Skip to content

Commit b8ce2dd

Browse files
tmuntanertmuntaner
authored
Merge pull request #1 from SUSE/set-up-policies
PLAT-1431 Set up policies
2 parents 9b76ed2 + fa17c0f commit b8ce2dd

File tree

105 files changed

+6130
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

105 files changed

+6130
-0
lines changed

‎.github/actions/get-policy-metadata/action.yaml‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
name: "kubewarden-policy-gh-action-dependencies"
2+
description: "Install all the binaries needed inside of GH action"
3+
branding:
4+
icon: "package"
5+
color: "blue"
6+
inputs:
7+
KWCTL_VERSION:
8+
description: "kwctl release to be installed"
9+
required: false
10+
default: v1.31.0
11+
SYFT_VERSION:
12+
description: "syft release to be installed"
13+
required: false
14+
default: "1.28.0"
15+
arch:
16+
description: "syft arch to be installed"
17+
required: false
18+
default: "linux_amd64" # windows_amd64, darwin_amd64
19+
BINARYEN_VERSION:
20+
description: "binaryen release to be installed"
21+
required: false
22+
default: "116"
23+
runs:
24+
using: "composite"
25+
steps:
26+
- name: Install cosign
27+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
28+
- name: Install kwctl
29+
shell: bash
30+
run: |
31+
#!/bin/bash
32+
set -e
33+
34+
# Build name of gihub release asset
35+
OS=$(echo "${{ runner.os }}" | tr '[:upper:]' '[:lower:]' | sed 's/macos/darwin/')
36+
ARCH=$(echo "${{ runner.arch }}" | sed -E 's/X64/x86_64/; s/ARM64/aarch64/')
37+
ASSET="kwctl-${OS}-${ARCH}"
38+
39+
INSTALL_DIR=$HOME/.kwctl
40+
RELEASE_URL="download/${{ inputs.KWCTL_VERSION }}"
41+
[ "${{ inputs.KWCTL_VERSION }}" == "latest" ] && RELEASE_URL="latest/download"
42+
43+
mkdir -p $INSTALL_DIR
44+
curl -sL https://github.com/kubewarden/kwctl/releases/$RELEASE_URL/$ASSET.zip -o $INSTALL_DIR/$ASSET.zip
45+
unzip -o $INSTALL_DIR/$ASSET.zip -d $INSTALL_DIR
46+
rm $INSTALL_DIR/$ASSET.zip
47+
48+
mv $INSTALL_DIR/$ASSET $INSTALL_DIR/kwctl
49+
chmod 755 $INSTALL_DIR/kwctl
50+
echo $INSTALL_DIR >> $GITHUB_PATH
51+
52+
$INSTALL_DIR/kwctl -V
53+
- name: Install bats
54+
shell: bash
55+
run: sudo apt install -y bats
56+
- name: Install SBOM generator tool
57+
shell: bash
58+
if: ${{ inputs.arch != 'windows_amd64' }}
59+
run: |
60+
#!/bin/bash
61+
set -e
62+
63+
INSTALL_DIR=$HOME/.syft
64+
65+
mkdir -p $INSTALL_DIR
66+
67+
curl -sL https://github.com/anchore/syft/releases/download/v${{ inputs.SYFT_VERSION }}/syft_${{ inputs.SYFT_VERSION }}_${{ inputs.arch }}.tar.gz -o $INSTALL_DIR/syft.tar.gz
68+
tar xvf $INSTALL_DIR/syft.tar.gz -C $INSTALL_DIR
69+
rm $INSTALL_DIR/syft.tar.gz
70+
71+
echo $INSTALL_DIR >> $GITHUB_PATH
72+
73+
- name: Install SBOM generator tool
74+
shell: bash
75+
if: ${{ inputs.arch == 'windows_amd64' }}
76+
run: |
77+
#!/bin/bash
78+
set -e
79+
80+
INSTALL_DIR=$HOME/.syft
81+
82+
mkdir -p $INSTALL_DIR
83+
84+
curl -sL https://github.com/anchore/syft/releases/download/v${{ inputs.SYFT_VERSION }}/syft_${{ inputs.SYFT_VERSION }}_windows_amd64.zip -o $INSTALL_DIR/syft.zip
85+
unzip -n $INSTALL_DIR/syft.zip -d $INSTALL_DIR
86+
rm $INSTALL_DIR/syft.zip
87+
88+
echo $INSTALL_DIR >> $GITHUB_PATH
89+
- name: Install binaryen tool
90+
shell: bash
91+
run: |
92+
#!/bin/bash
93+
set -e
94+
95+
INSTALL_DIR=$HOME/.binaryen
96+
97+
mkdir -p $INSTALL_DIR
98+
99+
curl -sL https://github.com/WebAssembly/binaryen/releases/download/version_${{ inputs.BINARYEN_VERSION }}/binaryen-version_${{ inputs.BINARYEN_VERSION }}-x86_64-linux.tar.gz -o $INSTALL_DIR/binaryen.tar.gz
100+
tar xvf $INSTALL_DIR/binaryen.tar.gz -C $INSTALL_DIR
101+
mv $INSTALL_DIR/binaryen-version_${{ inputs.BINARYEN_VERSION }}/bin/* $INSTALL_DIR
102+
rm $INSTALL_DIR/binaryen.tar.gz
103+
rm -rf $INSTALL_DIR/binaryen-version_${{ inputs.BINARYEN_VERSION }}
104+
105+
echo $INSTALL_DIR >> $GITHUB_PATH
106+
- name: Setup rust toolchain
107+
run: |
108+
rustup toolchain install stable --profile minimal --target wasm32-wasip1
109+
rustup override set stable
110+
shell: bash
111+
- name: Install tinygo
112+
shell: bash
113+
run: |
114+
wget https://github.com/tinygo-org/tinygo/releases/download/v0.39.0/tinygo_0.39.0_amd64.deb
115+
sudo dpkg -i tinygo_0.39.0_amd64.deb
116+
- name: Install semver tool
117+
shell: bash
118+
run: |
119+
INSTALL_DIR="$HOME"/.semver
120+
mkdir -p "$INSTALL_DIR"
121+
wget -O "$INSTALL_DIR"/semver https://github.com/fsaintjacques/semver-tool/raw/3.4.0/src/semver
122+
chmod +x "$INSTALL_DIR"/semver
123+
echo "$INSTALL_DIR" >> "$GITHUB_PATH"
124+
- name: Install updatecli
125+
uses: updatecli/updatecli-action@719e3592d124cbf826da704cbe557e1221dd4bba # v2.94.0

