chore: sync with upstream goharbor/harbor

[github-actions]

Automated PR to sync 23 new commit(s) from upstream goharbor/harbor main branch.

Merge strategy: Our changes in next are preserved on conflicts (upstream changes are additive only).

Note: The .github folder is preserved and not synced from upstream.

---

Summary by cubic

Syncs upstream changes to improve security, stability, and tooling. Adds per-endpoint CA certificates, Cosign release verification, backup/restore scripts, pprof support, and multiple API/UI fixes.

• New Features

  • Add per-endpoint CA certificate trust for registries (DB migration adds ca_certificate, API validation, UI field, transport updates across adapters). Backward compatible.
  • Support OCI repository type for JFrog replication; env var JFROG_SUPPORTED_REPOSITORY_TYPES to override defaults.
  • Document Cosign keyless signing and how to verify Harbor releases; update README.
  • Add contrib backup/restore scripts for DB, registry, Redis, secrets, and config.
  • Enable optional pprof server in core, jobservice, exporter, and registryctl via PPROF_ENABLED and PPROF_ADDR.
  • Bake Harbor version into exporter and expose via metrics (build passes RELEASEVERSION and GITCOMMIT).
  • UI: add missing i18n key check script and restore translations; hide admin-only alerts for non-admin users.

• Bug Fixes

  • Rework user and user group search to DB-side fuzzy search with stable ordering; remove MostMatchSorter; add SearchByName APIs and tests.
  • Handle OIDC group claims returned as a single string.
  • Prevent goroutine leak in task StopAndWait with a buffered channel.
  • Improve HTTP/TLS transport: custom CA support with PEM normalization/validation; update adapters and use status constants.
  • Fix session regenerate to store an empty map; update tests. Swagger now uses NewTag for tag creation (no immutable flag).
  • Bump Trivy to v0.68.2 and Trivy Adapter to v0.34.2; update semver to v3; minor Makefile/push script fixes.

^{Written for commit 24b8236. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot
3.3% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[cubic-dev-ai]

3 issues found across 106 files

Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed.

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="src/lib/pprof.go">

<violation number="1" location="src/lib/pprof.go:38">
P1: Default pprof binding exposes profiling endpoints on all interfaces. Default to localhost to reduce accidental exposure when PPROF_ENABLED is enabled.</violation>
</file>

<file name="README.md">

<violation number="1" location="README.md:80">
P3: The new verification guide link is broken because docs/signature-verification.md is not present in the repo. Remove the link or add the referenced documentation file.</violation>
</file>

<file name="contrib/backup-restore/README.md">

<violation number="1" location="contrib/backup-restore/README.md:40">
P2: The backup steps instruct running the script before stopping Harbor, which contradicts the prerequisite and can lead to inconsistent backups. Reorder the steps so Harbor is stopped before invoking the backup script.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P1: Default pprof binding exposes profiling endpoints on all interfaces. Default to localhost to reduce accidental exposure when PPROF_ENABLED is enabled.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/lib/pprof.go, line 38:

<comment>Default pprof binding exposes profiling endpoints on all interfaces. Default to localhost to reduce accidental exposure when PPROF_ENABLED is enabled.</comment>

<file context>
@@ -0,0 +1,45 @@
+	go func() {
+		addr := os.Getenv("PPROF_ADDR")
+		if addr == "" {
+			addr = ":6060"
+		}
+		log.Infof("Starting pprof at %s/debug/pprof/", addr)
</file context>

[cubic-dev-ai]

P2: The backup steps instruct running the script before stopping Harbor, which contradicts the prerequisite and can lead to inconsistent backups. Reorder the steps so Harbor is stopped before invoking the backup script.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At contrib/backup-restore/README.md, line 40:

<comment>The backup steps instruct running the script before stopping Harbor, which contradicts the prerequisite and can lead to inconsistent backups. Reorder the steps so Harbor is stopped before invoking the backup script.</comment>

<file context>
@@ -0,0 +1,107 @@
+    chmod +x harbor-backup
+    ```
+
+3.  **Run the Backup Script:**
+    ```bash
+    ./harbor-backup [OPTIONS]
</file context>

[cubic-dev-ai]

P3: The new verification guide link is broken because docs/signature-verification.md is not present in the repo. Remove the link or add the referenced documentation file.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At README.md, line 80:

<comment>The new verification guide link is broken because docs/signature-verification.md is not present in the repo. Remove the link or add the referenced documentation file.</comment>

<file context>
@@ -59,6 +58,26 @@ Download binaries of **[Harbor release ](https://github.com/goharbor/harbor/rele
+```
+- *Expected output:* Verified OK
+
+- *Full verification guide:* [docs/signature-verification.md](docs/signature-verification.md)
 
 ## OCI Distribution Conformance Tests
</file context>