Skip to content

Commit 66429c3

Browse files
hspitzley-czihspitzley-czi
authored
Merge branch 'main' into dependabot/github_actions/dorny/paths-filter-3.0.2
2 parents 2c2e4fb + a4e91c6 commit 66429c3

File tree

20 files changed

+764
-176
lines changed

20 files changed

+764
-176
lines changed

‎.github/actions/argus-builder/build-prep/action.yml

+129
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
name: argus-docker-build-prep
2+
description: Prepare for building a Docker Image for Argus
3+
4+
inputs:
5+
path_filters:
6+
description: 'Glob patterns to match against changed files in the repository, comma delimited'
7+
required: false
8+
default: '**/*'
9+
path_filters_base:
10+
description: |
11+
Git reference (e.g. branch name) against which the changes will be detected. Defaults to the current branch.
12+
If it references same branch it was pushed to, changes are detected against the most recent commit before the push.
13+
This option is ignored if action is triggered by pull_request event.
14+
required: false
15+
default: ${{ github.ref }}
16+
branches_include:
17+
description: 'Branch names to run this job on, supports wildcards, comma delimited'
18+
required: false
19+
default: '*'
20+
branches_ignore:
21+
description: 'Branch names to run this job on, supports wildcards, comma delimited'
22+
required: false
23+
default: ''
24+
25+
outputs:
26+
image_tag:
27+
description: A custom tag to apply to the images that are built
28+
value: ${{ steps.build_tags.outputs.image_tag }}
29+
should_build:
30+
description: Whether the job should run
31+
value: ${{ steps.final_check.outputs.should_build }}
32+
33+
runs:
34+
using: composite
35+
steps:
36+
- name: Check for matching branch
37+
id: branch_filter
38+
uses: actions/github-script@v7
39+
with:
40+
script: |
41+
function wildcardMatch(text, pattern) {
42+
const regexPattern =
43+
new RegExp('^' + pattern.replace(/\?/g, '.').replace(/\*/g, '.*') + '$');
44+
return regexPattern.test(text);
45+
}
46+
const branchesInclude = `${{ inputs.branches_include }}`.split(',').map(b => b.trim()).filter(b => b.length > 0);
47+
console.log('Branches to run against:', branchesInclude);
48+
const branchesIgnore = `${{ inputs.branches_ignore }}`.split(',').map(b => b.trim()).filter(b => b.length > 0);
49+
console.log('Branches to ignore:', branchesIgnore);
50+
const branch = `${{ github.ref }}`.replace('refs/heads/', '');
51+
const shouldRun = branchesInclude.some(b => wildcardMatch(branch, b)) && !branchesIgnore.some(b => wildcardMatch(branch, b));
52+
if (shouldRun) {
53+
console.log('Job will run');
54+
} else {
55+
console.log(`Job will be skipped because branch name "${branch}" does not match the filters`);
56+
}
57+
core.setOutput('match', shouldRun);
58+
59+
- uses: actions/checkout@v4
60+
with:
61+
fetch-depth: 0
62+
63+
- name: Get build tag
64+
id: build_tags
65+
uses: actions/github-script@v7
66+
with:
67+
script: |
68+
let sha;
69+
const eventName = context.eventName;
70+
if (eventName === "pull_request") {
71+
console.log('pull_request:', context.payload.pull_request.head.sha);
72+
sha = context.payload.pull_request.head.sha;
73+
} else if (eventName === "push") {
74+
console.log('push:', context.sha);
75+
sha = context.sha;
76+
} else {
77+
core.setFailed(`EventName ${eventName} not supported`);
78+
return;
79+
}
80+
81+
const imageTag = `sha-${sha.slice(0, 7)}`;
82+
if (imageTag === 'sha-') {
83+
core.setFailed('The image tag [${imageTag}] is invalid.');
84+
}
85+
86+
console.log('imageTag:', imageTag);
87+
core.setOutput('image_tag', imageTag);
88+
89+
- name: Parse inputs
90+
id: parse_filters
91+
uses: actions/github-script@v7
92+
with:
93+
script: |
94+
const filters = `${{ inputs.path_filters }}`.split(',').map(f => f.trim()).filter(b => b.length > 0);
95+
const filtersStr = "run_on:\n" + filters.map(f => ` - '${f}'`).join('\n');
96+
core.setOutput('filters', filtersStr);
97+
98+
- name: Check for force push
99+
id: force_push
100+
uses: actions/github-script@v7
101+
with:
102+
# if the push was forced, use the default branch as the base -- otherwise, use the most recent commit before the push
103+
# this is necessary because when you force push the previous commit is not available in the repo, thus no changes can be detected
104+
script: |
105+
if (`${{ github.event_name }}` === 'push' && ${{ github.event.forced || false }}) {
106+
core.info(`Force push detected, using the repo's default branch (${{ github.event.repository.default_branch }}) as the base`)
107+
core.setOutput('base', `${{ github.event.repository.default_branch }}`);
108+
} else {
109+
core.info(`Push was not forced, using the most recent commit before the push as the base`)
110+
core.setOutput('base', `${{ inputs.path_filters_base }}`);
111+
}
112+
113+
- name: Check for matching file changes
114+
uses: dorny/paths-filter@v3
115+
id: file_filter
116+
with:
117+
filters: |
118+
${{ steps.parse_filters.outputs.filters }}
119+
base: ${{ steps.force_push.outputs.base }}
120+
list-files: json
121+
122+
- name: Check if build should run
123+
id: final_check
124+
uses: actions/github-script@v7
125+
with:
126+
script: |
127+
const branchMatched = `${{ steps.branch_filter.outputs.match }}` === 'true';
128+
const filesMatched = `${{ steps.file_filter.outputs.run_on }}` === 'true';
129+
core.setOutput('should_build', filesMatched && branchMatched);

