Merge branch 'master' into feat/rdb-benchmarks

Author: jremy42

.github/workflows/codeql-analysis.yml

@@ -48,7 +48,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -59,7 +59,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -73,4 +73,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4

cmd/scw/testdata/test-all-usage-audit-trail-event-list-usage.golden

@@ -7,7 +7,7 @@ USAGE:
 
 ARGS:
   [project-id]        (Optional) ID of the Project containing the Audit Trail events
-  [resource-type]     (Optional) Type of the Scaleway resource (unknown_type | secm_secret | secm_secret_version | kube_cluster | kube_pool | kube_node | kube_acl | keym_key | iam_user | iam_application | iam_group | iam_policy | iam_api_key | iam_ssh_key | iam_rule | iam_saml | iam_saml_certificate | secret_manager_secret | secret_manager_version | key_manager_key | account_user | account_organization | account_project | instance_server | instance_placement_group | instance_security_group | instance_volume | instance_snapshot | instance_image | apple_silicon_server | baremetal_server | baremetal_setting | ipam_ip | sbs_volume | sbs_snapshot | load_balancer_lb | load_balancer_ip | load_balancer_frontend | load_balancer_backend | load_balancer_route | load_balancer_acl | load_balancer_certificate | sfs_filesystem | vpc_private_network)
+  [resource-type]     (Optional) Type of the Scaleway resource (unknown_type | secm_secret | secm_secret_version | kube_cluster | kube_pool | kube_node | kube_acl | keym_key | iam_user | iam_application | iam_group | iam_policy | iam_api_key | iam_ssh_key | iam_rule | iam_saml | iam_saml_certificate | secret_manager_secret | secret_manager_version | key_manager_key | account_user | account_organization | account_project | instance_server | instance_placement_group | instance_security_group | instance_volume | instance_snapshot | instance_image | apple_silicon_server | baremetal_server | baremetal_setting | ipam_ip | sbs_volume | sbs_snapshot | load_balancer_lb | load_balancer_ip | load_balancer_frontend | load_balancer_backend | load_balancer_route | load_balancer_acl | load_balancer_certificate | sfs_filesystem | vpc_private_network | edge_services_plan | edge_services_pipeline | edge_services_dns_stage | edge_services_tls_stage | edge_services_cache_stage | edge_services_route_stage | edge_services_route_rules | edge_services_waf_stage | edge_services_backend_stage)
   [method-name]       (Optional) Name of the method of the API call performed
   [status]            (Optional) HTTP status code of the request. Returns either `200` if the request was successful or `403` if the permission was denied
   [recorded-after]    (Optional) The `recorded_after` parameter defines the earliest timestamp from which Audit Trail events are retrieved. Returns `one hour ago` by default

cmd/scw/testdata/test-all-usage-registry-tag-delete-usage.golden

@@ -7,6 +7,7 @@ USAGE:
 
 ARGS:
   tag-id            UUID of the tag
+  [timeout]         Maximum time to handle the request
   [region=fr-par]   Region to target. If none is passed will use default region from the config (fr-par | nl-ams | pl-waw)
 
 DEPRECATED ARGS:

core/testing.go

@@ -312,6 +312,7 @@ var DefaultRetryInterval *time.Duration
 
 var foldersUsingVCRv4 = []string{
 	"instance",
+	"k8s",
 }
 
 func folderUsesVCRv4(fullFolderPath string) bool {
@@ -678,6 +679,14 @@ func ExecBeforeCmdArgs(args []string) BeforeFunc {
 	}
 }
 
