Skip to content

Commit b0731f6

Browse files
kristofgyuraczkristofgyuracz
authored
Merge branch 'main' into status-and-notification-notes
Signed-off-by: Kristóf Gyurácz <[email protected]>
2 parents ed32153 + 876d472 commit b0731f6

24 files changed

+1335
-517
lines changed

‎.github/workflows/artifacts.yaml

+145
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
name: Artifacts
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
publish:
7+
description: Publish artifacts to the artifact store
8+
default: false
9+
required: false
10+
type: boolean
11+
release:
12+
description: Whether this is a release build
13+
default: false
14+
required: false
15+
type: boolean
16+
outputs:
17+
container-image-name:
18+
description: Container image name
19+
value: ${{ jobs.container-image.outputs.name }}
20+
container-image-digest:
21+
description: Container image digest
22+
value: ${{ jobs.container-image.outputs.digest }}
23+
container-image-tag:
24+
description: Container image tag
25+
value: ${{ jobs.container-image.outputs.tag }}
26+
container-image-ref:
27+
description: Container image ref
28+
value: ${{ jobs.container-image.outputs.ref }}
29+
30+
permissions:
31+
contents: read
32+
33+
jobs:
34+
container-image:
35+
name: Container image
36+
runs-on: ubuntu-latest
37+
38+
permissions:
39+
contents: read
40+
packages: write
41+
id-token: write
42+
security-events: write
43+
44+
outputs:
45+
name: ${{ steps.image-name.outputs.value }}
46+
digest: ${{ steps.build.outputs.digest }}
47+
tag: ${{ steps.meta.outputs.version }}
48+
ref: ${{ steps.image-ref.outputs.value }}
49+
50+
steps:
51+
- name: Checkout repository
52+
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
53+
54+
- name: Set up QEMU
55+
uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2.2.0
56+
57+
- name: Set up Docker Buildx
58+
uses: docker/setup-buildx-action@4c0219f9ac95b02789c1075625400b2acbff50b1 # v2.9.1
59+
60+
- name: Set image name
61+
id: image-name
62+
run: echo "value=ghcr.io/${{ github.repository }}" >> "$GITHUB_OUTPUT"
63+
64+
- name: Gather build metadata
65+
id: meta
66+
uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0
67+
with:
68+
images: ${{ steps.image-name.outputs.value }}
69+
flavor: |
70+
latest = false
71+
tags: |
72+
type=ref,event=branch
73+
type=ref,event=pr,prefix=pr-
74+
type=semver,pattern={{raw}}
75+
type=raw,value=latest,enable={{is_default_branch}}
76+
labels: |
77+
org.opencontainers.image.description=Telemetry controller
78+
org.opencontainers.image.title=Telemetry controller
79+
org.opencontainers.image.authors=Kube logging authors
80+
org.opencontainers.image.documentation=https://todo.docs
81+
82+
83+
# Multiple exporters are not supported yet
84+
# See https://github.com/moby/buildkit/pull/2760
85+
- name: Determine build output
86+
uses: haya14busa/action-cond@1d6e8a12b20cdb4f1954feef9aa475b9c390cab5 # v1.1.1
87+
id: build-output
88+
with:
89+
cond: ${{ inputs.publish }}
90+
if_true: type=image,push=true
91+
if_false: type=oci,dest=image.tar
92+
93+
- name: Login to GitHub Container Registry
94+
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2.2.0
95+
with:
96+
registry: ghcr.io
97+
username: ${{ github.actor }}
98+
password: ${{ github.token }}
99+
if: inputs.publish
100+
101+
- name: Build and push image
102+
id: build
103+
uses: docker/build-push-action@2eb1c1961a95fc15694676618e422e8ba1d63825 # v4.1.1
104+
with:
105+
context: .
106+
platforms: linux/amd64,linux/arm64,linux/arm/v7
107+
tags: ${{ steps.meta.outputs.tags }}
108+
labels: ${{ steps.meta.outputs.labels }}
109+
cache-from: type=gha
110+
cache-to: type=gha,mode=max
111+
outputs: ${{ steps.build-output.outputs.value }},name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
112+
# push: ${{ inputs.publish }}
113+
114+
- name: Set image ref
115+
id: image-ref
116+
run: echo "value=${{ steps.image-name.outputs.value }}@${{ steps.build.outputs.digest }}" >> "$GITHUB_OUTPUT"
117+
118+
- name: Fetch image
119+
run: skopeo --insecure-policy copy docker://${{ steps.image-name.outputs.value }}:${{ steps.meta.outputs.version }} oci-archive:image.tar
120+
if: inputs.publish
121+
122+
- name: Extract OCI tarball
123+
run: |
124+
mkdir -p image
125+
tar -xf image.tar -C image
126+
127+
- name: Run Trivy vulnerability scanner
128+
uses: aquasecurity/trivy-action@d43c1f16c00cfd3978dde6c07f4bbcf9eb6993ca # 0.16.1
129+
with:
130+
input: image
131+
format: sarif
132+
output: trivy-results.sarif
133+
134+
- name: Upload Trivy scan results as artifact
135+
uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
136+
with:
137+
name: "[${{ github.job }}] Trivy scan results"
138+
path: trivy-results.sarif
139+
retention-days: 5
140+
141+
# TODO: Enable it once it can successfully run
142+
# - name: Upload Trivy scan results to GitHub Security tab
143+
# uses: github/codeql-action/upload-sarif@6b5b95806324a3ee7e164709fbfc152595556fe9 # v2.16.1
144+
# with:
145+
# sarif_file: trivy-results.sarif

