chore: release v3.5.0

.github/workflows/prow-bot.yml

@@ -1,5 +1,5 @@
 # This repository runs the bot through its own reusable workflow; templates/workflow-templates/prow.yml
-# is the same file for consumers, with pull_request_target and @v3.4.0. Kept on pull_request here, so
+# is the same file for consumers, with pull_request_target and @v3.5.0. Kept on pull_request here, so
 # fork pull requests are handled by the scheduled sweep like templates/workflow-templates/prow-pull-request.yml.
 name: Prow bot
 on:

.github/workflows/prow.yml

@@ -2,7 +2,7 @@
 #
 #   jobs:
 #     prow:
-#       uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0
+#       uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0
 #
 # It runs the action at the commit of this very file, so the workflow and the action can
 # never drift and no floating action tag exists inside it. The caller owns the triggers,
@@ -66,7 +66,7 @@ jobs:
       - name: Require the workflow's own commit
         if: job.workflow_sha == ''
         run: |
-          echo "::error::job.workflow_sha is empty; this reusable workflow needs github.com. Use 'uses: cncf/prow-github-actions@v3.4.0' directly instead."
+          echo "::error::job.workflow_sha is empty; this reusable workflow needs github.com. Use 'uses: cncf/prow-github-actions@v3.5.0' directly instead."
           exit 1
 
       # Checks out cncf/prow-github-actions at that commit, never the caller's repository

README.md

@@ -50,11 +50,11 @@ concurrency:
 jobs:
   prow:
     if: github.event_name != 'workflow_dispatch' && github.event_name != 'push'
-    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0
+    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0
 
   label-sync:
     if: github.event_name == 'workflow_dispatch' || github.event_name == 'push'
-    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0
+    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0
     with:
       jobs: label-sync
 ```
@@ -71,7 +71,7 @@ your organization's `.github` repository for label families and `needs-*` rules
 ([starter](./templates/prow.yaml), [configuration](./docs/configuration.md)). The
 [Installing](./docs/installing.md) guide covers organizations, upgrading, inputs and secrets.
 
-These docs describe `main`; the latest release is [`v3.4.0`](https://github.com/cncf/prow-github-actions/releases/tag/v3.4.0)
+These docs describe `main`; the latest release is [`v3.5.0`](https://github.com/cncf/prow-github-actions/releases/tag/v3.5.0)
 ([releasing](./docs/releasing.md)). The action requires the `node24` runtime
 (GitHub requires actions/runner 2.327.1 or newer for node24 on self-hosted runners).
 
@@ -97,7 +97,7 @@ jobs:
   execute:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           prow-commands: /assign /unassign /cc /uncc /approve /lgtm /hold /close /reopen /lock /retitle /milestone /remove /area /kind /priority /label /lifecycle /stage /status /help /good-first-issue /retest /test /ok-to-test /label-sync /meow
           github-token: '${{ secrets.GITHUB_TOKEN }}'

docs/automatic-merging.md

@@ -45,7 +45,7 @@ jobs:
   execute:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           prow-commands: /lgtm /approve /hold /kind /area /priority /check-required-labels /auto-cc
           jobs: lgtm
@@ -196,7 +196,7 @@ jobs:
   execute:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           jobs: lgtm
           github-token: '${{ secrets.GITHUB_TOKEN }}'

docs/commands.md

@@ -1,6 +1,6 @@
 # Prow github actions commands
 
-These docs describe `main`; the latest release is `v3.4.0` ([releasing](./releasing.md)).
+These docs describe `main`; the latest release is `v3.5.0` ([releasing](./releasing.md)).
 
 ## Command syntax
 
@@ -161,7 +161,7 @@ jobs:
   prow:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           prow-commands: /meow
           github-token: '${{ secrets.GITHUB_TOKEN }}'

docs/configuration.md

@@ -27,7 +27,7 @@ The configuration is read once per run, however many commands the comment carrie
 ### The `config` input
 
