fix(api/workflows): kubernetes UAC (#2507)

Co-authored-by: LP B <xAt0mZ@users.noreply.github.com>

.eslintignore

@@ -1,3 +0,0 @@
-node_modules/
-dist/
-test/

.eslintrc.yml

@@ -1,157 +0,0 @@
-env:
-  browser: true
-  jquery: true
-  node: true
-  es6: true
-
-globals:
-  angular: true
-
-extends:
-  - 'eslint:recommended'
-  - 'plugin:storybook/recommended'
-  - 'plugin:import/typescript'
-  - prettier
-
-plugins:
-  - import
-
-parserOptions:
-  ecmaVersion: latest
-  sourceType: module
-  project: './tsconfig.json'
-  ecmaFeatures:
-    modules: true
-
-rules:
-  no-console: error
-  no-alert: error
-  no-control-regex: 'off'
-  no-empty: warn
-  no-empty-function: warn
-  no-useless-escape: 'off'
-  import/named: error
-  import/order:
-    [
-      'error',
-      {
-        pathGroups:
-          [
-            { pattern: '@@/**', group: 'internal', position: 'after' },
-            { pattern: '@/**', group: 'internal' },
-            { pattern: '{Kubernetes,Portainer,Agent,Azure,Docker}/**', group: 'internal' },
-          ],
-        groups: ['builtin', 'external', 'internal', 'parent', 'sibling', 'index'],
-        pathGroupsExcludedImportTypes: ['internal'],
-      },
-    ]
-  no-restricted-imports:
-    - error
-    - patterns:
-        - group:
-            - '@/react/test-utils/*'
-          message: 'These utils are just for test files'
-
-settings:
-  'import/resolver':
-    alias:
-      map:
-        - ['@@', './app/react/components']
-        - ['@', './app']
-      extensions: ['.js', '.ts', '.tsx']
-    typescript: true
-    node: true
-
-overrides:
-  - files:
-      - app/**/*.ts{,x}
-    parserOptions:
-      project: './tsconfig.json'
-    parser: '@typescript-eslint/parser'
-    plugins:
-      - '@typescript-eslint'
-      - 'regex'
-    extends:
-      - airbnb
-      - airbnb-typescript
-      - 'plugin:eslint-comments/recommended'
-      - 'plugin:react-hooks/recommended'
-      - 'plugin:react/jsx-runtime'
-      - 'plugin:@typescript-eslint/recommended'
-      - 'plugin:@typescript-eslint/eslint-recommended'
-      - 'plugin:promise/recommended'
-      - 'plugin:storybook/recommended'
-      - prettier # should be last
-    settings:
-      react:
-        version: 'detect'
-
-    rules:
-      no-console: error
-      import/order:
-        [
-          'error',
-          {
-            pathGroups: [{ pattern: '@@/**', group: 'internal', position: 'after' }, { pattern: '@/**', group: 'internal' }],
-            groups: ['builtin', 'external', 'internal', 'parent', 'sibling', 'index'],
-            'newlines-between': 'always',
-          },
-        ]
-      no-plusplus: off
-      func-style: [error, 'declaration']
-      import/prefer-default-export: off
-      no-use-before-define: 'off'
-      '@typescript-eslint/no-use-before-define': ['error', { functions: false, 'allowNamedExports': true }]
-      no-shadow: 'off'
-      '@typescript-eslint/no-shadow': off
-      jsx-a11y/no-autofocus: warn
-      react/forbid-prop-types: off
-      react/require-default-props: off
-      react/no-array-index-key: off
-      no-underscore-dangle: off
-      react/jsx-filename-extension: [0]
-      import/no-extraneous-dependencies: ['error', { devDependencies: true }]
-      '@typescript-eslint/explicit-module-boundary-types': off
-      '@typescript-eslint/no-unused-vars': 'error'
-      '@typescript-eslint/no-explicit-any': 'error'
-      'jsx-a11y/label-has-associated-control':
-        - error
-        - assert: either
-          controlComponents:
-            - Input
-            - Checkbox
-      'jsx-a11y/control-has-associated-label': off
-      'react/function-component-definition': ['error', { 'namedComponents': 'function-declaration' }]
-      'react/jsx-no-bind': off
-      'no-await-in-loop': 'off'
-      'react/jsx-no-useless-fragment': ['error', { allowExpressions: true }]
-      'regex/invalid': ['error', [{ 'regex': '<Icon icon="(.*)"', 'message': 'Please directly import the `lucide-react` icon instead of using the string' }]]
-      '@typescript-eslint/no-restricted-imports':
-        - error
-        - patterns:
-            - group:
-                - '@/react/test-utils/*'
-              message: 'These utils are just for test files'
-    overrides: # allow props spreading for hoc files
-      - files:
-          - app/**/with*.ts{,x}
-        rules:
-          'react/jsx-props-no-spreading': off
-  - files:
-      - app/**/*.test.*
-    extends:
-      - 'plugin:vitest/recommended'
-    env:
-      'vitest/env': true
-    rules:
-      'react/jsx-no-constructed-context-values': off
-      '@typescript-eslint/no-restricted-imports': off
-      no-restricted-imports: off
-      'react/jsx-props-no-spreading': off
-  - files:
-      - app/**/*.stories.*
-    rules:
-      'no-alert': off
-      '@typescript-eslint/no-restricted-imports': off
-      no-restricted-imports: off
-      'react/jsx-props-no-spreading': off

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -94,10 +94,16 @@ body:
       description: We only provide support for current versions of Portainer as per the lifecycle policy linked above. If you are on an older version of Portainer we recommend [updating first](https://docs.portainer.io/start/upgrade) in case your bug has already been fixed.
       multiple: false
       options:
+        - '2.40.0'
+        - '2.39.1'
+        - '2.39.0'
+        - '2.38.1'
+        - '2.38.0'
         - '2.37.0'
         - '2.36.0'
         - '2.35.0'
         - '2.34.0'
+        - '2.33.7'
         - '2.33.6'
         - '2.33.5'
         - '2.33.4'
@@ -137,10 +143,6 @@ body:
         - '2.22.0'
         - '2.21.5'
         - '2.21.4'
-        - '2.21.3'
-        - '2.21.2'
-        - '2.21.1'
-        - '2.21.0'
     validations:
       required: true
 

.golangci-forward.yaml

@@ -6,11 +6,8 @@ linters:
   settings:
     forbidigo:
       forbid:
-        - pattern: ^dataservices.DataStore.(EdgeGroup|EdgeJob|EdgeStack|EndpointRelation|Endpoint|GitCredential|Registry|ResourceControl|Role|Settings|Snapshot|Stack|Tag|User)$
+        - pattern: ^dataservices.DataStore.(EdgeGroup|EdgeJob|EdgeStack|EndpointRelation|Endpoint|GitCredential|Registry|ResourceControl|Role|Settings|Snapshot|SSLSettings|Stack|Tag|User)$
           msg: Use a transaction instead
+        - pattern: ^(filepath|path)\.Join$
+          msg: Use filesystem.JoinPaths() from github.com/portainer/portainer/api/filesystem to prevent path traversal attacks
       analyze-types: true
-  exclusions:
-    rules:
-      - path: _test\.go
-        linters:
-          - forbidigo

.golangci.yaml

@@ -54,8 +54,28 @@ linters:
               desc: github.com/ProtonMail/go-crypto/openpgp is not allowed because of FIPS mode
             - pkg: github.com/cosi-project/runtime
               desc: github.com/cosi-project/runtime is not allowed because of FIPS mode
+            - pkg: gopkg.in/yaml.v2
+              desc: use go.yaml.in/yaml/v3 instead
             - pkg: gopkg.in/yaml.v3
               desc: use go.yaml.in/yaml/v3 instead
+            - pkg: github.com/golang-jwt/jwt/v4
+              desc: use github.com/golang-jwt/jwt/v5 instead
+            - pkg: github.com/mitchellh/mapstructure
+              desc: use github.com/go-viper/mapstructure/v2 instead
+            - pkg: gopkg.in/alecthomas/kingpin.v2
+              desc: use github.com/alecthomas/kingpin/v2 instead
+            - pkg: github.com/jcmturner/gokrb5$
+              desc: use github.com/jcmturner/gokrb5/v8 instead
+            - pkg: github.com/gofrs/uuid
+              desc: use github.com/google/uuid
+            - pkg: github.com/Masterminds/semver$
+              desc: use github.com/Masterminds/semver/v3
+            - pkg: github.com/blang/semver
+              desc: use github.com/Masterminds/semver/v3
+            - pkg: github.com/coreos/go-semver
+              desc: use github.com/Masterminds/semver/v3
+            - pkg: github.com/hashicorp/go-version
+              desc: use github.com/Masterminds/semver/v3
     forbidigo:
       forbid:
         - pattern: ^tls\.Config$

.prettierignore

@@ -1,2 +1,3 @@
 dist
-api/datastore/test_data
+api/datastore/test_data
+coverage

.prettierrc

@@ -5,21 +5,18 @@
   "trailingComma": "es5",
   "overrides": [
     {
-      "files": [
-        "*.html"
-      ],
+      "files": ["*.html"],
       "options": {
         "parser": "angular"
       }
     },
     {
-      "files": [
-        "*.{j,t}sx",
-        "*.ts"
-      ],
+      "files": ["*.{j,t}sx", "*.ts"],
       "options": {
         "printWidth": 80
       }
     }
-  ]
-}
+  ],
+  "plugins": ["prettier-plugin-tailwindcss"],
+  "tailwindFunctions": ["clsx"]
+}

.storybook/main.ts

@@ -1,6 +1,7 @@
+import path from 'path';
+
 import { StorybookConfig } from '@storybook/react-webpack5';
 
-import TsconfigPathsPlugin from 'tsconfig-paths-webpack-plugin';
 import { Configuration } from 'webpack';
 import postcss from 'postcss';
 
@@ -9,20 +10,38 @@ const config: StorybookConfig = {
   addons: [
     '@storybook/addon-links',
     '@storybook/addon-essentials',
+    '@storybook/addon-webpack5-compiler-swc',
+    '@chromatic-com/storybook',
     {
-      name: '@storybook/addon-styling',
+      name: '@storybook/addon-styling-webpack',
+
       options: {
-        cssLoaderOptions: {
-          importLoaders: 1,
-          modules: {
-            localIdentName: '[path][name]__[local]',
-            auto: true,
-            exportLocalsConvention: 'camelCaseOnly',
+        rules: [
+          {
+            test: /\.css$/,
+            sideEffects: true,
+            use: [
+              require.resolve('style-loader'),
+              {
+                loader: require.resolve('css-loader'),
+                options: {
+                  importLoaders: 1,
+                  modules: {
+                    localIdentName: '[path][name]__[local]',
+                    auto: true,
+                    exportLocalsConvention: 'camelCaseOnly',
+                  },
+                },
+              },
+              {
+                loader: require.resolve('postcss-loader'),
+                options: {
+                  implementation: postcss,
+                },
+              },
+            ],
           },
-        },
-        postCss: {
-          implementation: postcss,
-        },
+        ],
       },
     },
   ],
@@ -67,12 +86,7 @@ const config: StorybookConfig = {
       ...config,
       resolve: {
         ...config.resolve,
-        plugins: [
-          ...(config.resolve?.plugins || []),
-          new TsconfigPathsPlugin({
-            extensions: config.resolve?.extensions,
-          }),
-        ],
+        tsconfig: path.resolve(__dirname, '..', 'tsconfig.json'),
       },
       module: {
         ...config.module,
@@ -83,11 +97,17 @@ const config: StorybookConfig = {
   staticDirs: ['./public'],
   typescript: {
     reactDocgen: 'react-docgen-typescript',
+    reactDocgenTypescriptOptions: {
+      compilerOptions: {
+        outDir: path.resolve(__dirname, '..', 'dist/public'),
+      },
+    },
   },
   framework: {
     name: '@storybook/react-webpack5',
     options: {},
   },
+  docs: {},
 };
 
 export default config;

.storybook/preview.tsx

@@ -1,9 +1,9 @@
 import '../app/assets/css';
-import React from 'react';
 import { pushStateLocationPlugin, UIRouter } from '@uirouter/react';
 import { initialize as initMSW, mswLoader } from 'msw-storybook-addon';
 import { handlers } from '../app/setup-tests/server-handlers';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { Preview } from '@storybook/react';
 
 initMSW(
   {
@@ -21,31 +21,35 @@ initMSW(
   handlers
 );
 
-export const parameters = {
-  actions: { argTypesRegex: '^on[A-Z].*' },
-  controls: {
-    matchers: {
-      color: /(background|color)$/i,
-      date: /Date$/,
-    },
-  },
-  msw: {
-    handlers,
-  },
-};
-
 const testQueryClient = new QueryClient({
   defaultOptions: { queries: { retry: false } },
 });
 
-export const decorators = [
-  (Story) => (
+const preview: Preview = {
+  decorators: (Story) => (
     <QueryClientProvider client={testQueryClient}>
       <UIRouter plugins={[pushStateLocationPlugin]}>
         <Story />
       </UIRouter>
     </QueryClientProvider>
   ),
-];
+  loaders: [mswLoader],
+  parameters: {
+    options: {
+      storySort: {
+        order: ['Design System', 'Components', '*'],
+      },
+    },
+    controls: {
+      matchers: {
+        color: /(background|color)$/i,
+        date: /Date$/,
+      },
+    },
+    msw: {
+      handlers,
+    },
+  },
+};
 
-export const loaders = [mswLoader];
+export default preview;

.storybook/public/mockServiceWorker.js

@@ -1,27 +1,29 @@
 /* eslint-disable */
 /* tslint:disable */
 
+import { v4 as uuidv4 } from 'uuid';
+
 /**
- * Mock Service Worker (2.0.11).
+ * Mock Service Worker.
  * @see https://github.com/mswjs/msw
  * - Please do NOT modify this file.
- * - Please do NOT serve this file on production.
  */
 
-const INTEGRITY_CHECKSUM = 'c5f7f8e188b673ea4e677df7ea3c5a39';
+const PACKAGE_VERSION = '2.12.10';
+const INTEGRITY_CHECKSUM = '4db4a41e972cec1b64cc569c66952d82';
 const IS_MOCKED_RESPONSE = Symbol('isMockedResponse');
 const activeClientIds = new Set();
 
-self.addEventListener('install', function () {
+addEventListener('install', function () {
   self.skipWaiting();
 });
 
-self.addEventListener('activate', function (event) {
+addEventListener('activate', function (event) {
   event.waitUntil(self.clients.claim());
 });
 
-self.addEventListener('message', async function (event) {
-  const clientId = event.source.id;
+addEventListener('message', async function (event) {
+  const clientId = Reflect.get(event.source || {}, 'id');
 
   if (!clientId || !self.clients) {
     return;
@@ -48,7 +50,10 @@ self.addEventListener('message', async function (event) {
     case 'INTEGRITY_CHECK_REQUEST': {
       sendToClient(client, {
         type: 'INTEGRITY_CHECK_RESPONSE',
-        payload: INTEGRITY_CHECKSUM,
+        payload: {
+          packageVersion: PACKAGE_VERSION,
+          checksum: INTEGRITY_CHECKSUM,
+        },
       });
       break;
     }
@@ -58,16 +63,16 @@ self.addEventListener('message', async function (event) {
 
       sendToClient(client, {
         type: 'MOCKING_ENABLED',
-        payload: true,
+        payload: {
+          client: {
+            id: client.id,
+            frameType: client.frameType,
+          },
+        },
       });
       break;
     }
 
-    case 'MOCK_DEACTIVATE': {
-      activeClientIds.delete(clientId);
-      break;
-    }
-
     case 'CLIENT_CLOSED': {
       activeClientIds.delete(clientId);
 
@@ -85,72 +90,91 @@ self.addEventListener('message', async function (event) {
   }
 });
 
-self.addEventListener('fetch', function (event) {
-  const { request } = event;
+addEventListener('fetch', function (event) {
+  const requestInterceptedAt = Date.now();
 
   // Bypass navigation requests.
-  if (request.mode === 'navigate') {
+  if (event.request.mode === 'navigate') {
     return;
   }
 
   // Opening the DevTools triggers the "only-if-cached" request
   // that cannot be handled by the worker. Bypass such requests.
-  if (request.cache === 'only-if-cached' && request.mode !== 'same-origin') {
+  if (event.request.cache === 'only-if-cached' && event.request.mode !== 'same-origin') {
     return;
   }
 
   // Bypass all requests when there are no active clients.
   // Prevents the self-unregistered worked from handling requests
-  // after it's been deleted (still remains active until the next reload).
+  // after it's been terminated (still remains active until the next reload).
   if (activeClientIds.size === 0) {
     return;
   }
 
-  // Generate unique request ID.
-  const requestId = crypto.randomUUID();
-  event.respondWith(handleRequest(event, requestId));
+  const requestId = uuidv4();
+  event.respondWith(handleRequest(event, requestId, requestInterceptedAt));
 });
 
-async function handleRequest(event, requestId) {
+/**
+ * @param {FetchEvent} event
+ * @param {string} requestId
+ * @param {number} requestInterceptedAt
+ */
+async function handleRequest(event, requestId, requestInterceptedAt) {
   const client = await resolveMainClient(event);
-  const response = await getResponse(event, client, requestId);
+  const requestCloneForEvents = event.request.clone();
+  const response = await getResponse(event, client, requestId, requestInterceptedAt);
 
   // Send back the response clone for the "response:*" life-cycle events.
   // Ensure MSW is active and ready to handle the message, otherwise
   // this message will pend indefinitely.
   if (client && activeClientIds.has(client.id)) {
-    (async function () {
-      const responseClone = response.clone();
+    const serializedRequest = await serializeRequest(requestCloneForEvents);
 
-      sendToClient(
-        client,
-        {
-          type: 'RESPONSE',
-          payload: {
-            requestId,
-            isMockedResponse: IS_MOCKED_RESPONSE in response,
+    // Clone the response so both the client and the library could consume it.
+    const responseClone = response.clone();
+
+    sendToClient(
+      client,
+      {
+        type: 'RESPONSE',
+        payload: {
+          isMockedResponse: IS_MOCKED_RESPONSE in response,
+          request: {
+            id: requestId,
+            ...serializedRequest,
+          },
+          response: {
             type: responseClone.type,
             status: responseClone.status,
             statusText: responseClone.statusText,
-            body: responseClone.body,
             headers: Object.fromEntries(responseClone.headers.entries()),
+            body: responseClone.body,
           },
         },
-        [responseClone.body]
-      );
-    })();
+      },
+      responseClone.body ? [serializedRequest.body, responseClone.body] : []
+    );
   }
 
   return response;
 }
 
-// Resolve the main client for the given event.
-// Client that issues a request doesn't necessarily equal the client
-// that registered the worker. It's with the latter the worker should
-// communicate with during the response resolving phase.
+/**
+ * Resolve the main client for the given event.
+ * Client that issues a request doesn't necessarily equal the client
+ * that registered the worker. It's with the latter the worker should
+ * communicate with during the response resolving phase.
+ * @param {FetchEvent} event
+ * @returns {Promise<Client | undefined>}
+ */
 async function resolveMainClient(event) {
   const client = await self.clients.get(event.clientId);
 
+  if (activeClientIds.has(event.clientId)) {
+    return client;
+  }
+
   if (client?.frameType === 'top-level') {
     return client;
   }
@@ -171,20 +195,37 @@ async function resolveMainClient(event) {
     });
 }
 
-async function getResponse(event, client, requestId) {
-  const { request } = event;
-
+/**
+ * @param {FetchEvent} event
+ * @param {Client | undefined} client
+ * @param {string} requestId
+ * @param {number} requestInterceptedAt
+ * @returns {Promise<Response>}
+ */
+async function getResponse(event, client, requestId, requestInterceptedAt) {
   // Clone the request because it might've been already used
   // (i.e. its body has been read and sent to the client).
-  const requestClone = request.clone();
+  const requestClone = event.request.clone();
 
   function passthrough() {
-    const headers = Object.fromEntries(requestClone.headers.entries());
+    // Cast the request headers to a new Headers instance
+    // so the headers can be manipulated with.
+    const headers = new Headers(requestClone.headers);
 
-    // Remove internal MSW request header so the passthrough request
-    // complies with any potential CORS preflight checks on the server.
-    // Some servers forbid unknown request headers.
-    delete headers['x-msw-intention'];
+    // Remove the "accept" header value that marked this request as passthrough.
+    // This prevents request alteration and also keeps it compliant with the
+    // user-defined CORS policies.
+    const acceptHeader = headers.get('accept');
+    if (acceptHeader) {
+      const values = acceptHeader.split(',').map((value) => value.trim());
+      const filteredValues = values.filter((value) => value !== 'msw/passthrough');
+
+      if (filteredValues.length > 0) {
+        headers.set('accept', filteredValues.join(', '));
+      } else {
+        headers.delete('accept');
+      }
+    }
 
     return fetch(requestClone, { headers });
   }
@@ -202,37 +243,19 @@ async function getResponse(event, client, requestId) {
     return passthrough();
   }
 
-  // Bypass requests with the explicit bypass header.
-  // Such requests can be issued by "ctx.fetch()".
-  const mswIntention = request.headers.get('x-msw-intention');
-  if (['bypass', 'passthrough'].includes(mswIntention)) {
-    return passthrough();
-  }
-
   // Notify the client that a request has been intercepted.
-  const requestBuffer = await request.arrayBuffer();
+  const serializedRequest = await serializeRequest(event.request);
   const clientMessage = await sendToClient(
     client,
     {
       type: 'REQUEST',
       payload: {
         id: requestId,
-        url: request.url,
-        mode: request.mode,
-        method: request.method,
-        headers: Object.fromEntries(request.headers.entries()),
-        cache: request.cache,
-        credentials: request.credentials,
-        destination: request.destination,
-        integrity: request.integrity,
-        redirect: request.redirect,
-        referrer: request.referrer,
-        referrerPolicy: request.referrerPolicy,
-        body: requestBuffer,
-        keepalive: request.keepalive,
+        interceptedAt: requestInterceptedAt,
+        ...serializedRequest,
       },
     },
-    [requestBuffer]
+    [serializedRequest.body]
   );
 
   switch (clientMessage.type) {
@@ -240,7 +263,7 @@ async function getResponse(event, client, requestId) {
       return respondWithMock(clientMessage.data);
     }
 
-    case 'MOCK_NOT_FOUND': {
+    case 'PASSTHROUGH': {
       return passthrough();
     }
   }
@@ -248,6 +271,12 @@ async function getResponse(event, client, requestId) {
   return passthrough();
 }
 
+/**
+ * @param {Client} client
+ * @param {any} message
+ * @param {Array<Transferable>} transferrables
+ * @returns {Promise<any>}
+ */
 function sendToClient(client, message, transferrables = []) {
   return new Promise((resolve, reject) => {
     const channel = new MessageChannel();
@@ -260,11 +289,15 @@ function sendToClient(client, message, transferrables = []) {
       resolve(event.data);
     };
 
-    client.postMessage(message, [channel.port2].concat(transferrables.filter(Boolean)));
+    client.postMessage(message, [channel.port2, ...transferrables.filter(Boolean)]);
   });
 }
 
