Skip to content

Commit 725a541

Browse files
oliverbaehleroliverbaehler
committed
feat: add ci stuff
1 parent d88e390 commit 725a541

18 files changed

+474
-0
lines changed

‎.github/configs/ct.yaml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
## Reference: https://github.com/helm/chart-testing/blob/master/doc/ct_lint-and-install.md
2+
##
3+
remote: origin
4+
target-branch: main
5+
chart-dirs:
6+
- helm/
7+
chart-repos:
8+
- buttahtoast=https://buttahtoast.github.io/helm-charts/
9+
- bitnami=https://charts.bitnami.com/bitnami
10+
validate-chart-schema: true
11+
validate-maintainers: false
12+
validate-yaml: true
13+
exclude-deprecated: true
14+
check-version-increment: false

‎.github/configs/lintconf.yaml

+42
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
---
2+
rules:
3+
braces:
4+
min-spaces-inside: 0
5+
max-spaces-inside: 0
6+
min-spaces-inside-empty: -1
7+
max-spaces-inside-empty: -1
8+
brackets:
9+
min-spaces-inside: 0
10+
max-spaces-inside: 0
11+
min-spaces-inside-empty: -1
12+
max-spaces-inside-empty: -1
13+
colons:
14+
max-spaces-before: 0
15+
max-spaces-after: 1
16+
commas:
17+
max-spaces-before: 0
18+
min-spaces-after: 1
19+
max-spaces-after: 1
20+
comments:
21+
require-starting-space: true
22+
min-spaces-from-content: 1
23+
document-end: disable
24+
document-start: disable # No --- to start a file
25+
empty-lines:
26+
max: 2
27+
max-start: 0
28+
max-end: 0
29+
hyphens:
30+
max-spaces-after: 1
31+
indentation:
32+
spaces: consistent
33+
indent-sequences: whatever # - list indentation will handle both indentation and without
34+
check-multi-line-strings: false
35+
key-duplicates: enable
36+
line-length: disable # Lines can be any length
37+
new-line-at-end-of-file: enable
38+
new-lines:
39+
type: unix
40+
trailing-spaces: enable
41+
truthy:
42+
level: warning

‎.github/dependabot.yml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# To get started with Dependabot version updates, you'll need to specify which
2+
# package ecosystems to update and where the package manifests are located.
3+
# Please see the documentation for all configuration options:
4+
# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
5+
6+
version: 2
7+
updates:
8+
- package-ecosystem: "gomod" # See documentation for possible values
9+
directory: "/" # Location of package manifests
10+
schedule:
11+
interval: "weekly"
12+
- package-ecosystem: "github-actions"
13+
directory: "/"
14+
schedule:
15+
interval: weekly
16+
open-pull-requests-limit: 10
17+
- package-ecosystem: "docker"
18+
directory: "/"
19+
schedule:
20+
interval: weekly

‎.github/workflows/check-actions.yaml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Check actions
2+
permissions: {}
3+
4+
on:
5+
push:
6+
branches:
7+
- '*'
8+
pull_request:
9+
branches: [ "master", "main" ]
10+
11+
jobs:
12+
check:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
17+
- name: Ensure SHA pinned actions
18+
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@f32435541e24cd6a4700a7f52bb2ec59e80603b1 # v2.1.4
19+
with:
20+
# slsa-github-generator requires using a semver tag for reusable workflows.
21+
# See: https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators
22+
allowlist: |
23+
slsa-framework/slsa-github-generator

‎.github/workflows/check-commit.yml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Check Commit
2+
permissions: {}
3+
4+
on:
5+
push:
6+
branches: [ "*" ]
7+
pull_request:
8+
branches: [ "*" ]
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
14+
jobs:
15+
commit_lint:
16+
runs-on: ubuntu-20.04
17+
steps:
18+
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
19+
with:
20+
fetch-depth: 0
21+
- uses: wagoid/commitlint-github-action@6319f54d83768b60acd6fd60e61007ccc583e62f #v5.4.3
22+
with:
23+
firstParent: true

