Skip to content

Commit 32785d1

Browse files
wagoodmanwagoodman
committed
add release workflow and port common patterns
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
1 parent cfb1b3e commit 32785d1

14 files changed

Lines changed: 298 additions & 214 deletions

‎.binny.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# only pull in version updates that were released more than a week ago (low-pass filter for quickly-retracted releases)
2+
cooldown: 7d
3+
4+
# other binary versions inherited from .binny.yaml file in the anchore/go-make repo (version pinned in .make).
5+
# If you need to override a tool version, please do so by adding an entry here and go-make will
6+
# account for the local definition over the go-make shared definitions.
7+
tools: []

‎.chronicle.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# no matter the change, stay v0 for now
2+
enforce-v0: true
3+
4+
# since github release pages already have titles that are the tag, we don't need to repeat that in the changelog
5+
title: ""

‎.github/dependabot.yml‎

Lines changed: 42 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,56 @@
1+
# Dependabot configuration
2+
#
3+
# Grouping behavior (see inline comments for details):
4+
# - Minor + patch updates: grouped into a single PR per ecosystem
5+
# - Major version bumps: individual PR per dependency
6+
# - Security updates: individual PR per dependency
7+
#
8+
# Note: "patch" refers to semver version bumps (1.2.3 -> 1.2.4), not security fixes.
9+
# Security updates are identified separately via GitHub's Advisory Database and
10+
# can be any version bump (patch, minor, or major) that fixes a known CVE.
11+
112
version: 2
213

314
updates:
15+
416
- package-ecosystem: gomod
5-
directory: "/"
17+
directories:
18+
- "/"
19+
- "/.make"
20+
cooldown:
21+
default-days: 7
622
schedule:
7-
interval: "daily"
23+
interval: "weekly"
24+
day: "friday"
825
open-pull-requests-limit: 10
926
labels:
1027
- "dependencies"
11-
cooldown:
12-
default-days: 7
28+
groups:
29+
go-minor-patch:
30+
applies-to: version-updates # security updates get individual PRs
31+
patterns:
32+
- "*"
33+
update-types: # major omitted, gets individual PRs
34+
- "minor"
35+
- "patch"
1336

1437
- package-ecosystem: "github-actions"
15-
directory: "/"
38+
directories:
39+
- "/"
40+
- "/.github/actions/*"
41+
cooldown:
42+
default-days: 7
1643
schedule:
17-
interval: "daily"
44+
interval: "weekly"
45+
day: "friday"
1846
open-pull-requests-limit: 10
1947
labels:
2048
- "dependencies"
21-
cooldown:
22-
default-days: 7
49+
groups:
50+
actions-minor-patch:
51+
applies-to: version-updates # security updates get individual PRs
52+
patterns:
53+
- "*"
54+
update-types: # major omitted, gets individual PRs
55+
- "minor"
56+
- "patch"

‎.github/workflows/codeql.yaml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: "CodeQL"
2+
3+
on:
4+
push:
5+
branches: [ "main" ]
6+
pull_request:
7+
branches: [ "main" ]
8+
schedule:
9+
- cron: '38 11 * * 3'
10+
11+
jobs:
12+
analyze:
13+
name: Analyze (${{ matrix.language }})
14+
runs-on: ubuntu-latest
15+
permissions:
16+
security-events: write
17+
packages: read
18+
actions: read
19+
contents: read
20+
21+
strategy:
22+
fail-fast: false
23+
matrix:
24+
include:
25+
- language: actions
26+
build-mode: none
27+
28+
- language: go
29+
build-mode: autobuild
30+
31+
steps:
32+
- name: Checkout repository
33+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
34+
with:
35+
persist-credentials: false
36+
37+
- name: Setup Go
38+
if: matrix.language == 'go'
39+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
40+
with:
41+
go-version-file: go.mod
42+
43+
- name: Initialize CodeQL
44+
uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
45+
with:
46+
languages: ${{ matrix.language }}
47+
build-mode: ${{ matrix.build-mode }}
48+
49+
- name: Perform CodeQL Analysis
50+
uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
51+
with:
52+
category: "/language:${{matrix.language}}"

‎.github/workflows/release.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: "Release"
2+
3+
permissions:
4+
contents: read
5+
6+
# there should never be two releases in progress at the same time
7+
concurrency:
8+
group: release
9+
cancel-in-progress: false
10+
11+
on:
12+
workflow_dispatch:
13+
inputs:
14+
version:
15+
description: tag the latest commit on main with the given version (prefixed with v)
16+
required: true
17+
18+
jobs:
19+
20+
version-available:
21+
uses: anchore/workflows/.github/workflows/check-version-available.yaml@4f25313f96311410cad4173f74617654a3e46d48 # v0.3.0
22+
with:
23+
version: ${{ github.event.inputs.version }}
24+
25+
check-gate:
26+
permissions:
27+
checks: read # required for getting the status of specific check names
28+
uses: anchore/workflows/.github/workflows/check-gate.yaml@4f25313f96311410cad4173f74617654a3e46d48 # v0.3.0
29+
with:
30+
# these are checks that should be run on pull-request and merges to main.
31+
# we do NOT want to kick off a release if these have not been verified on main.
32+
# Please see the validations.yaml workflow for the names that should be used here.
33+
checks: '["Static analysis", "Unit tests"]'
34+
35+
release:
36+
needs: [check-gate, version-available]
37+
environment: release # contains secrets needed for release
38+
runs-on: ubuntu-24.04
39+
permissions:
40+
contents: write # needed for creating github release objects
41+
steps:
42+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd #v6.0.2
43+
with:
44+
fetch-depth: 0 # we need the full history to reason about changelogs and tags
45+
persist-credentials: true # needed for pushing a tag
46+
47+
# setup checkout, go, go-make, binny, and cache go modules
48+
- uses: anchore/go-make/.github/actions/setup@383ef7852b8ae43a30f424896b52479186d2ea4d # v0.1.0
49+
50+
- name: Create release
51+
env:
52+
GITHUB_TOKEN: ${{ github.token }}
53+
DEPLOY_KEY: ${{ secrets.DEPLOY_KEY }}
54+
RELEASE_VERSION: ${{ github.event.inputs.version }}
55+
run: make ci-release