+// ExecBeforeCmdWithResult executes the given command and returns its result.
+func ExecBeforeCmdWithResult(ctx *BeforeFuncCtx, cmd string) any {
+	args := cmdToArgs(ctx.Meta, cmd)
+	ctx.Logger.Debugf("ExecBeforeCmd: args=%s\n", args)
+
+	return ctx.ExecuteCmd(args)
+}
+
 // ExecAfterCmd executes the given before command.
 func ExecAfterCmd(cmd string) AfterFunc {
 	return func(ctx *AfterFuncCtx) error {

docs/commands/audit-trail.md

@@ -29,7 +29,7 @@ scw audit-trail event list [arg=value ...]
 | Name |   | Description |
 |------|---|-------------|
 | project-id |  | (Optional) ID of the Project containing the Audit Trail events |
-| resource-type | One of: `unknown_type`, `secm_secret`, `secm_secret_version`, `kube_cluster`, `kube_pool`, `kube_node`, `kube_acl`, `keym_key`, `iam_user`, `iam_application`, `iam_group`, `iam_policy`, `iam_api_key`, `iam_ssh_key`, `iam_rule`, `iam_saml`, `iam_saml_certificate`, `secret_manager_secret`, `secret_manager_version`, `key_manager_key`, `account_user`, `account_organization`, `account_project`, `instance_server`, `instance_placement_group`, `instance_security_group`, `instance_volume`, `instance_snapshot`, `instance_image`, `apple_silicon_server`, `baremetal_server`, `baremetal_setting`, `ipam_ip`, `sbs_volume`, `sbs_snapshot`, `load_balancer_lb`, `load_balancer_ip`, `load_balancer_frontend`, `load_balancer_backend`, `load_balancer_route`, `load_balancer_acl`, `load_balancer_certificate`, `sfs_filesystem`, `vpc_private_network` | (Optional) Type of the Scaleway resource |
+| resource-type | One of: `unknown_type`, `secm_secret`, `secm_secret_version`, `kube_cluster`, `kube_pool`, `kube_node`, `kube_acl`, `keym_key`, `iam_user`, `iam_application`, `iam_group`, `iam_policy`, `iam_api_key`, `iam_ssh_key`, `iam_rule`, `iam_saml`, `iam_saml_certificate`, `secret_manager_secret`, `secret_manager_version`, `key_manager_key`, `account_user`, `account_organization`, `account_project`, `instance_server`, `instance_placement_group`, `instance_security_group`, `instance_volume`, `instance_snapshot`, `instance_image`, `apple_silicon_server`, `baremetal_server`, `baremetal_setting`, `ipam_ip`, `sbs_volume`, `sbs_snapshot`, `load_balancer_lb`, `load_balancer_ip`, `load_balancer_frontend`, `load_balancer_backend`, `load_balancer_route`, `load_balancer_acl`, `load_balancer_certificate`, `sfs_filesystem`, `vpc_private_network`, `edge_services_plan`, `edge_services_pipeline`, `edge_services_dns_stage`, `edge_services_tls_stage`, `edge_services_cache_stage`, `edge_services_route_stage`, `edge_services_route_rules`, `edge_services_waf_stage`, `edge_services_backend_stage` | (Optional) Type of the Scaleway resource |
 | method-name |  | (Optional) Name of the method of the API call performed |
 | status |  | (Optional) HTTP status code of the request. Returns either `200` if the request was successful or `403` if the permission was denied |
 | recorded-after |  | (Optional) The `recorded_after` parameter defines the earliest timestamp from which Audit Trail events are retrieved. Returns `one hour ago` by default |

docs/commands/registry.md

@@ -332,6 +332,7 @@ scw registry tag delete <tag-id ...> [arg=value ...]
 | Name |   | Description |
 |------|---|-------------|
 | tag-id | Required | UUID of the tag |
+| timeout |  | Maximum time to handle the request |
 | ~~force~~ | Deprecated | If two tags share the same digest the deletion will fail unless this parameter is set to true (deprecated) |
 | region | Default: `fr-par`<br />One of: `fr-par`, `nl-ams`, `pl-waw` | Region to target. If none is passed will use default region from the config |
 