‎.github/workflows/codecov.yml

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Integration Test
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- "master"
7+
push:
8+
branches:
9+
- "master"
10+
11+
permissions: read-all
12+
13+
jobs:
14+
integration-test:
15+
runs-on: ubuntu-latest
16+
steps:
17+
- uses: actions/checkout@v2
18+
- name: Check secret
19+
id: checksecret
20+
uses: oliverbaehler/github-actions/exists@8dfd42735c85f6c58d5d4d6f3232cd0e39d1fe73 # v0.1.0
21+
with:
22+
value: ${{ secrets.CODECOV_TOKEN }}
23+
- uses: actions/setup-go@v4
24+
with:
25+
go-version: '1.19'
26+
- name: Run integration tests
27+
run: |
28+
make integration-test
29+
- name: Upload coverage reports to Codecov
30+
if: steps.checksecret.outputs.result == 'true'
31+
uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
32+
with:
33+
files: ./test/integration/cover.out
34+
env:
35+
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

‎.github/workflows/docker-build.yml

+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Build images
2+
permissions: {}
3+
4+
on:
5+
push:
6+
branches:
7+
- '*'
8+
pull_request:
9+
branches: [ "master", "main" ]
10+
11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.ref }}
13+
cancel-in-progress: true
14+
15+
jobs:
16+
build-images:
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
21+
- name: ko build
22+
run: VERSION=${{ github.ref_name }} REPOSITORY=${GITHUB_REPOSITORY} make ko-build-all
23+
- name: Trivy Scan Image
24+
uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # v0.12.0
25+
with:
26+
scan-type: 'fs'
27+
ignore-unfixed: true
28+
format: 'sarif'
29+
output: 'trivy-results.sarif'
30+
severity: 'CRITICAL,HIGH'

‎.github/workflows/docker-publish.yml

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: Publish images
2+
permissions: {}
3+
on:
4+
push:
5+
tags:
6+
- "v*"
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.ref }}
9+
cancel-in-progress: true
10+
jobs:
11+
publish-images:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
packages: write
15+
id-token: write
16+
outputs:
17+
container-digest: ${{ steps.publish.outputs.digest }}
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
21+
- name: "Extract Version"
22+
id: extract_version
23+
run: |
24+
GIT_TAG=${GITHUB_REF##*/}
25+
VERSION=${GIT_TAG##v}
26+
echo "version=$(echo $VERSION)" >> $GITHUB_OUTPUT
27+
- name: Run Trivy vulnerability (Repo)
28+
uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # v0.12.0
29+
with:
30+
scan-type: 'fs'
31+
ignore-unfixed: true
32+
format: 'sarif'
33+
output: 'trivy-results.sarif'
34+
severity: 'CRITICAL,HIGH'
35+
- name: Install Cosign
36+
uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
37+
- name: Publish with KO
38+
id: publish
39+
uses: oliverbaehler/github-actions/ko-publish-image@8dfd42735c85f6c58d5d4d6f3232cd0e39d1fe73 # v0.1.0
40+
with:
41+
makefile-target: ko-publish-all
42+
registry: ghcr.io
43+
registry-username: ${{ github.actor }}
44+
registry-password: ${{ secrets.GITHUB_TOKEN }}
45+
repository: ${{ github.repository_owner }}
46+
version: ${{ steps.extract_version.outputs.version }}
47+
sign-image: true
48+
sbom-name: svc-ingress-propagator
49+
sbom-repository: ghcr.io/${{ github.repository_owner }}/sbom
50+
signature-repository: ghcr.io/${{ github.repository_owner }}/signatures
51+
main-path: ./cmd/
52+
env:
53+
REPOSITORY: ${{ github.repository }}
54+
VERSION: ${{ steps.extract_version.outputs.version }}
55+
generate-provenance:
56+
needs: publish-images
57+
permissions:
58+
id-token: write # To sign the provenance.
59+
packages: write # To upload assets to release.
60+
actions: read # To read the workflow path.
61+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0
62+
with:
63+
image: ghcr.io/${{ github.repository_owner }}/svc-ingress-propagator
64+
digest: "${{ needs.publish-images.outputs.container-digest }}"
65+
registry-username: ${{ github.actor }}
66+
secrets:
67+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/helm-publish.yml