‎.github/actions/install-dependencies/action.yaml‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,125 @@
1+
name: "kubewarden-policy-gh-action-dependencies"
2+
description: "Install all the binaries needed inside of GH action"
3+
branding:
4+
icon: "package"
5+
color: "blue"
6+
inputs:
7+
KWCTL_VERSION:
8+
description: "kwctl release to be installed"
9+
required: false
10+
default: v1.29.1
11+
SYFT_VERSION:
12+
description: "syft release to be installed"
13+
required: false
14+
default: "1.28.0"
15+
arch:
16+
description: "syft arch to be installed"
17+
required: false
18+
default: "linux_amd64" # windows_amd64, darwin_amd64
19+
BINARYEN_VERSION:
20+
description: "binaryen release to be installed"
21+
required: false
22+
default: "116"
23+
runs:
24+
using: "composite"
25+
steps:
26+
- name: Install cosign
27+
uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
28+
- name: Install kwctl
29+
shell: bash
30+
run: |
31+
#!/bin/bash
32+
set -e
33+
34+
# Build name of gihub release asset
35+
OS=$(echo "${{ runner.os }}" | tr '[:upper:]' '[:lower:]' | sed 's/macos/darwin/')
36+
ARCH=$(echo "${{ runner.arch }}" | sed -E 's/X64/x86_64/; s/ARM64/aarch64/')
37+
ASSET="kwctl-${OS}-${ARCH}"
38+
39+
INSTALL_DIR=$HOME/.kwctl
40+
RELEASE_URL="download/${{ inputs.KWCTL_VERSION }}"
41+
[ "${{ inputs.KWCTL_VERSION }}" == "latest" ] && RELEASE_URL="latest/download"
42+
43+
mkdir -p $INSTALL_DIR
44+
curl -sL https://github.com/kubewarden/kwctl/releases/$RELEASE_URL/$ASSET.zip -o $INSTALL_DIR/$ASSET.zip
45+
unzip -o $INSTALL_DIR/$ASSET.zip -d $INSTALL_DIR
46+
rm $INSTALL_DIR/$ASSET.zip
47+
48+
mv $INSTALL_DIR/$ASSET $INSTALL_DIR/kwctl
49+
chmod 755 $INSTALL_DIR/kwctl
50+
echo $INSTALL_DIR >> $GITHUB_PATH
51+
52+
$INSTALL_DIR/kwctl -V
53+
- name: Install bats
54+
shell: bash
55+
run: sudo apt install -y bats
56+
- name: Install SBOM generator tool
57+
shell: bash
58+
if: ${{ inputs.arch != 'windows_amd64' }}
59+
run: |
60+
#!/bin/bash
61+
set -e
62+
63+
INSTALL_DIR=$HOME/.syft
64+
65+
mkdir -p $INSTALL_DIR
66+
67+
curl -sL https://github.com/anchore/syft/releases/download/v${{ inputs.SYFT_VERSION }}/syft_${{ inputs.SYFT_VERSION }}_${{ inputs.arch }}.tar.gz -o $INSTALL_DIR/syft.tar.gz
68+
tar xvf $INSTALL_DIR/syft.tar.gz -C $INSTALL_DIR
69+
rm $INSTALL_DIR/syft.tar.gz
70+
71+
echo $INSTALL_DIR >> $GITHUB_PATH
72+
73+
- name: Install SBOM generator tool
74+
shell: bash
75+
if: ${{ inputs.arch == 'windows_amd64' }}
76+
run: |
77+
#!/bin/bash
78+
set -e
79+
80+
INSTALL_DIR=$HOME/.syft
81+
82+
mkdir -p $INSTALL_DIR
83+
84+
curl -sL https://github.com/anchore/syft/releases/download/v${{ inputs.SYFT_VERSION }}/syft_${{ inputs.SYFT_VERSION }}_windows_amd64.zip -o $INSTALL_DIR/syft.zip
85+
unzip -n $INSTALL_DIR/syft.zip -d $INSTALL_DIR
86+
rm $INSTALL_DIR/syft.zip
87+
88+
echo $INSTALL_DIR >> $GITHUB_PATH
89+
- name: Install binaryen tool
90+
shell: bash
91+
run: |
92+
#!/bin/bash
93+
set -e
94+
95+
INSTALL_DIR=$HOME/.binaryen
96+
97+
mkdir -p $INSTALL_DIR
98+
99+
curl -sL https://github.com/WebAssembly/binaryen/releases/download/version_${{ inputs.BINARYEN_VERSION }}/binaryen-version_${{ inputs.BINARYEN_VERSION }}-x86_64-linux.tar.gz -o $INSTALL_DIR/binaryen.tar.gz
100+
tar xvf $INSTALL_DIR/binaryen.tar.gz -C $INSTALL_DIR
101+
mv $INSTALL_DIR/binaryen-version_${{ inputs.BINARYEN_VERSION }}/bin/* $INSTALL_DIR
102+
rm $INSTALL_DIR/binaryen.tar.gz
103+
rm -rf $INSTALL_DIR/binaryen-version_${{ inputs.BINARYEN_VERSION }}
104+
105+
echo $INSTALL_DIR >> $GITHUB_PATH
106+
- name: Setup rust toolchain
107+
run: |
108+
rustup toolchain install stable --profile minimal --target wasm32-wasip1
109+
rustup override set stable
110+
shell: bash
111+
- name: Install tinygo
112+
shell: bash
113+
run: |
114+
wget https://github.com/tinygo-org/tinygo/releases/download/v0.39.0/tinygo_0.39.0_amd64.deb
115+
sudo dpkg -i tinygo_0.39.0_amd64.deb
116+
- name: Install semver tool
117+
shell: bash
118+
run: |
119+
INSTALL_DIR="$HOME"/.semver
120+
mkdir -p "$INSTALL_DIR"
121+
wget -O "$INSTALL_DIR"/semver https://github.com/fsaintjacques/semver-tool/raw/3.4.0/src/semver
122+
chmod +x "$INSTALL_DIR"/semver
123+
echo "$INSTALL_DIR" >> "$GITHUB_PATH"
124+
- name: Install updatecli
125+
uses: updatecli/updatecli-action@719e3592d124cbf826da704cbe557e1221dd4bba # v2.94.0

