Skip to content

Commit 246d9f1

Browse files
klihubklihub
authored
Merge pull request #1048 from marquiz/release-0.8
[release-0.8]: backports from master
2 parents adb0945 + 24d0251 commit 246d9f1

File tree

91 files changed

+921
-947
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

91 files changed

+921
-947
lines changed

‎.github/workflows/common-build-docs.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
name: Build documentation
2+
on:
3+
workflow_call:
4+
inputs:
5+
publish:
6+
default: false
7+
required: false
8+
type: boolean
9+
10+
jobs:
11+
update-gh-pages:
12+
runs-on: ubuntu-22.04
13+
steps:
14+
- uses: actions/checkout@v1
15+
16+
- name: Fetch gh-pages
17+
run: git fetch --no-tags --prune --depth=1 origin refs/heads/gh-pages:refs/heads/gh-pages
18+
19+
- name: Install build dependencies
20+
run: |
21+
pip3 install --user -r docs/requirements.txt
22+
echo "`python3 -m site --user-base`/bin" >> $GITHUB_PATH
23+
24+
- name: Add docs from this revision to gh-pages
25+
run: |
26+
git config user.name "Github"
27+
git config user.email "no-reply@github.com"
28+
./scripts/build/update-gh-pages.sh
29+
30+
- name: Publish gh-pages
31+
if: ${{ inputs.publish }}
32+
shell: bash
33+
env:
34+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
35+
run: |
36+
git push https://${GITHUB_ACTOR}:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git gh-pages

‎.github/workflows/common-build-images.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Build container images
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
image-tag:
7+
default: ${{ github.ref_name }}
8+
required: false
9+
type: string
10+
publish:
11+
default: false
12+
required: false
13+
type: boolean
14+
github-environment:
15+
default: null
16+
required: false
17+
type: string
18+
19+
jobs:
20+
build-images:
21+
name: Build and publish container images
22+
runs-on: ubuntu-22.04
23+
environment: ${{ inputs.github-environment }}
24+
env:
25+
IMAGE_REPO: intel
26+
IMAGE_VERSION: ${{ inputs.image-tag }}
27+
steps:
28+
- name: Checkout
29+
uses: actions/checkout@v3
30+
31+
- name: Build images
32+
run: "make images IMAGE_VERSION=${IMAGE_VERSION} Q="
33+
34+
- name: Login to Docker Hub
35+
if: ${{ inputs.publish }}
36+
uses: docker/login-action@v2
37+
with:
38+
username: ${{ secrets.DOCKERHUB_USERNAME }}
39+
password: ${{ secrets.DOCKERHUB_TOKEN }}
40+
41+
- name: Push images
42+
if: ${{ inputs.publish }}
43+
run: "make images-push IMAGE_VERSION=${IMAGE_VERSION} Q="
44+

‎.github/workflows/common-codeql.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: CodeQL scanning
2+
on:
3+
workflow_call:
4+
5+
jobs:
6+
codeql-scan:
7+
runs-on: ubuntu-22.04
8+
9+
steps:
10+
- name: Checkout
11+
uses: actions/checkout@v3
12+
13+
- name: Initialize CodeQL
14+
uses: github/codeql-action/init@v2
15+
with:
16+
languages: go
17+
18+
- name: Perform CodeQL Analysis
19+
uses: github/codeql-action/analyze@v2