‎.github/workflows/ci.yaml

+90
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- "release-[0-9]+.[0-9]+*"
8+
9+
pull_request:
10+
11+
jobs:
12+
test:
13+
name: Test
14+
runs-on: ubuntu-latest
15+
16+
steps:
17+
- name: Checkout code
18+
uses: actions/checkout@v3
19+
20+
- name: Set up Go
21+
uses: actions/setup-go@v4
22+
with:
23+
go-version: '1.21'
24+
25+
- name: Check diff
26+
run: make check-diff
27+
28+
- name: Test
29+
run: make test
30+
31+
lint:
32+
name: Lint
33+
runs-on: ubuntu-latest
34+
35+
steps:
36+
- name: Checkout code
37+
uses: actions/checkout@v3
38+
39+
- name: Set up Go
40+
uses: actions/setup-go@v4
41+
with:
42+
go-version: '1.21'
43+
44+
- name: Lint
45+
run: make lint
46+
env:
47+
LINTER_FLAGS: '--timeout 5m'
48+
49+
license-check:
50+
name: License check
51+
runs-on: ubuntu-latest
52+
53+
steps:
54+
- name: Checkout code
55+
uses: actions/checkout@v3
56+
57+
- name: Set up Go
58+
uses: actions/setup-go@v4
59+
with:
60+
go-version: '1.21'
61+
62+
- name: Cache licenses
63+
uses: actions/cache@v3
64+
with:
65+
key: licensei-v2-${{ hashFiles('go.sum') }}
66+
path: |
67+
.licensei.cache
68+
restore-keys: |
69+
licensei-v2
70+
71+
- name: Download license information for dependencies
72+
env:
73+
GITHUB_TOKEN: ${{ github.token }}
74+
run: make license-cache
75+
76+
- name: Check licenses
77+
env:
78+
GITHUB_TOKEN: ${{ github.token }}
79+
run: make license-check
80+
81+
artifacts:
82+
name: Artifacts
83+
uses: ./.github/workflows/artifacts.yaml
84+
with:
85+
publish: ${{ github.event_name == 'push' }}
86+
permissions:
87+
contents: read
88+
packages: write
89+
id-token: write
90+
security-events: write

0 commit comments

Comments
 (0)