‎.github/workflows/ci.yaml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
name: Continuous integration
2+
on:
3+
workflow_dispatch:
4+
pull_request:
5+
schedule:
6+
- cron: "0 21 * * *"
7+
8+
defaults:
9+
run:
10+
shell: bash
11+
12+
jobs:
13+
calculate-policy-matrix:
14+
runs-on: ubuntu-latest
15+
outputs:
16+
policy_working_dirs: ${{ steps.calculate-policy-dirs.outputs.policy_working_dirs }}
17+
steps:
18+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
19+
with:
20+
fetch-depth: 0 # checkout all history to do git diff
21+
- name: calculate which policies need a CI job
22+
id: calculate-policy-dirs
23+
shell: bash
24+
run: |
25+
git remote -v
26+
27+
policies_working_dirs=($(find policies -maxdepth 2 -name Makefile -exec dirname '{}' \;))
28+
if [ "${{github.event_name}}" == "pull_request" ]; then
29+
# list only changes of files in `policies/`:
30+
git_files="$(git diff --no-color --find-renames --find-copies --name-only origin/${{ github.base_ref }} ${{ github.sha }} -- policies)"
31+
32+
# build policy_working_dirs:
33+
policies_working_dirs=($(echo "$git_files" | cut -d/ -f1,2 ))
34+
fi
35+
36+
declare -p policies_working_dirs # for debug
37+
policy_working_dirs=$(jq --compact-output --null-input '$ARGS.positional | map(select(. != "policies/Cargo.lock" and . != "policies/Cargo.toml" and . != "policies/go.mod" and . != "policies/go.sum")) | unique' --args -- "${policies_working_dirs[@]}")
38+
echo "policy_working_dirs=$policy_working_dirs"
39+
echo "policy_working_dirs=$policy_working_dirs" >> $GITHUB_OUTPUT
40+
41+
continuos-integration:
42+
uses: ./.github/workflows/reusable-ci.yaml
43+
needs: calculate-policy-matrix
44+
if: ${{ needs.calculate-policy-matrix.outputs.policy_working_dirs != '[]' }}
45+
strategy:
46+
fail-fast: false
47+
matrix:
48+
policy-working-dir: ${{ fromJSON(needs.calculate-policy-matrix.outputs.policy_working_dirs) }}
49+
with:
50+
policy-working-dir: ${{ matrix.policy-working-dir }}