-async function respondWithMock(response) {
+/**
+ * @param {Response} response
+ * @returns {Response}
+ */
+function respondWithMock(response) {
   // Setting response status code to 0 is a no-op.
   // However, when responding with a "Response.error()", the produced Response
   // instance will have status code set to 0. Since it's not possible to create
@@ -282,3 +315,24 @@ async function respondWithMock(response) {
 
   return mockedResponse;
 }
+
+/**
+ * @param {Request} request
+ */
+async function serializeRequest(request) {
+  return {
+    url: request.url,
+    mode: request.mode,
+    method: request.method,
+    headers: Object.fromEntries(request.headers.entries()),
+    cache: request.cache,
+    credentials: request.credentials,
+    destination: request.destination,
+    integrity: request.integrity,
+    redirect: request.redirect,
+    referrer: request.referrer,
+    referrerPolicy: request.referrerPolicy,
+    body: await request.arrayBuffer(),
+    keepalive: request.keepalive,
+  };
+}

CLAUDE.md

@@ -0,0 +1,59 @@
+# Portainer Community Edition
+
+Open-source container management platform with full Docker and Kubernetes support.
+
+## Project Structure
+
+For a detailed breakdown of frontend and backend directory layout, feature locations, and common development tasks, see [docs/guidelines/project-structure.md](../../docs/guidelines/project-structure.md).
+
+## Frontend Guidelines
+
+- [docs/guidelines/frontend-conventions.md](../../docs/guidelines/frontend-conventions.md) — component structure, React Query patterns, shared components, forms, theming
+- [docs/guidelines/typescript-conventions.md](../../docs/guidelines/typescript-conventions.md) — types, anti-patterns, union types, named constants
+- [docs/guidelines/frontend-unit-testing.md](../../docs/guidelines/frontend-unit-testing.md) — Vitest, React Testing Library
+
+## Backend Guidelines
+
+- [docs/guidelines/go-conventions.md](../../docs/guidelines/go-conventions.md) — error handling, naming, testing, code style
+- [docs/guidelines/server-architecture.md](../../docs/guidelines/server-architecture.md) — Clean Architecture layers, transactions, CE/EE sharing patterns
+- [docs/guidelines/logging.md](../../docs/guidelines/logging.md) — zerolog usage, log levels, message style
+- [docs/guidelines/backend-code-reusability.md](../../docs/guidelines/backend-code-reusability.md) — how CE and EE share backend code
+
+## Package Manager
+
+- **PNPM** 10+ (for frontend)
+- **Go** 1.26.1 (for backend)
+
+## Build Commands
+
+```bash
+# Full build
+make build              # Build both client and server
+make build-client       # Build React/AngularJS frontend
+make build-server       # Build Go binary
+make build-image        # Build Docker image
+
+# Development
+make dev                # Run both in dev mode
+make dev-client         # Start webpack-dev-server (port 8999)
+make dev-server         # Run containerized Go server
+
+# Frontend
+pnpm dev            # Webpack dev server
+pnpm build          # Build frontend with webpack
+pnpm typecheck      # Run typecheck for frontend (with tsc)
+pnpm lint           # lint frontend (with eslint)
+pnpm test           # test frontend (with vitest)
+pnpm format         # format frontend (with prettier)
+
+# Testing
+make test               # All tests (backend + frontend)
+make test-server        # Backend tests only
+make lint               # Lint all code
+make format             # Format code
+```
+
+## Development Servers
+
+- Frontend: http://localhost:8999
+- Backend: http://localhost:9000 (HTTP) / https://localhost:9443 (HTTPS)

Makefile

@@ -4,7 +4,8 @@ WEBPACK_CONFIG=webpack/webpack.$(ENV).js
 TAG=local
 
 SWAG=go run github.com/swaggo/swag/cmd/swag@v1.16.2
-GOTESTSUM=go run gotest.tools/gotestsum@latest
+GOTESTSUM_VERSION?=v1.13.0
+GOTESTSUM=go run gotest.tools/gotestsum@$(GOTESTSUM_VERSION)
 
 # Don't change anything below this line unless you know what you're doing
 .DEFAULT_GOAL := help
@@ -57,8 +58,10 @@ test: test-server test-client ## Run all tests
 test-client: ## Run client tests
 	pnpm run test $(ARGS) --coverage
 
+TEST_PACKAGES?=./...
+
 test-server:	## Run server tests
-	$(GOTESTSUM) --format pkgname-and-test-fails --format-hide-empty-pkg --hide-summary skipped -- -cover -covermode=atomic -coverprofile=coverage.out ./...
+	$(GOTESTSUM) --format pkgname-and-test-fails --format-hide-empty-pkg --hide-summary skipped -- -cover -covermode=atomic -coverprofile=coverage.out $(TEST_PACKAGES)
 
 ##@ Dev
 .PHONY: dev dev-client dev-server
@@ -112,6 +115,13 @@ docs-validate: docs-build ## Validate docs
 	pnpm swagger2openapi --warnOnly dist/docs/swagger.yaml -o dist/docs/openapi.yaml
 	pnpm swagger-cli validate dist/docs/openapi.yaml
 
+.PHONY: docs-serve
+docs-serve: docs-build ## Serve docs locally with Swagger UI on port 8080
+	docker run -p 8080:8080 \
+		-e SWAGGER_JSON=/foo/swagger.yaml \
+		-v $(PWD)/dist/docs:/foo \
+		swaggerapi/swagger-ui
+
 ##@ Helpers
 .PHONY: help
 help:  ## Display this help

SECURITY.md

@@ -4,13 +4,13 @@
 
 Portainer maintains both Short-Term Support (STS) and Long-Term Support (LTS) versions in accordance with our official [Portainer Lifecycle Policy](https://docs.portainer.io/start/lifecycle).
 
-| Version Type | Support Status |
-| --- | --- |
-| LTS (Long-Term Support) | Supported for critical security fixes |
+| Version Type             | Support Status                              |
+| ------------------------ | ------------------------------------------- |
+| LTS (Long-Term Support)  | Supported for critical security fixes       |
 | STS (Short-Term Support) | Supported until the next STS or LTS release |
-| Legacy / EOL | Not supported |
+| Legacy / EOL             | Not supported                               |
 
-For a detailed breakdown of current versions and their specific End of Life (EOL) dates, 
+For a detailed breakdown of current versions and their specific End of Life (EOL) dates,
 please refer to the [Portainer Lifecycle Policy](https://docs.portainer.io/start/lifecycle).
 
 ## Reporting a Vulnerability
@@ -21,15 +21,19 @@ The Portainer team takes the security of our products seriously. If you believe
 
 ### Disclosure Process
 
-1. **Report**: Email your findings to security@portainer.io.
+1. **Report**: You can report in one of two ways:
+
+   - **GitHub**: Use the **Report a vulnerability** button on the **Security** tab of this repository.
+
+   - **Email**: Send your findings to security@portainer.io.
 
 2. **Details**: To help us verify the issue, please include:
 
-    - A description of the vulnerability and its potential impact.
+   - A description of the vulnerability and its potential impact.
 
-    - Step-by-step instructions to reproduce the issue (e.g. proof-of-concept code, scripts, or screenshots).
+   - Step-by-step instructions to reproduce the issue (e.g. proof-of-concept code, scripts, or screenshots).
 
-    - The version of the software and the environment in which it was found.
+   - The version of the software and the environment in which it was found.
 
 3. **Acknowledge**: We will acknowledge receipt of your report and provide an initial assessment.
 
@@ -47,7 +51,6 @@ If you follow the responsible disclosure process, we will:
 
 - Give credit for the discovery (if desired) once the fix is public.
 
-
 We will make every effort to promptly address any security weaknesses. Security advisories and fixes will be published through GitHub Security Advisories and other channels as needed.
 
 Thank you for helping keep Portainer and our community secure.

api/adminmonitor/admin_monitor.go

@@ -19,24 +19,22 @@ const RedirectReasonAdminInitTimeout string = "AdminInitTimeout"
 type Monitor struct {
 	timeout           time.Duration
 	datastore         dataservices.DataStore
-	shutdownCtx       context.Context
 	cancellationFunc  context.CancelFunc
 	mu                sync.RWMutex
 	adminInitDisabled bool
 }
 
 // New creates a monitor that when started will wait for the timeout duration and then shutdown the application unless it has been initialized.
-func New(timeout time.Duration, datastore dataservices.DataStore, shutdownCtx context.Context) *Monitor {
+func New(timeout time.Duration, datastore dataservices.DataStore) *Monitor {
 	return &Monitor{
 		timeout:           timeout,
 		datastore:         datastore,
-		shutdownCtx:       shutdownCtx,
 		adminInitDisabled: false,
 	}
 }
 
-// Starts starts the monitor. Active monitor could be stopped or shuttted down by cancelling the shutdown context.
-func (m *Monitor) Start() {
+// Start starts the monitor. The monitor will stop when ctx is cancelled, or when Stop is called.
+func (m *Monitor) Start(ctx context.Context) {
 	m.mu.Lock()
 	defer m.mu.Unlock()
 
@@ -44,7 +42,7 @@ func (m *Monitor) Start() {
 		return
 	}
 
-	cancellationCtx, cancellationFunc := context.WithCancel(context.Background())
+	cancellationCtx, cancellationFunc := context.WithCancel(ctx)
 	m.cancellationFunc = cancellationFunc
 
 	go func() {
@@ -69,8 +67,6 @@ func (m *Monitor) Start() {
 			}
 		case <-cancellationCtx.Done():
 			log.Debug().Msg("canceling initialization monitor")
-		case <-m.shutdownCtx.Done():
-			log.Debug().Msg("shutting down initialization monitor")
 		}
 	}()
 }

api/adminmonitor/admin_monitor_test.go

@@ -1,8 +1,8 @@
 package adminmonitor
 
 import (
-	"context"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	portainer "github.com/portainer/portainer/api"
@@ -11,21 +11,28 @@ import (
 )
 
 func Test_stopWithoutStarting(t *testing.T) {
-	monitor := New(1*time.Minute, nil, nil)
+	t.Parallel()
+	monitor := New(1*time.Minute, nil)
 	monitor.Stop()
 }
 
 func Test_stopCouldBeCalledMultipleTimes(t *testing.T) {
-	monitor := New(1*time.Minute, nil, nil)
+	t.Parallel()
+	monitor := New(1*time.Minute, nil)
 	monitor.Stop()
 	monitor.Stop()
 }
 
 func Test_startOrStopCouldBeCalledMultipleTimesConcurrently(t *testing.T) {
-	monitor := New(1*time.Minute, nil, context.Background())
+	t.Parallel()
+	synctest.Test(t, test_startOrStopCouldBeCalledMultipleTimesConcurrently)
+}
 
-	go monitor.Start()
-	monitor.Start()
+func test_startOrStopCouldBeCalledMultipleTimesConcurrently(t *testing.T) {
+	monitor := New(1*time.Minute, nil)
+
+	go monitor.Start(t.Context())
+	monitor.Start(t.Context())
 
 	go monitor.Stop()
 	monitor.Stop()
@@ -34,8 +41,9 @@ func Test_startOrStopCouldBeCalledMultipleTimesConcurrently(t *testing.T) {
 }
 
 func Test_canStopStartedMonitor(t *testing.T) {
-	monitor := New(1*time.Minute, nil, context.Background())
-	monitor.Start()
+	t.Parallel()
+	monitor := New(1*time.Minute, nil)
+	monitor.Start(t.Context())
 	assert.NotNil(t, monitor.cancellationFunc, "cancellation function is missing in started monitor")
 
 	monitor.Stop()
@@ -43,11 +51,12 @@ func Test_canStopStartedMonitor(t *testing.T) {
 }
 
 func Test_start_shouldDisableInstanceAfterTimeout_ifNotInitialized(t *testing.T) {
+	t.Parallel()
 	timeout := 10 * time.Millisecond
 
 	datastore := i.NewDatastore(i.WithUsers([]portainer.User{}))
-	monitor := New(timeout, datastore, context.Background())
-	monitor.Start()
+	monitor := New(timeout, datastore)
+	monitor.Start(t.Context())
 
 	<-time.After(20 * timeout)
 	assert.True(t, monitor.WasInstanceDisabled(), "monitor should have been timeout and instance is disabled")

api/apikey/apikey_test.go

@@ -7,6 +7,7 @@ import (
 )
 
 func Test_generateRandomKey(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	tests := []struct {

api/apikey/cache.go

@@ -71,7 +71,7 @@ func (c *ApiKeyCache[T]) InvalidateUserKeyCache(userId portainer.UserID) bool {
 	for _, k := range c.cache.Keys() {
 		user, _, _ := c.Get(k.(string))
 		if c.userCmpFn(user, userId) {
-			present = c.cache.Remove(k)
+			present = c.cache.Remove(k) || present
 		}
 	}
 

api/apikey/cache_test.go

@@ -8,6 +8,7 @@ import (
 )
 
 func Test_apiKeyCacheGet(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	keyCache := NewAPIKeyCache(10, compareUser)
@@ -43,6 +44,7 @@ func Test_apiKeyCacheGet(t *testing.T) {
 }
 
 func Test_apiKeyCacheSet(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	keyCache := NewAPIKeyCache(10, compareUser)
@@ -68,6 +70,7 @@ func Test_apiKeyCacheSet(t *testing.T) {
 }
 
 func Test_apiKeyCacheDelete(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	keyCache := NewAPIKeyCache(10, compareUser)
@@ -87,6 +90,7 @@ func Test_apiKeyCacheDelete(t *testing.T) {
 }
 
 func Test_apiKeyCacheLRU(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	tests := []struct {
@@ -148,6 +152,7 @@ func Test_apiKeyCacheLRU(t *testing.T) {
 }
 
 func Test_apiKeyCacheInvalidateUserKeyCache(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	keyCache := NewAPIKeyCache(10, compareUser)

api/apikey/service_test.go

@@ -17,11 +17,13 @@ import (
 )
 
 func Test_SatisfiesAPIKeyServiceInterface(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 	is.Implements((*APIKeyService)(nil), NewAPIKeyService(nil, nil))
 }
 
 func Test_GenerateApiKey(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -75,6 +77,7 @@ func Test_GenerateApiKey(t *testing.T) {
 }
 
 func Test_GetAPIKey(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -94,6 +97,7 @@ func Test_GetAPIKey(t *testing.T) {
 }
 
 func Test_GetAPIKeys(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -114,6 +118,7 @@ func Test_GetAPIKeys(t *testing.T) {
 }
 
 func Test_GetDigestUserAndKey(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -149,6 +154,7 @@ func Test_GetDigestUserAndKey(t *testing.T) {
 }
 
 func Test_UpdateAPIKey(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -197,6 +203,7 @@ func Test_UpdateAPIKey(t *testing.T) {
 }
 
 func Test_DeleteAPIKey(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)
@@ -237,6 +244,7 @@ func Test_DeleteAPIKey(t *testing.T) {
 }
 
 func Test_InvalidateUserKeyCache(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	_, store := datastore.MustNewTestStore(t, true, true)

api/archive/targz.go

@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/portainer/portainer/api/filesystem"
 	"github.com/portainer/portainer/api/logs"
 )
 
@@ -108,7 +109,7 @@ func ExtractTarGz(r io.Reader, outputDirPath string) error {
 		case tar.TypeDir:
 			// skip, dir will be created with a file
 		case tar.TypeReg:
-			p := filepath.Clean(filepath.Join(outputDirPath, header.Name))
+			p := filesystem.JoinPaths(outputDirPath, header.Name)
 			if err := os.MkdirAll(filepath.Dir(p), 0o744); err != nil {
 				return fmt.Errorf("Failed to extract dir %s", filepath.Dir(p))
 			}

api/archive/targz_test.go

@@ -1,12 +1,14 @@
 package archive
 
 import (
+	"archive/tar"
+	"compress/gzip"
 	"os"
 	"os/exec"
-	"path"
 	"path/filepath"
 	"testing"
 
+	"github.com/portainer/portainer/api/filesystem"
 	"github.com/rs/zerolog/log"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -31,24 +33,25 @@ func listFiles(dir string) []string {
 }
 
 func Test_shouldCreateArchive(t *testing.T) {
+	t.Parallel()
 	tmpdir := t.TempDir()
 	content := []byte("content")
 
-	err := os.WriteFile(path.Join(tmpdir, "outer"), content, 0600)
+	err := os.WriteFile(filesystem.JoinPaths(tmpdir, "outer"), content, 0600)
 	require.NoError(t, err)
 
-	err = os.MkdirAll(path.Join(tmpdir, "dir"), 0700)
+	err = os.MkdirAll(filesystem.JoinPaths(tmpdir, "dir"), 0700)
 	require.NoError(t, err)
 
-	err = os.WriteFile(path.Join(tmpdir, "dir", ".dotfile"), content, 0600)
+	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", ".dotfile"), content, 0600)
 	require.NoError(t, err)
 
-	err = os.WriteFile(path.Join(tmpdir, "dir", "inner"), content, 0600)
+	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", "inner"), content, 0600)
 	require.NoError(t, err)
 
 	gzPath, err := TarGzDir(tmpdir)
 	require.NoError(t, err)
-	assert.Equal(t, filepath.Join(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
+	assert.Equal(t, filesystem.JoinPaths(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
 
 	extractionDir := t.TempDir()
 	cmd := exec.Command("tar", "-xzf", gzPath, "-C", extractionDir)
@@ -58,7 +61,7 @@ func Test_shouldCreateArchive(t *testing.T) {
 	extractedFiles := listFiles(extractionDir)
 
 	wasExtracted := func(p string) {
-		fullpath := path.Join(extractionDir, p)
+		fullpath := filesystem.JoinPaths(extractionDir, p)
 		assert.Contains(t, extractedFiles, fullpath)
 		copyContent, err := os.ReadFile(fullpath)
 		require.NoError(t, err)
@@ -71,24 +74,25 @@ func Test_shouldCreateArchive(t *testing.T) {
 }
 
 func Test_shouldCreateArchive2(t *testing.T) {
+	t.Parallel()
 	tmpdir := t.TempDir()
 	content := []byte("content")
 
-	err := os.WriteFile(path.Join(tmpdir, "outer"), content, 0600)
+	err := os.WriteFile(filesystem.JoinPaths(tmpdir, "outer"), content, 0600)
 	require.NoError(t, err)
 
-	err = os.MkdirAll(path.Join(tmpdir, "dir"), 0700)
+	err = os.MkdirAll(filesystem.JoinPaths(tmpdir, "dir"), 0700)
 	require.NoError(t, err)
 
-	err = os.WriteFile(path.Join(tmpdir, "dir", ".dotfile"), content, 0600)
+	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", ".dotfile"), content, 0600)
 	require.NoError(t, err)
 
-	err = os.WriteFile(path.Join(tmpdir, "dir", "inner"), content, 0600)
+	err = os.WriteFile(filesystem.JoinPaths(tmpdir, "dir", "inner"), content, 0600)
 	require.NoError(t, err)
 
 	gzPath, err := TarGzDir(tmpdir)
 	require.NoError(t, err)
-	assert.Equal(t, filepath.Join(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
+	assert.Equal(t, filesystem.JoinPaths(tmpdir, filepath.Base(tmpdir)+".tar.gz"), gzPath)
 
 	extractionDir := t.TempDir()
 	r, _ := os.Open(gzPath)
@@ -98,7 +102,7 @@ func Test_shouldCreateArchive2(t *testing.T) {
 	extractedFiles := listFiles(extractionDir)
 
 	wasExtracted := func(p string) {
-		fullpath := path.Join(extractionDir, p)
+		fullpath := filesystem.JoinPaths(extractionDir, p)
 		assert.Contains(t, extractedFiles, fullpath)
 		copyContent, _ := os.ReadFile(fullpath)
 		assert.Equal(t, content, copyContent)
@@ -108,3 +112,57 @@ func Test_shouldCreateArchive2(t *testing.T) {
 	wasExtracted("dir/inner")
 	wasExtracted("dir/.dotfile")
 }
+
+func TestExtractTarGzPathTraversal(t *testing.T) {
+	t.Parallel()
+	testDir := t.TempDir()
+
+	// Create an evil file with a path traversal attempt
+	tarPath := filesystem.JoinPaths(testDir, "evil.tar.gz")
+
+	evilFile, err := os.Create(tarPath)
+	require.NoError(t, err)
+
+	gzWriter := gzip.NewWriter(evilFile)
+	tarWriter := tar.NewWriter(gzWriter)
+
+	content := []byte("evil content")
+
+	header := &tar.Header{
+		Name:     "../evil.txt",
+		Mode:     0600,
+		Size:     int64(len(content)),
+		Typeflag: tar.TypeReg,
+	}
+
+	err = tarWriter.WriteHeader(header)
+	require.NoError(t, err)
+
+	_, err = tarWriter.Write(content)
+	require.NoError(t, err)
+
+	err = tarWriter.Close()
+	require.NoError(t, err)
+
+	err = gzWriter.Close()
+	require.NoError(t, err)
+
+	err = evilFile.Close()
+	require.NoError(t, err)
+
+	// Attempt to extract the evil file
+	extractionDir := filesystem.JoinPaths(testDir, "extraction")
+	err = os.Mkdir(extractionDir, 0700)
+	require.NoError(t, err)
+
+	tarFile, err := os.Open(tarPath)
+	require.NoError(t, err)
+
+	// Check that the file didn't escape
+	err = ExtractTarGz(tarFile, extractionDir)
+	require.NoError(t, err)
+	require.NoFileExists(t, filesystem.JoinPaths(testDir, "evil.txt"))
+
+	err = tarFile.Close()
+	require.NoError(t, err)
+}

api/archive/zip_test.go

@@ -1,14 +1,16 @@
 package archive
 
 import (
-	"path/filepath"
 	"testing"
 
+	"github.com/portainer/portainer/api/filesystem"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func TestUnzipFile(t *testing.T) {
+	t.Parallel()
 	dir := t.TempDir()
 	/*
 		Archive structure.
@@ -23,8 +25,8 @@ func TestUnzipFile(t *testing.T) {
 
 	require.NoError(t, err)
 	archiveDir := dir + "/sample_archive"
-	assert.FileExists(t, filepath.Join(archiveDir, "0.txt"))
-	assert.FileExists(t, filepath.Join(archiveDir, "0", "1.txt"))
-	assert.FileExists(t, filepath.Join(archiveDir, "0", "1", "2.txt"))
+	assert.FileExists(t, filesystem.JoinPaths(archiveDir, "0.txt"))
+	assert.FileExists(t, filesystem.JoinPaths(archiveDir, "0", "1.txt"))
+	assert.FileExists(t, filesystem.JoinPaths(archiveDir, "0", "1", "2.txt"))
 
 }

api/aws/ecr/parse_endpoints_test.go

@@ -5,6 +5,7 @@ import (
 )
 
 func TestParseECREndpoint(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name      string
 		url       string

api/chisel/crypto/crypto_test.go

@@ -6,6 +6,7 @@ import (
 )
 
 func TestGenerateGo119CompatibleKey(t *testing.T) {
+	t.Parallel()
 	type args struct {
 		seed string
 	}

api/chisel/service.go

@@ -11,6 +11,7 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices"
 	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/pkg/schedule"
 
 	chserver "github.com/jpillora/chisel/server"
 	"github.com/jpillora/chisel/share/ccrypto"
@@ -233,23 +234,13 @@ func (service *Service) startTunnelVerificationLoop() {
 		Float64("check_interval_seconds", tunnelCleanupInterval.Seconds()).
 		Msg("starting tunnel management process")
 
-	ticker := time.NewTicker(tunnelCleanupInterval)
+	schedule.RunOnInterval(service.shutdownCtx, tunnelCleanupInterval, service.checkTunnels, func() {
+		log.Debug().Msg("shutting down tunnel service")
 
-	for {
-		select {
-		case <-ticker.C:
-			service.checkTunnels()
-		case <-service.shutdownCtx.Done():
-			log.Debug().Msg("shutting down tunnel service")
-
-			if err := service.StopTunnelServer(); err != nil {
-				log.Debug().Err(err).Msg("stopped tunnel service")
-			}
-
-			ticker.Stop()
-			return
+		if err := service.StopTunnelServer(); err != nil {
+			log.Debug().Err(err).Msg("stopped tunnel service")
 		}
-	}
+	})
 }
 
