Ensure imagepullsecrets and hooks informer for dynamic namespaces eve… #1331
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: alpha | |
| on: | |
| push: | |
| branches: | |
| - main | |
| jobs: | |
| generate-tag: | |
| runs-on: ubuntu-20.04 | |
| outputs: | |
| tag: ${{ steps.get_tag.outputs.GIT_TAG }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Get tags | |
| id: get_tag | |
| uses: ./.github/actions/version-tag | |
| build-schema-migrations: | |
| runs-on: ubuntu-20.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - uses: azure/docker-login@v1 | |
| env: | |
| DOCKER_CONFIG: ./migrations/.docker | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USER }} | |
| password: ${{ secrets.DOCKERHUB_PASSWORD }} | |
| - name: Build | |
| env: | |
| DOCKER_CONFIG: ./.docker | |
| run: | | |
| mapfile -t envs < <(grep -v '#.*' < .image.env) && export "${envs[@]}" && make -C migrations schema-alpha | |
| build_web: | |
| runs-on: ubuntu-20.04 | |
| needs: [generate-tag] | |
| container: | |
| image: replicated/gitops-builder:buildkite | |
| options: --user root | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Setup Node.js environment | |
| uses: actions/setup-node@v3 | |
| with: | |
| node-version: '17.x' | |
| - name: Build web | |
| env: | |
| GIT_TAG: ${{ needs.generate-tag.outputs.tag }} | |
| run: mapfile -t envs < <(grep -v '#.*' < .image.env) && export "${envs[@]}" && make -C web deps build-kotsadm | |
| shell: bash | |
| - name: Upload web artifact | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: web | |
| path: ./web/dist | |
| build_kurl_proxy: | |
| runs-on: ubuntu-20.04 | |
| needs: [generate-tag] | |
| steps: | |
| - name: Setup Go | |
| uses: actions/setup-go@v3 | |
| with: | |
| go-version: '^1.20.0' | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Cache Go modules | |
| uses: actions/cache@v3 | |
| with: | |
| path: | | |
| ~/.cache/go-build | |
| ~/go/pkg/mod | |
| key: ${{ runner.os }}-go-kurlproxy-${{ hashFiles('**/go.sum') }} | |
| restore-keys: | | |
| ${{ runner.os }}-go-kurlproxy- | |
| - name: Build kurl_proxy | |
| env: | |
| GIT_TAG: ${{ needs.generate-tag.outputs.tag }} | |
| SCOPE_DSN_PUBLIC: "" | |
| run: mapfile -t envs < <(grep -v '#.*' < .image.env) && export "${envs[@]}" && make -C kurl_proxy test build | |
| shell: bash | |
| - name: Upload kurl_proxy artifact | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: kurl_proxy | |
| path: ./kurl_proxy/bin | |
| build_go_api: | |
| runs-on: ubuntu-20.04 | |
| needs: [build_web, build_kurl_proxy, generate-tag] | |
| steps: | |
| - uses: actions/setup-go@v3 | |
| with: | |
| go-version: '^1.20.0' | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Cache Go modules | |
| uses: actions/cache@v3 | |
| with: | |
| path: | | |
| ~/.cache/go-build | |
| ~/go/pkg/mod | |
| key: ${{ runner.os }}-go-kots-${{ hashFiles('**/go.sum') }} | |
| restore-keys: | | |
| ${{ runner.os }}-go-kots- | |
| - name: Download web artifact | |
| uses: actions/download-artifact@v3 | |
| with: | |
| name: web | |
| path: ./web/dist | |
| - name: Build Go API | |
| env: | |
| GIT_TAG: ${{ needs.generate-tag.outputs.tag }} | |
| SCOPE_DSN_PUBLIC: "" | |
| run: mapfile -t envs < <(grep -v '#.*' < .image.env) && export "${envs[@]}" && make vet ci-test kots build | |
| shell: bash | |
| - name: Upload Go API artifact | |
| uses: actions/upload-artifact@v3 | |
| with: | |
| name: go_api | |
| path: ./bin | |
| release_go_api_alpha: | |
| runs-on: ubuntu-20.04 | |
| needs: [build_web, build_go_api, generate-tag] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Download go_api artifact | |
| uses: actions/download-artifact@v3 | |
| with: | |
| name: go_api | |
| path: ./bin | |
| - name: Add executable permissions | |
| run: | | |
| chmod a+x ./bin/kotsadm | |
| chmod a+x ./bin/kots | |
| - uses: azure/docker-login@v1 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USER }} | |
| password: ${{ secrets.DOCKERHUB_PASSWORD }} | |
| - name: Build alpha release | |
| env: | |
| GIT_TAG: ${{ needs.generate-tag.outputs.tag }} | |
| run: | | |
| mapfile -t envs < <(grep -v '#.*' < .image.env) && export "${envs[@]}" && make build-alpha | |
| build_kurl_proxy_alpha: | |
| runs-on: ubuntu-20.04 | |
| needs: [build_kurl_proxy, generate-tag] | |
| steps: | |
| - uses: azure/docker-login@v1 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USER }} | |
| password: ${{ secrets.DOCKERHUB_PASSWORD }} | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Download kurl_proxy artifact | |
| uses: actions/download-artifact@v3 | |
| with: | |
| name: kurl_proxy | |
| path: ./kurl_proxy/bin | |
| - name: Add executable permissions | |
| run: chmod a+x ./kurl_proxy/bin/kurl_proxy | |
| - name: Build alpha release | |
| env: | |
| GIT_TAG: ${{ needs.generate-tag.outputs.tag }} | |
| run: | | |
| mapfile -t envs < <(grep -v '#.*' < .image.env) && export "${envs[@]}" && make -C kurl_proxy build-alpha | |
| scan_rqlite: | |
| runs-on: ubuntu-20.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Read image tags from env file | |
| uses: falti/dotenv-action@v1 | |
| id: dotenv | |
| with: | |