 ```yaml
-- uses: cncf/prow-github-actions@v3.4.0
+- uses: cncf/prow-github-actions@v3.5.0
   with:
     config: cncf/prow-config:configs/prow.yaml@v1
     github-token: ${{ secrets.GITHUB_TOKEN }}
@@ -212,7 +212,7 @@ jobs:
   execute:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           jobs: label-sync
           github-token: '${{ secrets.GITHUB_TOKEN }}'

docs/cron-jobs.md

@@ -68,7 +68,7 @@ jobs:
   execute:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           jobs: sweep lgtm
           github-token: '${{ secrets.GITHUB_TOKEN }}'
@@ -112,7 +112,7 @@ jobs:
   execute:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           jobs: label-sync
           github-token: '${{ secrets.GITHUB_TOKEN }}'

docs/events.md

@@ -67,7 +67,7 @@ jobs:
   execute:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           prow-commands: /lgtm /approve /hold /kind /area /priority /check-required-labels /auto-cc
           jobs: lgtm

docs/examples.md

@@ -100,7 +100,7 @@ jobs:
   execute:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           prow-commands: /approve /lgtm
           github-token: '${{ secrets.GITHUB_TOKEN }}'
@@ -127,7 +127,7 @@ jobs:
   execute:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           prow-commands: /assign /approve /retitle /area /kind /priority /lgtm /close /reopen /hold /cc /uncc /retest /test /ok-to-test
           github-token: '${{ secrets.GITHUB_TOKEN }}'
@@ -152,7 +152,7 @@ jobs:
   execute:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           prow-commands: /triage
           github-token: '${{ secrets.GITHUB_TOKEN }}'
@@ -178,7 +178,7 @@ jobs:
   execute:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           prow-commands: /meow
           github-token: '${{ secrets.GITHUB_TOKEN }}'

docs/installing.md

@@ -59,11 +59,11 @@ concurrency:
 jobs:
   prow:
     if: github.event_name != 'workflow_dispatch' && github.event_name != 'push'
-    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0
+    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0
 
   label-sync:
     if: github.event_name == 'workflow_dispatch' || github.event_name == 'push'
-    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0
+    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0
     with:
       jobs: label-sync
 ```
@@ -105,7 +105,7 @@ flags it; a hash-pinning policy often comes with it). The second template,
 +    if: github.event_name != 'workflow_dispatch' && github.event_name != 'push' && github.event_name != 'schedule'
 +  sweep:
 +    if: github.event_name == 'schedule'
-+    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0
++    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0
 +    with:
 +      jobs: sweep lgtm
 ```
@@ -118,8 +118,8 @@ any, on a comment (`/lgtm`, `/approve`, ...) | the `issue_comment` run, which ha
 
 Caveat: an `lgtm` label applied **by hand** on a fork pull request cannot be
 [bound to the commit](./automatic-merging.md#lgtm-is-bound-to-a-commit) by the read-only run,
-so the sweep strips it with a comment; use `/lgtm`. Organizations that hash-pin replace `@v3.4.0`
-in the template with the release's commit sha and a `# v3.4.0` comment; Dependabot keeps it
+so the sweep strips it with a comment; use `/lgtm`. Organizations that hash-pin replace `@v3.5.0`
+in the template with the release's commit sha and a `# v3.5.0` comment; Dependabot keeps it
 current.
 
 ## An organization
@@ -141,7 +141,7 @@ pass a token with read access to it:
 ```yaml
 jobs:
   prow:
-    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0
+    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0
     secrets:
       token: ${{ secrets.PROW_TOKEN }}
 ```
@@ -153,9 +153,9 @@ lookup ([the `config` input](./configuration.md#the-config-input)).
 
 Ref | Behaviour
 --- | ---
-`@v3.4.0` | Exact release, what the templates ship. [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot)'s `github-actions` ecosystem proposes the next release (it also updates reusable-workflow `uses:` refs).
+`@v3.5.0` | Exact release, what the templates ship. [Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot)'s `github-actions` ecosystem proposes the next release (it also updates reusable-workflow `uses:` refs).
 `@v3` | Floats: `release.yml` moves it to every stable `v3.x.y` that is newer than the one it points at (a backport to an older minor leaves it alone). Nothing to do; you get every fix and every minor change without review.
-`@<sha> # v3.4.0` | Hash pinning; the commit is on the [release page](https://github.com/cncf/prow-github-actions/releases/tag/v3.4.0). Dependabot keeps the comment and the sha in step.
+`@<sha> # v3.5.0` | Hash pinning; the commit is on the [release page](https://github.com/cncf/prow-github-actions/releases/tag/v3.5.0). Dependabot keeps the comment and the sha in step.
 