 // checkTunnels finds the first tunnel that has not had any activity recently

api/chisel/service_test.go

@@ -1,7 +1,6 @@
 package chisel
 
 import (
-	"context"
 	"net"
 	"net/http"
 	"testing"
@@ -19,6 +18,7 @@ func init() {
 }
 
 func TestPingAgentPanic(t *testing.T) {
+	t.Parallel()
 	endpoint := &portainer.Endpoint{
 		ID:          1,
 		EdgeID:      "test-edge-id",
@@ -26,7 +26,7 @@ func TestPingAgentPanic(t *testing.T) {
 		UserTrusted: true,
 	}
 
-	_, store := datastore.MustNewTestStore(t, true, true)
+	_, store := datastore.MustNewTestStore(t, false, true)
 
 	s := NewService(store, nil, nil)
 
@@ -54,6 +54,6 @@ func TestPingAgentPanic(t *testing.T) {
 	s.activeTunnels[endpoint.ID].Port = ln.Addr().(*net.TCPAddr).Port
 
 	require.Error(t, s.pingAgent(endpoint.ID))
-	require.NoError(t, srv.Shutdown(context.Background()))
+	require.NoError(t, srv.Shutdown(t.Context()))
 	require.ErrorIs(t, <-errCh, http.ErrServerClosed)
 }

api/chisel/tunnel_test.go

@@ -28,6 +28,7 @@ func (s *testStore) Settings() dataservices.SettingsService {
 }
 
 func TestGetUnusedPort(t *testing.T) {
+	t.Parallel()
 	testCases := []struct {
 		name            string
 		existingTunnels map[portainer.EndpointID]*portainer.TunnelDetails

api/cli/cli.go

@@ -32,7 +32,7 @@ func CLIFlags() *portainer.CLIFlags {
 		Assets:                    kingpin.Flag("assets", "Path to the assets").Default(defaultAssetsDirectory).Short('a').String(),
 		Data:                      kingpin.Flag("data", "Path to the folder where the data is stored").Default(defaultDataDirectory).Short('d').String(),
 		EndpointURL:               kingpin.Flag("host", "Environment URL").Short('H').String(),
-		FeatureFlags:              kingpin.Flag("feat", "List of feature flags").Strings(),
+		FeatureFlags:              kingpin.Flag("feat", "List of feature flags").Envar(portainer.FeatureFlagEnvVar).Strings(),
 		EnableEdgeComputeFeatures: kingpin.Flag("edge-compute", "Enable Edge Compute features").Bool(),
 		NoAnalytics:               kingpin.Flag("no-analytics", "Disable Analytics in app (deprecated)").Bool(),
 		TLSSkipVerify:             kingpin.Flag("tlsskipverify", "Disable TLS server verification").Default(defaultTLSSkipVerify).Bool(),
@@ -152,11 +152,11 @@ func (Service) ParseFlags(version string) (*portainer.CLIFlags, error) {
 func (Service) ValidateFlags(flags *portainer.CLIFlags) error {
 	displayDeprecationWarnings(flags)
 
-	if err := validateEndpointURL(*flags.EndpointURL); err != nil {
+	if err := ValidateEndpointURL(*flags.EndpointURL); err != nil {
 		return err
 	}
 
-	if err := validateSnapshotInterval(*flags.SnapshotInterval); err != nil {
+	if err := ValidateSnapshotInterval(*flags.SnapshotInterval); err != nil {
 		return err
 	}
 
@@ -173,7 +173,7 @@ func displayDeprecationWarnings(flags *portainer.CLIFlags) {
 	}
 }
 
-func validateEndpointURL(endpointURL string) error {
+func ValidateEndpointURL(endpointURL string) error {
 	if endpointURL == "" {
 		return nil
 	}
@@ -198,7 +198,7 @@ func validateEndpointURL(endpointURL string) error {
 	return nil
 }
 
-func validateSnapshotInterval(snapshotInterval string) error {
+func ValidateSnapshotInterval(snapshotInterval string) error {
 	if snapshotInterval == "" {
 		return nil
 	}

api/cmd/portainer/main.go

@@ -7,6 +7,7 @@ import (
 	"os"
 	"path"
 	"strings"
+	"time"
 
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/apikey"
@@ -51,11 +52,10 @@ import (
 	"github.com/portainer/portainer/pkg/featureflags"
 	"github.com/portainer/portainer/pkg/fips"
 	"github.com/portainer/portainer/pkg/libhelm"
-	libhelmtypes "github.com/portainer/portainer/pkg/libhelm/types"
 	"github.com/portainer/portainer/pkg/libstack/compose"
 	"github.com/portainer/portainer/pkg/validate"
 
-	"github.com/gofrs/uuid"
+	"github.com/google/uuid"
 	"github.com/rs/zerolog/log"
 )
 
@@ -119,7 +119,7 @@ func initDataStore(flags *portainer.CLIFlags, secretKey []byte, fileService port
 	}
 
 	if isNew {
-		instanceId, err := uuid.NewV4()
+		instanceId, err := uuid.NewRandom()
 		if err != nil {
 			log.Fatal().Err(err).Msg("failed generating instance id")
 		}
@@ -174,10 +174,6 @@ func initKubernetesDeployer(kubernetesTokenCacheManager *kubeproxy.TokenCacheMan
 	return exec.NewKubernetesDeployer(kubernetesTokenCacheManager, kubernetesClientFactory, dataStore, reverseTunnelService, signatureService, proxyManager)
 }
 
-func initHelmPackageManager() (libhelmtypes.HelmPackageManager, error) {
-	return libhelm.NewHelmPackageManager()
-}
-
 func initAPIKeyService(datastore dataservices.DataStore) apikey.APIKeyService {
 	return apikey.NewAPIKeyService(datastore.APIKeyRepository(), datastore.User())
 }
@@ -216,13 +212,12 @@ func initSnapshotService(
 	dataStore dataservices.DataStore,
 	dockerClientFactory *dockerclient.ClientFactory,
 	kubernetesClientFactory *kubecli.ClientFactory,
-	shutdownCtx context.Context,
 	pendingActionsService *pendingactions.PendingActionsService,
 ) (portainer.SnapshotService, error) {
 	dockerSnapshotter := docker.NewSnapshotter(dockerClientFactory)
 	kubernetesSnapshotter := kubernetes.NewSnapshotter(kubernetesClientFactory)
 
-	snapshotService, err := snapshot.NewService(snapshotIntervalFromFlag, dataStore, dockerSnapshotter, kubernetesSnapshotter, shutdownCtx, pendingActionsService)
+	snapshotService, err := snapshot.NewService(snapshotIntervalFromFlag, dataStore, dockerSnapshotter, kubernetesSnapshotter, pendingActionsService)
 	if err != nil {
 		return nil, err
 	}
@@ -338,8 +333,7 @@ func loadEncryptionSecretKey(keyfilename string) []byte {
 	return hash[:]
 }
 
-func buildServer(flags *portainer.CLIFlags) portainer.Server {
-	shutdownCtx, shutdownTrigger := context.WithCancel(context.Background())
+func buildServer(flags *portainer.CLIFlags, shutdownCtx context.Context, shutdownTrigger context.CancelFunc) portainer.Server {
 
 	if flags.FeatureFlags != nil {
 		featureflags.Parse(*flags.FeatureFlags, portainer.SupportedFeatureFlags)
@@ -350,7 +344,7 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		// validate if the trusted origins are valid urls
 		for origin := range strings.SplitSeq(*flags.TrustedOrigins, ",") {
 			if !validate.IsTrustedOrigin(origin) {
-				log.Fatal().Str("trusted_origin", origin).Msg("invalid url for trusted origin. Please check the trusted origins flag.")
+				log.Fatal().Str("trusted_origin", origin).Msg("invalid trusted origin: must be scheme://host or scheme://host:port (e.g. https://example.com)")
 			}
 
 			trustedOrigins = append(trustedOrigins, origin)
@@ -461,19 +455,16 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 	pendingActionsService.RegisterHandler(actions.DeletePortainerK8sRegistrySecrets, handlers.NewHandlerDeleteRegistrySecrets(authorizationService, dataStore, kubernetesClientFactory))
 	pendingActionsService.RegisterHandler(actions.PostInitMigrateEnvironment, handlers.NewHandlerPostInitMigrateEnvironment(authorizationService, dataStore, kubernetesClientFactory, dockerClientFactory, *flags.Assets, kubernetesDeployer))
 
-	snapshotService, err := initSnapshotService(*flags.SnapshotInterval, dataStore, dockerClientFactory, kubernetesClientFactory, shutdownCtx, pendingActionsService)
+	snapshotService, err := initSnapshotService(*flags.SnapshotInterval, dataStore, dockerClientFactory, kubernetesClientFactory, pendingActionsService)
 	if err != nil {
 		log.Fatal().Err(err).Msg("failed initializing snapshot service")
 	}
 
-	snapshotService.Start()
+	snapshotService.Start(shutdownCtx)
 
 	proxyManager.NewProxyFactory(dataStore, signatureService, reverseTunnelService, dockerClientFactory, kubernetesClientFactory, kubernetesTokenCacheManager, gitService, snapshotService, jwtService)
 
-	helmPackageManager, err := initHelmPackageManager()
-	if err != nil {
-		log.Fatal().Err(err).Msg("failed initializing helm package manager")
-	}
+	helmPackageManager := libhelm.NewHelmPackageManager()
 
 	applicationStatus := initStatus(instanceID)
 
@@ -539,10 +530,7 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		log.Fatal().Msg("failed to fetch SSL settings from DB")
 	}
 
-	platformService, err := platform.NewService(dataStore)
-	if err != nil {
-		log.Fatal().Err(err).Msg("failed initializing platform service")
-	}
+	platformService := platform.NewService(dataStore)
 
 	upgradeService, err := upgrade.NewService(
 		*flags.Assets,
@@ -572,6 +560,13 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		log.Fatal().Err(err).Msg("failure during post init migrations")
 	}
 
+	if err := dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		return recoverStaleDeployingStacks(tx)
+	}); err != nil {
+		log.Info().Err(err).
+			Msg("Error recovering stale deploying stacks")
+	}
+
 	return &http.Server{
 		AuthorizationService:        authorizationService,
 		ReverseTunnelService:        reverseTunnelService,
@@ -604,7 +599,6 @@ func buildServer(flags *portainer.CLIFlags) portainer.Server {
 		DockerClientFactory:         dockerClientFactory,
 		KubernetesClientFactory:     kubernetesClientFactory,
 		Scheduler:                   scheduler,
-		ShutdownCtx:                 shutdownCtx,
 		ShutdownTrigger:             shutdownTrigger,
 		StackDeployer:               stackDeployer,
 		UpgradeService:              upgradeService,
@@ -626,7 +620,8 @@ func main() {
 	logs.SetLoggingMode(*flags.LogMode)
 
 	for {
-		server := buildServer(flags)
+		shutdownCtx, shutdownTrigger := context.WithCancel(context.Background())
+		server := buildServer(flags, shutdownCtx, shutdownTrigger)
 
 		log.Info().
 			Str("version", portainer.APIVersion).
@@ -638,8 +633,44 @@ func main() {
 			Str("go_version", build.GoVersion).
 			Msg("starting Portainer")
 
-		err := server.Start()
+		err := server.Start(shutdownCtx)
 
 		log.Info().Err(err).Msg("HTTP server exited")
 	}
 }
+
+// recoverStaleDeployingStacks resets any stack that was left in the Deploying state
+// (e.g. because the server was restarted mid-deployment) to the Error state so the
+// user can retry.
+func recoverStaleDeployingStacks(tx dataservices.DataStoreTx) error {
+	stacks, err := tx.Stack().ReadAll(func(s portainer.Stack) bool {
+		return s.Status == portainer.StackStatusDeploying
+	})
+	if err != nil {
+		return err
+	}
+
+	for _, stack := range stacks {
+		stack.Status = portainer.StackStatusError
+		stack.DeploymentStatus = append(stack.DeploymentStatus, portainer.StackDeploymentStatus{
+			Status:  portainer.StackStatusError,
+			Time:    time.Now().Unix(),
+			Message: "Deployment interrupted by server restart",
+		})
+
+		if err := tx.Stack().Update(stack.ID, &stack); err != nil {
+			log.Warn().Err(err).
+				Int("stack_id", int(stack.ID)).
+				Str("context", "RecoverStaleDeployingStacks").
+				Msg("Unable to recover stale deploying stack")
+			continue
+		}
+		log.Debug().
+			Int("stack_id", int(stack.ID)).
+			Str("stack_name", stack.Name).
+			Str("context", "RecoverStaleDeployingStacks").
+			Msg("Recovered stale deploying stack to error state")
+	}
+
+	return nil
+}

api/cmd/portainer/main_test.go

@@ -2,9 +2,10 @@ package main
 
 import (
 	"os"
-	"path"
 	"testing"
 
+	"github.com/portainer/portainer/api/filesystem"
+
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -18,8 +19,9 @@ func createPasswordFile(t *testing.T, secretPath, password string) string {
 }
 
 func TestLoadEncryptionSecretKey(t *testing.T) {
+	t.Parallel()
 	tempDir := t.TempDir()
-	secretPath := path.Join(tempDir, secretFileName)
+	secretPath := filesystem.JoinPaths(tempDir, secretFileName)
 
 	// first pointing to file that does not exist, gives nil hash (no encryption)
 	encryptionKey := loadEncryptionSecretKey(secretPath)
@@ -39,6 +41,7 @@ func TestLoadEncryptionSecretKey(t *testing.T) {
 }
 
 func TestDBSecretPath(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		keyFilenameFlag string
 		expected        string

api/crypto/aes_test.go

@@ -6,9 +6,9 @@ import (
 	"io"
 	"math/rand"
 	"os"
-	"path/filepath"
 	"testing"
 
+	"github.com/portainer/portainer/api/filesystem"
 	"github.com/portainer/portainer/api/logs"
 	"github.com/portainer/portainer/pkg/fips"
 
@@ -42,9 +42,9 @@ func Test_encryptAndDecrypt_withTheSamePassword(t *testing.T) {
 		tmpdir := t.TempDir()
 
 		var (
-			originFilePath    = filepath.Join(tmpdir, "origin")
-			encryptedFilePath = filepath.Join(tmpdir, "encrypted")
-			decryptedFilePath = filepath.Join(tmpdir, "decrypted")
+			originFilePath    = filesystem.JoinPaths(tmpdir, "origin")
+			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted")
+			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted")
 		)
 
 		content := randBytes(1024*1024*100 + 523)
@@ -141,15 +141,16 @@ func Test_encryptAndDecrypt_withTheSamePassword(t *testing.T) {
 }
 
 func Test_encryptAndDecrypt_withStrongPassphrase(t *testing.T) {
+	t.Parallel()
 	const passphrase = "A strong passphrase with special characters: !@#$%^&*()_+"
 
 	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
 		tmpdir := t.TempDir()
 
 		var (
-			originFilePath    = filepath.Join(tmpdir, "origin2")
-			encryptedFilePath = filepath.Join(tmpdir, "encrypted2")
-			decryptedFilePath = filepath.Join(tmpdir, "decrypted2")
+			originFilePath    = filesystem.JoinPaths(tmpdir, "origin2")
+			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted2")
+			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted2")
 		)
 
 		content := randBytes(500)
@@ -200,13 +201,14 @@ func Test_encryptAndDecrypt_withStrongPassphrase(t *testing.T) {
 }
 
 func Test_encryptAndDecrypt_withTheSamePasswordSmallFile(t *testing.T) {
+	t.Parallel()
 	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
 		tmpdir := t.TempDir()
 
 		var (
-			originFilePath    = filepath.Join(tmpdir, "origin2")
-			encryptedFilePath = filepath.Join(tmpdir, "encrypted2")
-			decryptedFilePath = filepath.Join(tmpdir, "decrypted2")
+			originFilePath    = filesystem.JoinPaths(tmpdir, "origin2")
+			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted2")
+			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted2")
 		)
 
 		content := randBytes(500)
@@ -257,13 +259,14 @@ func Test_encryptAndDecrypt_withTheSamePasswordSmallFile(t *testing.T) {
 }
 
 func Test_encryptAndDecrypt_withEmptyPassword(t *testing.T) {
+	t.Parallel()
 	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
 		tmpdir := t.TempDir()
 
 		var (
-			originFilePath    = filepath.Join(tmpdir, "origin")
-			encryptedFilePath = filepath.Join(tmpdir, "encrypted")
-			decryptedFilePath = filepath.Join(tmpdir, "decrypted")
+			originFilePath    = filesystem.JoinPaths(tmpdir, "origin")
+			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted")
+			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted")
 		)
 
 		content := randBytes(1024 * 50)
@@ -314,13 +317,14 @@ func Test_encryptAndDecrypt_withEmptyPassword(t *testing.T) {
 }
 
 func Test_decryptWithDifferentPassphrase_shouldProduceWrongResult(t *testing.T) {
+	t.Parallel()
 	testFunc := func(t *testing.T, encrypt encryptFunc, decrypt decryptFunc) {
 		tmpdir := t.TempDir()
 
 		var (
-			originFilePath    = filepath.Join(tmpdir, "origin")
-			encryptedFilePath = filepath.Join(tmpdir, "encrypted")
-			decryptedFilePath = filepath.Join(tmpdir, "decrypted")
+			originFilePath    = filesystem.JoinPaths(tmpdir, "origin")
+			encryptedFilePath = filesystem.JoinPaths(tmpdir, "encrypted")
+			decryptedFilePath = filesystem.JoinPaths(tmpdir, "decrypted")
 		)
 
 		content := randBytes(1034)
@@ -385,6 +389,7 @@ func legacyAesEncrypt(input io.Reader, output io.Writer, passphrase []byte) erro
 }
 
 func Test_hasEncryptedHeader(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name     string
 		data     []byte

api/crypto/ecdsa_test.go

@@ -7,6 +7,7 @@ import (
 )
 
 func TestCreateSignature(t *testing.T) {
+	t.Parallel()
 	var s = NewECDSAService("secret")
 
 	privKey, pubKey, err := s.GenerateKeyPair()

api/crypto/hash_test.go

@@ -7,6 +7,7 @@ import (
 )
 
 func TestService_Hash(t *testing.T) {
+	t.Parallel()
 	var s = Service{}
 
 	type args struct {
@@ -55,6 +56,7 @@ func TestService_Hash(t *testing.T) {
 }
 
 func TestHash(t *testing.T) {
+	t.Parallel()
 	s := Service{}
 
 	hash, err := s.Hash("Passw0rd!")

api/crypto/tls.go

@@ -92,7 +92,9 @@ func CreateTLSConfigurationFromDisk(config portainer.TLSConfiguration) (*tls.Con
 }
 
 func createTLSConfigurationFromDisk(fipsEnabled bool, config portainer.TLSConfiguration) (*tls.Config, error) { //nolint:forbidigo
-	if !config.TLS {
+	if !config.TLS && fipsEnabled {
+		return nil, fips.ErrTLSRequired
+	} else if !config.TLS {
 		return nil, nil
 	}
 

api/crypto/tls_test.go

@@ -10,6 +10,7 @@ import (
 )
 
 func TestCreateTLSConfiguration(t *testing.T) {
+	t.Parallel()
 	// InsecureSkipVerify = false
 	config := CreateTLSConfiguration(false)
 	require.Equal(t, config.MinVersion, uint16(tls.VersionTLS12)) //nolint:forbidigo
@@ -22,6 +23,7 @@ func TestCreateTLSConfiguration(t *testing.T) {
 }
 
 func TestCreateTLSConfigurationFIPS(t *testing.T) {
+	t.Parallel()
 	fips := true
 
 	fipsCipherSuites := []uint16{
@@ -42,6 +44,7 @@ func TestCreateTLSConfigurationFIPS(t *testing.T) {
 }
 
 func TestCreateTLSConfigurationFromBytes(t *testing.T) {
+	t.Parallel()
 	// No TLS
 	config, err := CreateTLSConfigurationFromBytes(false, nil, nil, nil, false, false)
 	require.NoError(t, err)
@@ -59,6 +62,7 @@ func TestCreateTLSConfigurationFromBytes(t *testing.T) {
 }
 
 func TestCreateTLSConfigurationFromDisk(t *testing.T) {
+	t.Parallel()
 	// No TLS
 	config, err := CreateTLSConfigurationFromDisk(portainer.TLSConfiguration{})
 	require.NoError(t, err)
@@ -74,6 +78,7 @@ func TestCreateTLSConfigurationFromDisk(t *testing.T) {
 }
 
 func TestCreateTLSConfigurationFromDiskFIPS(t *testing.T) {
+	t.Parallel()
 	fips := true
 
 	// Skipping TLS verifications cannot be done in FIPS mode

api/database/boltdb/db_test.go

@@ -2,7 +2,6 @@ package boltdb
 
 import (
 	"os"
-	"path"
 	"testing"
 
 	"github.com/portainer/portainer/api/filesystem"
@@ -13,6 +12,7 @@ import (
 )
 
 func Test_NeedsEncryptionMigration(t *testing.T) {
+	t.Parallel()
 	// Test the specific scenarios mentioned in NeedsEncryptionMigration
 
 	// i.e.
@@ -96,7 +96,7 @@ func Test_NeedsEncryptionMigration(t *testing.T) {
 
 			if tc.dbname == "both" {
 				// Special case.  If portainer.db and portainer.edb exist.
-				dbFile1 := path.Join(connection.Path, DatabaseFileName)
+				dbFile1 := filesystem.JoinPaths(connection.Path, DatabaseFileName)
 				f, _ := os.Create(dbFile1)
 
 				err := f.Close()
@@ -107,7 +107,7 @@ func Test_NeedsEncryptionMigration(t *testing.T) {
 					require.NoError(t, err)
 				}()
 
-				dbFile2 := path.Join(connection.Path, EncryptedDatabaseFileName)
+				dbFile2 := filesystem.JoinPaths(connection.Path, EncryptedDatabaseFileName)
 				f, _ = os.Create(dbFile2)
 
 				err = f.Close()
@@ -118,7 +118,7 @@ func Test_NeedsEncryptionMigration(t *testing.T) {
 					require.NoError(t, err)
 				}()
 			} else if tc.dbname != "" {
-				dbFile := path.Join(connection.Path, tc.dbname)
+				dbFile := filesystem.JoinPaths(connection.Path, tc.dbname)
 				f, _ := os.Create(dbFile)
 
 				err := f.Close()
@@ -143,6 +143,7 @@ func Test_NeedsEncryptionMigration(t *testing.T) {
 }
 
 func TestDBCompaction(t *testing.T) {
+	t.Parallel()
 	db := &DbConnection{Path: t.TempDir()}
 
 	err := db.Open()

api/database/boltdb/json.go

@@ -45,12 +45,12 @@ func (connection *DbConnection) UnmarshalObject(data []byte, object any) error {
 		}
 	}
 
-	if e := json.Unmarshal(data, object); e != nil {
+	if err := json.Unmarshal(data, object); err != nil {
 		// Special case for the VERSION bucket. Here we're not using json
 		// So we need to return it as a string
 		s, ok := object.(*string)
 		if !ok {
-			return errors.Wrap(err, e.Error())
+			return errors.Wrap(err, "Failed unmarshalling object")
 		}
 
 		*s = string(data)

api/database/boltdb/json_test.go

@@ -10,7 +10,7 @@ import (
 	"io"
 	"testing"
 