docs/cookbook.md

@@ -88,6 +88,69 @@ scw instance server list zone=all -o template="{{.ID}} zone={{.Zone}}" | xargs -
 scw rdb backup list -ojson | jq --arg d "$(date -d "7 days ago" --utc --iso-8601=ns)" '.[] | select (.created_at < $d)'
 ```
 
+### Configure password storage for rdb connect
+
+The `scw rdb instance connect` command can automatically use stored credentials to avoid typing passwords manually. Here's how to configure it for PostgreSQL and MySQL.
+
+#### PostgreSQL - Using .pgpass file
+
+Create a password file to store your connection credentials securely:
+
+```bash
+# Linux/macOS: Create ~/.pgpass
+cat > ~/.pgpass << 'EOF'
+# Format: hostname:port:database:username:password
+51.159.25.206:13917:rdb:myuser:mypassword
+# You can use * as wildcard
+*:*:*:myuser:mypassword
+EOF
+chmod 600 ~/.pgpass
+
+# Windows: Create %APPDATA%\postgresql\pgpass.conf
+# Same format as above
+```
+
+Then connect without password prompt:
+```bash
+scw rdb instance connect <instance-id> username=myuser
+```
+
+**Documentation:** https://www.postgresql.org/docs/current/libpq-pgpass.html
+
+#### MySQL - Using mysql_config_editor
+
+MySQL provides `mysql_config_editor` for secure, obfuscated password storage:
+
+```bash
+# Configure credentials for a login path
+mysql_config_editor set --login-path=scw \
+  --host=195.154.69.163 \
+  --port=12210 \
+  --user=myuser \
+  --password
+# You'll be prompted to enter the password securely
+
+# Verify configuration (password will be masked)
+mysql_config_editor print --login-path=scw
+
+# Connect using the login path
+mysql --login-path=scw --database=rdb
+```
+
+The credentials are stored in `~/.mylogin.cnf` (Linux/macOS) or `%APPDATA%\MySQL\.mylogin.cnf` (Windows).
+
+**Alternative:** You can also use `~/.my.cnf` for plain-text storage (less secure):
+```bash
+cat > ~/.my.cnf << 'EOF'
+[client]
+user=myuser
+password=mypassword
+EOF
+chmod 600 ~/.my.cnf
+```
+
+**Documentation:** https://dev.mysql.com/doc/refman/8.0/en/mysql-config-editor.html
+
 ## IPAM
 
 ### Find resource ipv4 with exact name using jq

go.mod

@@ -3,15 +3,15 @@ module github.com/scaleway/scaleway-cli/v2
 go 1.25.0
 
 require (
-	github.com/aws/aws-sdk-go-v2 v1.39.5
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.89.0
+	github.com/aws/aws-sdk-go-v2 v1.39.6
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.89.2
 	github.com/buildpacks/pack v0.38.2
 	github.com/c-bata/go-prompt v0.2.6
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/chzyer/readline v1.5.1
 	github.com/containerd/console v1.0.5
 	github.com/dnaeon/go-vcr v1.2.0
-	github.com/docker/docker v28.5.1+incompatible
+	github.com/docker/docker v28.5.2+incompatible
 	github.com/dustin/go-humanize v1.0.1
 	github.com/fatih/color v1.18.0
 	github.com/getsentry/sentry-go v0.36.2
@@ -21,7 +21,7 @@ require (
 	github.com/karrick/tparse/v2 v2.8.2
 	github.com/mattn/go-colorable v0.1.14
 	github.com/mattn/go-isatty v0.0.20
-	github.com/moby/buildkit v0.25.1
+	github.com/moby/buildkit v0.25.2
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/scaleway/scaleway-sdk-go v1.0.0-beta.35.0.20251029154854-a599ef194f4a
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
@@ -54,24 +54,24 @@ require (
 	github.com/ProtonMail/go-crypto v1.3.0 // indirect
 	github.com/agext/levenshtein v1.2.3 // indirect
 	github.com/apex/log v1.9.0 // indirect
-	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.2 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.3 // indirect
 	github.com/aws/aws-sdk-go-v2/config v1.31.6 // indirect
 	github.com/aws/aws-sdk-go-v2/credentials v1.18.10 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.6 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.11 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.11 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.13 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.13 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.11 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.13 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecr v1.50.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ecrpublic v1.37.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.2 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.11 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.11 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.3 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.4 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.13 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.13 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.29.1 // indirect
 	github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sts v1.38.2 // indirect
-	github.com/aws/smithy-go v1.23.1 // indirect
+	github.com/aws/smithy-go v1.23.2 // indirect
 	github.com/awslabs/amazon-ecr-credential-helper/ecr-login v0.10.1 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect