Chore/sync upstream automation

.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# This team will own the entire repository
+* @qdrant/cloud-unit-resilience

.github/workflows/conflict-markers.yaml

@@ -0,0 +1,29 @@
+name: conflict-markers
+
+# Fails when a file contains unresolved merge conflict markers. The
+# sync-upstream workflow commits conflicts as-is so that the pull request cannot
+# go green by accident, but a conflict in a file that no test builds (for
+# example another workflow) would otherwise be invisible to CI.
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Fail on unresolved conflict markers
+        run: |
+          if git grep -nE '^(<<<<<<<|>>>>>>>) '; then
+            echo "::error::Unresolved merge conflict markers found, see the lines above."
+            exit 1
+          fi

.github/workflows/sync-upstream.yaml

@@ -0,0 +1,130 @@
+name: sync-upstream
+
+# Opens a pull request that merges the latest upstream release of
+# fluxcd/source-controller into this fork. The pull request always gets opened:
+# if the merge has conflicts or the result does not build, CI on the pull
+# request fails and someone has to take care of it. See "Maintaining the fork
+# up to date" in the README.
+
+on:
+  schedule:
+    # Weekdays, early morning UTC.
+    - cron: '0 6 * * 1-5'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Upstream release tag to sync, e.g. v1.9.6 (default: the latest stable release)'
+        required: false
+        type: string
+
+permissions: {}
+
+concurrency:
+  group: sync-upstream
+  cancel-in-progress: false
+
+env:
+  UPSTREAM_URL: https://github.com/fluxcd/source-controller.git
+
+jobs:
+  sync:
+    if: github.repository_owner == 'qdrant'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: main
+          fetch-depth: 0
+          # BOT_GITHUB_TOKEN instead of GITHUB_TOKEN: pushes and pull requests
+          # made with GITHUB_TOKEN do not trigger the CI workflows, and the
+          # whole point is for CI to judge the result.
+          token: ${{ secrets.BOT_GITHUB_TOKEN }}
+          persist-credentials: true # zizmor: ignore[artipacked] needed to push the sync branch
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+
+      - name: Configure git identity
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Find the upstream release to sync
+        id: target
+        env:
+          INPUT_TAG: ${{ inputs.tag }}
+        run: scripts/sync-upstream.sh target "$INPUT_TAG"
+
+      - name: Skip if the sync branch or a pull request already exists
+        id: existing
+        if: steps.target.outputs.status == 'needs-sync'
+        env:
+          GH_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
+          BRANCH: ${{ steps.target.outputs.branch }}
+        run: |
+          # --state all: a pull request that was closed without merging is a
+          # decision not to take this release. Do not reopen it every morning.
+          prs=$(gh pr list --state all --head "$BRANCH" --json number --jq 'length')
+          if [ "$prs" != "0" ] || git ls-remote --exit-code --heads origin "$BRANCH" > /dev/null; then
+            echo "Branch or pull request for $BRANCH already exists, nothing to do."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Merge the upstream release
+        id: merge
+        if: steps.target.outputs.status == 'needs-sync' && steps.existing.outputs.skip == 'false'
+        env:
+          TAG: ${{ steps.target.outputs.tag }}
+        run: scripts/sync-upstream.sh merge "$TAG"
+
+      - name: Push branch and open pull request
+        if: steps.merge.outputs.status == 'merged' || steps.merge.outputs.status == 'conflict'
+        env:
+          GH_TOKEN: ${{ secrets.BOT_GITHUB_TOKEN }}
+          TAG: ${{ steps.merge.outputs.tag }}
+          BRANCH: ${{ steps.merge.outputs.branch }}
+          MERGE_STATUS: ${{ steps.merge.outputs.status }}
+          CONFLICTS_FILE: ${{ steps.merge.outputs.conflicts_file }}
+        run: |
+          upstream_repo=${UPSTREAM_URL%.git}
+          {
+            echo "Merges upstream [\`${TAG}\`](${upstream_repo}/releases/tag/${TAG}) and re-applies the Qdrant adaptations (\`scripts/rename-api-groups.sh\`, \`make tidy\`)."
+            echo
+            echo "Opened automatically by the \`sync-upstream\` workflow. **CI is the verdict**: if it is red, this release needs work before it can be taken."
+            echo
+            if [ "$MERGE_STATUS" = "conflict" ]; then
+              echo "### Merge conflicts"
+              echo
+              echo "The merge had conflicts. The conflict markers are committed as-is, so CI fails until they are resolved. Conflicting files:"
+              echo
+              sed 's/^/- `/; s/$/`/' "$CONFLICTS_FILE"
+              echo
+            fi
+            echo "### Reviewing"
+            echo
+            echo "The merge commit from upstream is not worth reviewing. Look at the commits that follow it (rename script, \`make tidy\`) and at CI."
+            echo
+            echo "### After merging"
+            echo
+            echo "- [ ] Tag the fork release: \`${TAG}-qdrant.1\` and \`api/${TAG}-qdrant.1\` (bump the number for a re-release of the same upstream version)."
+            echo "- [ ] fluxcd-helm-controller: update its \`source-controller/api\` replace and \`SOURCE_BRANCH\` in the Makefile to the new tag."
+            echo "- [ ] qdrant-cloud-agent: bump the \`replace\` lines in \`go.mod\`, \`make download-crd-deps\` and review the CRD diff (see docs/upgrading-flux-controller-crds.md)."
+          } > pr-body.md
+          git push origin "$BRANCH"
+          draft=()
+          if [ "$MERGE_STATUS" = "conflict" ]; then
+            draft=(--draft)
+          fi
+          gh pr create \
+            --base main \
+            --head "$BRANCH" \
+            --title "Sync upstream ${TAG}" \
+            --body-file pr-body.md \
+            "${draft[@]}"

