Skip to content

Commit e8c656b

Browse files
akijakyaakijakya
committed
feat(ci): add dependabot and Github Actions
Signed-off-by: András Jáky <ajaky@cisco.com> Signed-off-by: András Jáky <ajaky@cisco.com>
1 parent 8468111 commit e8c656b

File tree

5 files changed

+949
-0
lines changed

5 files changed

+949
-0
lines changed

‎.github/dependabot.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
version: 2
2+
3+
updates:
4+
- package-ecosystem: "gomod"
5+
directory: "/"
6+
schedule:
7+
interval: "daily"
8+
9+
- package-ecosystem: "docker"
10+
directory: "/"
11+
schedule:
12+
interval: "daily"
13+
14+
- package-ecosystem: "github-actions"
15+
directory: "/"
16+
schedule:
17+
interval: "daily"

‎.github/workflows/artifacts.yaml‎

Lines changed: 268 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,268 @@
1+
name: Artifacts
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
publish:
7+
description: Publish artifacts to the artifact store
8+
default: false
9+
required: false
10+
type: boolean
11+
release:
12+
description: Whether this is a release build
13+
default: false
14+
required: false
15+
type: boolean
16+
outputs:
17+
container-image-name:
18+
description: Container image name
19+
value: ${{ jobs.container-image.outputs.name }}
20+
container-image-digest:
21+
description: Container image digest
22+
value: ${{ jobs.container-image.outputs.digest }}
23+
container-image-tag:
24+
description: Container image tag
25+
value: ${{ jobs.container-image.outputs.tag }}
26+
container-image-ref:
27+
description: Container image ref
28+
value: ${{ jobs.container-image.outputs.ref }}
29+
helm-chart-name:
30+
description: Helm chart OCI name
31+
value: ${{ jobs.helm-chart.outputs.name }}
32+
helm-chart-tag:
33+
description: Helm chart tag
34+
value: ${{ jobs.helm-chart.outputs.tag }}
35+
helm-chart-package:
36+
description: Helm chart package name
37+
value: ${{ jobs.helm-chart.outputs.package }}
38+
39+
permissions:
40+
contents: read
41+
42+
jobs:
43+
container-image:
44+
name: Container image
45+
runs-on: ubuntu-latest
46+
47+
permissions:
48+
contents: read
49+
packages: write
50+
id-token: write
51+
security-events: write
52+
53+
outputs:
54+
name: ${{ steps.image-name.outputs.value }}
55+
digest: ${{ steps.build.outputs.digest }}
56+
tag: ${{ steps.meta.outputs.version }}
57+
ref: ${{ steps.image-ref.outputs.value }}
58+
59+
steps:
60+
- name: Checkout repository
61+
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
62+
63+
- name: Set up QEMU
64+
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
65+
66+
- name: Set up Docker Buildx
67+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
68+
69+
- name: Set image name
70+
id: image-name
71+
run: echo "value=ghcr.io/${{ github.repository }}" >> "$GITHUB_OUTPUT"
72+
73+
- name: Gather build metadata
74+
id: meta
75+
uses: docker/metadata-action@96383f45573cb7f253c731d3b3ab81c87ef81934 # v5.0.0
76+
with:
77+
images: ${{ steps.image-name.outputs.value }}
78+
flavor: |
79+
latest = false
80+
tags: |
81+
type=ref,event=branch
82+
type=ref,event=pr,prefix=pr-
83+
type=semver,pattern={{raw}}
84+
type=raw,value=latest,enable={{is_default_branch}}
85+
86+
# Multiple exporters are not supported yet
87+
# See https://github.com/moby/buildkit/pull/2760
88+
- name: Determine build output
89+
uses: haya14busa/action-cond@1d6e8a12b20cdb4f1954feef9aa475b9c390cab5 # v1.1.1
90+
id: build-output
91+
with:
92+
cond: ${{ inputs.publish }}
93+
if_true: type=image,push=true
94+
if_false: type=oci,dest=image.tar
95+
96+
- name: Login to GitHub Container Registry
97+
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
98+
with:
99+
registry: ghcr.io
100+
username: ${{ github.actor }}
101+
password: ${{ github.token }}
102+
if: inputs.publish
103+
104+
- name: Build and push image
105+
id: build
106+
uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0
107+
with:
108+
context: .
109+
platforms: linux/amd64,linux/arm64,linux/arm/v7
110+
tags: ${{ steps.meta.outputs.tags }}
111+
labels: ${{ steps.meta.outputs.labels }}
112+
cache-from: type=gha
113+
cache-to: type=gha,mode=max
114+
outputs: ${{ steps.build-output.outputs.value }}
115+
# push: ${{ inputs.publish }}
116+
117+
- name: Set image ref
118+
id: image-ref
119+
run: echo "value=${{ steps.image-name.outputs.value }}@${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"
120+
121+
- name: Fetch image
122+
run: skopeo --insecure-policy copy docker://${{ steps.image-name.outputs.value }}:${{ steps.meta.outputs.version }} oci-archive:image.tar
123+
if: inputs.publish
124+
125+
- name: Upload image as artifact
126+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
127+
with:
128+
name: "[${{ github.job }}] OCI tarball"
129+
path: image.tar
130+
131+