‎.github/actions/argus-builder/docker-build/action.yml

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
name: argus-docker-build
2+
description: Build a Docker Image for Argus
3+
4+
inputs:
5+
image_name:
6+
description: 'Name of the image to build'
7+
required: true
8+
dockerfile:
9+
description: 'Path to the Dockerfile'
10+
required: true
11+
context:
12+
description: 'Path to the build context'
13+
required: true
14+
platform:
15+
description: 'Platform to build for'
16+
required: false
17+
default: 'linux/arm64'
18+
build_args:
19+
description: 'Args for docker build'
20+
required: false
21+
default: ''
22+
secret_files:
23+
description: 'Files to copy into the build context'
24+
required: false
25+
default: ''
26+
image_tag:
27+
description: 'Additional tag to apply to the image this is built'
28+
required: true
29+
github_app_id:
30+
description: 'GitHub App ID'
31+
required: true
32+
github_private_key:
33+
description: 'GitHub App private key'
34+
required: true
35+
36+
outputs:
37+
image_uri:
38+
description: 'URI of the image that was built'
39+
value: ${{ steps.ecr_metadata.outputs.IMAGE_URI }}
40+
41+
runs:
42+
using: composite
43+
steps:
44+
- uses: actions/checkout@v4
45+
with:
46+
fetch-depth: 0
47+
path: ${{ github.event.repository.name }}
48+
- name: Configure AWS Credentials
49+
uses: aws-actions/configure-aws-credentials@v4
50+
with:
51+
aws-region: us-west-2
52+
role-to-assume: arn:aws:iam::533267185808:role/gh_actions_core_platform_infra_prod_eks
53+
role-session-name: ArgusContainerBuilder
54+
- name: Generate token
55+
id: generate_token
56+
uses: tibdex/github-app-token@v2
57+
with:
58+
app_id: ${{ inputs.github_app_id }}
59+
private_key: ${{ inputs.github_private_key }}
60+
- uses: actions/checkout@v4
61+
with:
62+
repository: chanzuckerberg/core-platform-settings
63+
path: core-platform-settings
64+
token: ${{ steps.generate_token.outputs.token }}
65+
- name: ECR Metadata
66+
id: ecr_metadata
67+
uses: actions/github-script@v7
68+
with:
69+
script: |
70+
const path = require('path');
71+
const ECR_REGISTRY = "533267185808.dkr.ecr.us-west-2.amazonaws.com";
72+
const ECR_REPO_NAME = path.join(
73+
'core-platform',
74+
'${{ github.event.repository.name }}',
75+
'${{ inputs.context }}',
76+
'${{ inputs.image_name }}',
77+
);
78+
const IMAGE_URI = `${ECR_REGISTRY}/${ECR_REPO_NAME}:${{ inputs.image_tag }}`;
79+
80+
core.setOutput('ECR_REGISTRY', ECR_REGISTRY);
81+
core.setOutput('ECR_REPO_NAME', ECR_REPO_NAME);
82+
core.setOutput('IMAGE_URI', IMAGE_URI);
83+
- name: Create ECR repo if necessary
84+
uses: int128/create-ecr-repository-action@v1
85+
with:
86+
repository: ${{ steps.ecr_metadata.outputs.ECR_REPO_NAME }}
87+
lifecycle-policy: core-platform-settings/ecr/lifecycle-policy.json
88+
repository-policy: core-platform-settings/ecr/repository-policy.json
89+
- name: Build And Push
90+
uses: chanzuckerberg/github-actions/.github/actions/docker-build-push@6fe6046403cf16689027cb3981781d8b05fd702b
91+
with:
92+
dockerfile: ${{ github.event.repository.name }}/${{ inputs.dockerfile }}
93+
context: ${{ github.event.repository.name }}/${{ inputs.context }}
94+
name: ${{ steps.ecr_metadata.outputs.ECR_REPO_NAME }}
95+
registry: ${{ steps.ecr_metadata.outputs.ECR_REGISTRY }}
96+
custom_tag: ${{ inputs.image_tag }}
97+
platforms: ${{ inputs.platform }}
98+
build_args: |
99+
IMAGE_TAG=${{ inputs.image_tag }}
100+
${{ inputs.build_args }}
101+
secret-files: ${{ inputs.secret_files }}
102+
103+
# TODO: scan image for vulnerabilities
104+
# - name: Scan for vulnerabilities
105+
# uses: chanzuckerberg/github-actions/.github/actions/argus-builder/scan-for-vulnerabilities@main
106+
# with:
107+
# image_uri: ${{ steps.ecr_metadata.outputs.ECR_REGISTRY }}/${{ steps.ecr_metadata.outputs.ECR_REPO_NAME }}:${{ inputs.image_tag }}
108+
# github_app_id: ${{ inputs.github_app_id }}
109+
# github_private_key: ${{ inputs.github_private_key }}

