Skip to content

Commit f9113e6

Browse files
bastjanbastjan
authored
Merge pull request #162 from appuio/modernize-ci
2 parents 1284ffd + 47ab810 commit f9113e6

10 files changed

Lines changed: 158 additions & 137 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,25 +8,17 @@ on:
88
branches:
99
- master
1010

11+
permissions: {}
12+
1113
jobs:
1214
go:
1315
runs-on: ubuntu-latest
1416
steps:
15-
- uses: actions/checkout@v4
16-
17-
- name: Determine Go version from go.mod
18-
run: echo "GO_VERSION=$(grep "go 1." go.mod | cut -d " " -f 2)" >> $GITHUB_ENV
19-
20-
- uses: actions/setup-go@v5
21-
with:
22-
go-version: ${{ env.GO_VERSION }}
17+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
2318

24-
- uses: actions/cache@v4
19+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
2520
with:
26-
path: ~/go/pkg/mod
27-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
28-
restore-keys: |
29-
${{ runner.os }}-go-
21+
go-version-file: 'go.mod'
3022

3123
- name: Run build
3224
run: make build

‎.github/workflows/fuzz.yml‎

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,25 +8,17 @@ on:
88
branches:
99
- master
1010

11+
permissions: {}
12+
1113
jobs:
1214
fuzz:
1315
runs-on: ubuntu-latest
1416
steps:
15-
- uses: actions/checkout@v4
16-
17-
- name: Determine Go version from go.mod
18-
run: echo "GO_VERSION=$(grep "go 1." go.mod | cut -d " " -f 2)" >> $GITHUB_ENV
19-
20-
- uses: actions/setup-go@v5
21-
with:
22-
go-version: ${{ env.GO_VERSION }}
17+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
2318

24-
- uses: actions/cache@v4
19+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
2520
with:
26-
path: ~/go/pkg/mod
27-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
28-
restore-keys: |
29-
${{ runner.os }}-go-
21+
go-version-file: 'go.mod'
3022

3123
- name: Run fuzz tests
3224
run: make fuzz

‎.github/workflows/govulncheck.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Check for Vulnerabilities
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- master
7+
push:
8+
branches:
9+
- master
10+
schedule:
11+
- cron: "0 9 * * 1"
12+
13+
permissions:
14+
contents: read
15+
security-events: write
16+
17+
jobs:
18+
check-for-vulnerabilities:
19+
name: Check for Vulnerabilities
20+
runs-on: ubuntu-latest
21+
22+
steps:
23+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
24+
25+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
26+
with:
27+
go-version-file: 'go.mod'
28+
29+
- name: Run govulncheck and save to file
30+
run: go run golang.org/x/vuln/cmd/govulncheck@latest -format sarif ./... > govulncheck.sarif
31+
env:
32+
GOEXPERIMENT: jsonv2
33+
34+
- name: Upload SARIF File
35+
uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
36+
with:
37+
sarif_file: govulncheck.sarif
38+
category: govulncheck

‎.github/workflows/lint.yml‎

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -3,25 +3,17 @@ name: Lint
33
on:
44
pull_request: {}
55

6+
permissions: {}
7+
68
jobs:
79
lint:
810
runs-on: ubuntu-latest
911
steps:
10-
- uses: actions/checkout@v4
11-
12-
- name: Determine Go version from go.mod
13-
run: echo "GO_VERSION=$(grep "go 1." go.mod | cut -d " " -f 2)" >> $GITHUB_ENV
14-
15-
- uses: actions/setup-go@v5
16-
with:
17-
go-version: ${{ env.GO_VERSION }}
12+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
1813

19-
- uses: actions/cache@v4
14+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
2015
with:
21-
path: ~/go/pkg/mod
22-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
23-
restore-keys: |
24-
${{ runner.os }}-go-
16+
go-version-file: 'go.mod'
2517

2618
- name: Run linters
2719
run: make lint

‎.github/workflows/release.yml‎

Lines changed: 10 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -5,59 +5,14 @@ on:
55
tags:
66
- "*"
77