.gitignore

@@ -19,3 +19,5 @@ config/release/
 
 # Exclude temporary build files
 build/
+.idea/
+vendor/

CHANGELOG.md

@@ -2,6 +2,54 @@
 
 All notable changes to this project are documented in this file.
 
+## 1.9.3
+
+**Release date:** 2026-07-13
+
+This patch release fixes the `HelmChart` CRD description for `.status.url`, which
+was copy-pasted from `Bucket` and pointed users at `BucketStatus.Artifact`
+instead of `HelmChartStatus.Artifact`.
+
+Improvements:
+- Fix HelmChartStatus.URL doc-comment referencing BucketStatus
+  [#2110](https://github.com/fluxcd/source-controller/pull/2110)
+
+## 1.9.2
+
+**Release date:** 2026-07-07
+
+This patch release disables Flux variable substitution on the source-controller
+CRDs by annotating them with `kustomize.toolkit.fluxcd.io/substitute: disabled`,
+so that Kustomizations with post-build substitution enabled no longer corrupt
+the CRD schemas when they contain `${...}` sequences. It also caches the
+registry authorization token during Notation verification, so the token is
+fetched once per verification instead of once per request, reducing
+token-endpoint traffic against the registry.
+
+Fixes:
+- Disable variable substitution in CRDs
+  [#2103](https://github.com/fluxcd/source-controller/pull/2103)
+
+Improvements:
+- Cache registry token during Notation verification
+  [#2105](https://github.com/fluxcd/source-controller/pull/2105)
+
+## 1.9.1
+
+**Release date:** 2026-06-30
+
+This patch release updates Kubernetes to 1.36.2 and the fluxcd/pkg dependencies,
+adds kubectl categories to the source-controller CRDs and documents the
+controller's command-line options.
+
+Improvements:
+- Add categories to source-controller CRDs
+  [#2090](https://github.com/fluxcd/source-controller/pull/2090)
+- Document controller options
+  [#2094](https://github.com/fluxcd/source-controller/pull/2094)
+- Update fluxcd/pkg dependencies
+  [#2092](https://github.com/fluxcd/source-controller/pull/2092)
+
 ## 1.9.0
 