‎.github/actions/argus-builder/manifest-update/action.yml

+81
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: argus-docker-manifest-update
2+
description: Updates manifests for Argus after the Docker image is built
3+
4+
inputs:
5+
envs:
6+
description: 'Env names, comma delimited'
7+
required: true
8+
image_tag:
9+
description: The tag of the image that should be updated
10+
required: true
11+
argus_project_dirs:
12+
description: 'Comma-delimited list of Argus project roots (directories that contain the .infra/ directory for each app)'
13+
default: '.'
14+
required: false
15+
github_app_id:
16+
description: 'GitHub App ID'
17+
required: true
18+
github_private_key:
19+
description: 'GitHub App private key'
20+
required: true
21+
22+
runs:
23+
using: composite
24+
steps:
25+
- run: |
26+
echo "Image Tag: ${{ inputs.image_tag }}"
27+
shell: bash
28+
- name: Generate token
29+
id: generate_token
30+
uses: tibdex/github-app-token@v2
31+
with:
32+
app_id: ${{ inputs.github_app_id }}
33+
private_key: ${{ inputs.github_private_key }}
34+
- name: Calculate Branch and Base Names
35+
id: refs
36+
uses: chanzuckerberg/github-actions/.github/actions/[email protected]
37+
- uses: actions/checkout@v4
38+
with:
39+
fetch-depth: 0
40+
token: ${{ steps.generate_token.outputs.token }}
41+
ref: ${{ steps.refs.outputs.headRef }}
42+
- name: Parse envs
43+
id: parse_envs
44+
uses: actions/github-script@v7
45+
with:
46+
script: |
47+
const envs = `${{ inputs.envs }}`.split(',').map(env => env.trim()).filter(b => b.length > 0);
48+
core.setOutput('envs', envs.join(' '));
49+
- name: Determine .infra path
50+
uses: actions/github-script@v7
51+
id: path
52+
with:
53+
script: |
54+
const path = require('path');
55+
const fs = require('fs');
56+
const workingDirs = `${{ inputs.argus_project_dirs }}`.split(',').map(dir => dir.trim()).filter(b => b.length > 0);
57+
const infraDirPaths = workingDirs.map(dir => {
58+
const infraDirPath = path.join(dir, '.infra');
59+
if (!fs.existsSync(infraDirPath)) {
60+
throw new Error(`.infra directory not found at ${infraDirPath}`);
61+
}
62+
return infraDirPath;
63+
});
64+
core.setOutput('infra_dir_paths', infraDirPaths.join(' '));
65+
- name: Update Manifest
66+
shell: bash
67+
run: |
68+
for env in ${{ steps.parse_envs.outputs.envs }}
69+
do
70+
for infra_dir_path in ${{ steps.path.outputs.infra_dir_paths }}
71+
do
72+
sed -i 's/tag: sha-\w\+/tag: ${{ inputs.image_tag }}/g' ${infra_dir_path}/${env}/values.yaml
73+
cat ${infra_dir_path}/${env}/values.yaml
74+
done
75+
done
76+
- name: Update Argus manifests
77+
uses: EndBug/add-and-commit@v9
78+
with:
79+
add: -A
80+
message: 'chore: Updated [${{ steps.parse_envs.outputs.envs }}] values.yaml image tags to ${{ inputs.image_tag }}'
81+