‎.github/workflows/reusable-ci.yaml‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
policy-working-dir:
5+
description: "Working directory of the policy. Useful for repos with policies in folders"
6+
required: false
7+
type: string
8+
default: "."
9+
10+
jobs:
11+
linter:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
15+
with:
16+
go-version: "1.25"
17+
- uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9.0.0
18+
with:
19+
version: "latest"
20+
install-only: true
21+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
22+
- name: Install dependencies
23+
uses: ./.github/actions/install-dependencies
24+
- name: Policy linter
25+
shell: bash
26+
run: |
27+
make -C ${{ inputs.policy-working-dir}} lint
28+
build:
29+
runs-on: ubuntu-latest
30+
steps:
31+
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
32+
with:
33+
go-version: "1.25"
34+
- uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9.0.0
35+
with:
36+
version: "latest"
37+
install-only: true
38+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
39+
- name: Install dependencies
40+
uses: ./.github/actions/install-dependencies
41+
- name: Build policy
42+
shell: bash
43+
run: |
44+
make -C ${{ inputs.policy-working-dir}} policy.wasm
45+
unit-test:
46+
runs-on: ubuntu-latest
47+
steps:
48+
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
49+
with:
50+
go-version: "1.25"
51+
- uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9.0.0
52+
with:
53+
version: "latest"
54+
install-only: true
55+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
56+
- name: Install dependencies
57+
uses: ./.github/actions/install-dependencies
58+
- name: Policy unit tests
59+
shell: bash
60+
run: |
61+
make -C ${{ inputs.policy-working-dir}} test
62+
e2e-test:
63+
runs-on: ubuntu-latest
64+
steps:
65+
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
66+
with:
67+
go-version: "1.25"
68+
- uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9.0.0
69+
with:
70+
version: "latest"
71+
install-only: true
72+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
73+
- name: Install dependencies
74+
uses: ./.github/actions/install-dependencies
75+
- name: Policy integration test
76+
shell: bash
77+
run: |
78+
make -C ${{ inputs.policy-working-dir}} e2e-tests

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,6 @@
11
qodana.yaml
2+
.github/workflows/qodana_code_quality.yml
3+
bin
24

35
### VisualStudioCode template
46
.vscode/*

0 commit comments

Comments
 (0)