-	"github.com/gofrs/uuid"
+	"github.com/google/uuid"
 	"github.com/pkg/errors"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
@@ -27,9 +27,10 @@ func secretToEncryptionKey(passphrase string) []byte {
 }
 
 func Test_MarshalObjectUnencrypted(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
-	uuid := uuid.Must(uuid.NewV4())
+	uuid := uuid.New()
 
 	tests := []struct {
 		object   any
@@ -101,6 +102,7 @@ func Test_MarshalObjectUnencrypted(t *testing.T) {
 }
 
 func Test_UnMarshalObjectUnencrypted(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	// Based on actual data entering and what we expect out of the function
@@ -142,6 +144,7 @@ func Test_UnMarshalObjectUnencrypted(t *testing.T) {
 }
 
 func Test_ObjectMarshallingEncrypted(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	// Based on actual data entering and what we expect out of the function
@@ -184,6 +187,7 @@ func Test_ObjectMarshallingEncrypted(t *testing.T) {
 }
 
 func Test_NonceSources(t *testing.T) {
+	t.Parallel()
 	// ensure that the new go 1.24 NewGCMWithRandomNonce works correctly with
 	// the old way of creating and including the nonce
 

api/database/boltdb/tx_test.go

@@ -18,6 +18,7 @@ type testStruct struct {
 }
 
 func TestTxs(t *testing.T) {
+	t.Parallel()
 	conn := DbConnection{Path: t.TempDir()}
 
 	err := conn.Open()

api/database/database_test.go

@@ -10,6 +10,7 @@ import (
 )
 
 func TestNewDatabase(t *testing.T) {
+	t.Parallel()
 	dbPath := filesystem.JoinPaths(t.TempDir(), "test.db")
 	connection, err := NewDatabase("boltdb", dbPath, nil, false)
 	require.NoError(t, err)

api/dataservices/base_test.go

@@ -51,6 +51,7 @@ func (m mockConnection) ConvertToKey(v int) []byte {
 	return []byte(strconv.Itoa(v))
 }
 func TestReadAll(t *testing.T) {
+	t.Parallel()
 	service := BaseDataService[testObject, int]{
 		Bucket:     "testBucket",
 		Connection: mockConnection{store: make(map[int]testObject)},

api/dataservices/customtemplate/customtemplate_test.go

@@ -9,7 +9,8 @@ import (
 )
 
 func TestCustomTemplateCreate(t *testing.T) {
-	_, ds := datastore.MustNewTestStore(t, true, false)
+	t.Parallel()
+	_, ds := datastore.MustNewTestStore(t, false, false)
 	require.NotNil(t, ds)
 
 	require.NoError(t, ds.CustomTemplate().Create(&portainer.CustomTemplate{ID: 1}))

api/dataservices/customtemplate/tx_test.go

@@ -10,7 +10,8 @@ import (
 )
 
 func TestCustomTemplateCreateTx(t *testing.T) {
-	_, ds := datastore.MustNewTestStore(t, true, false)
+	t.Parallel()
+	_, ds := datastore.MustNewTestStore(t, false, false)
 	require.NotNil(t, ds)
 
 	require.NoError(t, ds.UpdateTx(func(tx dataservices.DataStoreTx) error {

api/dataservices/edgestack/edgestack_test.go

@@ -11,6 +11,7 @@ import (
 )
 
 func TestUpdate(t *testing.T) {
+	t.Parallel()
 	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
 	err := conn.Open()
 	require.NoError(t, err)

api/dataservices/endpoint/endpoint.go

@@ -119,6 +119,19 @@ func (service *Service) Endpoints() ([]portainer.Endpoint, error) {
 	return endpoints, nil
 }
 
+// ReadAll retrieves all the elements that satisfy all the provided predicates.
+func (service *Service) ReadAll(predicates ...func(endpoint portainer.Endpoint) bool) ([]portainer.Endpoint, error) {
+	var endpoints []portainer.Endpoint
+	var err error
+
+	err = service.connection.ViewTx(func(tx portainer.Transaction) error {
+		endpoints, err = service.Tx(tx).ReadAll(predicates...)
+		return err
+	})
+
+	return endpoints, err
+}
+
 // EndpointIDByEdgeID returns the EndpointID from the given EdgeID using an in-memory index
 func (service *Service) EndpointIDByEdgeID(edgeID string) (portainer.EndpointID, bool) {
 	service.mu.RLock()

api/dataservices/endpoint/tx.go

@@ -89,6 +89,11 @@ func (service ServiceTx) Endpoints() ([]portainer.Endpoint, error) {
 	)
 }
 
+// ReadAll retrieves all the elements that satisfy all the provided predicates.
+func (service ServiceTx) ReadAll(predicates ...func(endpoint portainer.Endpoint) bool) ([]portainer.Endpoint, error) {
+	return dataservices.BaseDataServiceTx[portainer.Endpoint, portainer.EndpointID]{Bucket: BucketName, Connection: service.service.connection, Tx: service.tx}.ReadAll(predicates...)
+}
+
 func (service ServiceTx) EndpointIDByEdgeID(edgeID string) (portainer.EndpointID, bool) {
 	log.Error().Str("func", "EndpointIDByEdgeID").Msg("cannot be called inside a transaction")
 

api/dataservices/endpointrelation/endpointrelation.go

@@ -28,6 +28,9 @@ func (service *Service) BucketName() string {
 func (service *Service) RegisterUpdateStackFunction(
 	updateFuncTx func(portainer.Transaction, portainer.EdgeStackID, func(*portainer.EdgeStack)) error,
 ) {
+	service.mu.Lock()
+	defer service.mu.Unlock()
+
 	service.updateStackFnTx = updateFuncTx
 }
 

api/dataservices/endpointrelation/endpointrelation_test.go

@@ -13,6 +13,7 @@ import (
 )
 
 func TestUpdateRelation(t *testing.T) {
+	t.Parallel()
 	const endpointID = 1
 	const edgeStackID1 = 1
 	const edgeStackID2 = 2
@@ -106,6 +107,7 @@ func TestUpdateRelation(t *testing.T) {
 }
 
 func TestAddEndpointRelationsForEdgeStack(t *testing.T) {
+	t.Parallel()
 	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
 	err := conn.Open()
 	require.NoError(t, err)
@@ -125,6 +127,7 @@ func TestAddEndpointRelationsForEdgeStack(t *testing.T) {
 }
 
 func TestEndpointRelations(t *testing.T) {
+	t.Parallel()
 	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
 	err := conn.Open()
 	require.NoError(t, err)

api/dataservices/errors/errors.go

@@ -6,7 +6,7 @@ import (
 
 var (
 	ErrObjectNotFound     = errors.New("object not found inside the database")
-	ErrWrongDBEdition     = errors.New("the Portainer database is set for Portainer Business Edition, please follow the instructions in our documentation to downgrade it: https://documentation.portainer.io/v2.0-be/downgrade/be-to-ce/")
+	ErrWrongDBEdition     = errors.New("the Portainer database is set for Portainer Business Edition, please follow the instructions in our documentation to downgrade it: https://docs.portainer.io/faqs/upgrading/can-i-downgrade-from-portainer-business-to-portainer-ce")
 	ErrDBImportFailed     = errors.New("importing backup failed")
 	ErrDatabaseIsUpdating = errors.New("database is currently in updating state. Failed prior upgrade. Please restore from backup or delete the database and restart Portainer")
 )

api/dataservices/interface.go

@@ -102,6 +102,9 @@ type (
 
 	// EndpointService represents a service for managing environment(endpoint) data
 	EndpointService interface {
+		// partial dataservices.BaseCRUD[portainer.Endpoint, portainer.EndpointID]
+		ReadAll(predicates ...func(endpoint portainer.Endpoint) bool) ([]portainer.Endpoint, error)
+
 		Endpoint(ID portainer.EndpointID) (*portainer.Endpoint, error)
 		EndpointIDByEdgeID(edgeID string) (portainer.EndpointID, bool)
 		EndpointsByTeamID(teamID portainer.TeamID) ([]portainer.Endpoint, error)

api/dataservices/pendingactions/pendingactions_test.go

@@ -10,6 +10,7 @@ import (
 )
 
 func TestDeleteByEndpoint(t *testing.T) {
+	t.Parallel()
 	_, store := datastore.MustNewTestStore(t, false, false)
 
 	// Create Endpoint 1

api/dataservices/ssl/ssl.go

@@ -31,6 +31,13 @@ func NewService(connection portainer.Connection) (*Service, error) {
 	}, nil
 }
 
+func (service *Service) Tx(tx portainer.Transaction) ServiceTx {
+	return ServiceTx{
+		service: service,
+		tx:      tx,
+	}
+}
+
 // Settings retrieve the ssl settings object.
 func (service *Service) Settings() (*portainer.SSLSettings, error) {
 	var settings portainer.SSLSettings

api/dataservices/ssl/tx.go

@@ -0,0 +1,31 @@
+package ssl
+
+import (
+	portainer "github.com/portainer/portainer/api"
+)
+
+type ServiceTx struct {
+	service *Service
+	tx      portainer.Transaction
+}
+
+func (service ServiceTx) BucketName() string {
+	return BucketName
+}
+
+// Settings retrieve the settings object.
+func (service ServiceTx) Settings() (*portainer.SSLSettings, error) {
+	var settings portainer.SSLSettings
+
+	err := service.tx.GetObject(BucketName, []byte(key), &settings)
+	if err != nil {
+		return nil, err
+	}
+
+	return &settings, nil
+}
+
+// UpdateSettings persists a Settings object.
+func (service ServiceTx) UpdateSettings(settings *portainer.SSLSettings) error {
+	return service.tx.UpdateObject(BucketName, []byte(key), settings)
+}

api/dataservices/stack/tests/stack_test.go

@@ -8,13 +8,13 @@ import (
 	"github.com/portainer/portainer/api/datastore"
 	"github.com/portainer/portainer/api/filesystem"
 
-	"github.com/gofrs/uuid"
+	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func newGuidString(t *testing.T) string {
-	uuid, err := uuid.NewV4()
+	uuid, err := uuid.NewRandom()
 	require.NoError(t, err)
 
 	return uuid.String()
@@ -27,10 +27,11 @@ type stackBuilder struct {
 }
 
 func TestService_StackByWebhookID(t *testing.T) {
+	t.Parallel()
 	if testing.Short() {
 		t.Skip("skipping test in short mode. Normally takes ~1s to run.")
 	}
-	_, store := datastore.MustNewTestStore(t, true, true)
+	_, store := datastore.MustNewTestStore(t, false, true)
 
 	b := stackBuilder{t: t, store: store}
 	b.createNewStack(newGuidString(t))
@@ -84,10 +85,11 @@ func (b *stackBuilder) createNewStack(webhookID string) portainer.Stack {
 }
 
 func Test_RefreshableStacks(t *testing.T) {
+	t.Parallel()
 	if testing.Short() {
 		t.Skip("skipping test in short mode. Normally takes ~1s to run.")
 	}
-	_, store := datastore.MustNewTestStore(t, true, true)
+	_, store := datastore.MustNewTestStore(t, false, true)
 
 	staticStack := portainer.Stack{ID: 1}
 	stackWithWebhook := portainer.Stack{ID: 2, AutoUpdate: &portainer.AutoUpdateSettings{Webhook: "webhook"}}

api/dataservices/team/tests/team_test.go

@@ -3,6 +3,7 @@ package tests
 import (
 	"testing"
 
+	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/dataservices/errors"
 	"github.com/portainer/portainer/api/datastore"
 
@@ -10,9 +11,29 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
+type teamBuilder struct {
+	t     *testing.T
+	count int
+	store *datastore.Store
+}
+
+func (b *teamBuilder) createNew(name string) *portainer.Team {
+	b.count++
+	team := &portainer.Team{
+		ID:   portainer.TeamID(b.count),
+		Name: name,
+	}
+
+	err := b.store.Team().Create(team)
+	assert.NoError(b.t, err)
+
+	return team
+}
+
 func Test_teamByName(t *testing.T) {
+	t.Parallel()
 	t.Run("When store is empty should return ErrObjectNotFound", func(t *testing.T) {
-		_, store := datastore.MustNewTestStore(t, true, true)
+		_, store := datastore.MustNewTestStore(t, false, true)
 
 		_, err := store.Team().TeamByName("name")
 		require.ErrorIs(t, err, errors.ErrObjectNotFound)
@@ -20,7 +41,7 @@ func Test_teamByName(t *testing.T) {
 	})
 
 	t.Run("When there is no object with the same name should return ErrObjectNotFound", func(t *testing.T) {
-		_, store := datastore.MustNewTestStore(t, true, true)
+		_, store := datastore.MustNewTestStore(t, false, true)
 
 		teamBuilder := teamBuilder{
 			t:     t,
@@ -35,7 +56,7 @@ func Test_teamByName(t *testing.T) {
 	})
 
 	t.Run("When there is an object with the same name should return the object", func(t *testing.T) {
-		_, store := datastore.MustNewTestStore(t, true, true)
+		_, store := datastore.MustNewTestStore(t, false, true)
 
 		teamBuilder := teamBuilder{
 			t:     t,

api/dataservices/team/tests/utils.go

@@ -1,28 +0,0 @@
-package tests
-
-import (
-	"testing"
-
-	portainer "github.com/portainer/portainer/api"
-	"github.com/portainer/portainer/api/datastore"
-	"github.com/stretchr/testify/assert"
-)
-
-type teamBuilder struct {
-	t     *testing.T
-	count int
-	store *datastore.Store
-}
-
-func (b *teamBuilder) createNew(name string) *portainer.Team {
-	b.count++
-	team := &portainer.Team{
-		ID:   portainer.TeamID(b.count),
-		Name: name,
-	}
-
-	err := b.store.Team().Create(team)
-	assert.NoError(b.t, err)
-
-	return team
-}

api/datastore/backup_test.go

@@ -13,6 +13,7 @@ import (
 )
 
 func TestStoreCreation(t *testing.T) {
+	t.Parallel()
 	_, store := MustNewTestStore(t, true, true)
 	require.NotNil(t, store)
 
@@ -31,6 +32,7 @@ func TestStoreCreation(t *testing.T) {
 }
 
 func TestBackup(t *testing.T) {
+	t.Parallel()
 	_, store := MustNewTestStore(t, true, true)
 	backupFileName := store.backupFilename()
 	t.Run("Backup should create "+backupFileName, func(t *testing.T) {
@@ -52,6 +54,7 @@ func TestBackup(t *testing.T) {
 }
 
 func TestRestore(t *testing.T) {
+	t.Parallel()
 	_, store := MustNewTestStore(t, true, false)
 
 	t.Run("Basic Restore", func(t *testing.T) {
@@ -93,6 +96,7 @@ func TestRestore(t *testing.T) {
 }
 
 func TestBackupDBFile(t *testing.T) {
+	t.Parallel()
 	_, store := MustNewTestStore(t, true, false)
 
 	t.Run("creates backup file without managing connection state", func(t *testing.T) {
@@ -122,6 +126,7 @@ func TestBackupDBFile(t *testing.T) {
 }
 
 func TestBackupDBFileUsesCorrectPath(t *testing.T) {
+	t.Parallel()
 	_, store := MustNewTestStore(t, true, false)
 
 	t.Run("backs up unencrypted db when encrypted flag is false", func(t *testing.T) {

api/datastore/datastore_test.go

@@ -29,6 +29,7 @@ const (
 // TestStoreFull an eventually comprehensive set of tests for the Store.
 // The idea is what we write to the store, we should read back.
 func TestStoreFull(t *testing.T) {
+	t.Parallel()
 	_, store := MustNewTestStore(t, true, true)
 
 	testCases := map[string]func(t *testing.T){

api/datastore/migrate_data_test.go

@@ -6,18 +6,18 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"path/filepath"
 	"testing"
 
-	"github.com/Masterminds/semver"
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/database/boltdb"
 	"github.com/portainer/portainer/api/database/models"
 	"github.com/portainer/portainer/api/datastore/migrator"
-	"github.com/stretchr/testify/require"
+	"github.com/portainer/portainer/api/filesystem"
 
+	"github.com/Masterminds/semver/v3"
 	"github.com/google/go-cmp/cmp"
 	"github.com/rs/zerolog/log"
+	"github.com/stretchr/testify/require"
 )
 
 func TestMigrateData(t *testing.T) {
@@ -174,6 +174,7 @@ func TestMigrateData(t *testing.T) {
 }
 
 func TestRollback(t *testing.T) {
+	t.Parallel()
 	t.Run("Rollback should restore upgrade after backup", func(t *testing.T) {
 		version := "2.11"
 
@@ -324,7 +325,7 @@ func migrateDBTestHelper(t *testing.T, srcPath, wantPath string, overrideInstanc
 
 	// Compare the result we got with the one we wanted.
 	if diff := cmp.Diff(wantJSON, gotJSON); diff != "" {
-		gotPath := filepath.Join(os.TempDir(), "portainer-migrator-test-fail.json")
+		gotPath := filesystem.JoinPaths(os.TempDir(), "portainer-migrator-test-fail.json")
 		err = os.WriteFile(
 			gotPath,
 			gotJSON,

api/datastore/migrate_dbversion29_test.go

@@ -26,6 +26,7 @@ func setup(store *Store) error {
 }
 
 func TestMigrateSettings(t *testing.T) {
+	t.Parallel()
 	_, store := MustNewTestStore(t, false, true)
 
 	err := setup(store)

api/datastore/migrate_dbversion33_test.go

@@ -12,6 +12,7 @@ import (
 )
 
 func TestMigrateStackEntryPoint(t *testing.T) {
+	t.Parallel()
 	_, store := MustNewTestStore(t, false, true)
 
 	stackService := store.Stack()

api/datastore/migrator/migrate_2_33_test.go

@@ -12,6 +12,7 @@ import (
 )
 
 func TestMigrateEdgeGroupEndpointsToRoars_2_33_0Idempotency(t *testing.T) {
+	t.Parallel()
 	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
 	err := conn.Open()
 	require.NoError(t, err)

api/datastore/migrator/migrate_2_40_test.go

@@ -0,0 +1,206 @@
+package migrator
+
+import (
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/database/boltdb"
+	"github.com/portainer/portainer/api/dataservices/endpoint"
+	"github.com/portainer/portainer/api/dataservices/pendingactions"
+	"github.com/portainer/portainer/api/dataservices/registry"
+	"github.com/portainer/portainer/api/logs"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMigrateRegistryAccessSASecrets_2_40_0(t *testing.T) {
+	t.Parallel()
+	var conn portainer.Connection = &boltdb.DbConnection{Path: t.TempDir()}
+	err := conn.Open()
+	require.NoError(t, err)
+	defer logs.CloseAndLogErr(conn)
+
+	registryService, err := registry.NewService(conn)
+	require.NoError(t, err)
+
+	endpointService, err := endpoint.NewService(conn)
+	require.NoError(t, err)
+
+	pendingActionsService, err := pendingactions.NewService(conn)
+	require.NoError(t, err)
+
+	t.Run("sets MigrateRegistrySASecrets flag for k8s endpoints with registry access", func(t *testing.T) {
+		k8sEndpoint := &portainer.Endpoint{
+			ID:   1,
+			Name: "k8s-cluster",
+			Type: portainer.AgentOnKubernetesEnvironment,
+		}
+		dockerEndpoint := &portainer.Endpoint{
+			ID:   2,
+			Name: "docker-standalone",
+			Type: portainer.DockerEnvironment,
+		}
+
+		err := conn.CreateObjectWithId(endpoint.BucketName, int(k8sEndpoint.ID), k8sEndpoint)
+		require.NoError(t, err)
+		err = conn.CreateObjectWithId(endpoint.BucketName, int(dockerEndpoint.ID), dockerEndpoint)
+		require.NoError(t, err)
+
+		reg := &portainer.Registry{
+			ID:   1,
+			Name: "test-registry",
+			RegistryAccesses: portainer.RegistryAccesses{
+				k8sEndpoint.ID: portainer.RegistryAccessPolicies{
+					Namespaces: []string{"default", "production"},
+				},
+				dockerEndpoint.ID: portainer.RegistryAccessPolicies{
+					Namespaces: []string{"ignored"},
+				},
+			},
+		}
+
+		err = conn.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
+		require.NoError(t, err)
+
+		m := NewMigrator(&MigratorParameters{
+			RegistryService:       registryService,
+			EndpointService:       endpointService,
+			PendingActionsService: pendingActionsService,
+		})
+
+		err = m.migrateRegistryAccessSASecrets_2_40_0()
+		require.NoError(t, err)
+
+		updatedK8sEndpoint, err := endpointService.Endpoint(k8sEndpoint.ID)
+		require.NoError(t, err)
+		assert.True(t, updatedK8sEndpoint.PostInitMigrations.MigrateRegistrySASecrets, "should have set MigrateRegistrySASecrets flag for k8s endpoint")
+
+		updatedDockerEndpoint, err := endpointService.Endpoint(dockerEndpoint.ID)
+		require.NoError(t, err)
+		assert.False(t, updatedDockerEndpoint.PostInitMigrations.MigrateRegistrySASecrets, "should not have set MigrateRegistrySASecrets flag for docker endpoint")
+	})
+
+	t.Run("skips endpoints with empty namespaces", func(t *testing.T) {
+		conn2 := &boltdb.DbConnection{Path: t.TempDir()}
+		err := conn2.Open()
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(conn2)
+
+		registryService2, _ := registry.NewService(conn2)
+		endpointService2, _ := endpoint.NewService(conn2)
+		pendingActionsService2, _ := pendingactions.NewService(conn2)
+
+		k8sEndpoint := &portainer.Endpoint{
+			ID:   10,
+			Name: "k8s-cluster",
+			Type: portainer.AgentOnKubernetesEnvironment,
+		}
+		err = conn2.CreateObjectWithId(endpoint.BucketName, int(k8sEndpoint.ID), k8sEndpoint)
+		require.NoError(t, err)
+
+		reg := &portainer.Registry{
+			ID:   10,
+			Name: "empty-registry",
+			RegistryAccesses: portainer.RegistryAccesses{
+				k8sEndpoint.ID: portainer.RegistryAccessPolicies{
+					Namespaces: []string{},
+				},
+			},
+		}
+		err = conn2.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
+		require.NoError(t, err)
+
+		m := NewMigrator(&MigratorParameters{
+			RegistryService:       registryService2,
+			EndpointService:       endpointService2,
+			PendingActionsService: pendingActionsService2,
+		})
+
+		err = m.migrateRegistryAccessSASecrets_2_40_0()
+		require.NoError(t, err)
+
+		allPAs, err := pendingActionsService2.ReadAll()
+		require.NoError(t, err)
+		assert.Empty(t, allPAs, "should not create pending actions for empty namespaces")
+	})
+
+	t.Run("skips non-existent endpoints", func(t *testing.T) {
+		conn3 := &boltdb.DbConnection{Path: t.TempDir()}
+		err := conn3.Open()
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(conn3)
+
+		registryService3, _ := registry.NewService(conn3)
+		endpointService3, _ := endpoint.NewService(conn3)
+		pendingActionsService3, _ := pendingactions.NewService(conn3)
+
+		reg := &portainer.Registry{
+			ID:   20,
+			Name: "orphan-registry",
+			RegistryAccesses: portainer.RegistryAccesses{
+				999: portainer.RegistryAccessPolicies{
+					Namespaces: []string{"default"},
+				},
+			},
+		}
+		err = conn3.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
+		require.NoError(t, err)
+
+		m := NewMigrator(&MigratorParameters{
+			RegistryService:       registryService3,
+			EndpointService:       endpointService3,
+			PendingActionsService: pendingActionsService3,
+		})
+
+		err = m.migrateRegistryAccessSASecrets_2_40_0()
+		require.NoError(t, err)
+
+		allPAs, err := pendingActionsService3.ReadAll()
+		require.NoError(t, err)
+		assert.Empty(t, allPAs, "should not create pending actions for non-existent endpoints")
+	})
+
+	t.Run("idempotent - running twice creates duplicate actions but doesn't error", func(t *testing.T) {
+		conn4 := &boltdb.DbConnection{Path: t.TempDir()}
+		err := conn4.Open()
+		require.NoError(t, err)
+		defer logs.CloseAndLogErr(conn4)
+
+		registryService4, _ := registry.NewService(conn4)
+		endpointService4, _ := endpoint.NewService(conn4)
+		pendingActionsService4, _ := pendingactions.NewService(conn4)
+
+		k8sEndpoint := &portainer.Endpoint{
+			ID:   30,
+			Name: "k8s-cluster",
+			Type: portainer.AgentOnKubernetesEnvironment,
+		}
+		err = conn4.CreateObjectWithId(endpoint.BucketName, int(k8sEndpoint.ID), k8sEndpoint)
+		require.NoError(t, err)
+
+		reg := &portainer.Registry{
+			ID:   30,
+			Name: "test-registry",
+			RegistryAccesses: portainer.RegistryAccesses{
+				k8sEndpoint.ID: portainer.RegistryAccessPolicies{
+					Namespaces: []string{"default"},
+				},
+			},
+		}
+		err = conn4.CreateObjectWithId(registry.BucketName, int(reg.ID), reg)
+		require.NoError(t, err)
+
+		m := NewMigrator(&MigratorParameters{
+			RegistryService:       registryService4,
+			EndpointService:       endpointService4,
+			PendingActionsService: pendingActionsService4,
+		})
+
+		err = m.migrateRegistryAccessSASecrets_2_40_0()
+		require.NoError(t, err)
+
+		err = m.migrateRegistryAccessSASecrets_2_40_0()
+		require.NoError(t, err)
+	})
+}

api/datastore/migrator/migrate_ce.go

@@ -7,7 +7,7 @@ import (
 	"github.com/pkg/errors"
 	portainer "github.com/portainer/portainer/api"
 