 Whatever the ref, the reusable workflow checks out the action at the **same commit as the
 workflow file**, so a caller pinned to a sha runs exactly that action bundle and a floating
@@ -191,7 +191,7 @@ Secret | Default | Meaning
 ```yaml
 jobs:
   prow:
-    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0
+    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0
     with:
       prow-commands: /lgtm /approve /hold /kind /area /priority /meow
       merge-method: squash
@@ -219,6 +219,6 @@ Label sections (`/kind`, `/area`, `/priority`, ...) and `needs-*` rules need a `
 
 ## Using the action directly
 
-The action itself is still `uses: cncf/prow-github-actions@v3.4.0` with the same inputs; it is the
+The action itself is still `uses: cncf/prow-github-actions@v3.5.0` with the same inputs; it is the
 way on GitHub Enterprise Server and for workflows that mix it with other steps. The
 [events](./events.md#recommended-triggers) page has the direct form of the caller above.

docs/pr-jobs.md

@@ -31,7 +31,7 @@ jobs:
   execute:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           jobs: lgtm
           github-token: '${{ secrets.GITHUB_TOKEN }}'
@@ -63,7 +63,7 @@ jobs:
   execute:
     runs-on: ubuntu-latest
     steps:
-      - uses: cncf/prow-github-actions@v3.4.0
+      - uses: cncf/prow-github-actions@v3.5.0
         with:
           jobs: lgtm
           github-token: '${{ secrets.GITHUB_TOKEN }}'

docs/prow-for-your-org.md

@@ -129,7 +129,7 @@ concurrency:
 jobs:
   prow:
     if: github.event_name != 'workflow_dispatch' && github.event_name != 'push'
-    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0
+    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0
     # optional; the defaults enable every built-in command and the lgtm job
     # with:
     #   prow-commands: /lgtm /approve /hold /kind /area /priority
@@ -141,12 +141,12 @@ jobs:
 
   label-sync:
     if: github.event_name == 'workflow_dispatch' || github.event_name == 'push'
-    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.4.0
+    uses: cncf/prow-github-actions/.github/workflows/prow.yml@v3.5.0
     with:
       jobs: label-sync
 ```
 
-The templates pin the release `@v3.4.0`; [upgrading](./installing.md#upgrading) covers moving to
+The templates pin the release `@v3.5.0`; [upgrading](./installing.md#upgrading) covers moving to
 newer releases, the floating `v3` tag and hash pinning. The `permissions` block is the
 ceiling: the reusable workflow can only downgrade what the caller grants
 ([installing](./installing.md#one-repository)). Inputs, secrets and upgrading are covered