‎.github/actions/container-scanning/action.yml

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: Container Scanning
2+
description: 'A GitHub Action to scan a container image for security vulnerabilities that follows CZI Best Practices'
3+
inputs:
4+
image_uri:
5+
description: 'which image to scan'
6+
required: true
7+
critical_threshold:
8+
description: 'number of critical vulnerabilities that will cause the action to fail'
9+
required: false
10+
default: "1"
11+
high_threshold:
12+
description: 'number of high vulnerabilities that will cause the action to fail'
13+
required: false
14+
default: "1"
15+
medium_threshold:
16+
description: 'number of medium vulnerabilities that will cause the action to fail'
17+
required: false
18+
default: "10"
19+
low_threshold:
20+
description: 'number of low vulnerabilities that will cause the action to fail'
21+
required: false
22+
default: "10"
23+
other_threshold:
24+
description: 'number of other vulnerabilities that will cause the action to fail'
25+
required: false
26+
default: "10"
27+
fail_on_vulnerabilities:
28+
description: 'whether to fail the action if vulnerabilities are found'
29+
required: false
30+
default: "true"
31+
runs:
32+
using: "composite"
33+
steps:
34+
- uses: aws-actions/configure-aws-credentials@v3
35+
with:
36+
aws-region: us-west-2
37+
role-to-assume: arn:aws:iam::871040364337:role/ci/github-actions-inspector
38+
role-duration-seconds: 1800
39+
role-session-name: github-actions-inspector
40+
- name: Scan built image with Inspector
41+
uses: aws-actions/[email protected]
42+
id: inspector
43+
with:
44+
artifact_type: 'container'
45+
artifact_path: ${{ inputs.image_uri }} # make sure this matches the image you built
46+
critical_threshold: ${{ inputs.critical_threshold }}
47+
high_threshold: ${{ inputs.high_threshold }}
48+
medium_threshold: ${{ inputs.medium_threshold }}
49+
low_threshold: ${{ inputs.low_threshold }}
50+
other_threshold: ${{ inputs.other_threshold }}
51+
display_vulnerability_findings: "enabled"
52+
- name: Display Inspector vulnerability scan results (markdown)
53+
shell: bash
54+
run: cat ${{ steps.inspector.outputs.inspector_scan_results_markdown }}
55+
- name: Fail job if vulnerability threshold is exceeded
56+
if: contains(inputs.fail_on_vulnerabilities, 'true')
57+
shell: bash
58+
run: exit ${{ steps.inspector.outputs.vulnerability_threshold_exceeded }}

‎.github/actions/conventional-commits/CHANGELOG.md

+7
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
# Changelog
22

3+
## [1.5.0](https://github.com/chanzuckerberg/github-actions/compare/conventional-commits-v1.4.0...conventional-commits-v1.5.0) (2024-07-08)
4+
5+
6+
### Features
7+
8+
* add more conventional commit types ([#279](https://github.com/chanzuckerberg/github-actions/issues/279)) ([c212929](https://github.com/chanzuckerberg/github-actions/commit/c2129291817d4055272deee803d893d6669ababd))
9+
310
## [1.4.0](https://github.com/chanzuckerberg/github-actions/compare/conventional-commits-v1.3.4...conventional-commits-v1.4.0) (2024-02-01)
411

512

0 commit comments

Comments
 (0)