8-
jobs:
9-
goreleaser:
10-
runs-on: ubuntu-latest
11-
steps:
12-
- uses: actions/checkout@v4
13-
with:
14-
fetch-depth: 0
15-
16-
- name: Determine Go version from go.mod
17-
run: echo "GO_VERSION=$(grep "go 1." go.mod | cut -d " " -f 2)" >> $GITHUB_ENV
18-
19-
- uses: actions/setup-go@v5
20-
with:
21-
go-version: ${{ env.GO_VERSION }}
22-
23-
- name: Set up QEMU
24-
uses: docker/setup-qemu-action@v3
25-
26-
- name: Set up Docker Buildx
27-
uses: docker/setup-buildx-action@v3
8+
permissions: {}
289

29-
- uses: actions/cache@v4
30-
with:
31-
path: ~/go/pkg/mod
32-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
33-
restore-keys: |
34-
${{ runner.os }}-go-
35-
36-
- name: Login to ghcr.io
37-
uses: docker/login-action@v3
38-
with:
39-
registry: ghcr.io
40-
username: ${{ github.repository_owner }}
41-
password: ${{ secrets.GITHUB_TOKEN }}
42-
43-
- name: Build changelog from PRs with labels
44-
id: build_changelog
45-
uses: mikepenz/release-changelog-builder-action@v5
46-
with:
47-
configuration: ".github/changelog-configuration.json"
48-
# PreReleases still get a changelog, but the next full release gets a diff since the last full release,
49-
# combining possible changelogs of all previous PreReleases in between.
50-
# PreReleases show a partial changelog since last PreRelease.
51-
ignorePreReleases: "${{ !contains(github.ref, '-rc') }}"
52-
outputFile: .github/release-notes.md
53-
env:
54-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
55-
56-
- name: Publish releases
57-
uses: goreleaser/goreleaser-action@v6
58-
with:
59-
args: release --release-notes .github/release-notes.md
60-
env:
61-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
62-
REGISTRY: ghcr.io
63-
IMAGE_NAME: ${{ github.repository }}
10+
jobs:
11+
release:
12+
name: Release
13+
uses: ./.github/workflows/tooling-release.yml
14+
permissions:
15+
contents: write # Required to publish a release
16+
packages: write # Required to push the docker images
17+
with:
18+
goreleaser-version: "2.16.0"

‎.github/workflows/test.yml‎

Lines changed: 5 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,25 +8,17 @@ on:
88
branches:
99
- master
1010

11+
permissions: {}
12+
1113
jobs:
1214
test:
1315
runs-on: ubuntu-latest
1416
steps:
15-
- uses: actions/checkout@v4
16-
17-
- name: Determine Go version from go.mod
18-
run: echo "GO_VERSION=$(grep "go 1." go.mod | cut -d " " -f 2)" >> $GITHUB_ENV
19-
20-
- uses: actions/setup-go@v5
21-
with:
22-
go-version: ${{ env.GO_VERSION }}
17+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
2318

24-
- uses: actions/cache@v4
19+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
2520
with:
26-
path: ~/go/pkg/mod
27-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
28-
restore-keys: |
29-
${{ runner.os }}-go-
21+
go-version-file: 'go.mod'
3022