-	"github.com/Masterminds/semver"
+	"github.com/Masterminds/semver/v3"
 	"github.com/rs/zerolog/log"
 )
 
@@ -95,7 +95,7 @@ func (m *Migrator) NeedsMigration() bool {
 
 	// In this particular instance we should log a fatal error
 	if m.CurrentDBEdition() != portainer.PortainerCE {
-		log.Fatal().Msg("the Portainer database is set for Portainer Business Edition, please follow the instructions in our documentation to downgrade it: https://documentation.portainer.io/v2.0-be/downgrade/be-to-ce/")
+		log.Fatal().Msg("the Portainer database is set for Portainer Business Edition, please follow the instructions in our documentation to downgrade it: https://docs.portainer.io/faqs/upgrading/can-i-downgrade-from-portainer-business-to-portainer-ce")
 
 		return false
 	}

api/datastore/migrator/migrate_dbversion140.go

@@ -0,0 +1,58 @@
+package migrator
+
+import (
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/rs/zerolog/log"
+)
+
+// migrateRegistryAccessSASecrets_2_40_0 marks Kubernetes endpoints that have
+// registry access configured so that imagePullSecrets can be added to their
+// default ServiceAccounts during the post-init migration phase (when cluster
+// access is available).
+func (m *Migrator) migrateRegistryAccessSASecrets_2_40_0() error {
+	log.Info().Msg("migrating registry access service account secrets")
+
+	registries, err := m.registryService.ReadAll()
+	if err != nil {
+		return err
+	}
+
+	endpoints, err := m.endpointService.Endpoints()
+	if err != nil {
+		return err
+	}
+
+	// Collect the IDs of endpoints that have at least one registry with
+	// non-empty namespace access - these need the SA imagePullSecrets migration.
+	needsMigration := make(map[portainer.EndpointID]bool)
+	for _, registry := range registries {
+		for endpointID, access := range registry.RegistryAccesses {
+			if len(access.Namespaces) > 0 {
+				needsMigration[endpointID] = true
+			}
+		}
+	}
+
+	for i := range endpoints {
+		endpoint := &endpoints[i]
+
+		if !endpointutils.IsKubernetesEndpoint(endpoint) {
+			continue
+		}
+
+		if !needsMigration[endpoint.ID] {
+			continue
+		}
+
+		endpoint.PostInitMigrations.MigrateRegistrySASecrets = true
+		if err := m.endpointService.UpdateEndpoint(endpoint.ID, endpoint); err != nil {
+			log.Warn().
+				Err(err).
+				Int("endpointID", int(endpoint.ID)).
+				Msg("failed to set registry SA secret migration flag for endpoint")
+		}
+	}
+
+	return nil
+}

api/datastore/migrator/migrator.go

@@ -29,7 +29,7 @@ import (
 	"github.com/portainer/portainer/api/dataservices/version"
 	"github.com/portainer/portainer/api/internal/authorization"
 
-	"github.com/Masterminds/semver"
+	"github.com/Masterminds/semver/v3"
 	"github.com/rs/zerolog/log"
 )
 
@@ -258,6 +258,8 @@ func (m *Migrator) initMigrations() {
 
 	m.addMigrations("2.33.1", m.migrateEdgeGroupEndpointsToRoars_2_33_0)
 
+	m.addMigrations("2.40.0", m.migrateRegistryAccessSASecrets_2_40_0)
+
 	// WARNING: do not change migrations that have already been released!
 
 	// Add new migrations above...

api/datastore/pendingactions_test.go

@@ -14,6 +14,7 @@ type cleanNAPWithOverridePolicies struct {
 }
 
 func Test_ConvertCleanNAPWithOverridePoliciesPayload(t *testing.T) {
+	t.Parallel()
 	t.Run("test ConvertCleanNAPWithOverridePoliciesPayload", func(t *testing.T) {
 
 		_, store := MustNewTestStore(t, true, false)

api/datastore/postinit/migrate_post_init.go

@@ -1,8 +1,10 @@
 package postinit
 
 import (
+	"cmp"
 	"context"
 	"fmt"
+	"slices"
 
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/client"
@@ -10,6 +12,7 @@ import (
 	"github.com/portainer/portainer/api/dataservices"
 	dockerClient "github.com/portainer/portainer/api/docker/client"
 	"github.com/portainer/portainer/api/internal/endpointutils"
+	"github.com/portainer/portainer/api/internal/registryutils"
 	"github.com/portainer/portainer/api/kubernetes/cli"
 	"github.com/portainer/portainer/api/logs"
 	"github.com/portainer/portainer/api/pendingactions/actions"
@@ -44,40 +47,65 @@ func NewPostInitMigrator(
 
 // PostInitMigrate will run all post-init migrations, which require docker/kube clients for all edge or non-edge environments
 func (postInitMigrator *PostInitMigrator) PostInitMigrate() error {
-	environments, err := postInitMigrator.dataStore.Endpoint().Endpoints()
-	if err != nil {
-		log.Error().Err(err).Msg("Error getting environments")
-		return err
-	}
+	var environments []portainer.Endpoint
 
-	for _, environment := range environments {
-		// edge environments will run after the server starts, in pending actions
-		if endpoints.IsEdgeEndpoint(&environment) {
-			// Skip edge environments that do not have direct connectivity
-			if !endpoints.HasDirectConnectivity(&environment) {
+	if err := postInitMigrator.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		var err error
+		if environments, err = tx.Endpoint().ReadAll(func(endpoint portainer.Endpoint) bool {
+			return endpoints.HasDirectConnectivity(&endpoint)
+		}); err != nil {
+			return fmt.Errorf("failed to retrieve environments: %w", err)
+		}
+
+		var pendingActions []portainer.PendingAction
+		if pendingActions, err = tx.PendingActions().ReadAll(func(action portainer.PendingAction) bool {
+			return action.Action == actions.PostInitMigrateEnvironment
+		}); err != nil {
+			return fmt.Errorf("failed to retrieve pending actions: %w", err)
+		}
+
+		// Sort for the binary search in createPostInitMigrationPendingAction()
+		slices.SortFunc(pendingActions, func(a, b portainer.PendingAction) int {
+			return cmp.Compare(a.EndpointID, b.EndpointID)
+		})
+
+		for _, environment := range environments {
+			if !endpoints.IsEdgeEndpoint(&environment) {
 				continue
 			}
 
+			// Edge environments will run after the server starts, in pending actions
 			log.Info().
 				Int("endpoint_id", int(environment.ID)).
 				Msg("adding pending action 'PostInitMigrateEnvironment' for environment")
 
-			if err := postInitMigrator.createPostInitMigrationPendingAction(environment.ID); err != nil {
+			if err := postInitMigrator.createPostInitMigrationPendingAction(tx, environment.ID, pendingActions); err != nil {
 				log.Error().
 					Err(err).
 					Int("endpoint_id", int(environment.ID)).
 					Msg("error creating pending action for environment")
 			}
-		} else {
-			// Non-edge environments will run before the server starts.
-			if err := postInitMigrator.MigrateEnvironment(&environment); err != nil {
-				log.Error().
-					Err(err).
-					Int("endpoint_id", int(environment.ID)).
-					Msg("error running post-init migrations for non-edge environment")
-			}
 		}
 
+		return err
+	}); err != nil {
+		log.Error().Err(err).Msg("error running post-init migrations")
+
+		return err
+	}
+
+	for _, environment := range environments {
+		if endpoints.IsEdgeEndpoint(&environment) {
+			continue
+		}
+
+		// Non-edge environments will run before the server starts.
+		if err := postInitMigrator.MigrateEnvironment(&environment); err != nil {
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(environment.ID)).
+				Msg("error running post-init migrations for non-edge environment")
+		}
 	}
 
 	return nil
@@ -85,59 +113,79 @@ func (postInitMigrator *PostInitMigrator) PostInitMigrate() error {
 
 // try to create a post init migration pending action. If it already exists, do nothing
 // this function exists for readability, not reusability
-func (postInitMigrator *PostInitMigrator) createPostInitMigrationPendingAction(environmentID portainer.EndpointID) error {
+// pending actions must be passed in ascending order by endpoint ID
+func (postInitMigrator *PostInitMigrator) createPostInitMigrationPendingAction(tx dataservices.DataStoreTx, environmentID portainer.EndpointID, pendingActions []portainer.PendingAction) error {
 	action := portainer.PendingAction{
 		EndpointID: environmentID,
 		Action:     actions.PostInitMigrateEnvironment,
 	}
 
-	pendingActions, err := postInitMigrator.dataStore.PendingActions().ReadAll()
-	if err != nil {
-		return fmt.Errorf("failed to retrieve pending actions: %w", err)
+	if _, found := slices.BinarySearchFunc(pendingActions, environmentID, func(e portainer.PendingAction, id portainer.EndpointID) int {
+		return cmp.Compare(e.EndpointID, id)
+	}); found {
+		log.Debug().
+			Str("action", action.Action).
+			Int("endpoint_id", int(action.EndpointID)).
+			Msg("pending action already exists for environment, skipping...")
+
+		return nil
 	}
 
-	for _, dba := range pendingActions {
-		if dba.EndpointID == action.EndpointID && dba.Action == action.Action {
-			log.Debug().
-				Str("action", action.Action).
-				Int("endpoint_id", int(action.EndpointID)).
-				Msg("pending action already exists for environment, skipping...")
-			return nil
-		}
-	}
-
-	return postInitMigrator.dataStore.PendingActions().Create(&action)
+	return tx.PendingActions().Create(&action)
 }
 
 // MigrateEnvironment runs migrations on a single environment
 func (migrator *PostInitMigrator) MigrateEnvironment(environment *portainer.Endpoint) error {
-	log.Info().Msgf("Executing post init migration for environment %d", environment.ID)
+	log.Info().
+		Int("endpoint_id", int(environment.ID)).
+		Msg("executing post init migration for environment")
 
 	switch {
 	case endpointutils.IsKubernetesEndpoint(environment):
 		// get the kubeclient for the environment, and skip all kube migrations if there's an error
 		kubeclient, err := migrator.kubeFactory.GetPrivilegedKubeClient(environment)
 		if err != nil {
-			log.Error().Err(err).Msgf("Error creating kubeclient for environment: %d", environment.ID)
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(environment.ID)).
+				Msg("error creating kubeclient for environment")
+
 			return err
 		}
 
-		// if one environment fails, it is logged and the next migration runs. The error is returned at the end and handled by pending actions
-		if err := migrator.MigrateIngresses(*environment, kubeclient); err != nil {
-			return err
+		// If one environment fails, it is logged and the next migration runs. The error is returned at the end and handled by pending actions
+		var latestErr error
+		kubernetesMigrations := []func() error{
+			func() error { return migrator.MigrateIngresses(*environment, kubeclient) },
+			func() error { return migrator.MigrateRegistrySASecrets(*environment, kubeclient) },
 		}
 
-		return nil
+		for _, migration := range kubernetesMigrations {
+			if err := migration(); err != nil {
+				latestErr = err
+			}
+		}
+
+		return latestErr
 	case endpointutils.IsDockerEndpoint(environment):
 		// get the docker client for the environment, and skip all docker migrations if there's an error
 		dockerClient, err := migrator.dockerFactory.CreateClient(environment, "", nil)
 		if err != nil {
-			log.Error().Err(err).Msgf("Error creating docker client for environment: %d", environment.ID)
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(environment.ID)).
+				Msg("error creating docker client for environment")
+
 			return err
 		}
 		defer logs.CloseAndLogErr(dockerClient)
 
 		if err := migrator.MigrateGPUs(*environment, dockerClient); err != nil {
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(environment.ID)).
+				Msg("error migrating GPUs for environment")
+
 			return err
 		}
 	}
@@ -145,18 +193,73 @@ func (migrator *PostInitMigrator) MigrateEnvironment(environment *portainer.Endp
 	return nil
 }
 
+func (migrator *PostInitMigrator) MigrateRegistrySASecrets(environment portainer.Endpoint, kubeclient *cli.KubeClient) error {
+	if !environment.PostInitMigrations.MigrateRegistrySASecrets {
+		return nil
+	}
+
+	log.Debug().
+		Int("endpoint_id", int(environment.ID)).
+		Msg("migrating registry SA secrets for environment")
+
+	return migrator.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
+		env, err := tx.Endpoint().Endpoint(environment.ID)
+		if err != nil {
+			return err
+		}
+
+		if !env.PostInitMigrations.MigrateRegistrySASecrets {
+			return nil
+		}
+
+		registries, err := tx.Registry().ReadAll()
+		if err != nil {
+			return err
+		}
+
+		for _, registry := range registries {
+			access, ok := registry.RegistryAccesses[env.ID]
+			if !ok || len(access.Namespaces) == 0 {
+				continue
+			}
+
+			secretName := registryutils.RegistrySecretName(registry.ID)
+			for _, namespace := range access.Namespaces {
+				if err := kubeclient.AddImagePullSecretToServiceAccount(namespace, "default", secretName); err != nil {
+					log.Warn().
+						Err(err).
+						Int("endpoint_id", int(env.ID)).
+						Str("namespace", namespace).
+						Str("secret", secretName).
+						Msg("failed to add imagePullSecret to service account during registry SA secret migration")
+				}
+			}
+		}
+
+		env.PostInitMigrations.MigrateRegistrySASecrets = false
+		return tx.Endpoint().UpdateEndpoint(env.ID, env)
+	})
+}
+
 func (migrator *PostInitMigrator) MigrateIngresses(environment portainer.Endpoint, kubeclient *cli.KubeClient) error {
 	// Early exit if we do not need to migrate!
 	if !environment.PostInitMigrations.MigrateIngresses {
 		return nil
 	}
-	log.Debug().Msgf("Migrating ingresses for environment %d", environment.ID)
 
-	err := migrator.kubeFactory.MigrateEndpointIngresses(&environment, migrator.dataStore, kubeclient)
-	if err != nil {
-		log.Error().Err(err).Msgf("Error migrating ingresses for environment %d", environment.ID)
+	log.Debug().
+		Int("endpoint_id", int(environment.ID)).
+		Msg("migrating ingresses for environment")
+
+	if err := migrator.kubeFactory.MigrateEndpointIngresses(&environment, migrator.dataStore, kubeclient); err != nil {
+		log.Error().
+			Err(err).
+			Int("endpoint_id", int(environment.ID)).
+			Msg("error migrating ingresses for environment")
+
 		return err
 	}
+
 	return nil
 }
 
@@ -166,29 +269,42 @@ func (migrator *PostInitMigrator) MigrateGPUs(e portainer.Endpoint, dockerClient
 	return migrator.dataStore.UpdateTx(func(tx dataservices.DataStoreTx) error {
 		environment, err := tx.Endpoint().Endpoint(e.ID)
 		if err != nil {
-			log.Error().Err(err).Msgf("Error getting environment %d", e.ID)
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(e.ID)).
+				Msg("error getting environment")
+
 			return err
 		}
+
 		// Early exit if we do not need to migrate!
 		if !environment.PostInitMigrations.MigrateGPUs {
 			return nil
 		}
-		log.Debug().Msgf("Migrating GPUs for environment %d", e.ID)
 
-		// get all containers
+		log.Debug().
+			Int("endpoint_id", int(e.ID)).
+			Msg("migrating GPUs for environment")
+
+		// Get all containers
 		containers, err := dockerClient.ContainerList(context.Background(), container.ListOptions{All: true})
 		if err != nil {
-			log.Error().Err(err).Msgf("failed to list containers for environment %d", environment.ID)
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(environment.ID)).
+				Msg("failed to list containers for environment")
+
 			return err
 		}
 
-		// check for a gpu on each container. If even one GPU is found, set EnableGPUManagement to true for the whole environment
+		// Check for a gpu on each container. If even one GPU is found, set EnableGPUManagement to true for the whole environment
 	containersLoop:
 		for _, container := range containers {
 			// https://www.sobyte.net/post/2022-10/go-docker/ has nice documentation on the docker client with GPUs
 			containerDetails, err := dockerClient.ContainerInspect(context.Background(), container.ID)
 			if err != nil {
 				log.Error().Err(err).Msg("failed to inspect container")
+
 				continue
 			}
 
@@ -202,10 +318,14 @@ func (migrator *PostInitMigrator) MigrateGPUs(e portainer.Endpoint, dockerClient
 			}
 		}
 
-		// set the MigrateGPUs flag to false so we don't run this again
+		// Set the MigrateGPUs flag to false so we don't run this again
 		environment.PostInitMigrations.MigrateGPUs = false
 		if err := tx.Endpoint().UpdateEndpoint(environment.ID, environment); err != nil {
-			log.Error().Err(err).Msgf("Error updating EnableGPUManagement flag for environment %d", environment.ID)
+			log.Error().
+				Err(err).
+				Int("endpoint_id", int(environment.ID)).
+				Msg("error updating EnableGPUManagement flag for environment")
+
 			return err
 		}
 

api/datastore/postinit/migrate_post_init_test.go

@@ -18,6 +18,7 @@ import (
 )
 
 func TestMigrateGPUs(t *testing.T) {
+	t.Parallel()
 	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if strings.HasSuffix(r.URL.Path, "/containers/json") {
 			containerSummary := []container.Summary{{ID: "container1"}}
@@ -79,6 +80,7 @@ func TestMigrateGPUs(t *testing.T) {
 }
 
 func TestPostInitMigrate_PendingActionsCreated(t *testing.T) {
+	t.Parallel()
 	tests := []struct {
 		name                   string
 		existingPendingActions []*portainer.PendingAction

api/datastore/services_tx.go

@@ -74,7 +74,9 @@ func (tx *StoreTx) Snapshot() dataservices.SnapshotService {
 	return tx.store.SnapshotService.Tx(tx.tx)
 }
 
-func (tx *StoreTx) SSLSettings() dataservices.SSLSettingsService { return nil }
+func (tx *StoreTx) SSLSettings() dataservices.SSLSettingsService {
+	return tx.store.SSLSettingsService.Tx(tx.tx)
+}
 
 func (tx *StoreTx) Stack() dataservices.StackService {
 	return tx.store.StackService.Tx(tx.tx)

api/datastore/test_data/output_24_to_latest.json

@@ -80,7 +80,8 @@
       "Name": "local",
       "PostInitMigrations": {
         "MigrateGPUs": true,
-        "MigrateIngresses": true
+        "MigrateIngresses": true,
+        "MigrateRegistrySASecrets": false
       },
       "PublicURL": "",
       "SecuritySettings": {
@@ -89,6 +90,7 @@
         "allowDeviceMappingForRegularUsers": true,
         "allowHostNamespaceForRegularUsers": true,
         "allowPrivilegedModeForRegularUsers": true,
+        "allowSecurityOptForRegularUsers": false,
         "allowStackManagementForRegularUsers": true,
         "allowSysctlSettingForRegularUsers": false,
         "allowVolumeBrowserForRegularUsers": false,
@@ -613,7 +615,7 @@
       "RequiredPasswordLength": 12
     },
     "KubeconfigExpiry": "0",
-    "KubectlShellImage": "portainer/kubectl-shell:2.38.0",
+    "KubectlShellImage": "portainer/kubectl-shell:2.41.0",
     "LDAPSettings": {
       "AnonymousMode": true,
       "AutoCreateUsers": true,
@@ -806,6 +808,7 @@
       "AutoUpdate": null,
       "CreatedBy": "",
       "CreationDate": 0,
+      "DeploymentStartStatus": 0,
       "EndpointId": 1,
       "EntryPoint": "docker/alpine37-compose.yml",
       "Env": [],
@@ -828,6 +831,7 @@
       "AutoUpdate": null,
       "CreatedBy": "",
       "CreationDate": 0,
+      "DeploymentStartStatus": 0,
       "EndpointId": 1,
       "EntryPoint": "docker-compose.yml",
       "Env": [],
@@ -850,6 +854,7 @@
       "AutoUpdate": null,
       "CreatedBy": "",
       "CreationDate": 0,
+      "DeploymentStartStatus": 0,
       "EndpointId": 1,
       "EntryPoint": "docker-compose.yml",
       "Env": [],
@@ -942,7 +947,7 @@
     }
   ],
   "version": {
-    "VERSION": "{\"SchemaVersion\":\"2.38.0\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
+    "VERSION": "{\"SchemaVersion\":\"2.41.0\",\"MigratorCount\":0,\"Edition\":1,\"InstanceID\":\"463d5c47-0ea5-4aca-85b1-405ceefee254\"}"
   },
   "webhooks": null
 }

api/docker/client/client_test.go

@@ -10,6 +10,7 @@ import (
 )
 
 func TestHttpClient(t *testing.T) {
+	t.Parallel()
 	fips.InitFIPS(false)
 
 	// Valid TLS configuration

api/docker/container.go

@@ -10,7 +10,7 @@ import (
 	"github.com/portainer/portainer/api/docker/images"
 	"github.com/portainer/portainer/api/logs"
 
-	"github.com/Masterminds/semver"
+	"github.com/Masterminds/semver/v3"
 	"github.com/docker/docker/api/types"
 	dockercontainer "github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/network"
@@ -21,14 +21,12 @@ import (
 type ContainerService struct {
 	factory   *dockerclient.ClientFactory
 	dataStore dataservices.DataStore
-	sr        *serviceRestore
 }
 
 func NewContainerService(factory *dockerclient.ClientFactory, dataStore dataservices.DataStore) *ContainerService {
 	return &ContainerService{
 		factory:   factory,
 		dataStore: dataStore,
-		sr:        &serviceRestore{},
 	}
 }
 
@@ -141,11 +139,14 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 			initialNetwork.EndpointsConfig[name] = network
 		}
 	}
-	c.sr.enable()
-	defer c.sr.close()
-	defer c.sr.restore()
 