‎.github/workflows/common-trivy.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
name: Trivy scanning
2+
on:
3+
workflow_call:
4+
inputs:
5+
upload-to-github-security-tab:
6+
default: false
7+
required: false
8+
type: boolean
9+
export-csv:
10+
default: false
11+
required: false
12+
type: boolean
13+
14+
jobs:
15+
trivy-scan-licenses:
16+
runs-on: ubuntu-22.04
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@v3
20+
21+
- name: Run Trivy in fs mode
22+
uses: aquasecurity/trivy-action@master
23+
with:
24+
scan-type: fs
25+
scan-ref: .
26+
exit-code: 1
27+
scanners: license
28+
severity: "UNKNOWN,MEDIUM,HIGH,CRITICAL"
29+
30+
trivy-scan-vulns:
31+
runs-on: ubuntu-22.04
32+
steps:
33+
- name: Checkout
34+
uses: actions/checkout@v3
35+
36+
- name: Run Trivy in fs mode
37+
continue-on-error: true
38+
uses: aquasecurity/trivy-action@master
39+
with:
40+
scan-type: fs
41+
scan-ref: .
42+
exit-code: 1
43+
list-all-pkgs: true
44+
format: json
45+
output: trivy-report.json
46+
47+
- name: Show report in human-readable format
48+
uses: aquasecurity/trivy-action@master
49+
with:
50+
scan-type: convert
51+
vuln-type: ''
52+
severity: ''
53+
image-ref: trivy-report.json
54+
format: table
55+
56+
- name: Convert report to sarif
57+
if: ${{ inputs.upload-to-github-security-tab }}
58+
uses: aquasecurity/trivy-action@master
59+
with:
60+
scan-type: convert
61+
vuln-type: ''
62+
severity: ''
63+
image-ref: trivy-report.json
64+
format: sarif
65+
output: trivy-report.sarif
66+
67+
- name: Upload sarif report to GitHub Security tab
68+
if: ${{ inputs.upload-to-github-security-tab }}
69+
uses: github/codeql-action/upload-sarif@v2
70+
with:
71+
sarif_file: trivy-report.sarif
72+
73+
- name: Convert report to csv
74+
if: ${{ inputs.export-csv }}
75+
uses: aquasecurity/trivy-action@master
76+
with:
77+
scan-type: convert
78+
vuln-type: ''
79+
severity: ''
80+
image-ref: trivy-report.json
81+
format: template
82+
template: "@.github/workflows/trivy-csv.tpl"
83+
output: trivy-report.csv
84+
85+
- name: Upload CSV report as an artifact
86+
if: ${{ inputs.export-csv }}
87+
uses: actions/upload-artifact@v3
88+
with:
89+
name: trivy-report
90+
path: trivy-report.csv

‎.github/workflows/common-verify-code.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Verify code
2+
3+
on:
4+
- workflow_call
5+
6+
jobs:
7+
build-and-test:
8+
runs-on: ubuntu-22.04
9+
steps:
10+
- name: Check out code
11+
uses: actions/checkout@v1
12+
13+
- name: Set up Go
14+
uses: actions/setup-go@v4
15+
with:
16+
go-version-file: go.mod
17+
id: go
18+
19+
- name: Install golangci-lint
20+
run: curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin v1.51.2
21+
22+
- name: Gofmt
23+
run: make format
24+
25+
- name: Build
26+
run: make
27+
28+
- name: Test
29+
run: make test
30+
31+
- name: Golangci-lint
32+
run: |
33+
export PATH=$PATH:$(go env GOPATH)/bin
34+
make golangci-lint
35+
36+
- name: Codecov report
37+
run: bash <(curl -s https://codecov.io/bash)
38+
39+
trivy-scan:
40+
uses: "./.github/workflows/common-trivy.yaml"
41+
with:
42+
upload-to-github-security-tab: true
43+
44+
codeql-scan:
45+
uses: "./.github/workflows/common-codeql.yaml"

‎.github/workflows/publish-devel-images.yaml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Build and publish devel container images
2+
3+
on:
4+
push:
5+
branches: ["master"]
6+
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.ref_name }}
9+
cancel-in-progress: true
10+
11+
jobs:
12+
trivy-scan:
13+
uses: "./.github/workflows/common-trivy.yaml"
14+
15+
publish-images:
16+
uses: "./.github/workflows/common-build-images.yaml"
17+
needs: [trivy-scan]
18+
secrets: inherit
19+
with:
20+
publish: true
21+
image-tag: "devel"
22+
github-environment: "staging"
23+

‎.github/workflows/publish-docs.yml‎

Lines changed: 11 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,22 @@
1-
name: Publish
1+
name: Publish documentation
22