3123
- name: Run tests
3224
run: make test

‎.github/workflows/tooling-release.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: Tooling Release
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
goreleaser-version:
7+
description: The version of GoReleaser to use for builds and releases.
8+
required: true
9+
type: string
10+
11+
jobs:
12+
goreleaser:
13+
runs-on: ubuntu-latest
14+
steps:
15+
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
16+
with:
17+
fetch-depth: 0
18+
19+
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
20+
with:
21+
go-version-file: 'go.mod'
22+
23+
- name: Set up QEMU
24+
uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
25+
26+
- name: Set up Docker Buildx
27+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
28+
29+
- name: Login to ghcr.io
30+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4
31+
with:
32+
registry: ghcr.io
33+
username: ${{ github.repository_owner }}
34+
password: ${{ secrets.GITHUB_TOKEN }}
35+
36+
- name: Build changelog from PRs with labels
37+
id: build_changelog
38+
uses: mikepenz/release-changelog-builder-action@348e88fab4c37338b1e803ceb2d4a7a5db6c0833 # v6
39+
with:
40+
configuration: ".github/changelog-configuration.json"
41+
# PreReleases still get a changelog, but the next full release gets a diff since the last full release,
42+
# combining possible changelogs of all previous PreReleases in between.
43+
# PreReleases show a partial changelog since last PreRelease.
44+
ignorePreReleases: "${{ !contains(github.ref, '-rc') }}"
45+
outputFile: .github/release-notes.md
46+
env:
47+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
48+
49+
- name: Publish releases
50+
uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7
51+
with:
52+
version: "${{ inputs.goreleaser-version }}"
53+
args: release --release-notes .github/release-notes.md
54+
env:
55+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
56+
REGISTRY: ghcr.io
57+
IMAGE_NAME: ${{ github.repository }}

‎Dockerfile‎

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,4 @@
1-
FROM docker.io/library/alpine:3.20 as runtime
1+
FROM gcr.io/distroless/static:nonroot@sha256:963fa6c544fe5ce420f1f54fb88b6fb01479f054c8056d0f74cc2c6000df5240
22

3-
RUN \
4-
apk add --update --no-cache \
5-
bash \
6-
curl \
7-
ca-certificates \
8-
tzdata
9-
10-
ENTRYPOINT ["appuio-cloud-agent"]
3+
ENTRYPOINT ["/usr/bin/appuio-cloud-agent"]
114
COPY appuio-cloud-agent /usr/bin/
12-
13-
USER 65536:0

‎go.mod‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,6 @@
11
module github.com/appuio/appuio-cloud-agent
22

3-
go 1.23
4-
5-
toolchain go1.23.3
3+
go 1.26.5
64

75
require (
86
github.com/appuio/control-api v0.33.4

‎renovate.json‎

Lines changed: 30 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,50 @@
11
{
2+
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
23
"extends": [
3-
"config:base",
4+
"config:recommended",
45
":gitSignOff",
5-
":disableDependencyDashboard"
6+
"helpers:pinGitHubActionDigests",
7+
"docker:pinDigests"
68
],
79
"labels": [
810
"dependency"
911
],
1012
"postUpdateOptions": [
1113
"gomodTidy"
1214
],
13-
"packageRules": [
15+
"customManagers": [
1416
{
15-
"matchPackagePatterns": [
16-
"golang.org/x/*"
17+
"customType": "regex",
18+
"managerFilePatterns": [
19+
"/\\.github/workflows/.+\\.yml$/"
1720
],
18-
"groupName": "golang.org/x",
19-
"schedule": [
20-
"on the first day of the month"
21+
"matchStrings": [
22+
"goreleaser-version:\\s+[\"']?(?<currentValue>v?[0-9.]+)[\"']?"
2123
],
22-
"automerge": true
23-
},
24+
"datasourceTemplate": "github-releases",
25+
"depNameTemplate": "goreleaser/goreleaser",
26+
"versioningTemplate": "semver"
27+
}
28+
],
29+
"packageRules": [
2430
{
25-
"matchPackagePatterns": [
26-
"k8s.io/utils",
27-
"sigs.k8s.io/controller-runtime/tools/setup-envtest"
28-
],
29-
"groupName": "k8s.io/utils",
3031
"schedule": [
3132
"on the first day of the month"
3233
],
33-
"automerge": true
34+
"automerge": true,
35+
"matchPackageNames": [
36+
"/k8s.io/utils/",
37+
"/golang.org/x/exp/",
38+
"/sigs.k8s.io/controller-runtime/tools/setup-envtest/"
39+
]
40+
},
41+
{
42+
"matchManagers": ["github-actions"],
43+
"groupName": "github actions dependencies",
44+
"automerge": true,
45+
"minimumReleaseAge": "7 days",
46+
"prCreation": "not-pending",
47+
"internalChecksFilter": "strict"
3448
}
3549
]
3650
}

0 commit comments

Comments
 (0)