| path: .image.env | |
| - name: Scan rqlite for vulnerabilities | |
| id: scan | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: "rqlite/rqlite:${{ steps.dotenv.outputs.RQLITE_TAG }}" | |
| format: 'template' | |
| template: '@/contrib/sarif.tpl' | |
| output: 'rqlite-scan-output.sarif' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| severity: 'CRITICAL,HIGH,MEDIUM' | |
| - name: Upload scan report | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: rqlite-scan-output.sarif | |
| scan_minio: | |
| runs-on: ubuntu-20.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Read image tags from env file | |
| uses: falti/dotenv-action@v1 | |
| id: dotenv | |
| with: | |
| path: .image.env | |
| - name: Scan minio for vulnerabilities | |
| id: scan | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: "docker.io/minio/minio:${{ steps.dotenv.outputs.minio_tag }}" | |
| format: 'template' | |
| template: '@/contrib/sarif.tpl' | |
| output: 'minio-scan-output.sarif' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| severity: 'CRITICAL,HIGH,MEDIUM' | |
| - name: Upload scan report | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: 'minio-scan-output.sarif' | |
| scan_mc: | |
| runs-on: ubuntu-20.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Read image tags from env file | |
| uses: falti/dotenv-action@v1 | |
| id: dotenv | |
| with: | |
| path: .image.env | |
| - name: Scan minio client for vulnerabilities | |
| id: scan | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: "docker.io/minio/mc:${{ steps.dotenv.outputs.mc_tag }}" | |
| format: 'template' | |
| template: '@/contrib/sarif.tpl' | |
| output: 'mc-scan-output.sarif' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| severity: 'CRITICAL,HIGH,MEDIUM' | |
| - name: Upload scan report | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: 'mc-scan-output.sarif' | |
| scan_dex: | |
| runs-on: ubuntu-20.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Read image tags from env file | |
| uses: falti/dotenv-action@v1 | |
| id: dotenv | |
| with: | |
| path: .image.env | |
| - name: Scan dex for vulnerabilities | |
| id: scan | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: "ghcr.io/dexidp/dex:${{ steps.dotenv.outputs.dex_tag }}" | |
| format: 'template' | |
| template: '@/contrib/sarif.tpl' | |
| output: 'dex-scan-output.sarif' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| severity: 'CRITICAL,HIGH,MEDIUM' | |
| - name: Upload scan report | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: dex-scan-output.sarif | |
| scan_kurl_proxy: | |
| runs-on: ubuntu-20.04 | |
| needs: [build_kurl_proxy_alpha] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Scan kurl-proxy for vulnerabilities | |
| id: scan | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: 'docker.io/kotsadm/kurl-proxy:alpha' | |
| format: 'template' | |
| template: '@/contrib/sarif.tpl' | |
| output: 'kurl-proxy-scan-output.sarif' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| severity: 'CRITICAL,HIGH,MEDIUM' | |
| - name: Upload scan report | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: kurl-proxy-scan-output.sarif | |
| scan_local_volume_provider: | |
| runs-on: ubuntu-20.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Read image tags from env file | |
| uses: falti/dotenv-action@v1 | |
| id: dotenv | |
| with: | |
| path: .image.env | |
| - name: Scan replicated/local-volume-provider for vulnerabilities | |
| id: scan | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: "docker.io/replicated/local-volume-provider:${{ steps.dotenv.outputs.lvp_tag }}" | |
| format: 'template' | |
| template: '@/contrib/sarif.tpl' | |
| output: 'scan-output.sarif' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| severity: 'CRITICAL,HIGH,MEDIUM' | |
| - name: Upload scan report | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: scan-output.sarif | |
| scan_kotsadm: | |
| runs-on: ubuntu-20.04 | |
| needs: [release_go_api_alpha] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Scan kotsadm for vulnerabilities | |
| id: scan | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: 'docker.io/kotsadm/kotsadm:alpha' | |
| format: 'template' | |
| template: '@/contrib/sarif.tpl' | |
| output: 'kotsadm-scan-output.sarif' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| severity: 'CRITICAL,HIGH,MEDIUM' | |
| - name: Upload scan report | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: kotsadm-scan-output.sarif | |
| scan_migrations: | |
| runs-on: ubuntu-20.04 | |
| needs: [build-schema-migrations] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| - name: Scan migrations for vulnerabilities | |
| id: scan | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: 'docker.io/kotsadm/kotsadm-migrations:alpha' | |
| format: 'template' | |
| template: '@/contrib/sarif.tpl' | |
| output: 'kotsadm-migration-scan-output.sarif' | |
| exit-code: '0' | |
| ignore-unfixed: true | |
| severity: 'CRITICAL,HIGH,MEDIUM' | |
| - name: Upload scan report | |
| uses: github/codeql-action/upload-sarif@v2 | |
| with: | |
| sarif_file: kotsadm-migration-scan-output.sarif |