Skip to content

Commit 4e2ee6b

Browse files
sean-breensean-breen
committed
Merge branch 'main' into improve-assertion-doc-generation
2 parents 760a1f1 + 540ed2f commit 4e2ee6b

File tree

14 files changed

+393
-158
lines changed

14 files changed

+393
-158
lines changed

‎.github/workflows/assertion.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -56,8 +56,8 @@ jobs:
5656
- name: Checkout Repository
5757
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
5858

59-
- name: Setup go
60-
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
59+
- name: Set up Go
60+
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
6161
with:
6262
go-version-file: 'go.mod'
6363
cache: false
@@ -86,7 +86,7 @@ jobs:
8686
8787
- name: Generate Assertion Document
8888
id: assertiondoc
89-
uses: nginxinc/compliance-rules/.github/actions/assertion@83e452166aaf0ad8f07caf91a4f1f903b3dea1e6 # v0.3.0
89+
uses: nginxinc/compliance-rules/.github/actions/assertion@0aab935582c35a00e2c671d8fe25b7fdd72a927b # v0.3.1
9090
with:
9191
artifact-name: nginx-agent_${{ inputs.packageVersion }}_${{ matrix.osarch }}
9292
artifact-digest: ${{ env.agent-digest }}
@@ -106,6 +106,6 @@ jobs:
106106
- name: Sign and Store Assertion Document
107107
id: sign
108108
if: ${{ inputs.signAssertion == true }}
109-
uses: nginxinc/compliance-rules/.github/actions/sign@83e452166aaf0ad8f07caf91a4f1f903b3dea1e6 # v0.3.0
109+
uses: nginxinc/compliance-rules/.github/actions/sign@0aab935582c35a00e2c671d8fe25b7fdd72a927b # v0.3.1
110110
with:
111111
assertion-doc: ${{ steps.assertiondoc.outputs.assertion-document-path }}

