Skip to content

Commit f98a42f

Browse files
g-bggg-bgg
authored
bump deps, add Kind CI, cleanup, bug fixes (#43)
1 parent 374e951 commit f98a42f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+1072
-6501
lines changed

‎.github/workflows/build.yaml‎

Lines changed: 38 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,65 @@
11
name: Lint and Build
22
on:
33
push:
4-
## do not lint and build when tagged, we already do that in push to master
54
tags-ignore:
65
- '*'
7-
86
branches:
97
- '*'
108
pull_request:
119
branches: ['main', 'master']
1210

1311
jobs:
14-
# lint:
15-
# runs-on: ubuntu-latest
16-
# steps:
17-
# - name: Checkout repository
18-
# uses: actions/checkout@v3
19-
20-
# - name: Run golangci-lint
21-
# uses: reviewdog/action-golangci-lint@v2
22-
# with:
23-
# go_version: "1.24.3"
24-
# golangci_lint_flags: "--timeout=5m0s"
12+
lint:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout repository
16+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
17+
18+
- name: Run golangci-lint
19+
uses: reviewdog/action-golangci-lint@f9bba13753278f6a73b27a56a3ffb1bfda90ed71 # v2
20+
with:
21+
go_version: "1.25.4"
22+
fail_level: "none"
23+
2524
build:
2625
runs-on: ubuntu-latest
27-
#needs: lint
26+
needs: lint
2827
steps:
2928
- name: Checkout source code
30-
uses: actions/checkout@v3
29+
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
3130

3231
- name: Setup Go
33-
uses: actions/setup-go@v3
32+
uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
3433
with:
35-
go-version: '1.24.3'
34+
go-version: '1.25.4'
3635

3736
- name: Install dependencies
3837
run: go get ./...
3938

4039
- name: Test
4140
run: go test -v ./... --race
4241

42+
- name: E2E Test
43+
env:
44+
KIND_E2E_TESTS: yes
45+
run: go test -timeout 20m -v ./e2e/...
46+
4347
- name: Build
4448
run: go build -v ./...
49+
50+
- name: Build Container
51+
run: go build -v ./...
52+
53+
- name: Build an image from Dockerfile
54+
run: |
55+
docker build -t controlplane/netassert:${{ github.sha }} .
56+
57+
- name: Run Trivy vulnerability scanner
58+
uses: aquasecurity/trivy-action@master
59+
with:
60+
image-ref: 'controlplane/netassert:${{ github.sha }}'
61+
format: 'table'
62+
ignore-unfixed: true
63+
exit-code: '1'
64+
vuln-type: 'os,library'
65+
severity: 'CRITICAL,HIGH,MEDIUM'

‎.github/workflows/release.yaml‎

Lines changed: 65 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -8,98 +8,116 @@ on:
88

99
permissions:
1010
contents: write
11+
packages: write
12+
id-token: write
13+
attestations: write
1114

1215
env:
1316
GH_REGISTRY: ghcr.io
1417
IMAGE_NAME: ${{ github.repository }}
1518
RELEASE_VERSION: ${{ github.ref_name }}
19+
SCANNER_IMG_VERSION: v1.0.11
20+
SNIFFER_IMG_VERSION: v1.1.9
1621

1722
jobs:
1823
goreleaser:
1924
runs-on: ubuntu-latest
2025
steps:
2126
- name: Checkout
22-
uses: actions/checkout@v3
27+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
28+
2329
- name: Set up Go
24-
uses: actions/setup-go@v3
30+
uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
2531
with:
26-
go-version: '1.24.3'
27-
- uses: anchore/sbom-action/download-syft@v0.20.6
32+
go-version: '1.25.4'
33+
34+
- uses: anchore/sbom-action/download-syft@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # v0.20.6
35+
2836
- name: Run GoReleaser
29-
uses: goreleaser/goreleaser-action@v4
37+
uses: goreleaser/goreleaser-action@5fdedb94abba051217030cc86d4523cf3f02243d # v4
3038
with:
3139
distribution: goreleaser
3240
args: release --clean
3341
env:
3442
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
3543