+52
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: Publish charts
2+
permissions: read-all
3+
on:
4+
push:
5+
tags:
6+
- "v*"
7+
jobs:
8+
publish-helm:
9+
runs-on: ubuntu-20.04
10+
permissions:
11+
contents: write
12+
id-token: write
13+
packages: write
14+
outputs:
15+
chart-digest: ${{ steps.helm_publish.outputs.digest }}
16+
steps:
17+
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
18+
- uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
19+
- name: "Extract Version"
20+
id: extract_version
21+
run: |
22+
GIT_TAG=${GITHUB_REF##*/}
23+
VERSION=${GIT_TAG##v}
24+
echo "version=$(echo $VERSION)" >> $GITHUB_OUTPUT
25+
- name: Helm | Publish
26+
id: helm_publish
27+
uses: oliverbaehler/github-actions/helm-oci-chart@dev
28+
with:
29+
registry: ghcr.io
30+
repository: ${{ github.repository_owner }}/charts
31+
name: "svc-ingress-propagator"
32+
path: "./helm"
33+
app-version: ${{ steps.extract_version.outputs.version }}
34+
version: ${{ steps.extract_version.outputs.version }}
35+
registry-username: ${{ github.actor }}
36+
registry-password: ${{ secrets.GITHUB_TOKEN }}
37+
update-dependencies: 'true' # Defaults to false
38+
sign-image: 'true'
39+
signature-repository: ghcr.io/${{ github.repository_owner }}/signatures
40+
helm-provenance:
41+
needs: publish-helm
42+
permissions:
43+
id-token: write # To sign the provenance.
44+
packages: write # To upload assets to release.
45+
actions: read # To read the workflow path.
46+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.9.0
47+
with:
48+
image: ghcr.io/${{ github.repository_owner }}/charts/svc-ingress-propagator
49+
digest: "${{ needs.publish-helm.outputs.chart-digest }}"
50+
registry-username: ${{ github.actor }}
51+
secrets:
52+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/helm-test.yml

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: Test charts
2+
permissions: {}
3+
4+
on:
5+
push:
6+
branches: [ "*" ]
7+
pull_request:
8+
branches: [ "master", "main" ]
9+
10+
jobs:
11+
lint:
12+
runs-on: ubuntu-20.04
13+
steps:
14+
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
15+
with:
16+
fetch-depth: 0
17+
- uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3
18+
- name: Setup Chart Linting
19+
id: lint
20+
uses: helm/chart-testing-action@e8788873172cb653a90ca2e819d79d65a66d4e76 # v2.4.0
21+
- name: Run chart-testing (list-changed)
22+
id: list-changed
23+
run: |
24+
changed=$(ct list-changed --config .github/configs/ct.yaml)
25+
if [[ -n "$changed" ]]; then
26+
echo "::set-output name=changed::true"
27+
fi
28+
- name: Run chart-testing (lint)
29+
run: ct lint --debug --config .github/configs/ct.yaml --lint-conf .github/configs/lintconf.yaml
30+
- name: Run docs-testing (helm-docs)
31+
id: helm-docs
32+
run: |
33+
make helm-docs
34+
if [[ $(git diff --stat) != '' ]]; then
35+
echo -e '\033[0;31mDocumentation outdated! (Run make helm-docs locally and commit)\033[0m ❌'
36+
git diff --color
37+
exit 1
38+
else
39+
echo -e '\033[0;32mDocumentation up to date\033[0m ✔'
40+
fi
41+
42+
## Create KIND Cluster
43+
- name: Create kind cluster
44+
uses: helm/kind-action@dda0770415bac9fc20092cacbc54aa298604d140 # v1.8.0
45+
if: steps.list-changed.outputs.changed == 'true'
46+
47+
# Install Charts
48+
- name: Run chart-testing (install)
49+
run: ct install --debug --config .github/configs/ct.yaml
50+
if: steps.list-changed.outputs.changed == 'true'

0 commit comments

Comments
 (0)