 **Release date:** 2026-06-17

PROJECT

@@ -1,22 +1,22 @@
-domain: toolkit.fluxcd.io
+domain: qdrant.io
 repo: github.com/fluxcd/source-controller
 resources:
-- group: source
+- group: cd
   kind: GitRepository
   version: v1
-- group: source
+- group: cd
   kind: HelmRepository
   version: v1
-- group: source
+- group: cd
   kind: HelmChart
   version: v1
-- group: source
+- group: cd
   kind: Bucket
   version: v1
-- group: source
+- group: cd
   kind: OCIRepository
   version: v1
-- group: source
+- group: cd
   kind: ExternalArtifact
   version: v1
 version: "2"

README.md

@@ -6,6 +6,70 @@
 [![license](https://img.shields.io/github/license/fluxcd/source-controller.svg)](https://github.com/fluxcd/source-controller/blob/main/LICENSE)
 [![release](https://img.shields.io/github/release/fluxcd/source-controller/all.svg)](https://github.com/fluxcd/source-controller/releases)
 
+## About this fork
+
+This fork is used by the
+[qdrant-cloud-agent](https://github.com/qdrant/qdrant-cloud-agent/). The main
+reason behind forking the upstream project is to be able to distribute the CRDs of this
+project without risk of collision in case the customer is using Flux CD in their
+K8s cluster. The main change between the fork and upstream consist of renaming the
+API group names, replacing the ones from fluxcd (ex: `source.toolkit.fluxcd.io`)
+by our custom ones.
+
+### Maintaining the fork up to date
+
+#### Automated: the `sync-upstream` workflow
+
+The [`sync-upstream`](.github/workflows/sync-upstream.yaml) workflow runs on
+weekdays (and on demand from the Actions tab, optionally for a specific
+tag). When upstream publishes a new stable release (`vX.Y.Z`), it opens a PR
+named `Sync upstream vX.Y.Z` that merges the tag, runs
+`./scripts/rename-api-groups.sh` and `make tidy`. It uses
+[`scripts/sync-upstream.sh`](scripts/sync-upstream.sh), which you can also run
+locally to reproduce what the workflow did.
+
+The PR is always opened and **CI is the verdict**. If the merge had conflicts,
+the PR is a draft with the conflict markers committed, and the
+[`conflict-markers`](.github/workflows/conflict-markers.yaml) check fails until
+they are resolved. If it merged cleanly but does not build or pass the tests, CI is
+red and someone needs to fix it on the PR branch. The workflow never merges or
+tags anything. Closing a PR without merging tells it to leave that release
+alone.
+
+The workflow authenticates with the `BOT_GITHUB_TOKEN` secret, not with
+`GITHUB_TOKEN`: pushes and PRs made with `GITHUB_TOKEN` do not trigger CI. The
+token must be able to push branches and open PRs, and also to push changes to
+files under `.github/workflows/`, because upstream releases regularly modify
+them (for a classic PAT that means the `workflow` scope, for a fine-grained
+token or a GitHub App the "Workflows" write permission).
+
+Compatibility with the cloud-agent is not checked here: the agent's own CI is
+the gate once its `replace` lines are bumped to the new fork release.
+
+#### Manual
+
+Use this when the workflow cannot help, e.g. to sync something that is not a
+release tag.
+
+- Configure and fetch upstream/main.
+- Create your development branch from origin/main and merge upstream/main into
+  it. You can run the merge with `-X theirs` option.
+- Solve the git conflicts if any.
+- As there might be new files or content added in upstream, we might need to
+  rename groups again. You can do that executing
+  `./scripts/rename-api-groups.sh`.
+- Run `go mod tidy` to clean up the dependencies and execute the tests of the project with `make test`.
+- Ideally, they are passing. Otherwise, you need to work on fixing any possible
+  issue.
+- Push your development branch. After that, you would need to test it using it
+  in the cloud-agent to confirm everything works as expected.
+- Once you confirm it works fine, create a PR for review.
+- **Note for the reviewer:** The merge commit from upstream/main doesn't make
+  sense to review it. Focus on the commits with the changes relevant for the
+  project.
+
+---
+
 The source-controller is a Kubernetes operator, specialised in artifacts acquisition
 from external sources such as Git, OCI, Helm repositories and S3-compatible buckets.
 The source-controller implements the