‎.github/workflows/ci.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
user: ${{ secrets.ARTIFACTORY_USER }}
3838
token: ${{ secrets.ARTIFACTORY_TOKEN }}
3939
url: ${{ secrets.ARTIFACTORY_URL_DEV }}
40-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
40+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
4141
with:
4242
go-version-file: 'go.mod'
4343
cache: false
@@ -67,7 +67,7 @@ jobs:
6767
user: ${{ secrets.ARTIFACTORY_USER }}
6868
token: ${{ secrets.ARTIFACTORY_TOKEN }}
6969
url: ${{ secrets.ARTIFACTORY_URL_DEV }}
70-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
70+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
7171
with:
7272
go-version-file: 'go.mod'
7373
cache: false
@@ -95,7 +95,7 @@ jobs:
9595
user: ${{ secrets.ARTIFACTORY_USER }}
9696
token: ${{ secrets.ARTIFACTORY_TOKEN }}
9797
url: ${{ secrets.ARTIFACTORY_URL_DEV }}
98-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
98+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
9999
with:
100100
go-version-file: 'go.mod'
101101
cache: false
@@ -124,7 +124,7 @@ jobs:
124124
user: ${{ secrets.ARTIFACTORY_USER }}
125125
token: ${{ secrets.ARTIFACTORY_TOKEN }}
126126
url: ${{ secrets.ARTIFACTORY_URL_DEV }}
127-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
127+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
128128
with:
129129
go-version-file: 'go.mod'
130130
cache: false
@@ -150,7 +150,7 @@ jobs:
150150
user: ${{ secrets.ARTIFACTORY_USER }}
151151
token: ${{ secrets.ARTIFACTORY_TOKEN }}
152152
url: ${{ secrets.ARTIFACTORY_URL_DEV }}
153-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
153+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
154154
with:
155155
go-version-file: 'go.mod'
156156
cache: false
@@ -197,7 +197,7 @@ jobs:
197197
user: ${{ secrets.ARTIFACTORY_USER }}
198198
token: ${{ secrets.ARTIFACTORY_TOKEN }}
199199
url: ${{ secrets.ARTIFACTORY_URL_DEV }}
200-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
200+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
201201
with:
202202
go-version-file: 'go.mod'
203203
cache: false
@@ -253,7 +253,7 @@ jobs:
253253
user: ${{ secrets.ARTIFACTORY_USER }}
254254
token: ${{ secrets.ARTIFACTORY_TOKEN }}
255255
url: ${{ secrets.ARTIFACTORY_URL_DEV }}
256-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
256+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
257257
with:
258258
go-version-file: 'go.mod'
259259
cache: false
@@ -316,7 +316,7 @@ jobs:
316316
user: ${{ secrets.ARTIFACTORY_USER }}
317317
token: ${{ secrets.ARTIFACTORY_TOKEN }}
318318
url: ${{ secrets.ARTIFACTORY_URL_DEV }}
319-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
319+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
320320
with:
321321
go-version-file: 'go.mod'
322322
cache: false
@@ -389,7 +389,7 @@ jobs:
389389
user: ${{ secrets.ARTIFACTORY_USER }}
390390
token: ${{ secrets.ARTIFACTORY_TOKEN }}
391391
url: ${{ secrets.ARTIFACTORY_URL_DEV }}
392-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
392+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
393393
with:
394394
go-version-file: 'go.mod'
395395
cache: false
@@ -461,7 +461,7 @@ jobs:
461461
user: ${{ secrets.ARTIFACTORY_USER }}
462462
token: ${{ secrets.ARTIFACTORY_TOKEN }}
463463
url: ${{ secrets.ARTIFACTORY_URL_DEV }}
464-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
464+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
465465
with:
466466
go-version-file: 'go.mod'
467467
cache: false
@@ -534,7 +534,7 @@ jobs:
534534
user: ${{ secrets.ARTIFACTORY_USER }}
535535
token: ${{ secrets.ARTIFACTORY_TOKEN }}
536536
url: ${{ secrets.ARTIFACTORY_URL_DEV }}
537-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
537+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
538538
with:
539539
go-version-file: 'go.mod'
540540
cache: false
@@ -592,7 +592,7 @@ jobs:
592592
user: ${{ secrets.ARTIFACTORY_USER }}
593593
token: ${{ secrets.ARTIFACTORY_TOKEN }}
594594
url: ${{ secrets.ARTIFACTORY_URL_DEV }}
595-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
595+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
596596
with:
597597
go-version-file: 'go.mod'
598598
cache: false
@@ -630,7 +630,7 @@ jobs:
630630
needs: build-unsigned-snapshot
631631
steps:
632632
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
633-
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
633+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
634634
with:
635635
go-version-file: 'go.mod'
636636
cache: false

‎.github/workflows/dependency-review.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,6 @@ jobs:
2525
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
2626

2727
- name: "Dependency Review"
28-
uses: actions/dependency-review-action@40c09b7dc99638e5ddb0bfd91c1673effc064d8a # v4.8.1
28+
uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
2929
with:
3030
config-file: "nginxinc/k8s-common/dependency-review-config.yml@main"

‎.github/workflows/release-branch.yml‎

Lines changed: 25 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -3,38 +3,36 @@ name: Release Agent
33
on:
44
workflow_dispatch:
55
inputs:
6-
githubRelease:
7-
description: 'Setup release in github'
8-
type: boolean
9-
default: false
106
packageVersion:
11-
description: 'Package version number'
12-
default: "3.0.0"
7+
required: true
8+
description: 'Package version number (3.x.x)'
9+
default: ""
1310
type: string
1411
packageBuildNo:
15-
description: 'Package Build number'
12+
required: true
13+
description: 'Package build number'
1614
default: "1"
1715
type: string
18-
uploadAzure:
19-
description: 'Publish packages Azure storage'
16+
releaseBranch:
17+
description: 'Release branch to build from (release-3.x.x)'
18+
required: true
19+
type: string
20+
tagRelease:
21+
description: 'Add tag for release (v3.x.x)'
2022
default: false
2123
type: boolean
22-
publishPackages:
23-
description: 'Publish packages to nginx repo'
24-
default: false
24+
githubRelease:
25+
description: 'Draft release (v3.x.x) on GitHub'
2526
type: boolean
26-
tagRelease:
27-
description: 'Add tag to release branch'
2827
default: false
29-
type: boolean
3028
createPullRequest:
31-
description: 'Create pull request back into main'
29+
description: 'Create pull request into main (required if release branch has diverged from main)'
30+
default: false
31+
type: boolean
32+
publishPackages:
33+
description: 'Publish packages to nginx repo'
3234
default: false
3335
type: boolean
34-
releaseBranch:
35-
description: 'Release branch to build & publish from'
36-
required: true
37-
type: string
3836
uploadUrl:
3937
description: 'Location to publish packages to'
4038
required: false
@@ -47,7 +45,7 @@ on:
4745

