Skip to content

Commit 71f7e15

Browse files
nnicorannicora
authored
Merge branch 'main' into dependabot/go_modules/k8s.io/apimachinery-0.34.0-alpha.1
2 parents 5887d99 + f941b72 commit 71f7e15

File tree

11 files changed

+283
-217
lines changed

11 files changed

+283
-217
lines changed

‎.github/pull_request_template.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
<!-- Format of PR Title: <category>: <description>
22
Possible values:
3-
- category: breaking|feature|doc|build|chore|ci|docs|feature|fix|perf|refactor|revert|style|test
3+
- category: breaking|feat|doc|build|chore|ci|docs|fix|perf|refactor|revert|style|test
44
- description: <short description of the PR>
5+
6+
Following the conventional commits: https://www.conventionalcommits.org
57
-->
68

79
**What this PR does / why we need it**:

‎.github/workflows/chart-release.yaml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Release Helm Chart
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
paths:
7+
- 'charts/**'
8+
9+
permissions:
10+
packages: write
11+
12+
env:
13+
OCI_URL: ghcr.io/openkcm
14+
15+
jobs:
16+
release-chart:
17+
runs-on: ubuntu-24.04
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21+
with:
22+
fetch-tags: true
23+
fetch-depth: 0
24+
submodules: recursive
25+
26+
- name: Login to GitHub Container Registry
27+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
28+
with:
29+
registry: ghcr.io
30+
username: ${{ github.actor }}
31+
password: ${{ secrets.GITHUB_TOKEN }}
32+
33+
- name: Checkout build (taskfiles) repo
34+
run: |
35+
git clone https://github.com/openkcm/build.git ./hack/common
36+
37+
- name: Install Task
38+
uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 #v2.0.0
39+
with:
40+
version: 3.x
41+
42+
- name: Package and Push Helm Charts
43+
run: |
44+
task build:helm:all --verbose

‎.github/workflows/ci.yaml

Lines changed: 25 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,19 @@ on:
55
- v*
66
branches:
77
- main
8+
paths-ignore:
9+
- 'charts/**'
10+
- 'docs/**'
11+
- 'LICENSES/**'
12+
- '.releases/**'
13+
- '.github/**'
814
pull_request:
915

16+
permissions:
17+
contents: read
18+
1019
jobs:
11-
build:
20+
validate-and-testing:
1221
runs-on: ubuntu-24.04
1322

1423
steps:
@@ -17,25 +26,6 @@ jobs:
1726
with:
1827
submodules: recursive
1928

20-
- name: Extract repository name
21-
id: repo
22-
run: |
23-
echo "repo_name=$(basename "$GITHUB_REPOSITORY")" >> $GITHUB_ENV
24-
25-
- name: Generate Build Version
26-
uses: hashicorp/actions-generate-metadata@f6f1ca9cededa05d841a58d171064faf3de8ec74 #main
27-
id: execute
28-
with:
29-
repositoryOwner: ${{ github.repository_owner }}
30-
repository: ${{ github.repository }}
31-
version: cat VERSION
32-
product: ${{ env.repo_name }}
33-
metadataFileName: ${{ github.workspace }}/build_version.json
34-
35-
- name: Print Build Version
36-
shell: bash
37-
run: cat ${{ github.workspace }}/build_version.json
38-
3929
- name: Set up Go
4030
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
4131
with:
@@ -49,11 +39,24 @@ jobs:
4939
uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 #v2.0.0
5040
with:
5141
version: 3.x
52-
env:
53-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
42+
43+
- name: Set up environment
44+
run: |
45+
echo "repo_name=$(basename "$GITHUB_REPOSITORY")" >> $GITHUB_ENV
46+
echo "version=$(task version)" >> $GITHUB_ENV
47+
48+
- name: Generate Build Version
49+
uses: hashicorp/actions-generate-metadata@f6f1ca9cededa05d841a58d171064faf3de8ec74 #main
50+
with:
51+
repositoryOwner: ${{ github.repository_owner }}
52+
repository: ${{ github.repository }}
53+
version: ${{ env.version }}
54+
product: ${{ env.repo_name }}
55+
metadataFileName: ${{ github.workspace }}/build_version.json
5456

