewTag for tag creation.
  • JFrog adapter supports OCI/helm repository types and configurable types via JFROG_SUPPORTED_REPOSITORY_TYPES.
  • Added docs and README steps to verify release artifacts with Cosign keyless signing.
  • Dependency bumps: Trivy v0.68.2 and trivy-adapter v0.34.2.

• Bug Fixes

  • OIDC groups claim now handles a single string value as well as arrays.
  • User and user group search moved to DB-driven fuzzy search; removed MostMatchSorter and updated handlers to use SearchByName.
  • Fixed SessionRegenerate to use the correct data type.
  • CI/tests and scripts hardened for newer Docker output, proxy environments, and timing; minor typo fixes.

^{Written for commit 624978d. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Please retry analysis of this Pull-Request directly on SonarQube Cloud

[cubic-dev-ai]

5 issues found across 82 files

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed.

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="src/pkg/reg/adapter/jfrog/adapter.go">

<violation number="1" location="src/pkg/reg/adapter/jfrog/adapter.go:282">
P2: All ListTags failures are swallowed, so when every supported type errors this returns an empty artifact list instead of propagating the failure. That hides registry issues and makes replications look like empty repositories.</violation>
</file>

<file name="src/portal/src/i18n/lang/zh-cn-lang.json">

<violation number="1" location="src/portal/src/i18n/lang/zh-cn-lang.json:671">
P1: Adding new keys after "PLACEHOLDER" without adding a trailing comma on the previous line makes this JSON invalid. Add a comma after the "PLACEHOLDER" entry.</violation>

<violation number="2" location="src/portal/src/i18n/lang/zh-cn-lang.json:672">
P1: The tooltip string contains unescaped double quotes around 验证远程证书, which breaks JSON parsing. Escape the inner quotes.</violation>
</file>

<file name="src/controller/event/handler/util/util.go">

<violation number="1" location="src/controller/event/handler/util/util.go:72">
P2: strings.Cut returns an empty string when no "/" is present, whereas the previous implementation returned the full repo. This is a behavior change that can drop valid repo names without a slash. Preserve the old fallback when the separator isn’t found.</violation>
</file>

<file name="src/common/http/transport.go">

<violation number="1" location="src/common/http/transport.go:171">
P2: Using x509.NewCertPool() discards the system root CAs, so providing a custom CA will break trust for all normally trusted certificates. Consider starting from the system cert pool and appending the custom certs instead.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: The tooltip string contains unescaped double quotes around 验证远程证书, which breaks JSON parsing. Escape the inner quotes.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/portal/src/i18n/lang/zh-cn-lang.json, line 672:

<comment>The tooltip string contains unescaped double quotes around 验证远程证书, which breaks JSON parsing. Escape the inner quotes.</comment>

<file context>
@@ -668,6 +668,9 @@
         "CANNOT_EDIT": "当复制规则启用时目标无法修改。",
         "PLACEHOLDER": "未发现任何复制目标!"
+        "CA_CERTIFICATE": "CA 证书",
+        "CA_CERTIFICATE_TOOLTIP": "提供 PEM 编码的 CA 证书以验证仓库的 TLS 证书。留空将使用系统 CA 池。此字段仅在启用"验证远程证书"时可用。",
+        "CA_CERTIFICATE_HELPER": "可选。在此粘贴 PEM 编码的 CA 证书，以信任此端点的自签名或私有 CA 证书。如果留空，Harbor 将使用系统 CA 池。"
     },
</file context>

Suggested change

	"CA_CERTIFICATE_TOOLTIP": "提供 PEM 编码的 CA 证书以验证仓库的 TLS 证书。留空将使用系统 CA 池。此字段仅在启用"验证远程证书"时可用。",
	"CA_CERTIFICATE_TOOLTIP": "提供 PEM 编码的 CA 证书以验证仓库的 TLS 证书。留空将使用系统 CA 池。此字段仅在启用\"验证远程证书\"时可用。",

[cubic-dev-ai]

P1: Adding new keys after "PLACEHOLDER" without adding a trailing comma on the previous line makes this JSON invalid. Add a comma after the "PLACEHOLDER" entry.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/portal/src/i18n/lang/zh-cn-lang.json, line 671:

<comment>Adding new keys after "PLACEHOLDER" without adding a trailing comma on the previous line makes this JSON invalid. Add a comma after the "PLACEHOLDER" entry.</comment>

<file context>
@@ -668,6 +668,9 @@
         "DELETED_FAILED": "删除目标失败。",
         "CANNOT_EDIT": "当复制规则启用时目标无法修改。",
         "PLACEHOLDER": "未发现任何复制目标!"
+        "CA_CERTIFICATE": "CA 证书",
+        "CA_CERTIFICATE_TOOLTIP": "提供 PEM 编码的 CA 证书以验证仓库的 TLS 证书。留空将使用系统 CA 池。此字段仅在启用"验证远程证书"时可用。",
+        "CA_CERTIFICATE_HELPER": "可选。在此粘贴 PEM 编码的 CA 证书，以信任此端点的自签名或私有 CA 证书。如果留空，Harbor 将使用系统 CA 池。"
</file context>

[cubic-dev-ai]

P2: All ListTags failures are swallowed, so when every supported type errors this returns an empty artifact list instead of propagating the failure. That hides registry issues and makes replications look like empty repositories.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pkg/reg/adapter/jfrog/adapter.go, line 282:

<comment>All ListTags failures are swallowed, so when every supported type errors this returns an empty artifact list instead of propagating the failure. That hides registry issues and makes replications look like empty repositories.</comment>

<file context>
@@ -254,11 +271,19 @@ func (a *adapter) listArtifacts(repository string, filters []*model.Filter) ([]*
+		regClient := registry.NewClientWithAuthorizer(url, basic.NewAuthorizer(a.client.username, a.client.password), a.client.insecure, a.registry.CACertificate)
+		var err error
+		tags, err = regClient.ListTags(repoName)
+		if err != nil {
+			log.Debugf("List tags for repository %s with type %s error: %v", repository, t, err)
+			continue
</file context>

[cubic-dev-ai]

P2: strings.Cut returns an empty string when no "/" is present, whereas the previous implementation returned the full repo. This is a behavior change that can drop valid repo names without a slash. Preserve the old fallback when the separator isn’t found.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/controller/event/handler/util/util.go, line 72:

<comment>strings.Cut returns an empty string when no "/" is present, whereas the previous implementation returned the full repo. This is a behavior change that can drop valid repo names without a slash. Preserve the old fallback when the separator isn’t found.</comment>

<file context>
@@ -69,8 +69,8 @@ func SendHookWithPolicies(ctx context.Context, policies []*policy_model.Policy,
 func GetNameFromImgRepoFullName(repo string) string {
-	idx := strings.Index(repo, "/")
-	return repo[idx+1:]
+	_, after, _ := strings.Cut(repo, "/")
+	return after
 }
</file context>

[cubic-dev-ai]

P2: Using x509.NewCertPool() discards the system root CAs, so providing a custom CA will break trust for all normally trusted certificates. Consider starting from the system cert pool and appending the custom certs instead.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/common/http/transport.go, line 171:

<comment>Using x509.NewCertPool() discards the system root CAs, so providing a custom CA will break trust for all normally trusted certificates. Consider starting from the system cert pool and appending the custom certs instead.</comment>

<file context>
@@ -87,17 +93,92 @@ func WithInsecureSkipVerify(skipVerify bool) func(*http.Transport) {
+			return
+		}
+
+		caCertPool := x509.NewCertPool()
+		for _, cert := range certs {
+			caCertPool.AddCert(cert)
</file context>