4846
env:
4947
NFPM_VERSION: 'v2.35.3'
50-
GOPROXY: "https://${{ secrets.ARTIFACTORY_USER }}:${{ secrets.ARTIFACTORY_TOKEN }}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-local-approved-dependency"
48+
GOPROXY: "https://${{ secrets.ARTIFACTORY_USER }}:${{ secrets.ARTIFACTORY_TOKEN }}@${{ secrets.ARTIFACTORY_URL_PROD }}"
5149

5250
defaults:
5351
run:
@@ -65,10 +63,9 @@ jobs:
6563
name: Set workflow variables
6664
runs-on: ubuntu-22.04
6765
outputs:
66+
tag_release: ${{steps.vars.outputs.tag_release }}
6867
github_release: ${{steps.vars.outputs.github_release }}
69-
upload_azure: ${{steps.vars.outputs.upload_azure }}
7068
publish_packages: ${{steps.vars.outputs.publish_packages }}
71-
tag_release: ${{steps.vars.outputs.tag_release }}
7269
create_pull_request: ${{steps.vars.outputs.create_pull_request }}
7370
steps:
7471
- name: Checkout Repository
@@ -79,10 +76,9 @@ jobs:
7976
- name: Set variables
8077
id: vars
8178
run: |
79+
echo "tag_release=${{ inputs.tagRelease }}" >> $GITHUB_OUTPUT
8280
echo "github_release=${{ inputs.githubRelease }}" >> $GITHUB_OUTPUT
83-
echo "upload_azure=${{ inputs.uploadAzure }}" >> $GITHUB_OUTPUT
8481
echo "publish_packages=${{ inputs.publishPackages }}" >> $GITHUB_OUTPUT
85-
echo "tag_release=${{ inputs.tagRelease }}" >> $GITHUB_OUTPUT
8682
echo "create_pull_request=${{ inputs.createPullRequest }}" >> $GITHUB_OUTPUT
8783
cat $GITHUB_OUTPUT
8884
@@ -211,15 +207,15 @@ jobs:
211207
needs: [vars,release-draft,tag-release]
212208
permissions:
213209
id-token: write
214-
contents: write # Needed to update a github release
210+
contents: write # Needed to update a release
215211
steps:
216212
- name: Checkout Repository
217213
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
218214
with:
219215
ref: ${{ inputs.releaseBranch }}
220216

221217
- name: Setup go
222-
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
218+
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
223219
with:
224220
go-version-file: 'go.mod'
225221
cache: false
@@ -278,12 +274,6 @@ jobs:
278274
echo "nginx-agent-binaries-${{ inputs.packageVersion }}-amd64"
279275
find build/amd64 -type f -name "nginx-agent*"
280276
281-
- name: Install GPG tools
282-
if: ${{ inputs.publishPackages == true }}
283-
run: |
284-
sudo apt-get update
285-
sudo apt-get install -y gpgv1 monkeysphere
286-
287277
- name: Get Id Token
288278
if: ${{ inputs.publishPackages == true }}
289279
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@@ -343,6 +333,7 @@ jobs:
343333
head: '${{ inputs.releaseBranch }}',
344334
base: 'main',
345335
body: [
346-
'This PR is auto-generated by the release workflow.'
336+
'This PR was auto-generated by the release workflow.',
337+
'NOTE: DO NOT squash commits when merging!',
347338
].join('\n')
348339
});

‎.github/workflows/scorecards.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,6 @@ jobs:
5555