-	c.sr.push(func() {
+	restore := true
+
+	defer func() {
+		if !restore {
+			return
+		}
+
 		log.Debug().Str("container_id", containerId).Str("container", container.Name).Msg("restoring the container")
 		if err := cli.ContainerRename(ctx, containerId, container.Name); err != nil {
 			log.Warn().Err(err).Msg("failure to rename container")
@@ -160,7 +161,7 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 		if err := cli.ContainerStart(ctx, containerId, dockercontainer.StartOptions{}); err != nil {
 			log.Warn().Err(err).Msg("failure to start container")
 		}
-	})
+	}()
 
 	log.Debug().Str("container", strings.Split(container.Name, "/")[1]).Msg("starting to create a new container")
 
@@ -179,8 +180,15 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 	}
 
 	create, err := cli.ContainerCreate(ctx, container.Config, container.HostConfig, &initialNetwork, nil, container.Name)
+	if err != nil {
+		return nil, errors.Wrap(err, "create container error")
+	}
+
+	defer func() {
+		if !restore {
+			return
+		}
 
-	c.sr.push(func() {
 		log.Debug().Str("container_id", create.ID).Msg("removing the new container")
 
 		if err := cli.ContainerStop(ctx, create.ID, dockercontainer.StopOptions{}); err != nil {
@@ -190,11 +198,7 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 		if err := cli.ContainerRemove(ctx, create.ID, dockercontainer.RemoveOptions{}); err != nil {
 			log.Warn().Err(err).Msg("failure to remove container")
 		}
-	})
-
-	if err != nil {
-		return nil, errors.Wrap(err, "create container error")
-	}
+	}()
 
 	newContainerId := create.ID
 
@@ -224,7 +228,7 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 	log.Debug().Str("container_id", containerId).Msg("starting to remove the old container")
 	_ = cli.ContainerRemove(ctx, containerId, dockercontainer.RemoveOptions{})
 
-	c.sr.disable()
+	restore = false
 
 	newContainer, _, err := cli.ContainerInspectWithRaw(ctx, newContainerId, true)
 	if err != nil {
@@ -233,51 +237,3 @@ func (c *ContainerService) Recreate(ctx context.Context, endpoint *portainer.End
 
 	return &newContainer, nil
 }
-
-type serviceRestore struct {
-	restoreC chan struct{}
-	fs       []func()
-}
-
-func (sr *serviceRestore) enable() {
-	sr.restoreC = make(chan struct{}, 1)
-	sr.fs = make([]func(), 0)
-	sr.restoreC <- struct{}{}
-}
-
-func (sr *serviceRestore) disable() {
-	select {
-	case <-sr.restoreC:
-	default:
-	}
-}
-
-func (sr *serviceRestore) push(f func()) {
-	sr.fs = append(sr.fs, f)
-}
-
-func (sr *serviceRestore) restore() {
-	select {
-	case <-sr.restoreC:
-		l := len(sr.fs)
-		if l > 0 {
-			for i := l - 1; i >= 0; i-- {
-				sr.fs[i]()
-			}
-		}
-	default:
-	}
-}
-
-func (sr *serviceRestore) close() {
-	if sr == nil || sr.restoreC == nil {
-		return
-	}
-
-	select {
-	case <-sr.restoreC:
-	default:
-	}
-
-	close(sr.restoreC)
-}

api/docker/container_test.go

@@ -8,6 +8,7 @@ import (
 )
 
 func TestApplyVersionConstraint(t *testing.T) {
+	t.Parallel()
 	initialNet := network.NetworkingConfig{
 		EndpointsConfig: map[string]*network.EndpointSettings{
 			"key1": {

api/docker/images/digest_test.go

@@ -8,6 +8,7 @@ import (
 )
 
 func TestParseLocalImage(t *testing.T) {
+	t.Parallel()
 	// Test with a regular image
 
 	img, err := ParseLocalImage(image.InspectResponse{

api/docker/images/image_test.go

@@ -8,6 +8,7 @@ import (
 )
 
 func TestImageParser(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	// portainer/portainer-ee
@@ -62,6 +63,7 @@ func TestImageParser(t *testing.T) {
 }
 
 func TestUpdateParsedImage(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	// gcr.io/k8s-minikube/kicbase:v0.0.30@sha256:02c921df998f95e849058af14de7045efc3954d90320967418a0d1f182bbc0b2

api/docker/images/registry_test.go

@@ -10,6 +10,7 @@ import (
 )
 
 func TestFindBestMatchNeedAuthRegistry(t *testing.T) {
+	t.Parallel()
 	is := assert.New(t)
 
 	t.Run("", func(t *testing.T) {

api/docker/images/status.go

@@ -89,11 +89,11 @@ func FigureOut(statuses []Status) Status {
 		return Preparing
 	}
 
-	if contains(statuses, Outdated) {
+	if slices.Contains(statuses, Outdated) {
 		return Outdated
-	} else if contains(statuses, Processing) {
+	} else if slices.Contains(statuses, Processing) {
 		return Processing
-	} else if contains(statuses, Error) {
+	} else if slices.Contains(statuses, Error) {
 		return Error
 	}
 
@@ -275,14 +275,6 @@ func EvictImageStatus(resourceID string) {
 	statusCache.Delete(resourceID)
 }
 
-func contains(statuses []Status, status Status) bool {
-	if len(statuses) == 0 {
-		return false
-	}
-
-	return slices.Contains(statuses, status)
-}
-
 func allMatch(statuses []Status, status Status) bool {
 	if len(statuses) == 0 {
 		return false

api/docker/stats/container_stats.go

@@ -6,6 +6,7 @@ import (
 	"strings"
 	"sync"
 
+	"github.com/containerd/containerd/errdefs"
 	"github.com/docker/docker/api/types/container"
 )
 
@@ -35,8 +36,10 @@ func CalculateContainerStats(ctx context.Context, cli DockerClient, isSwarm bool
 	var aggErr error
 	var aggMu sync.Mutex
 
+	var processedCount int
 	for i := range containers {
 		id := containers[i].ID
+
 		semaphore <- struct{}{}
 		wg.Go(func() {
 			defer func() { <-semaphore }()
@@ -44,8 +47,17 @@ func CalculateContainerStats(ctx context.Context, cli DockerClient, isSwarm bool
 			containerInspection, err := cli.ContainerInspect(ctx, id)
 			stat := ContainerStats{}
 			if err != nil {
+				if errdefs.IsNotFound(err) {
+					// An edge case is reported that Docker can list containers with no names,
+					// but when inspecting a container with specific ID and it is not found.
+					// In this case, we can safely ignore the error.
+					// ref@https://linear.app/portainer/issue/BE-12567/500-error-when-loading-docker-dashboard-in-portainer
+					return
+				}
+
 				aggMu.Lock()
 				aggErr = errors.Join(aggErr, err)
+				processedCount++
 				aggMu.Unlock()
 				return
 			}
@@ -56,6 +68,7 @@ func CalculateContainerStats(ctx context.Context, cli DockerClient, isSwarm bool
 			stopped += stat.Stopped
 			healthy += stat.Healthy
 			unhealthy += stat.Unhealthy
+			processedCount++
 			mu.Unlock()
 		})
 	}
@@ -67,7 +80,7 @@ func CalculateContainerStats(ctx context.Context, cli DockerClient, isSwarm bool
 		Stopped:   stopped,
 		Healthy:   healthy,
 		Unhealthy: unhealthy,
-		Total:     len(containers),
+		Total:     processedCount,
 	}, aggErr
 }
 

api/docker/stats/container_stats_test.go

@@ -3,9 +3,11 @@ package stats
 import (
 	"context"
 	"errors"
+	"fmt"
 	"testing"
 	"time"
 
+	"github.com/containerd/containerd/errdefs"
 	"github.com/docker/docker/api/types/container"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/mock"
@@ -23,6 +25,7 @@ func (m *MockDockerClient) ContainerInspect(ctx context.Context, containerID str
 }
 
 func TestCalculateContainerStats(t *testing.T) {
+	t.Parallel()
 	mockClient := new(MockDockerClient)
 
 	// Test containers - using enough containers to test concurrent processing
@@ -37,6 +40,7 @@ func TestCalculateContainerStats(t *testing.T) {
 		{ID: "container8"},
 		{ID: "container9"},
 		{ID: "container10"},
+		{ID: "container11"},
 	}
 
 	// Setup mock expectations with different container states to test various scenarios
@@ -58,7 +62,6 @@ func TestCalculateContainerStats(t *testing.T) {
 		{"container10", container.StateDead, nil, ContainerStats{Running: 0, Stopped: 1, Healthy: 0, Unhealthy: 0}},
 	}
 
-	expected := ContainerStats{}
 	// Setup mock expectations for all containers with artificial delays to simulate real Docker calls
 	for _, state := range containerStates {
 		mockClient.On("ContainerInspect", mock.Anything, state.id).Return(container.InspectResponse{
@@ -68,27 +71,23 @@ func TestCalculateContainerStats(t *testing.T) {
 					Health: state.health,
 				},
 			},
-		}, nil).After(50 * time.Millisecond) // Simulate 50ms Docker API call
-
-		expected.Running += state.expected.Running
-		expected.Stopped += state.expected.Stopped
-		expected.Healthy += state.expected.Healthy
-		expected.Unhealthy += state.expected.Unhealthy
-		expected.Total++
+		}, nil).After(30 * time.Millisecond) // Simulate 30ms Docker API call
 	}
 
+	// Setup mock expectation for a container that returns NotFound error
+	mockClient.On("ContainerInspect", mock.Anything, "container11").Return(container.InspectResponse{}, fmt.Errorf("No such container: %w", errdefs.ErrNotFound)).After(50 * time.Millisecond)
+
 	// Call the function and measure time
 	startTime := time.Now()
-	stats, err := CalculateContainerStats(context.Background(), mockClient, false, containers)
+	stats, err := CalculateContainerStats(t.Context(), mockClient, false, containers)
 	require.NoError(t, err, "failed to calculate container stats")
 	duration := time.Since(startTime)
 
 	// Assert results
-	assert.Equal(t, expected, stats)
-	assert.Equal(t, expected.Running, stats.Running)
-	assert.Equal(t, expected.Stopped, stats.Stopped)
-	assert.Equal(t, expected.Healthy, stats.Healthy)
-	assert.Equal(t, expected.Unhealthy, stats.Unhealthy)
+	assert.Equal(t, 6, stats.Running)
+	assert.Equal(t, 4, stats.Stopped)
+	assert.Equal(t, 2, stats.Healthy)
+	assert.Equal(t, 2, stats.Unhealthy)
 	assert.Equal(t, 10, stats.Total)
 
 	// Verify concurrent processing by checking that all mock calls were made
@@ -107,6 +106,7 @@ func TestCalculateContainerStats(t *testing.T) {
 }
 
 func TestCalculateContainerStatsAllErrors(t *testing.T) {
+	t.Parallel()
 	mockClient := new(MockDockerClient)
 
 	// Test containers
@@ -120,7 +120,7 @@ func TestCalculateContainerStatsAllErrors(t *testing.T) {
 	mockClient.On("ContainerInspect", mock.Anything, "container2").Return(container.InspectResponse{}, errors.New("permission denied"))
 
 	// Call the function
-	stats, err := CalculateContainerStats(context.Background(), mockClient, false, containers)
+	stats, err := CalculateContainerStats(t.Context(), mockClient, false, containers)
 
 	// Assert that an error was returned
 	require.Error(t, err, "should return error when all containers fail to inspect")
@@ -142,6 +142,7 @@ func TestCalculateContainerStatsAllErrors(t *testing.T) {
 }
 
 func TestGetContainerStatus(t *testing.T) {
+	t.Parallel()
 	testCases := []struct {
 		name     string
 		state    *container.State
@@ -234,6 +235,7 @@ func TestGetContainerStatus(t *testing.T) {
 }
 
 func TestCalculateContainerStatsForSwarm(t *testing.T) {
+	t.Parallel()
 	containers := []container.Summary{
 		{State: "running"},
 		{State: "running", Status: "Up 5 minutes (healthy)"},

api/edge/edge.go

@@ -54,6 +54,9 @@ type (
 		// Used only for EE
 		AlwaysCloneGitRepoForRelativePath bool
 
+		// Whether the edge stack supports per device configs
+		SupportPerDeviceConfigs bool
+
 		// Mount point for relative path
 		FilesystemPath string
 		// Used only for EE
@@ -77,6 +80,9 @@ type (
 		// CreatedByUserId is the user ID that created this stack
 		// Used for adding labels to Kubernetes manifests
 		CreatedByUserId string
+
+		// HelmConfig represents the Helm configuration for an edge stack
+		HelmConfig portainer.HelmConfig
 	}
 
 	DeployerOptionsPayload struct {

api/exec/compose_stack.go

@@ -70,6 +70,7 @@ func (manager *ComposeStackManager) Up(ctx context.Context, stack *portainer.Sta
 		},
 		ForceRecreate:        options.ForceRecreate,
 		AbortOnContainerExit: options.AbortOnContainerExit,
+		RemoveOrphans:        options.Prune,
 	})
 	return errors.Wrap(err, "failed to deploy a stack")
 }

api/exec/compose_stack_integration_test.go

@@ -1,14 +1,13 @@
 package exec
 
 import (
-	"context"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"strings"
 	"testing"
 
 	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
 	"github.com/portainer/portainer/pkg/libstack/compose"
 	"github.com/portainer/portainer/pkg/testhelpers"
 	"github.com/stretchr/testify/require"
@@ -26,7 +25,7 @@ const composedContainerName = "compose_wrapper_test"
 func setup(t *testing.T) (*portainer.Stack, *portainer.Endpoint) {
 	dir := t.TempDir()
 	composeFileName := "compose_wrapper_test.yml"
-	f, err := os.Create(filepath.Join(dir, composeFileName))
+	f, err := os.Create(filesystem.JoinPaths(dir, composeFileName))
 	require.NoError(t, err)
 
 	_, err = f.WriteString(composeFile)
@@ -42,6 +41,7 @@ func setup(t *testing.T) (*portainer.Stack, *portainer.Endpoint) {
 }
 
 func Test_UpAndDown(t *testing.T) {
+	t.Parallel()
 	testhelpers.IntegrationTest(t)
 
 	stack, endpoint := setup(t)
@@ -50,9 +50,7 @@ func Test_UpAndDown(t *testing.T) {
 
 	w := NewComposeStackManager(deployer, nil, nil)
 
-	ctx := context.TODO()
-
-	if err := w.Up(ctx, stack, endpoint, portainer.ComposeUpOptions{}); err != nil {
+	if err := w.Up(t.Context(), stack, endpoint, portainer.ComposeUpOptions{}); err != nil {
 		t.Fatalf("Error calling docker-compose up: %s", err)
 	}
 
@@ -60,7 +58,7 @@ func Test_UpAndDown(t *testing.T) {
 		t.Fatal("container should exist")
 	}
 
-	if err := w.Down(ctx, stack, endpoint); err != nil {
+	if err := w.Down(t.Context(), stack, endpoint); err != nil {
 		t.Fatalf("Error calling docker-compose down: %s", err)
 	}
 

api/exec/compose_stack_test.go

@@ -3,17 +3,17 @@ package exec
 import (
 	"io"
 	"os"
-	"path"
-	"path/filepath"
 	"testing"
 
 	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
 
 func Test_createEnvFile(t *testing.T) {
+	t.Parallel()
 	dir := t.TempDir()
 
 	tests := []struct {
@@ -56,9 +56,9 @@ func Test_createEnvFile(t *testing.T) {
 			result, _ := createEnvFile(tt.stack)
 
 			if tt.expected != "" {
-				assert.Equal(t, filepath.Join(tt.stack.ProjectPath, "stack.env"), result)
+				assert.Equal(t, filesystem.JoinPaths(tt.stack.ProjectPath, "stack.env"), result)
 
-				f, _ := os.Open(path.Join(dir, "stack.env"))
+				f, _ := os.Open(filesystem.JoinPaths(dir, "stack.env"))
 				content, _ := io.ReadAll(f)
 
 				assert.Equal(t, tt.expected, string(content))
@@ -70,8 +70,9 @@ func Test_createEnvFile(t *testing.T) {
 }
 
 func Test_createEnvFile_mergesDefultAndInplaceEnvVars(t *testing.T) {
+	t.Parallel()
 	dir := t.TempDir()
-	err := os.WriteFile(path.Join(dir, ".env"), []byte("VAR1=VAL1\nVAR2=VAL2\n"), 0600)
+	err := os.WriteFile(filesystem.JoinPaths(dir, ".env"), []byte("VAR1=VAL1\nVAR2=VAL2\n"), 0600)
 	require.NoError(t, err)
 
 	stack := &portainer.Stack{
@@ -82,11 +83,11 @@ func Test_createEnvFile_mergesDefultAndInplaceEnvVars(t *testing.T) {
 		},
 	}
 	result, err := createEnvFile(stack)
-	assert.Equal(t, filepath.Join(stack.ProjectPath, "stack.env"), result)
+	assert.Equal(t, filesystem.JoinPaths(stack.ProjectPath, "stack.env"), result)
 	require.NoError(t, err)
-	assert.FileExists(t, path.Join(dir, "stack.env"))
+	assert.FileExists(t, filesystem.JoinPaths(dir, "stack.env"))
 
-	f, err := os.Open(path.Join(dir, "stack.env"))
+	f, err := os.Open(filesystem.JoinPaths(dir, "stack.env"))
 	require.NoError(t, err)
 
 	content, err := io.ReadAll(f)

api/exec/exectest/kubernetes_mocks.go

@@ -1,6 +1,8 @@
 package exectest
 
 import (
+	"context"
+
 	portainer "github.com/portainer/portainer/api"
 )
 
@@ -13,14 +15,14 @@ func NewKubernetesDeployer() *kubernetesMockDeployer {
 	return &kubernetesMockDeployer{}
 }
 
-func (deployer *kubernetesMockDeployer) Deploy(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+func (deployer *kubernetesMockDeployer) Deploy(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
 	return "", nil
 }
 
-func (deployer *kubernetesMockDeployer) Remove(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+func (deployer *kubernetesMockDeployer) Remove(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
 	return "", nil
 }
 
-func (deployer *kubernetesMockDeployer) Restart(userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+func (deployer *kubernetesMockDeployer) Restart(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
 	return "", nil
 }

api/exec/kubernetes_deploy.go

@@ -76,16 +76,16 @@ func (deployer *KubernetesDeployer) getToken(userID portainer.UserID, endpoint *
 }
 
 // Deploy upserts Kubernetes resources defined in manifest(s)
-func (deployer *KubernetesDeployer) Deploy(userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
-	return deployer.command("apply", userID, endpoint, resources, namespace)
+func (deployer *KubernetesDeployer) Deploy(ctx context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+	return deployer.command(ctx, "apply", userID, endpoint, resources, namespace)
 }
 
 // Remove deletes Kubernetes resources defined in manifest(s)
-func (deployer *KubernetesDeployer) Remove(userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
-	return deployer.command("delete", userID, endpoint, resources, namespace)
+func (deployer *KubernetesDeployer) Remove(ctx context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+	return deployer.command(ctx, "delete", userID, endpoint, resources, namespace)
 }
 
-func (deployer *KubernetesDeployer) command(operation string, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+func (deployer *KubernetesDeployer) command(ctx context.Context, operation string, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
 	token, err := deployer.getToken(userID, endpoint, endpoint.Type == portainer.KubernetesLocalEnvironment)
 	if err != nil {
 		return "", errors.Wrap(err, "failed generating a user token")
@@ -112,7 +112,7 @@ func (deployer *KubernetesDeployer) command(operation string, userID portainer.U
 
 	operations := map[string]func(context.Context, []string) (string, error){
 		"apply":  client.ApplyDynamic,
-		"delete": client.Delete,
+		"delete": client.DeleteDynamic,
 	}
 
 	operationFunc, ok := operations[operation]
@@ -120,7 +120,7 @@ func (deployer *KubernetesDeployer) command(operation string, userID portainer.U
 		return "", errors.Errorf("unsupported operation: %s", operation)
 	}
 
-	output, err := operationFunc(context.Background(), resources)
+	output, err := operationFunc(ctx, resources)
 	if err != nil {
 		return "", errors.Wrapf(err, "failed to execute kubectl %s command", operation)
 	}

api/exec/kubernetes_deploy_test.go

@@ -57,6 +57,7 @@ func testExecuteKubectlOperation(client *mockKubectlClient, operation string, ma
 }
 
 func TestExecuteKubectlOperation_Apply_Success(t *testing.T) {
+	t.Parallel()
 	called := false
 	mockClient := &mockKubectlClient{
 		applyFunc: func(ctx context.Context, files []string) error {
@@ -74,6 +75,7 @@ func TestExecuteKubectlOperation_Apply_Success(t *testing.T) {
 }
 
 func TestExecuteKubectlOperation_Apply_Error(t *testing.T) {
+	t.Parallel()
 	expectedErr := errors.New("kubectl apply failed")
 	called := false
 	mockClient := &mockKubectlClient{
@@ -93,6 +95,7 @@ func TestExecuteKubectlOperation_Apply_Error(t *testing.T) {
 }
 
 func TestExecuteKubectlOperation_Delete_Success(t *testing.T) {
+	t.Parallel()
 	called := false
 	mockClient := &mockKubectlClient{
 		deleteFunc: func(ctx context.Context, files []string) error {
@@ -110,6 +113,7 @@ func TestExecuteKubectlOperation_Delete_Success(t *testing.T) {
 }
 
 func TestExecuteKubectlOperation_Delete_Error(t *testing.T) {
+	t.Parallel()
 	expectedErr := errors.New("kubectl delete failed")
 	called := false
 	mockClient := &mockKubectlClient{
@@ -129,6 +133,7 @@ func TestExecuteKubectlOperation_Delete_Error(t *testing.T) {
 }
 
 func TestExecuteKubectlOperation_RolloutRestart_Success(t *testing.T) {
+	t.Parallel()
 	called := false
 	mockClient := &mockKubectlClient{
 		rolloutRestartFunc: func(ctx context.Context, resources []string) error {
@@ -146,6 +151,7 @@ func TestExecuteKubectlOperation_RolloutRestart_Success(t *testing.T) {
 }
 
 func TestExecuteKubectlOperation_RolloutRestart_Error(t *testing.T) {
+	t.Parallel()
 	expectedErr := errors.New("kubectl rollout restart failed")
 	called := false
 	mockClient := &mockKubectlClient{
@@ -165,6 +171,7 @@ func TestExecuteKubectlOperation_RolloutRestart_Error(t *testing.T) {
 }
 
 func TestExecuteKubectlOperation_UnsupportedOperation(t *testing.T) {
+	t.Parallel()
 	mockClient := &mockKubectlClient{}
 
 	err := testExecuteKubectlOperation(mockClient, "unsupported", []string{})

api/exec/swarm_stack.go

@@ -2,6 +2,7 @@ package exec
 
 import (
 	"bytes"
+	"context"
 	"errors"
 	"os"
 	"os/exec"
@@ -53,7 +54,7 @@ func NewSwarmStackManager(
 }
 