- name: Extract OCI tarball
132+
run: |
133+
mkdir -p image
134+
tar -xf image.tar -C image
135+
136+
# See https://github.com/anchore/syft/issues/1545
137+
- name: Extract image from multi-arch image
138+
run: skopeo --override-os linux --override-arch amd64 --insecure-policy copy --additional-tag ${{ steps.image-name.outputs.value }}:${{ steps.meta.outputs.version }} oci:image docker-archive:docker.tar
139+
140+
- name: Upload image as artifact
141+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
142+
with:
143+
name: "[${{ github.job }}] Docker tarball"
144+
path: docker.tar
145+
146+
- name: Run Trivy vulnerability scanner
147+
uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # 0.12.0
148+
with:
149+
input: image
150+
format: sarif
151+
output: trivy-results.sarif
152+
153+
- name: Upload Trivy scan results as artifact
154+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
155+
with:
156+
name: "[${{ github.job }}] Trivy scan results"
157+
path: trivy-results.sarif
158+
retention-days: 5
159+
160+
- name: Upload Trivy scan results to GitHub Security tab
161+
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
162+
with:
163+
sarif_file: trivy-results.sarif
164+
165+
helm-chart:
166+
name: Helm chart
167+
runs-on: ubuntu-latest
168+
169+
permissions:
170+
contents: read
171+
packages: write
172+
id-token: write
173+
security-events: write
174+
175+
outputs:
176+
name: ${{ steps.oci-chart-name.outputs.value }}
177+
tag: ${{ steps.version.outputs.value }}
178+
package: ${{ steps.build.outputs.package }}
179+
180+
steps:
181+
- name: Checkout repository
182+
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
183+
184+
- name: Set up Helm
185+
uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3.5
186+
with:
187+
version: v3.12.0
188+
189+
- name: Set chart name
190+
id: chart-name
191+
run: echo "value=${{ github.event.repository.name }}" >> "$GITHUB_OUTPUT"
192+
193+
- name: Set OCI registry name
194+
id: oci-registry-name
195+
run: echo "value=ghcr.io/${{ github.repository_owner }}/helm-charts" >> "$GITHUB_OUTPUT"
196+
197+
- name: Set OCI chart name
198+
id: oci-chart-name
199+
run: echo "value=${{ steps.oci-registry-name.outputs.value }}/${{ steps.chart-name.outputs.value }}" >> "$GITHUB_OUTPUT"
200+
201+
- name: Helm lint
202+
run: helm lint deploy/charts/${{ steps.chart-name.outputs.value }}
203+
204+
- name: Determine raw version
205+
uses: haya14busa/action-cond@1d6e8a12b20cdb4f1954feef9aa475b9c390cab5 # v1.1.1
206+
id: raw-version
207+
with:
208+
cond: ${{ inputs.release }}
209+
if_true: ${{ github.ref_name }}
210+
if_false: v0.0.0
211+
212+
- name: Determine version
213+
id: version
214+
run: |
215+
VERSION=${{ steps.raw-version.outputs.value }}
216+
echo "value=${VERSION#v}" >> "$GITHUB_OUTPUT"
217+
218+
- name: Helm package
219+
id: build
220+
run: |
221+
helm package deploy/charts/${{ steps.chart-name.outputs.value }} --version ${{ steps.version.outputs.value }} --app-version ${{ steps.raw-version.outputs.value }}
222+
echo "package=${{ steps.chart-name.outputs.value }}-${{ steps.version.outputs.value }}.tgz" >> "$GITHUB_OUTPUT"
223+
224+
- name: Upload chart as artifact
225+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
226+
with:
227+
name: "[${{ github.job }}] Helm chart"
228+
path: ${{ steps.build.outputs.package }}
229+
230+
- name: Login to GitHub Container Registry
231+
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
232+
with:
233+
registry: ghcr.io
234+
username: ${{ github.actor }}
235+
password: ${{ github.token }}
236+
if: inputs.publish && inputs.release
237+
238+
- name: Helm push
239+
run: helm push ${{ steps.build.outputs.package }} oci://${{ steps.oci-registry-name.outputs.value }}
240+
env:
241+
HELM_REGISTRY_CONFIG: ~/.docker/config.json
242+
if: inputs.publish && inputs.release
243+
244+
- name: Upload package as artifact
245+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
246+
with:
247+
name: "[${{ github.job }}] package"
248+
path: ${{ steps.build.outputs.package }}
249+
250+
- name: Run Trivy vulnerability scanner
251+
uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # 0.12.0
252+
with:
253+
scan-type: config
254+
scan-ref: deploy/charts/${{ steps.chart-name.outputs.value }}
255+
format: sarif
256+
output: trivy-results.sarif
257+
258+
- name: Upload Trivy scan results as artifact
259+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
260+
with:
261+
name: "[${{ github.job }}] Trivy scan results"
262+
path: trivy-results.sarif
263+
retention-days: 5
264+
265+
- name: Upload Trivy scan results to GitHub Security tab
266+
uses: github/codeql-action/upload-sarif@cdcdbb579706841c47f7063dda365e292e5cad7a # v2.13.4
267+
with:
268+
sarif_file: trivy-results.sarif

0 commit comments

Comments
 (0)