Merge https://github.com/project-velero/kopia:v0.23.0-velero-patch (908c5c0) into oadp-dev

.github/copilot-instructions.md

@@ -65,18 +65,14 @@ make lint
 make lint-fix
 ```
 
+Note: Linting is **NOT** run on linux/arm64 or linux/arm platforms to avoid issues.
+
 **Check code locks:**
 ```bash
 make check-locks
 ```
 **Note:** Not available on linux/arm64 or linux/arm.
 
-**Check JavaScript/TypeScript formatting (in app directory):**
-```bash
-make check-prettier
-```
-
-**Important:** Linting is **NOT** run on linux/arm64 or linux/arm platforms to avoid issues.
 
 ### Building Kopia CLI
 
@@ -120,7 +116,7 @@ make kopia-ui
 make test
 ```
 **Time:** ~2-4 minutes
-**Runs:** All unit tests with gotestsum, excludes TestIndexBlobManagerStress
+**Runs:** All unit tests with gotestsum
 **Timeout:** 1200s (20 minutes) per test
 **Format:** pkgname-and-test-fails
 
@@ -132,12 +128,6 @@ make test-with-coverage
 **Time:** ~3-5 minutes
 **Note:** Used by Code Coverage workflow. Sets KOPIA_COVERAGE_TEST=1
 
-### Index Blob Tests (Separate)
-```bash
-make test-index-blob-v0
-```
-**Runs:** TestIndexBlobManagerStress (excluded from standard tests due to duration)
-
 ### Integration Tests
 ```bash
 make build-integration-test-binary  # Build test binary first
@@ -146,6 +136,11 @@ make integration-tests
 **Time:** ~5-10 minutes
 **Requires:** KOPIA_INTEGRATION_EXE environment variable
 
+**Race Detector Tests:**
+```bash
+make test UNIT_TEST_RACE_FLAGS=-race UNIT_TESTS_TIMEOUT=1200s
+```
+
 ### CI Test Suites
 ```bash
 make ci-tests  # Runs: vet + test
@@ -157,7 +152,7 @@ make ci-integration-tests  # Runs: robustness-tool-tests + socket-activation-tes
 make provider-tests PROVIDER_TEST_TARGET=...
 ```
 **Time:** 15 minutes timeout
-**Requires:** KOPIA_PROVIDER_TEST=true, credentials for storage backend, rclone binary
+**Requires:** KOPIA_PROVIDER_TEST=true, credentials for storage backend.
 **Note:** Tests various cloud storage providers (S3, Azure, GCS, etc.)
 
 ### Other Test Types
@@ -167,11 +162,6 @@ make provider-tests PROVIDER_TEST_TARGET=...
 - `make stress-test` - Stress tests (1 hour timeout)
 - `make htmlui-e2e-test` - HTML UI end-to-end tests (10 minutes timeout)
 
-**Race Detector Tests:**
-```bash
-make test UNIT_TEST_RACE_FLAGS=-race UNIT_TESTS_TIMEOUT=1200s
-```
-
 ## Common Issues & Workarounds
 
 ### Build Issues
@@ -197,17 +187,16 @@ make test UNIT_TEST_RACE_FLAGS=-race UNIT_TESTS_TIMEOUT=1200s
 
 3. **Integration test binary:** Must build integration test binary explicitly with `make build-integration-test-binary` before running integration tests.
 
-4. **Provider tests require environment:** Provider tests need KOPIA_PROVIDER_TEST=true and rclone binary available.
+4. **Provider tests require environment:** Provider tests need KOPIA_PROVIDER_TEST=true and storage credentials.
 
 ### Environment Variables
 
 **Important variables for CI/tests:**
 - `UNIX_SHELL_ON_WINDOWS=true` - Required for Windows builds
 - `KOPIA_COVERAGE_TEST=1` - Enable coverage testing
 - `KOPIA_INTEGRATION_EXE` - Path to integration test binary
-- `TESTING_ACTION_EXE` - Path to testing action binary
 - `KOPIA_PROVIDER_TEST=true` - Enable provider tests
-- `RCLONE_EXE` - Path to rclone binary for provider tests
+
 
 ## Project Structure
 
@@ -270,9 +259,8 @@ make test UNIT_TEST_RACE_FLAGS=-race UNIT_TESTS_TIMEOUT=1200s
 ### Configuration Files
 
 - `.golangci.yml` - Linter config with 40+ enabled linters, custom rules
-- `.codecov.yml` - Code coverage reporting config
-- `.goreleaser.yml` - Release automation config
 - `.github/workflows/*.yml` - GitHub Actions workflows (19 workflow files)
+- `.codecov.yml` - Code coverage reporting config
 
 ## GitHub Actions Workflows
 
@@ -408,4 +396,7 @@ make test UNIT_TEST_RACE_FLAGS=-race UNIT_TESTS_TIMEOUT=1200s
    - node - JavaScript runtime for app builds
    - hugo - Static site generator for website
 
-10. **Trust these instructions** - These instructions have been validated by running all commands. Only search for additional information if something fails or if these instructions are incomplete or incorrect.
+10. Do not commit executables or binary artifacts to the git repository.
+    Do not modify `.gitignore` files.
+
+11. **Trust these instructions** - These instructions have been validated by running all commands. Only search for additional information if something fails or if these instructions are incomplete or incorrect.

.github/dependabot.yml

@@ -5,6 +5,8 @@ updates:
     open-pull-requests-limit: 5
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 4
     ignore:
       # htmluibuild is explicitly updated by us
       - dependency-name: "github.com/kopia/htmluibuild"
@@ -29,6 +31,8 @@ updates:
     open-pull-requests-limit: 5
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 4
     groups:
       github-actions:
         patterns:
@@ -41,6 +45,8 @@ updates:
     directory: "/app"
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 7
     groups:
       # create once-per-week PR for all KopiaUI dependency bumps, that usually includes
       # electron, electron-builder, etc.

.github/instructions/go.copilot-instructions.md

@@ -78,10 +78,12 @@ Refer to the linter configuration in `.golangci.yml` for style checks and standa
 
 ### Formatting
 
+- Indent with tabs
 - Use `gofumt` to format code
 - Use `goimports` to manage ordering of `import` statements
 - Keep line length reasonable (no hard limit, but consider readability)
-- Add blank lines to separate logical groups of code, adhering to the linter constraints.
+- Add blank lines to separate logical groups of code, adhering to the linter constraints
+- Ensure the file ends with a trailing newline `\n`
 
 ### Comments
 
@@ -330,6 +332,8 @@ Refer to the linter configuration in `.golangci.yml` for style checks and standa
 - `go mod`: Manage dependencies
 - `go generate`: Code generation
 
+`make lint vet` runs `go vet` and `golangci-lint`
+
 ### Development Practices
 
 - Run tests before committing

.github/workflows/auto-merge.yml.disabled

@@ -7,7 +7,7 @@ jobs:
   auto-merge:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ahmadnassri/action-dependabot-auto-merge@45fc124d949b19b6b8bf6645b6c9d55f4f9ac61a #v2.6.6
         with:
           # auto-merge rules are in /.github/auto-merge.yml

.github/workflows/code-coverage.yml.disabled

@@ -12,21 +12,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out repository
-      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 0
     - name: Set up Go
-      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version-file: 'go.mod'
     - name: Run Tests
       run: make test-with-coverage
     - name: Upload Coverage
-      uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
+      uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
       with:
         files: coverage.txt
     - name: Upload Logs
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: logs
         path: .logs/**/*.log

.github/workflows/compat-test.yml.disabled

@@ -14,17 +14,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out repository
-      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 0
     - name: Set up Go
-      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version-file: 'go.mod'
     - name: Compat Test
       run: make compat-tests
     - name: Upload Logs
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: logs
         path: .logs/**/*.log

.github/workflows/dependency-review.yml.disabled

@@ -15,6 +15,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 #v4.8.2
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 #v4.9.0

.github/workflows/endurance-test.yml.disabled