 // Login executes the docker login command against a list of registries (including DockerHub).
-func (manager *SwarmStackManager) Login(registries []portainer.Registry, endpoint *portainer.Endpoint) error {
+func (manager *SwarmStackManager) Login(ctx context.Context, registries []portainer.Registry, endpoint *portainer.Endpoint) error {
 	command, args, err := manager.prepareDockerCommandAndArgs(manager.binaryPath, manager.configPath, endpoint)
 	if err != nil {
 		return err
@@ -67,7 +68,7 @@ func (manager *SwarmStackManager) Login(registries []portainer.Registry, endpoin
 			}
 
 			registryArgs := append(args, "login", "--username", username, "--password", password, registry.URL)
-			if err := runCommandAndCaptureStdErr(command, registryArgs, nil, ""); err != nil {
+			if err := runCommandAndCaptureStdErr(ctx, command, registryArgs, nil, ""); err != nil {
 				log.Warn().
 					Err(err).
 					Str("RegistryName", registry.Name).
@@ -80,7 +81,7 @@ func (manager *SwarmStackManager) Login(registries []portainer.Registry, endpoin
 }
 
 // Logout executes the docker logout command.
-func (manager *SwarmStackManager) Logout(endpoint *portainer.Endpoint) error {
+func (manager *SwarmStackManager) Logout(ctx context.Context, endpoint *portainer.Endpoint) error {
 	command, args, err := manager.prepareDockerCommandAndArgs(manager.binaryPath, manager.configPath, endpoint)
 	if err != nil {
 		return err
@@ -88,11 +89,11 @@ func (manager *SwarmStackManager) Logout(endpoint *portainer.Endpoint) error {
 
 	args = append(args, "logout")
 
-	return runCommandAndCaptureStdErr(command, args, nil, "")
+	return runCommandAndCaptureStdErr(ctx, command, args, nil, "")
 }
 
 // Deploy executes the docker stack deploy command.
-func (manager *SwarmStackManager) Deploy(stack *portainer.Stack, prune bool, pullImage bool, endpoint *portainer.Endpoint) error {
+func (manager *SwarmStackManager) Deploy(ctx context.Context, stack *portainer.Stack, prune bool, pullImage bool, endpoint *portainer.Endpoint) error {
 	filePaths := stackutils.GetStackFilePaths(stack, true)
 	command, args, err := manager.prepareDockerCommandAndArgs(manager.binaryPath, manager.configPath, endpoint)
 	if err != nil {
@@ -117,11 +118,11 @@ func (manager *SwarmStackManager) Deploy(stack *portainer.Stack, prune bool, pul
 		env = append(env, envvar.Name+"="+envvar.Value)
 	}
 
-	return runCommandAndCaptureStdErr(command, args, env, stack.ProjectPath)
+	return runCommandAndCaptureStdErr(ctx, command, args, env, stack.ProjectPath)
 }
 
 // Remove executes the docker stack rm command.
-func (manager *SwarmStackManager) Remove(stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+func (manager *SwarmStackManager) Remove(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
 	command, args, err := manager.prepareDockerCommandAndArgs(manager.binaryPath, manager.configPath, endpoint)
 	if err != nil {
 		return err
@@ -129,14 +130,16 @@ func (manager *SwarmStackManager) Remove(stack *portainer.Stack, endpoint *porta
 
 	args = append(args, "stack", "rm", "--detach=false", stack.Name)
 
-	return runCommandAndCaptureStdErr(command, args, nil, "")
+	return runCommandAndCaptureStdErr(ctx, command, args, nil, "")
 }
 
-func runCommandAndCaptureStdErr(command string, args []string, env []string, workingDir string) error {
+func runCommandAndCaptureStdErr(ctx context.Context, command string, args []string, env []string, workingDir string) error {
 	var stderr bytes.Buffer
+	var stdout bytes.Buffer
 
-	cmd := exec.Command(command, args...)
+	cmd := exec.CommandContext(ctx, command, args...)
 	cmd.Stderr = &stderr
+	cmd.Stdout = &stdout
 
 	if workingDir != "" {
 		cmd.Dir = workingDir
@@ -148,7 +151,15 @@ func runCommandAndCaptureStdErr(command string, args []string, env []string, wor
 	}
 
 	if err := cmd.Run(); err != nil {
-		return errors.New(stderr.String())
+		errMsg := strings.TrimSpace(stderr.String())
+		if errMsg == "" {
+			errMsg = strings.TrimSpace(stdout.String())
+		}
+		if errMsg == "" {
+			errMsg = err.Error()
+		}
+
+		return errors.New(errMsg)
 	}
 
 	return nil

api/exec/swarm_stack_test.go

@@ -1,6 +1,7 @@
 package exec
 
 import (
+	"context"
 	"testing"
 
 	portainer "github.com/portainer/portainer/api"
@@ -9,6 +10,7 @@ import (
 )
 
 func TestConfigFilePaths(t *testing.T) {
+	t.Parallel()
 	args := []string{"stack", "deploy", "--with-registry-auth"}
 	filePaths := []string{"dir/file", "dir/file-two", "dir/file-three"}
 	expected := []string{"stack", "deploy", "--with-registry-auth", "--compose-file", "dir/file", "--compose-file", "dir/file-two", "--compose-file", "dir/file-three"}
@@ -17,6 +19,7 @@ func TestConfigFilePaths(t *testing.T) {
 }
 
 func TestPrepareDockerCommandAndArgs(t *testing.T) {
+	t.Parallel()
 	binaryPath := "/test/dist"
 	configPath := "/test/config"
 	manager := &SwarmStackManager{
@@ -41,3 +44,43 @@ func TestPrepareDockerCommandAndArgs(t *testing.T) {
 	require.Equal(t, expectedCommand, command)
 	require.Equal(t, expectedArgs, args)
 }
+
+func TestRunCommandAndCaptureStdErr(t *testing.T) {
+	t.Parallel()
+
+	t.Run("should return nil on successful command", func(t *testing.T) {
+		err := runCommandAndCaptureStdErr(context.Background(), "echo", []string{"hello"}, nil, "")
+		require.NoError(t, err)
+	})
+
+	t.Run("should capture stderr on failure", func(t *testing.T) {
+		err := runCommandAndCaptureStdErr(context.Background(), "sh", []string{"-c", "echo 'stderr error' >&2; exit 1"}, nil, "")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "stderr error")
+	})
+
+	t.Run("should fall back to stdout when stderr is empty", func(t *testing.T) {
+		err := runCommandAndCaptureStdErr(context.Background(), "sh", []string{"-c", "echo 'stdout error'; exit 1"}, nil, "")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "stdout error")
+	})
+
+	t.Run("should fall back to exec error when both are empty", func(t *testing.T) {
+		err := runCommandAndCaptureStdErr(context.Background(), "sh", []string{"-c", "exit 1"}, nil, "")
+		require.Error(t, err)
+		assert.NotEmpty(t, err.Error())
+		assert.Contains(t, err.Error(), "exit status 1")
+	})
+
+	t.Run("should prefer stderr over stdout", func(t *testing.T) {
+		err := runCommandAndCaptureStdErr(context.Background(), "sh", []string{"-c", "echo 'stdout msg'; echo 'stderr msg' >&2; exit 1"}, nil, "")
+		require.Error(t, err)
+		assert.Contains(t, err.Error(), "stderr msg")
+		assert.NotContains(t, err.Error(), "stdout msg")
+	})
+
+	t.Run("should return error for non-existent command", func(t *testing.T) {
+		err := runCommandAndCaptureStdErr(context.Background(), "nonexistent-cmd-12345", nil, nil, "")
+		require.Error(t, err)
+	})
+}

api/filesystem/copy_test.go

@@ -2,8 +2,6 @@ package filesystem
 
 import (
 	"os"
-	"path"
-	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -11,47 +9,52 @@ import (
 )
 
 func Test_copyFile_returnsError_whenSourceDoesNotExist(t *testing.T) {
+	t.Parallel()
 	tmpdir := t.TempDir()
 	err := copyFile("does-not-exist", tmpdir)
 	require.Error(t, err)
 }
 
 func Test_copyFile_shouldMakeAbackup(t *testing.T) {
+	t.Parallel()
 	tmpdir := t.TempDir()
 	content := []byte("content")
 
-	err := os.WriteFile(path.Join(tmpdir, "origin"), content, 0600)
+	err := os.WriteFile(JoinPaths(tmpdir, "origin"), content, 0600)
 	require.NoError(t, err)
 
-	err = copyFile(path.Join(tmpdir, "origin"), path.Join(tmpdir, "copy"))
+	err = copyFile(JoinPaths(tmpdir, "origin"), JoinPaths(tmpdir, "copy"))
 	require.NoError(t, err)
 
-	copyContent, err := os.ReadFile(path.Join(tmpdir, "copy"))
+	copyContent, err := os.ReadFile(JoinPaths(tmpdir, "copy"))
 	require.NoError(t, err)
 	assert.Equal(t, content, copyContent)
 }
 
 func Test_CopyDir_shouldCopyAllFilesAndDirectories(t *testing.T) {
+	t.Parallel()
 	destination := t.TempDir()
 	err := CopyDir("./testdata/copy_test", destination, true)
 	require.NoError(t, err)
 
-	assert.FileExists(t, filepath.Join(destination, "copy_test", "outer"))
-	assert.FileExists(t, filepath.Join(destination, "copy_test", "dir", ".dotfile"))
-	assert.FileExists(t, filepath.Join(destination, "copy_test", "dir", "inner"))
+	assert.FileExists(t, JoinPaths(destination, "copy_test", "outer"))
+	assert.FileExists(t, JoinPaths(destination, "copy_test", "dir", ".dotfile"))
+	assert.FileExists(t, JoinPaths(destination, "copy_test", "dir", "inner"))
 }
 
 func Test_CopyDir_shouldCopyOnlyDirContents(t *testing.T) {
+	t.Parallel()
 	destination := t.TempDir()
 	err := CopyDir("./testdata/copy_test", destination, false)
 	require.NoError(t, err)
 
-	assert.FileExists(t, filepath.Join(destination, "outer"))
-	assert.FileExists(t, filepath.Join(destination, "dir", ".dotfile"))
-	assert.FileExists(t, filepath.Join(destination, "dir", "inner"))
+	assert.FileExists(t, JoinPaths(destination, "outer"))
+	assert.FileExists(t, JoinPaths(destination, "dir", ".dotfile"))
+	assert.FileExists(t, JoinPaths(destination, "dir", "inner"))
 }
 
 func Test_CopyPath_shouldSkipWhenNotExist(t *testing.T) {
+	t.Parallel()
 	tmpdir := t.TempDir()
 	err := CopyPath("does-not-exists", tmpdir)
 	require.NoError(t, err)
@@ -60,36 +63,39 @@ func Test_CopyPath_shouldSkipWhenNotExist(t *testing.T) {
 }
 
 func Test_CopyPath_shouldCopyFile(t *testing.T) {
+	t.Parallel()
 	tmpdir := t.TempDir()
 	content := []byte("content")
 
-	err := os.WriteFile(path.Join(tmpdir, "file"), content, 0600)
+	err := os.WriteFile(JoinPaths(tmpdir, "file"), content, 0600)
 	require.NoError(t, err)
 
-	err = os.MkdirAll(path.Join(tmpdir, "backup"), 0700)
+	err = os.MkdirAll(JoinPaths(tmpdir, "backup"), 0700)
 	require.NoError(t, err)
 
-	err = CopyPath(path.Join(tmpdir, "file"), path.Join(tmpdir, "backup"))
+	err = CopyPath(JoinPaths(tmpdir, "file"), JoinPaths(tmpdir, "backup"))
 	require.NoError(t, err)
 
-	copyContent, err := os.ReadFile(path.Join(tmpdir, "backup", "file"))
+	copyContent, err := os.ReadFile(JoinPaths(tmpdir, "backup", "file"))
 	require.NoError(t, err)
 	assert.Equal(t, content, copyContent)
 }
 
 func Test_CopyPath_shouldCopyDir(t *testing.T) {
+	t.Parallel()
 	destination := t.TempDir()
 	err := CopyPath("./testdata/copy_test", destination)
 	require.NoError(t, err)
 
-	assert.FileExists(t, filepath.Join(destination, "copy_test", "outer"))
-	assert.FileExists(t, filepath.Join(destination, "copy_test", "dir", ".dotfile"))
-	assert.FileExists(t, filepath.Join(destination, "copy_test", "dir", "inner"))
+	assert.FileExists(t, JoinPaths(destination, "copy_test", "outer"))
+	assert.FileExists(t, JoinPaths(destination, "copy_test", "dir", ".dotfile"))
+	assert.FileExists(t, JoinPaths(destination, "copy_test", "dir", "inner"))
 }
 
 func TestCopyPathPanic(t *testing.T) {
+	t.Parallel()
 	dir := t.TempDir()
-	p := filepath.Join(dir, "myfile")
+	p := JoinPaths(dir, "myfile")
 
 	err := os.WriteFile(p, []byte("contents"), 0644)
 	require.NoError(t, err)

api/filesystem/filesystem.go

@@ -14,7 +14,7 @@ import (
 	portainer "github.com/portainer/portainer/api"
 	"github.com/portainer/portainer/api/logs"
 
-	"github.com/gofrs/uuid"
+	"github.com/google/uuid"
 	"github.com/rs/zerolog/log"
 	"github.com/segmentio/encoding/json"
 )
@@ -91,7 +91,7 @@ func JoinPaths(trustedRoot string, untrustedPaths ...string) string {
 		trustedRoot = "."
 	}
 
-	p := filepath.Join(trustedRoot, filepath.Join(append([]string{"/"}, untrustedPaths...)...))
+	p := filepath.Join(trustedRoot, filepath.Join(append([]string{"/"}, untrustedPaths...)...)) //nolint:forbidigo
 
 	// avoid setting a volume name from the untrusted paths
 	vnp := filepath.VolumeName(p)
@@ -812,7 +812,7 @@ func (service *Service) getEdgeJobTaskLogPath(edgeJobID string, taskID string) s
 
 // GetTemporaryPath returns a temp folder
 func (service *Service) GetTemporaryPath() (string, error) {
-	uid, err := uuid.NewV4()
+	uid, err := uuid.NewRandom()
 	if err != nil {
 		return "", err
 	}

api/filesystem/filesystem_fileexists_test.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"math/rand"
 	"os"
-	"path"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -12,20 +11,24 @@ import (
 )
 
 func Test_fileSystemService_FileExists_whenFileExistsShouldReturnTrue(t *testing.T) {
+	t.Parallel()
 	service := createService(t)
 	testHelperFileExists_fileExists(t, service.FileExists)
 }
 
 func Test_fileSystemService_FileExists_whenFileNotExistsShouldReturnFalse(t *testing.T) {
+	t.Parallel()
 	service := createService(t)
 	testHelperFileExists_fileNotExists(t, service.FileExists)
 }
 
 func Test_FileExists_whenFileExistsShouldReturnTrue(t *testing.T) {
+	t.Parallel()
 	testHelperFileExists_fileExists(t, FileExists)
 }
 
 func Test_FileExists_whenFileNotExistsShouldReturnFalse(t *testing.T) {
+	t.Parallel()
 	testHelperFileExists_fileNotExists(t, FileExists)
 }
 
@@ -45,7 +48,7 @@ func testHelperFileExists_fileExists(t *testing.T, checker func(path string) (bo
 }
 
 func testHelperFileExists_fileNotExists(t *testing.T, checker func(path string) (bool, error)) {
-	filePath := path.Join(t.TempDir(), fmt.Sprintf("%s%d", t.Name(), rand.Int()))
+	filePath := JoinPaths(t.TempDir(), fmt.Sprintf("%s%d", t.Name(), rand.Int()))
 
 	err := os.RemoveAll(filePath)
 	require.NoError(t, err, "RemoveAll should not fail")

api/filesystem/filesystem_linux_test.go

@@ -3,6 +3,7 @@ package filesystem
 import "testing"
 
 func TestJoinPaths(t *testing.T) {
+	t.Parallel()
 	var ts = []struct {
 		trusted   string
 		untrusted string

api/filesystem/filesystem_move_test.go

@@ -2,7 +2,6 @@ package filesystem
 
 import (
 	"os"
-	"path"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -12,6 +11,7 @@ import (
 var content = []byte("content")
 
 func Test_movePath_shouldFailIfSourceDirDoesNotExist(t *testing.T) {
+	t.Parallel()
 	sourceDir := "missing"
 	destinationDir := t.TempDir()
 	file1 := addFile(t, destinationDir, "dir", "file")
@@ -24,6 +24,7 @@ func Test_movePath_shouldFailIfSourceDirDoesNotExist(t *testing.T) {
 }
 
 func Test_movePath_shouldFailIfDestinationDirExists(t *testing.T) {
+	t.Parallel()
 	sourceDir := t.TempDir()
 	file1 := addFile(t, sourceDir, "dir", "file")
 	file2 := addFile(t, sourceDir, "file")
@@ -40,6 +41,7 @@ func Test_movePath_shouldFailIfDestinationDirExists(t *testing.T) {
 }
 
 func Test_movePath_succesIfOverwriteSetWhenDestinationDirExists(t *testing.T) {
+	t.Parallel()
 	sourceDir := t.TempDir()
 	file1 := addFile(t, sourceDir, "dir", "file")
 	file2 := addFile(t, sourceDir, "file")
@@ -56,31 +58,32 @@ func Test_movePath_succesIfOverwriteSetWhenDestinationDirExists(t *testing.T) {
 }
 
 func Test_movePath_successWhenSourceExistsAndDestinationIsMissing(t *testing.T) {
+	t.Parallel()
 	tmp := t.TempDir()
-	sourceDir := path.Join(tmp, "source")
+	sourceDir := JoinPaths(tmp, "source")
 	err := os.Mkdir(sourceDir, 0766)
 	require.NoError(t, err)
 
 	file1 := addFile(t, sourceDir, "dir", "file")
 	file2 := addFile(t, sourceDir, "file")
-	destinationDir := path.Join(tmp, "destination")
+	destinationDir := JoinPaths(tmp, "destination")
 
 	err = MoveDirectory(sourceDir, destinationDir, false)
 	require.NoError(t, err)
 	assert.NoFileExists(t, file1, "source dir contents should be moved")
 	assert.NoFileExists(t, file2, "source dir contents should be moved")
-	assertFileContent(t, path.Join(destinationDir, "file"))
-	assertFileContent(t, path.Join(destinationDir, "dir", "file"))
+	assertFileContent(t, JoinPaths(destinationDir, "file"))
+	assertFileContent(t, JoinPaths(destinationDir, "dir", "file"))
 }
 
 func addFile(t *testing.T, fileParts ...string) (filepath string) {
 	if len(fileParts) > 2 {
-		dir := path.Join(fileParts[:len(fileParts)-1]...)
+		dir := JoinPaths(fileParts[0], fileParts[1:len(fileParts)-1]...)
 		err := os.MkdirAll(dir, 0766)
 		require.NoError(t, err)
 	}
 
-	p := path.Join(fileParts...)
+	p := JoinPaths(fileParts[0], fileParts[1:]...)
 	err := os.WriteFile(p, content, 0766)
 	require.NoError(t, err)
 

api/filesystem/filesystem_test.go

@@ -2,14 +2,13 @@ package filesystem
 
 import (
 	"os"
-	"path"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 )
 
 func createService(t *testing.T) *Service {
-	dataStorePath := path.Join(t.TempDir(), t.Name())
+	dataStorePath := JoinPaths(t.TempDir(), t.Name())
 
 	service, err := NewService(dataStorePath, "")
 	require.NoError(t, err, "NewService should not fail")

api/filesystem/filesystem_windows_test.go

@@ -3,6 +3,7 @@ package filesystem
 import "testing"
 
 func TestJoinPaths(t *testing.T) {
+	t.Parallel()
 	var ts = []struct {
 		trusted   string
 		untrusted string

api/filesystem/serialize_per_dev_configs_test.go

@@ -10,6 +10,7 @@ import (
 )
 
 func TestMultiFilterDirForPerDevConfigs(t *testing.T) {
+	t.Parallel()
 	f := func(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs, wantDirEntries []DirEntry) {
 		t.Helper()
 
@@ -80,6 +81,7 @@ func TestMultiFilterDirForPerDevConfigs(t *testing.T) {
 }
 
 func TestMultiFilterDirForPerDevConfigsWithDefaults(t *testing.T) {
+	t.Parallel()
 	f := func(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs, defaultFilenames []string, wantDirEntries []DirEntry) {
 		t.Helper()
 
@@ -180,6 +182,7 @@ func TestMultiFilterDirForPerDevConfigsWithDefaults(t *testing.T) {
 }
 
 func TestMultiFilterDirForPerDevConfigsEnvFiles(t *testing.T) {
+	t.Parallel()
 	f := func(dirEntries []DirEntry, configPath string, multiFilterArgs MultiFilterArgs, wantEnvFiles []string) {
 		t.Helper()
 
@@ -204,6 +207,7 @@ func TestMultiFilterDirForPerDevConfigsEnvFiles(t *testing.T) {
 }
 
 func TestIsInConfigDir(t *testing.T) {
+	t.Parallel()
 	f := func(dirEntry DirEntry, configPath string, expect bool) {
 		t.Helper()
 
@@ -223,3 +227,16 @@ func TestIsInConfigDir(t *testing.T) {
 	f(DirEntry{Name: "edgestacktest/edge-configs/standalone-edge-agent-async"}, "edgestacktest/edge-configs", true)
 	f(DirEntry{Name: "edgestacktest/edge-configs/abc.txt"}, "edgestacktest/edge-configs", true)
 }
+
+func TestShouldIncludeDir(t *testing.T) {
+	t.Parallel()
+	f := func(dirEntry DirEntry, deviceName, configPath string, expect bool) {
+		t.Helper()
+
+		actual := shouldIncludeDir(dirEntry, deviceName, configPath)
+		assert.Equal(t, expect, actual)
+	}
+
+	f(DirEntry{Name: "app/blue-app", IsFile: false}, "blue-app", "app", true)
+	f(DirEntry{Name: "app/blue-app/values.yaml", IsFile: true}, "blue-app", "app", true)
+}

api/filesystem/write_test.go

@@ -2,7 +2,6 @@ package filesystem
 
 import (
 	"os"
-	"path"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -10,8 +9,9 @@ import (
 )
 
 func Test_WriteFile_CanStoreContentInANewFile(t *testing.T) {
+	t.Parallel()
 	tmpDir := t.TempDir()
-	tmpFilePath := path.Join(tmpDir, "dummy")
+	tmpFilePath := JoinPaths(tmpDir, "dummy")
 
 	content := []byte("content")
 	err := WriteToFile(tmpFilePath, content)
@@ -22,8 +22,9 @@ func Test_WriteFile_CanStoreContentInANewFile(t *testing.T) {
 }
 
 func Test_WriteFile_CanOverwriteExistingFile(t *testing.T) {
+	t.Parallel()
 	tmpDir := t.TempDir()
-	tmpFilePath := path.Join(tmpDir, "dummy")
+	tmpFilePath := JoinPaths(tmpDir, "dummy")
 
 	err := WriteToFile(tmpFilePath, []byte("content"))
 	require.NoError(t, err)
@@ -37,8 +38,9 @@ func Test_WriteFile_CanOverwriteExistingFile(t *testing.T) {
 }
 
 func Test_WriteFile_CanWriteANestedPath(t *testing.T) {
+	t.Parallel()
 	tmpDir := t.TempDir()
-	tmpFilePath := path.Join(tmpDir, "dir", "sub-dir", "dummy")
+	tmpFilePath := JoinPaths(tmpDir, "dir", "sub-dir", "dummy")
 
 	content := []byte("content")
 	err := WriteToFile(tmpFilePath, content)

api/git/azure.go

@@ -16,7 +16,9 @@ import (
 	"github.com/portainer/portainer/api/logs"
 	"github.com/rs/zerolog/log"
 