‎.github/workflows/validations.yaml‎

Lines changed: 6 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -2,51 +2,22 @@ name: "Validations"
22
on:
33
workflow_dispatch:
44
push:
5+
branches:
6+
- main
57
pull_request:
68

79
permissions:
810
contents: read
911

10-
env:
11-
GO_VERSION: "1.17.x"
12-
1312
jobs:
1413

1514
Static-Analysis:
1615
# Note: changing this job name requires making the same update in the .github/workflows/release.yaml pipeline
1716
name: "Static analysis"
1817
runs-on: ubuntu-24.04
1918
steps:
20-
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
21-
with:
22-
go-version: ${{ env.GO_VERSION }}
23-
24-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
25-
with:
26-
persist-credentials: false
27-
28-
- name: Restore tool cache
29-
id: tool-cache
30-
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
31-
with:
32-
path: ${{ github.workspace }}/.tmp
33-
key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
34-
35-
- name: Restore go cache
36-
id: go-cache
37-
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
38-
with:
39-
path: ~/go/pkg/mod
40-
key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
41-
restore-keys: |
42-
${{ runner.os }}-go-${{ env.GO_VERSION }}-
43-
44-
- name: (cache-miss) Bootstrap all project dependencies
45-
if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
46-
run: make bootstrap
47-
48-
- name: Bootstrap CI environment dependencies
49-
run: make ci-bootstrap
19+
# setup checkout, go, go-make, binny, and cache go modules
20+
- uses: anchore/go-make/.github/actions/setup@383ef7852b8ae43a30f424896b52479186d2ea4d # v0.1.0
5021

5122
- name: Run static analysis
5223
run: make static-analysis
@@ -56,10 +27,6 @@ jobs:
5627
name: "Unit tests"
5728
runs-on: ubuntu-24.04
5829
steps:
59-
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
60-
with:
61-
go-version: ${{ env.GO_VERSION }}
62-
6330
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6431
with:
6532
lfs: true
@@ -68,28 +35,8 @@ jobs:
6835
- name: Checkout LFS objects
6936
run: git lfs checkout
7037

71-
- name: Restore tool cache
72-
id: tool-cache
73-
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
74-
with:
75-
path: ${{ github.workspace }}/.tmp
76-
key: ${{ runner.os }}-tool-${{ hashFiles('Makefile') }}
77-
78-
- name: Restore go cache
79-
id: go-cache
80-
uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
81-
with:
82-
path: ~/go/pkg/mod
83-
key: ${{ runner.os }}-go-${{ env.GO_VERSION }}-${{ hashFiles('**/go.sum') }}
84-
restore-keys: |
85-
${{ runner.os }}-go-${{ env.GO_VERSION }}-
86-
87-
- name: (cache-miss) Bootstrap all project dependencies
88-
if: steps.tool-cache.outputs.cache-hit != 'true' || steps.go-cache.outputs.cache-hit != 'true'
89-
run: make bootstrap
90-
91-
- name: Bootstrap CI environment dependencies
92-
run: make ci-bootstrap
38+
# setup go, go-make, binny, and cache go modules
39+
- uses: anchore/go-make/.github/actions/setup@383ef7852b8ae43a30f424896b52479186d2ea4d # v0.1.0
9340

9441
- name: Run unit tests
9542
run: make unit

‎.github/zizmor.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
rules:
22
unpinned-uses:
3-
config:
4-
policies:
5-
# anchore/workflows is an internal repository; using @main is acceptable
6-
anchore/*: any
3+
ignore:
4+
# Allow unpinned uses of trusted internal anchore/workflows actions
5+
- oss-project-board-add.yaml
6+
- remove-awaiting-response-label.yaml

‎.gitignore‎

Lines changed: 21 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,28 @@
1-
CHANGELOG.md
1+
# local development
2+
go.work
3+
go.work.sum
4+
mise.toml
5+
/specs/
6+
7+
# IDEs
8+
.idea/
9+
.vscode/
10+
.history/
11+
12+
# tools and aux data
13+
.tool
14+
.tmp
15+
.task
16+
17+
# release info
18+
/CHANGELOG.md
19+
/VERSION
20+
21+
# archives and fixtures
222
/test/results
323
/dist
424
/snapshot
525
.server/
6-
.vscode/
7-
.history/
826
*.fingerprint
927
*.tar
1028
*.jar
@@ -13,7 +31,6 @@ CHANGELOG.md
1331
*.jpi
1432
*.hpi
1533
*.zip
16-
.idea/
1734
*.log
1835
.images
1936
.tmp/
@@ -37,7 +54,3 @@ bin/
3754
.DS_STORE
3855

3956
*.profile
40-
41-
# attestation
42-
cosign.key
43-
cosign.pub

0 commit comments

Comments
 (0)