5557
- name: task validate
5658
run: task validate --verbose
5759

5860
- name: task test
5961
run: task test --verbose
62+

‎.github/workflows/publish.yaml

Lines changed: 28 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Publish to GHCR
1+
name: Publish
22
on:
33
push:
44
tags:
@@ -16,7 +16,7 @@ env:
1616
OCI_URL: ghcr.io/openkcm
1717

1818
jobs:
19-
release_tag:
19+
release-next-version-tag:
2020
name: Release version
2121
runs-on: ubuntu-24.04
2222
steps:
@@ -30,58 +30,50 @@ jobs:
3030
- name: Checkout code
3131
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3232
with:
33-
token: ${{ steps.generate-token.outputs.token }}
3433
fetch-tags: true
3534
fetch-depth: 0
3635
submodules: recursive
3736

38-
- name: Extract repository name
39-
id: repo
37+
- name: Checkout build (taskfiles) repo
38+
run: |
39+
git clone https://github.com/openkcm/build.git ./hack/common
40+
41+
- name: Install Task
42+
uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 #v2.0.0
43+
with:
44+
version: 3.x
45+
46+
- name: Set up environment
4047
run: |
4148
echo "repo_name=$(basename "$GITHUB_REPOSITORY")" >> $GITHUB_ENV
49+
echo "version=$(task version)" >> $GITHUB_ENV
4250
4351
- name: Generate Build Version
4452
uses: hashicorp/actions-generate-metadata@f6f1ca9cededa05d841a58d171064faf3de8ec74 #main
45-
id: execute
4653
with:
4754
repositoryOwner: ${{ github.repository_owner }}
4855
repository: ${{ github.repository }}
49-
version: cat VERSION
56+
version: ${{ env.version }}
5057
product: ${{ env.repo_name }}
5158
metadataFileName: ${{ github.workspace }}/build_version.json
5259

5360
- name: Print Build Version
54-
shell: bash
5561
run: cat ${{ github.workspace }}/build_version.json
5662

57-
- name: Checkout build (taskfiles) repo
58-
run: |
59-
git clone https://github.com/openkcm/build.git ./hack/common
60-
61-
- name: Install Task
62-
uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 #v2.0.0
63+
- name: Run trivy repository security scanner
64+
uses: aquasecurity/trivy-action@76071ef0d7ec797419534a183b498b4d6366cf37 #v0.31.0
6365
with:
64-
version: 3.x
65-
env:
66-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
67-
68-
- name: Read and validate VERSION
69-
id: version
70-
run: |
71-
VERSION=$(task version)
72-
if [[ ! "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-dev(-[0-9a-f]*)?)?$ ]]; then
73-
echo "Invalid version format: $VERSION"
74-
exit 1
75-
fi
76-
echo "New version: $VERSION"
77-
echo "version=$VERSION" >> $GITHUB_ENV
78-
79-
- name: Skip release if version is a dev version
80-
if: contains(env.version, '-dev')
81-
run: |
82-
echo "Skipping development version release: ${{ env.version }}"
83-
echo "SKIP=true" >> $GITHUB_ENV
84-
exit 0
66+
token-setup-trivy: ${{ steps.generate-token.outputs.token }}
67+
scan-type: repository
68+
format: json
69+
output: trivy-repository-vuln.json
70+
severity: CRITICAL,HIGH,MEDIUM
71+
72+
- name: Run tfsec security scanner
73+
uses: aquasecurity/tfsec-action@b466648d6e39e7c75324f25d83891162a721f2d6 #v1.0.3
74+
with:
75+
github_token: ${{ steps.generate-token.outputs.token }}
76+
format: json
8577

8678
- name: Set up QEMU
8779
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
@@ -100,7 +92,7 @@ jobs:
10092

10193
- name: Set up Docker Buildx
10294
timeout-minutes: 5
103-
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
95+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
10496
with:
10597
version: latest
10698

0 commit comments

Comments
 (0)