+	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/plumbing/filemode"
+	githttp "github.com/go-git/go-git/v5/plumbing/transport/http"
 	"github.com/pkg/errors"
 	"github.com/segmentio/encoding/json"
 )
@@ -26,7 +28,7 @@ const (
 	visualStudioHostSuffix = ".visualstudio.com"
 )
 
-func isAzureUrl(s string) bool {
+func IsAzureUrl(s string) bool {
 	return strings.Contains(s, azureDevOpsHost) ||
 		strings.Contains(s, visualStudioHostSuffix)
 }
@@ -73,7 +75,11 @@ func newHttpClientForAzure(insecureSkipVerify bool) *http.Client {
 	return httpsCli
 }
 
-func (a *azureClient) download(ctx context.Context, destination string, opt cloneOption) error {
+func (a *azureClient) Download(ctx context.Context, destination string, opt *git.CloneOptions) error {
+	if opt == nil {
+		return errors.New("options cannot be nil")
+	}
+
 	zipFilepath, err := a.downloadZipFromAzureDevOps(ctx, opt)
 	if err != nil {
 		return errors.Wrap(err, "failed to download a zip file from Azure DevOps")
@@ -91,13 +97,13 @@ func (a *azureClient) download(ctx context.Context, destination string, opt clon
 	return nil
 }
 
-func (a *azureClient) downloadZipFromAzureDevOps(ctx context.Context, opt cloneOption) (string, error) {
-	config, err := parseUrl(opt.repositoryUrl)
+func (a *azureClient) downloadZipFromAzureDevOps(ctx context.Context, opt *git.CloneOptions) (string, error) {
+	config, err := parseUrl(opt.URL)
 	if err != nil {
 		return "", errors.WithMessage(err, "failed to parse url")
 	}
 
-	downloadUrl, err := a.buildDownloadUrl(config, opt.referenceName)
+	downloadUrl, err := a.buildDownloadUrl(config, string(opt.ReferenceName))
 	if err != nil {
 		return "", errors.WithMessage(err, "failed to build download url")
 	}
@@ -109,9 +115,18 @@ func (a *azureClient) downloadZipFromAzureDevOps(ctx context.Context, opt cloneO
 
 	defer logs.CloseAndLogErr(zipFile)
 
+	var basicAuth *githttp.BasicAuth
+	if opt.Auth != nil {
+		var ok bool
+		basicAuth, ok = opt.Auth.(*githttp.BasicAuth)
+		if !ok {
+			return "", errors.New("only basic auth is supported for azure")
+		}
+	}
+
 	req, err := http.NewRequestWithContext(ctx, "GET", downloadUrl, nil)
-	if opt.username != "" || opt.password != "" {
-		req.SetBasicAuth(opt.username, opt.password)
+	if basicAuth != nil {
+		req.SetBasicAuth(basicAuth.Username, basicAuth.Password)
 	} else if config.username != "" || config.password != "" {
 		req.SetBasicAuth(config.username, config.password)
 	}
@@ -120,7 +135,7 @@ func (a *azureClient) downloadZipFromAzureDevOps(ctx context.Context, opt cloneO
 		return "", errors.WithMessage(err, "failed to create a new HTTP request")
 	}
 
-	client := newHttpClientForAzure(opt.tlsSkipVerify)
+	client := newHttpClientForAzure(opt.InsecureSkipTLS)
 	defer client.CloseIdleConnections()
 
 	res, err := client.Do(req)
@@ -145,8 +160,12 @@ func (a *azureClient) downloadZipFromAzureDevOps(ctx context.Context, opt cloneO
 	return zipFile.Name(), nil
 }
 
-func (a *azureClient) latestCommitID(ctx context.Context, opt fetchOption) (string, error) {
-	rootItem, err := a.getRootItem(ctx, opt)
+func (a *azureClient) LatestCommitID(ctx context.Context, repositoryUrl, referenceName string, opt *git.ListOptions) (string, error) {
+	if opt == nil {
+		return "", errors.New("options cannot be nil")
+	}
+
+	rootItem, err := a.getRootItem(ctx, repositoryUrl, referenceName, opt)
 	if err != nil {
 		return "", err
 	}
@@ -154,20 +173,29 @@ func (a *azureClient) latestCommitID(ctx context.Context, opt fetchOption) (stri
 	return rootItem.CommitId, nil
 }
 
-func (a *azureClient) getRootItem(ctx context.Context, opt fetchOption) (*azureItem, error) {
-	config, err := parseUrl(opt.repositoryUrl)
+func (a *azureClient) getRootItem(ctx context.Context, repositoryUrl, referenceName string, opt *git.ListOptions) (*azureItem, error) {
+	config, err := parseUrl(repositoryUrl)
 	if err != nil {
 		return nil, errors.WithMessage(err, "failed to parse url")
 	}
 
-	rootItemUrl, err := a.buildRootItemUrl(config, opt.referenceName)
+	rootItemUrl, err := a.buildRootItemUrl(config, referenceName)
 	if err != nil {
 		return nil, errors.WithMessage(err, "failed to build azure root item url")
 	}
 
+	var basicAuth *githttp.BasicAuth
+	if opt.Auth != nil {
+		var ok bool
+		basicAuth, ok = opt.Auth.(*githttp.BasicAuth)
+		if !ok {
+			return nil, errors.New("only basic auth is supported for azure")
+		}
+	}
+
 	req, err := http.NewRequestWithContext(ctx, "GET", rootItemUrl, nil)
-	if opt.username != "" || opt.password != "" {
-		req.SetBasicAuth(opt.username, opt.password)
+	if basicAuth != nil {
+		req.SetBasicAuth(basicAuth.Username, basicAuth.Password)
 	} else if config.username != "" || config.password != "" {
 		req.SetBasicAuth(config.username, config.password)
 	}
@@ -176,7 +204,7 @@ func (a *azureClient) getRootItem(ctx context.Context, opt fetchOption) (*azureI
 		return nil, errors.WithMessage(err, "failed to create a new HTTP request")
 	}
 
-	client := newHttpClientForAzure(opt.tlsSkipVerify)
+	client := newHttpClientForAzure(opt.InsecureSkipTLS)
 	defer client.CloseIdleConnections()
 
 	resp, err := client.Do(req)
@@ -239,8 +267,10 @@ func parseSshUrl(rawUrl string) (*azureOptions, error) {
 	}, nil
 }
 
-const expectedAzureDevOpsHttpUrl = "https://Organisation@dev.azure.com/Organisation/Project/_git/Repository"
-const expectedVisualStudioHttpUrl = "https://organisation.visualstudio.com/project/_git/repository"
+const (
+	expectedAzureDevOpsHttpUrl  = "https://Organisation@dev.azure.com/Organisation/Project/_git/Repository"
+	expectedVisualStudioHttpUrl = "https://organisation.visualstudio.com/project/_git/repository"
+)
 
 func parseHttpUrl(rawUrl string) (*azureOptions, error) {
 	u, err := url.Parse(rawUrl)
@@ -283,7 +313,6 @@ func (a *azureClient) buildDownloadUrl(config *azureOptions, referenceName strin
 		url.PathEscape(config.project),
 		url.PathEscape(config.repository))
 	u, err := url.Parse(rawUrl)
-
 	if err != nil {
 		return "", errors.Wrapf(err, "failed to parse download url path %s", rawUrl)
 	}
@@ -310,7 +339,6 @@ func (a *azureClient) buildRootItemUrl(config *azureOptions, referenceName strin
 		url.PathEscape(config.project),
 		url.PathEscape(config.repository))
 	u, err := url.Parse(rawUrl)
-
 	if err != nil {
 		return "", errors.Wrapf(err, "failed to parse root item url path %s", rawUrl)
 	}
@@ -335,7 +363,6 @@ func (a *azureClient) buildRefsUrl(config *azureOptions) (string, error) {
 		url.PathEscape(config.project),
 		url.PathEscape(config.repository))
 	u, err := url.Parse(rawUrl)
-
 	if err != nil {
 		return "", errors.Wrapf(err, "failed to parse list refs url path %s", rawUrl)
 	}
@@ -357,7 +384,6 @@ func (a *azureClient) buildTreeUrl(config *azureOptions, rootObjectHash string)
 		url.PathEscape(rootObjectHash),
 	)
 	u, err := url.Parse(rawUrl)
-
 	if err != nil {
 		return "", errors.Wrapf(err, "failed to parse list tree url path %s", rawUrl)
 	}
@@ -400,8 +426,12 @@ func getVersionType(name string) string {
 	return "commit"
 }
 
-func (a *azureClient) listRefs(ctx context.Context, opt baseOption) ([]string, error) {
-	config, err := parseUrl(opt.repositoryUrl)
+func (a *azureClient) ListRefs(ctx context.Context, repositoryUrl string, opt *git.ListOptions) ([]string, error) {
+	if opt == nil {
+		return nil, errors.New("options cannot be nil")
+	}
+
+	config, err := parseUrl(repositoryUrl)
 	if err != nil {
 		return nil, errors.WithMessage(err, "failed to parse url")
 	}
@@ -411,9 +441,18 @@ func (a *azureClient) listRefs(ctx context.Context, opt baseOption) ([]string, e
 		return nil, errors.WithMessage(err, "failed to build list refs url")
 	}
 
+	var basicAuth *githttp.BasicAuth
+	if opt.Auth != nil {
+		var ok bool
+		basicAuth, ok = opt.Auth.(*githttp.BasicAuth)
+		if !ok {
+			return nil, errors.New("only basic auth is supported for azure")
+		}
+	}
+
 	req, err := http.NewRequestWithContext(ctx, "GET", listRefsUrl, nil)
-	if opt.username != "" || opt.password != "" {
-		req.SetBasicAuth(opt.username, opt.password)
+	if basicAuth != nil {
+		req.SetBasicAuth(basicAuth.Username, basicAuth.Password)
 	} else if config.username != "" || config.password != "" {
 		req.SetBasicAuth(config.username, config.password)
 	}
@@ -422,7 +461,7 @@ func (a *azureClient) listRefs(ctx context.Context, opt baseOption) ([]string, e
 		return nil, errors.WithMessage(err, "failed to create a new HTTP request")
 	}
 
-	client := newHttpClientForAzure(opt.tlsSkipVerify)
+	client := newHttpClientForAzure(opt.InsecureSkipTLS)
 	defer client.CloseIdleConnections()
 
 	resp, err := client.Do(req)
@@ -459,13 +498,21 @@ func (a *azureClient) listRefs(ctx context.Context, opt baseOption) ([]string, e
 }
 
 // listFiles list all filenames under the specific repository
-func (a *azureClient) listFiles(ctx context.Context, opt fetchOption) ([]string, error) {
-	rootItem, err := a.getRootItem(ctx, opt)
+func (a *azureClient) ListFiles(ctx context.Context, dirOnly bool, opt *git.CloneOptions) ([]string, error) {
+	if opt == nil {
+		return nil, errors.New("options cannot be nil")
+	}
+
+	listOptions := &git.ListOptions{
+		Auth:            opt.Auth,
+		InsecureSkipTLS: opt.InsecureSkipTLS,
+	}
+	rootItem, err := a.getRootItem(ctx, opt.URL, string(opt.ReferenceName), listOptions)
 	if err != nil {
 		return nil, err
 	}
 
-	config, err := parseUrl(opt.repositoryUrl)
+	config, err := parseUrl(opt.URL)
 	if err != nil {
 		return nil, errors.WithMessage(err, "failed to parse url")
 	}
@@ -475,9 +522,18 @@ func (a *azureClient) listFiles(ctx context.Context, opt fetchOption) ([]string,
 		return nil, errors.WithMessage(err, "failed to build list tree url")
 	}
 
+	var basicAuth *githttp.BasicAuth
+	if opt.Auth != nil {
+		var ok bool
+		basicAuth, ok = opt.Auth.(*githttp.BasicAuth)
+		if !ok {
+			return nil, errors.New("only basic auth is supported for azure")
+		}
+	}
+
 	req, err := http.NewRequestWithContext(ctx, "GET", listTreeUrl, nil)
-	if opt.username != "" || opt.password != "" {
-		req.SetBasicAuth(opt.username, opt.password)
+	if basicAuth != nil {
+		req.SetBasicAuth(basicAuth.Username, basicAuth.Password)
 	} else if config.username != "" || config.password != "" {
 		req.SetBasicAuth(config.username, config.password)
 	}
@@ -486,7 +542,7 @@ func (a *azureClient) listFiles(ctx context.Context, opt fetchOption) ([]string,
 		return nil, errors.WithMessage(err, "failed to create a new HTTP request")
 	}
 
-	client := newHttpClientForAzure(opt.tlsSkipVerify)
+	client := newHttpClientForAzure(opt.InsecureSkipTLS)
 	defer client.CloseIdleConnections()
 
 	resp, err := client.Do(req)
@@ -518,7 +574,7 @@ func (a *azureClient) listFiles(ctx context.Context, opt fetchOption) ([]string,
 	for _, treeEntry := range tree.TreeEntries {
 		mode, _ := filemode.New(treeEntry.Mode)
 		isDir := filemode.Dir == mode
-		if opt.dirOnly == isDir {
+		if dirOnly == isDir {
 			allPaths = append(allPaths, treeEntry.RelativePath)
 		}
 	}

api/git/azure_integration_test.go

@@ -1,13 +1,12 @@
 package git
 
 import (
-	"context"
 	"fmt"
 	"os"
-	"path/filepath"
 	"testing"
 	"time"
 
+	"github.com/portainer/portainer/api/filesystem"
 	gittypes "github.com/portainer/portainer/api/git/types"
 
 	_ "github.com/joho/godotenv/autoload"
@@ -18,10 +17,11 @@ import (
 const privateAzureRepoURL = "https://portainer.visualstudio.com/gitops-test/_git/gitops-test"
 
 func TestService_ClonePublicRepository_Azure(t *testing.T) {
+	t.Parallel()
 	ensureIntegrationTest(t)
 
 	pat := getRequiredValue(t, "AZURE_DEVOPS_PAT")
-	service := NewService(context.TODO())
+	service := NewService(t.Context())
 
 	type args struct {
 		repositoryURLFormat string
@@ -60,53 +60,55 @@ func TestService_ClonePublicRepository_Azure(t *testing.T) {
 			dst := t.TempDir()
 			repositoryUrl := fmt.Sprintf(tt.args.repositoryURLFormat, tt.args.password)
 			err := service.CloneRepository(
+				t.Context(),
 				dst,
 				repositoryUrl,
 				tt.args.referenceName,
 				"",
 				"",
-				gittypes.GitCredentialAuthType_Basic,
 				false,
 			)
 			require.NoError(t, err)
-			assert.FileExists(t, filepath.Join(dst, "README.md"))
+			assert.FileExists(t, filesystem.JoinPaths(dst, "README.md"))
 		})
 	}
 }
 
 func TestService_ClonePrivateRepository_Azure(t *testing.T) {
+	t.Parallel()
 	ensureIntegrationTest(t)
 
 	pat := getRequiredValue(t, "AZURE_DEVOPS_PAT")
-	service := NewService(context.TODO())
+	service := NewService(t.Context())
 
 	dst := t.TempDir()
 
 	err := service.CloneRepository(
+		t.Context(),
 		dst,
 		privateAzureRepoURL,
 		"refs/heads/main",
 		"",
 		pat,
-		gittypes.GitCredentialAuthType_Basic,
 		false,
 	)
 	require.NoError(t, err)
-	assert.FileExists(t, filepath.Join(dst, "README.md"))
+	assert.FileExists(t, filesystem.JoinPaths(dst, "README.md"))
 }
 
 func TestService_LatestCommitID_Azure(t *testing.T) {
+	t.Parallel()
 	ensureIntegrationTest(t)
 
 	pat := getRequiredValue(t, "AZURE_DEVOPS_PAT")
-	service := NewService(context.TODO())
+	service := NewService(t.Context())
 
 	id, err := service.LatestCommitID(
+		t.Context(),
 		privateAzureRepoURL,
 		"refs/heads/main",
 		"",
 		pat,
-		gittypes.GitCredentialAuthType_Basic,
 		false,
 	)
 	require.NoError(t, err)
@@ -114,17 +116,18 @@ func TestService_LatestCommitID_Azure(t *testing.T) {
 }
 
 func TestService_ListRefs_Azure(t *testing.T) {
+	t.Parallel()
 	ensureIntegrationTest(t)
 
 	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
 	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
-	service := NewService(context.TODO())
+	service := NewService(t.Context())
 
 	refs, err := service.ListRefs(
+		t.Context(),
 		privateAzureRepoURL,
 		username,
 		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
 		false,
 		false,
 	)
@@ -133,52 +136,59 @@ func TestService_ListRefs_Azure(t *testing.T) {
 }
 
 func TestService_ListRefs_Azure_Concurrently(t *testing.T) {
+	t.Parallel()
 	ensureIntegrationTest(t)
 
 	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
 	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
-	service := newService(context.TODO(), repositoryCacheSize, 200*time.Millisecond)
+	service := newService(t.Context(), repositoryCacheSize, 200*time.Millisecond)
 
 	go func() {
-		_, _ = service.ListRefs(privateAzureRepoURL, username, accessToken, gittypes.GitCredentialAuthType_Basic, false, false)
+		_, _ = service.ListRefs(t.Context(), privateAzureRepoURL, username, accessToken, false, false)
 	}()
 
-	_, err := service.ListRefs(privateAzureRepoURL, username, accessToken, gittypes.GitCredentialAuthType_Basic, false, false)
+	_, err := service.ListRefs(t.Context(), privateAzureRepoURL, username, accessToken, false, false)
 	require.NoError(t, err)
 
 	time.Sleep(2 * time.Second)
 }
 
 func TestService_ListFiles_Azure(t *testing.T) {
+	t.Parallel()
 	ensureIntegrationTest(t)
 
+	type args struct {
+		repositoryUrl string
+		referenceName string
+		username      string
+		password      string
+		extensions    []string
+	}
+
 	type expectResult struct {
 		shouldFail   bool
 		err          error
 		matchedCount int
 	}
 
-	service := newService(context.TODO(), 0, 0)
+	service := newService(t.Context(), 0, 0)
 	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
 	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
 
 	tests := []struct {
-		name       string
-		args       fetchOption
-		extensions []string
-		expect     expectResult
+		name   string
+		args   args
+		expect expectResult
 	}{
 		{
 			name: "list tree with real repository and head ref but incorrect credential",
-			args: fetchOption{
-				baseOption: baseOption{
-					repositoryUrl: privateAzureRepoURL,
-					username:      "test-username",
-					password:      "test-token",
-				},
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
 				referenceName: "refs/heads/main",
+				username:      "test-username",
+				password:      "test-token",
+				extensions:    []string{},
 			},
-			extensions: []string{},
 			expect: expectResult{
 				shouldFail: true,
 				err:        gittypes.ErrAuthenticationFailure,
@@ -186,15 +196,13 @@ func TestService_ListFiles_Azure(t *testing.T) {
 		},
 		{
 			name: "list tree with real repository and head ref but no credential",
-			args: fetchOption{
-				baseOption: baseOption{
-					repositoryUrl: privateAzureRepoURL,
-					username:      "",
-					password:      "",
-				},
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
 				referenceName: "refs/heads/main",
+				username:      "",
+				password:      "",
+				extensions:    []string{},
 			},
-			extensions: []string{},
 			expect: expectResult{
 				shouldFail: true,
 				err:        gittypes.ErrAuthenticationFailure,
@@ -202,15 +210,13 @@ func TestService_ListFiles_Azure(t *testing.T) {
 		},
 		{
 			name: "list tree with real repository and head ref",
-			args: fetchOption{
-				baseOption: baseOption{
-					repositoryUrl: privateAzureRepoURL,
-					username:      username,
-					password:      accessToken,
-				},
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
 				referenceName: "refs/heads/main",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{},
 			},
-			extensions: []string{},
 			expect: expectResult{
 				err:          nil,
 				matchedCount: 19,
@@ -218,15 +224,13 @@ func TestService_ListFiles_Azure(t *testing.T) {
 		},
 		{
 			name: "list tree with real repository and head ref and existing file extension",
-			args: fetchOption{
-				baseOption: baseOption{
-					repositoryUrl: privateAzureRepoURL,
-					username:      username,
-					password:      accessToken,
-				},
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
 				referenceName: "refs/heads/main",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{"yml"},
 			},
-			extensions: []string{"yml"},
 			expect: expectResult{
 				err:          nil,
 				matchedCount: 2,
@@ -234,15 +238,13 @@ func TestService_ListFiles_Azure(t *testing.T) {
 		},
 		{
 			name: "list tree with real repository and head ref and non-existing file extension",
-			args: fetchOption{
-				baseOption: baseOption{
-					repositoryUrl: privateAzureRepoURL,
-					username:      username,
-					password:      accessToken,
-				},
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
 				referenceName: "refs/heads/main",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{"hcl"},
 			},
-			extensions: []string{"hcl"},
 			expect: expectResult{
 				err:          nil,
 				matchedCount: 2,
@@ -250,30 +252,26 @@ func TestService_ListFiles_Azure(t *testing.T) {
 		},
 		{
 			name: "list tree with real repository but non-existing ref",
-			args: fetchOption{
-				baseOption: baseOption{
-					repositoryUrl: privateAzureRepoURL,
-					username:      username,
-					password:      accessToken,
-				},
+			args: args{
+				repositoryUrl: privateAzureRepoURL,
 				referenceName: "refs/fake/feature",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{},
 			},
-			extensions: []string{},
 			expect: expectResult{
 				shouldFail: true,
 			},
 		},
 		{
 			name: "list tree with fake repository ",
-			args: fetchOption{
-				baseOption: baseOption{
-					repositoryUrl: privateAzureRepoURL + "fake",
-					username:      username,
-					password:      accessToken,
-				},
+			args: args{
+				repositoryUrl: privateAzureRepoURL + "fake",
 				referenceName: "refs/fake/feature",
+				username:      username,
+				password:      accessToken,
+				extensions:    []string{},
 			},
-			extensions: []string{},
 			expect: expectResult{
 				shouldFail: true,
 				err:        gittypes.ErrIncorrectRepositoryURL,
@@ -284,14 +282,14 @@ func TestService_ListFiles_Azure(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			paths, err := service.ListFiles(
+				t.Context(),
 				tt.args.repositoryUrl,
 				tt.args.referenceName,
 				tt.args.username,
 				tt.args.password,
-				gittypes.GitCredentialAuthType_Basic,
 				false,
 				false,
-				tt.extensions,
+				tt.args.extensions,
 				false,
 			)
 
@@ -311,19 +309,20 @@ func TestService_ListFiles_Azure(t *testing.T) {
 }
 
 func TestService_ListFiles_Azure_Concurrently(t *testing.T) {
+	t.Parallel()
 	ensureIntegrationTest(t)
 
 	accessToken := getRequiredValue(t, "AZURE_DEVOPS_PAT")
 	username := getRequiredValue(t, "AZURE_DEVOPS_USERNAME")
-	service := newService(context.TODO(), repositoryCacheSize, 200*time.Millisecond)
+	service := newService(t.Context(), repositoryCacheSize, 200*time.Millisecond)
 
 	go func() {
 		_, _ = service.ListFiles(
+			t.Context(),
 			privateAzureRepoURL,
 			"refs/heads/main",
 			username,
 			accessToken,
-			gittypes.GitCredentialAuthType_Basic,
 			false,
 			false,
 			[]string{},
@@ -332,11 +331,11 @@ func TestService_ListFiles_Azure_Concurrently(t *testing.T) {
 	}()
 
 	_, err := service.ListFiles(
+		t.Context(),
 		privateAzureRepoURL,
 		"refs/heads/main",
 		username,
 		accessToken,
-		gittypes.GitCredentialAuthType_Basic,
 		false,
 		false,
 		[]string{},