36-
packagerelease:
44+
docker:
3745
runs-on: ubuntu-latest
38-
permissions:
39-
contents: read
40-
packages: write
41-
attestations: write
42-
id-token: write
46+
4347
steps:
4448
- name: Checkout repository
45-
uses: actions/checkout@v5
49+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
50+
51+
# - name: Extract metadata (tags, labels) for Docker
52+
# id: meta
53+
# uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
54+
# with:
55+
# images: ${{ env.GH_REGISTRY }}/${{ env.IMAGE_NAME }}
56+
57+
- name: Set up QEMU
58+
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
59+
60+
- name: Set up Docker Buildx
61+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
62+
63+
- name: Install cosign
64+
uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
65+
4666
- name: Log in to the GitHub Container registry
4767
uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
4868
with:
4969
registry: ${{ env.GH_REGISTRY }}
5070
username: ${{ github.actor }}
5171
password: ${{ secrets.GITHUB_TOKEN }}
52-
- name: Extract metadata (tags, labels) for Docker
53-
id: meta
54-
uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
55-
with:
56-
images: ${{ env.GH_REGISTRY }}/${{ env.IMAGE_NAME }}
57-
- name: Set up QEMU
58-
uses: docker/setup-qemu-action@v3
59-
- name: Set up Docker Buildx
60-
uses: docker/setup-buildx-action@v3
61-
- name: Build and push Docker image
62-
id: push
63-
uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
64-
with:
65-
context: .
66-
platforms: linux/amd64,linux/arm64
67-
push: true
68-
tags: ${{ steps.meta.outputs.tags }}
69-
labels: ${{ steps.meta.outputs.labels }}
70-
build-args: |
71-
VERSION=${{ env.RELEASE_VERSION }}
72+
7273
- name: Login to Docker Hub
73-
uses: docker/login-action@v2
74+
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
7475
with:
7576
username: ${{ secrets.DOCKERHUB_USERNAME }}
7677
password: ${{ secrets.DOCKERHUB_TOKEN }}
78+
7779
- name: Build and push
78-
uses: docker/build-push-action@v4
80+
id: buildpush
81+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
7982
with:
80-
context: .
8183
platforms: linux/amd64,linux/arm64
84+
sbom: true
85+
provenance: mode=max
8286
push: true
8387
tags: |
84-
controlplane/netassert:${{ github.ref_name }}
85-
controlplane/netassert:latest
88+
docker.io/controlplane/netassert:${{ env.RELEASE_VERSION }}
89+
docker.io/controlplane/netassert:latest
90+
${{ env.GH_REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.RELEASE_VERSION }}
91+
${{ env.GH_REGISTRY }}/${{ env.IMAGE_NAME }}:latest
8692
build-args: |
8793
VERSION=${{ env.RELEASE_VERSION }}
94+
SCANNER_IMG_VERSION=${{ env.SCANNER_IMG_VERSION }}
95+
SNIFFER_IMG_VERSION=${{ env.SNIFFER_IMG_VERSION }}
8896
89-
- name: Generate artifact attestation
90-
uses: actions/attest-build-provenance@v3
91-
with:
92-
subject-name: ${{ env.GH_REGISTRY }}/${{ env.IMAGE_NAME}}
93-
subject-digest: ${{ steps.push.outputs.digest }}
94-
push-to-registry: true
97+
- name: Sign artifact
98+
run: |
99+
cosign sign --yes \
100+
"${{ env.GH_REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.buildpush.outputs.digest }}"
101+
cosign sign --yes \
102+
"docker.io/controlplane/netassert@${{ steps.buildpush.outputs.digest }}"
103+
104+
helm:
105+
runs-on: ubuntu-latest
106+
107+
steps:
108+
- name: Checkout repository
109+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
95110

96111
- name: Set up Helm
97-
uses: azure/setup-helm@v4
112+
uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4
113+
98114
- name: Setup yq
99-
uses: mikefarah/yq@v4
115+
uses: mikefarah/yq@065b200af9851db0d5132f50bc10b1406ea5c0a8 # v4
116+
100117
- name: Log in to GitHub Container Registry
101118
run: |
102119
echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${{ github.actor }} --password-stdin
120+
103121
- name: Prepare and package Helm chart
104122
run: |
105123
CLEAN_VERSION=$(echo "$RELEASE_VERSION" | sed 's/^v//')
@@ -108,7 +126,8 @@ jobs:
108126
yq -i ".version = \"${CLEAN_VERSION}\"" ./helm/Chart.yaml
109127
yq -i ".appVersion = \"${CLEAN_VERSION}\"" ./helm/Chart.yaml
110128
helm package ./helm -d .
129+
111130
- name: Push Helm chart to GHCR
112131
run: |
113132
CLEAN_VERSION=$(echo "$RELEASE_VERSION" | sed 's/^v//')
114-
helm push "./netassert-${CLEAN_VERSION}.tgz" oci://ghcr.io/${{ github.repository_owner }}/charts
133+
helm push "./netassert-${CLEAN_VERSION}.tgz" oci://ghcr.io/${{ github.repository_owner }}/charts

‎Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
1-
FROM golang:1.24-alpine AS builder
1+
FROM golang:1.25-alpine AS builder
22

33
ARG VERSION
44

55
COPY . /build
66
WORKDIR /build
77

88
RUN go mod download && \
9-
CGO_ENABLED=0 GO111MODULE=on go build -ldflags="-X 'main.appName=NetAssert' -X 'main.version=${VERSION}'" -v -o /netassertv2 cmd/netassert/cli/*.go && \
9+
CGO_ENABLED=0 GO111MODULE=on go build -ldflags="-X 'main.appName=NetAssert' -X 'main.version=${VERSION}' -X 'main.scannerImgVersion=${SCANNER_IMG_VERSION}' -X 'main.snifferImgVersion=${SNIFFER_IMG_VERSION}'" -v -o /netassertv2 cmd/netassert/cli/*.go && \
1010
ls -ltr /netassertv2
1111

1212
FROM gcr.io/distroless/base:nonroot

0 commit comments

Comments
 (0)