@@ -26,19 +26,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out repository
-      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 0
     - name: Set up Go
-      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version-file: 'go.mod'
         check-latest: true
       id: go
     - name: Endurance Tests
       run: make endurance-tests
     - name: Upload Logs
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: logs
         path: .logs/**/*.log

.github/workflows/htmlui-tests.yml.disabled

@@ -27,19 +27,21 @@ jobs:
     runs-on: macos-latest
     steps:
     - name: Check out repository
-      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 0
     - name: Set up Go
-      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version-file: 'go.mod'
         check-latest: true
       id: go
+    - name: Install gotestsum
+      run: make install-gotestsum
     - name: Run Tests
       run: make htmlui-e2e-test
     - name: Upload Screenshots
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         path: .screenshots/**/*.png
         if-no-files-found: ignore

.github/workflows/license-check.yml.disabled

@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out repository
-      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 0
     - name: Set up Go
-      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version-file: 'go.mod'
     - name: Download dependencies

.github/workflows/lint.yml

@@ -16,6 +16,8 @@ env:
   ENABLE_UNICODE_FILENAMES: ${{ secrets.ENABLE_UNICODE_FILENAMES }}
   # set (to any value other than false) to trigger very long filenames testing
   ENABLE_LONG_FILENAMES: ${{ secrets.ENABLE_LONG_FILENAMES }}
+permissions:
+  contents: read
 jobs:
   build:
     strategy:
@@ -24,13 +26,15 @@ jobs:
         os: [ubuntu-latest]
     name: Lint
     runs-on: ${{ matrix.os }}
+    permissions:
+      security-events: write
     steps:
     - name: Check out repository
-      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 0
     - name: Set up Go
-      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version-file: 'go.mod'
     - name: Lint

.github/workflows/make.yml.disabled

@@ -36,11 +36,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Check out repository
-      uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 0
     - name: Set up Go
-      uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
         go-version-file: 'go.mod'
       id: go
@@ -62,7 +62,7 @@ jobs:
         CSC_KEYCHAIN: ${{ secrets.CSC_KEYCHAIN }}
         CSC_KEY_PASSWORD: ${{ secrets.CSC_KEY_PASSWORD }}
         MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
-      if: ${{ contains(matrix.os, 'macos') }}
+      if: ${{ contains(matrix.os, 'macos') && github.event_name != 'pull_request' }}
     - name: Install Windows signing tools
       # install signing tools and credentials for macOS and Windows outside of main
       # build process.
@@ -90,9 +90,9 @@ jobs:
         WINDOWS_SIGN_TOOL: ${{ secrets.WINDOWS_SIGN_TOOL }}
 
         # macOS signing certificate (base64-encoded), used by Electron Builder
-        MACOS_SIGNING_IDENTITY: ${{ secrets.MACOS_SIGNING_IDENTITY }}
+        MACOS_SIGNING_IDENTITY: ${{ github.event_name != 'pull_request' && secrets.MACOS_SIGNING_IDENTITY || '' }}
     - name: Upload Kopia Artifacts
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: kopia-${{ matrix.os }}
         path: |
@@ -113,7 +113,7 @@ jobs:
           dist/kopia-ui/*.yml
         if-no-files-found: ignore
     - name: Upload Kopia Binary
-      uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: kopia_binaries-${{ matrix.os }}
         path: |
@@ -128,21 +128,21 @@ jobs:
     needs: build
     if: github.event_name != 'pull_request' && github.repository == 'kopia/kopia'
     steps:
-    - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
     - name: Install Linux-specific packages
       run: "sudo apt-get install -y createrepo-c"
     - name: Download Artifacts
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         pattern: kopia-*
         merge-multiple: true
         path: dist
     - name: Download Kopia Binaries
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         pattern: kopia_binaries-*
         merge-multiple: true
@@ -185,7 +185,7 @@ jobs:
         DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
         DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
     - name: Bump Homebrew formula
-      uses: dawidd6/action-homebrew-bump-formula@3428a0601bba3173ec0bdcc945be23fa27aa4c31 # v5
+      uses: dawidd6/action-homebrew-bump-formula@1446dca236b0440c6f02723a3f14f13be2c04ab0 # v7
       # only bump formula for tags which don't contain '-'
       # this excludes vx.y.z-rc1
       if: github.ref_type == 'tag' && !contains(github.ref_name, '-')