docs/releases/v3.5.0.md

@@ -0,0 +1,67 @@
+# v3.5.0
+
+A hardening release: authorization gaps closed, commands that fail now say so, fewer GitHub API
+calls per event, and an App server that survives bad input, slow handlers and rolling updates.
+`@v3` callers get it automatically; `@v3.4.0` pins move to `@v3.5.0`.
+
+## Commands
+
+- **Authorization.** `/unassign @user` and `/uncc @user` now require the commenter to be an org
+  member or repository collaborator (self-unassign and self-uncc are unchanged). `/remove` refuses
+  `lgtm`, `approved`, `hold` and `do-not-merge/*` labels and points to the cancel command. Commands
+  run only on a *created* comment; editing an old comment no longer re-runs it.
+- **Exclusive label families** (`/priority`, `/lifecycle`, `/stage`, `/status`, `exclusive: true`)
+  take one value; `/priority low high` is refused and the issue is left untouched.
+- **Exact cancel matching.** `/lgtm cancel`, `/hold cancel` and `/approve cancel` are a cancel only
+  when the whole argument is `cancel`; a sentence that merely contains the word no longer removes a
+  label. `LGTM` on a repository that spells the label that way now cancels.
+- **Refusals are reported.** A refused `/close`, `/reopen`, `/retitle` or self `/assign` fails the
+  run with `<user> is not authorized to …`, like `/lock` and `/milestone`; when several commands in
+  one comment fail, every failure is reported. `/approve`, `/cc` and `/uncc` on an issue reply that
+  they only apply to pull requests.
+- `/milestone` pages through all open milestones; `/retitle` validates its title (1–256 chars).
+
+## Plugins and cron jobs
+
+- One bad item no longer aborts the run: the sweep, tide, blunderbuss, the lgtm cron and the App's
+  per-installation schedule each isolate per-item failures and continue.
+- The bot resolves its own identity from the token instead of assuming `github-actions[bot]`, so
+  under a GitHub App tide dequeues the entries it enqueued, `/approve cancel` finds its own review,
+  and the approve plugin ignores its own label writes.
+- blunderbuss skips users who already reviewed and counts requested teams toward
+  `max_request_count`. OWNERS rules survive a truncated tree listing. A deleted fork
+  (`head.repo: null`) is treated as a fork. `merge-method` is trimmed, case-insensitive, and an
+  unknown value warns before falling back to `merge`.
+- Fewer and parallel API calls: auth checks, the comment thread, the root OWNERS and the Octokit
+  client are memoized per run; config probes, OWNERS probes and label removals run concurrently.
+
+## App server (beta)
+
+- `POST /webhook` is capped at 25 MB (`413`); App-level events with no repository get `202 ignored`
+  instead of a `400`; a failed delivery is forgotten so GitHub's redelivery runs it again (Node,
+  Redis and Cloudflare KV stores alike).
+- Redis locks renew while a handler runs; waiters back off with jitter; `/readyz` answers `503`
+  whenever Redis is not ready and during the `PROW_SHUTDOWN_DRAIN_MS` drain on `SIGTERM`.
+- Cloudflare Worker: one platform scope per isolate, a real per-pull-request lock in the Durable
+  Object, a retrying queue path with a dead-letter queue (`prow-jobs-dlq`), and tokens minted only
+  where they are read.
+
+## Upgrading
+
+Nothing to do for the action. Helm users: the chart's Deployment, Service and PDB now select
+`app.kubernetes.io/component: server` so CronJob pods never receive webhook traffic. A Deployment's
+selector cannot change in place, so delete it once before `helm upgrade` (see
+[Kubernetes](https://github.com/cncf/prow-github-actions/blob/v3.5.0/docs/github-app.md#kubernetes)):
+
+```sh
+kubectl delete deployment prow-prow-github-app   # <release>-prow-github-app
+helm upgrade prow oci://ghcr.io/cncf/prow-github-actions/charts/prow-github-app --version 3.5.0 …
+```
+
+The chart also raises `terminationGracePeriodSeconds` to 75 and adds `cronjob.activeDeadlineSeconds`
+(default 3000); `values.schema.json` now rejects unknown keys.
+
+## Verification
+
+The SBOM, its cosign signature and the SLSA provenance are attached to this release; the commands
+are under *SBOM and provenance* below.

docs/releasing.md

@@ -50,7 +50,7 @@ highest in its major, and `X.Y` only when it is the highest in its minor. A
 backport `v3.3.2` tagged after `v3.4.0` therefore publishes `3.3.2` and `3.3`
 and leaves `3`, `v3` and `latest` on `v3.4.0`.
 
-The templates, the README and the docs pin the **exact** release (`@v3.4.0`) on
+The templates, the README and the docs pin the **exact** release (`@v3.5.0`) on
 purpose: organizations that hash-pin can replace it with the release's commit
 sha, and Dependabot bumps it to the next release. The floating `v3` tag keeps
 moving for callers who prefer it ([upgrading](./installing.md#upgrading)).
@@ -161,7 +161,7 @@ Releases follow [SemVer](https://semver.org/) with `v`-prefixed tags
 - uses: cncf/prow-github-actions@v3
 
 # or pin to an exact release, what the templates ship
-- uses: cncf/prow-github-actions@v3.4.0
+- uses: cncf/prow-github-actions@v3.5.0
 ```
 
 The same refs work for the reusable workflow,

package.json

@@ -1,6 +1,6 @@
 {
   "name": "prow-github-actions",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "Slash commands, jobs, and chat-ops for Github actions inspired by Kubernetes Prow",
   "author": "John McBride",
   "license": "MIT",