33
on:
44
push:
55
branches:
66
- master
77
- release-*
8+
# Path filters are ignored for tags
9+
paths:
10+
- "docs/**"
11+
- "Makefile"
812
tags:
913
- v*
14+
concurrency:
15+
group: ${{ github.workflow }}
16+
cancel-in-progress: false
1017

1118
jobs:
1219
update-gh-pages:
13-
runs-on: ubuntu-latest
14-
steps:
15-
- uses: actions/checkout@v1
16-
17-
- name: Turnstyle
18-
uses: softprops/turnstyle@v1
19-
with:
20-
abort-after-seconds: 600
21-
same-branch-only: false
22-
env:
23-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
24-
25-
- name: Fetch gh-pages
26-
run: git fetch --no-tags --prune --depth=1 origin refs/heads/gh-pages:refs/heads/gh-pages
27-
28-
- name: Install build dependencies
29-
run: |
30-
pip3 install --user -r docs/requirements.txt
31-
echo "`python3 -m site --user-base`/bin" >> $GITHUB_PATH
32-
33-
- name: Add docs from this revision to gh-pages
34-
run: |
35-
git config user.name "Github"
36-
git config user.email "no-reply@github.com"
37-
./scripts/build/update-gh-pages.sh
38-
39-
- name: Publish/push to gh-pages
40-
shell: bash
41-
env:
42-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
43-
run: |
44-
git push https://${GITHUB_ACTOR}:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git gh-pages
20+
uses: "./.github/workflows/common-build-docs.yaml"
21+
with:
22+
publish: true

‎.github/workflows/release.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: Build and publish release artifacts
2+
3+
on:
4+
push:
5+
tags: [ 'v*' ]
6+
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.ref_name }}
9+
cancel-in-progress: true
10+
11+
jobs:
12+
trivy-scan:
13+
uses: "./.github/workflows/common-trivy.yaml"
14+
with:
15+
export-csv: true
16+
17+
publish-images:
18+
uses: "./.github/workflows/common-build-images.yaml"
19+
needs: [trivy-scan]
20+
secrets: inherit
21+
with:
22+
publish: true
23+
image-tag: ${{ github.ref_name }}
24+
github-environment: "release"
25+
26+
build-packages:
27+
needs: [trivy-scan]
28+
runs-on: ubuntu-22.04
29+
steps:
30+
- name: Checkout
31+
uses: actions/checkout@v3
32+
33+
- name: Build packages
34+
run: "make cross-packages Q="
35+
36+
- name: Build vendored dist tarball
37+
run: "make vendored-dist Q="
38+
39+
- name: Upload release assets
40+
uses: softprops/action-gh-release@v1
41+
with:
42+
name: ${{ github.ref_name }}
43+
draft: true
44+
append_body: true
45+
files: |
46+
packages/release-assets/*
47+
vendored-cri-resource-manager-*.tar.gz

‎.github/workflows/trivy-csv.tpl‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{{ range . }}
2+
Trivy Vulnerability Scan Results ({{- .Target -}})
3+
VulnerabilityID,Severity,CVSS Score,Title,Library,Vulnerable Version,Fixed Version,Information URL,Triage Information
4+
{{ range .Vulnerabilities }}
5+
{{- .VulnerabilityID }},
6+
{{- .Severity }},
7+
{{- range $key, $value := .CVSS }}
8+
{{- if (eq $key "nvd") }}
9+
{{- .V3Score -}}
10+
{{- end }}
11+
{{- end }},
12+
{{- quote .Title }},
13+
{{- quote .PkgName }},
14+
{{- quote .InstalledVersion }},
15+
{{- quote .FixedVersion }},
16+
{{- .PrimaryURL }}
17+
{{ else -}}
18+
No vulnerabilities found at this time.
19+
{{ end }}
20+
Trivy Dependency Scan Results ({{ .Target }})
21+
ID,Name,Version,Notes
22+
{{ range .Packages -}}
23+
{{- quote .ID }},
24+
{{- quote .Name }},
25+
{{- quote .Version }}
26+
{{ else -}}
27+
No dependencies found at this time.
28+
{{ end }}
29+
{{ end }}

0 commit comments

Comments
 (0)