5656
# Upload the results to GitHub's code scanning dashboard.
5757
- name: "Upload to code-scanning"
58-
uses: github/codeql-action/upload-sarif@014f16e7ab1402f30e7c3329d33797e7948572db # v4.31.3
58+
uses: github/codeql-action/upload-sarif@fdbfb4d2750291e159f0156def62b853c2798ca2 # v4.31.5
5959
with:
6060
sarif_file: results.sarif

‎.github/workflows/upload-release-assets.yml‎

Lines changed: 16 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ on:
1212
type: string
1313
default: ""
1414
uploadAzure:
15-
description: 'Publish packages Azure storage'
15+
description: 'Publish packages to Azure blob storage'
1616
type: boolean
1717
default: false
1818
uploadGithub:
@@ -25,7 +25,7 @@ defaults:
2525
shell: bash
2626

2727
permissions:
28-
contents: read
28+
contents: write
2929

3030
jobs:
3131
vars:
@@ -63,31 +63,20 @@ jobs:
6363
echo "Checking Packages in ${{inputs.pkgRepo}}/nginx-agent"
6464
echo "${{secrets.PUBTEST_CERT}}" > pubtest.crt
6565
echo "${{secrets.PUBTEST_KEY}}" > pubtest.key
66-
PKG_REPO=${{inputs.pkgRepo}} CERT=pubtest.crt KEY=pubtest.key DL=1 scripts/packages/package-check.sh ${{inputs.pkgVersion}}
67-
for i in $(find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}"); do
68-
if [[ "$i" == *.deb ]]; then
69-
echo "Renaming ${i} to ${i/_/-}"
70-
mv "${i}" "${i/_/-}"
71-
fi
72-
if [[ "$i" == *.apk ]]; then
73-
ver=$(echo "$i" | grep -o -e "v[0-9]*\.[0-9]*")
74-
arch=$(echo "$i" | grep -o -F -e "x86_64" -e "aarch64")
75-
dest="$(dirname "$i")/nginx-agent-${{inputs.pkgVersion}}-$ver-$arch.apk"
76-
echo "Renaming ${i} to ${dest}"
77-
mv "${i}" "${dest}"
78-
fi
79-
done
80-
find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}"
66+
67+
DL=1 PKG_REPO=${{inputs.pkgRepo}} \
68+
CERT=pubtest.crt KEY=pubtest.key \
69+
scripts/packages/package-check.sh ${{inputs.pkgVersion}}
8170

8271
- name: GitHub Upload
83-
continue-on-error: true
8472
if: ${{ needs.vars.outputs.github_release == 'true' }}
8573
env:
8674
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8775
# clobber overwrites existing assets of the same name
8876
run: |
77+
gh release list
8978
gh release upload --clobber v${{ inputs.pkgVersion }} \
90-
$(find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}")
79+
$(find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}" | grep -v "azure")
9180
9281
- name: Azure Login
9382
if: ${{ inputs.uploadAzure == true }}
@@ -100,8 +89,14 @@ jobs:
10089
uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
10190
with:
10291
inlineScript: |
103-
for i in $(find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}"); do
104-
dest="nginx-agent/${GITHUB_REF##*/}/${i##*/}"
92+
echo "Uploading tarball... nginx-agent/release-${{ inputs.pkgVersion }}/nginx-agent.tar.gz"
93+
az storage blob upload --auth-mode=login -f "${{ inputs.pkgRepo }}/nginx-agent/nginx-agent.tar.gz" \
94+
-c ${{ secrets.AZURE_CONTAINER_NAME }} \
95+
--account-name ${{ secrets.AZURE_ACCOUNT_NAME }} --overwrite -n nginx-agent/release-${{ inputs.pkgVersion }}/nginx-agent.tar.gz
96+
97+
echo "Uploading packages..."
98+
for i in $(find ${{ inputs.pkgRepo }}/nginx-agent | grep -e "nginx-agent[_-]${{ inputs.pkgVersion }}"); do
99+
dest="nginx-agent/release-${{ inputs.pkgVersion }}/${i##*/}"
105100
echo "Uploading ${i} to ${dest}"
106101
az storage blob upload --auth-mode=login -f "$i" -c ${{ secrets.AZURE_CONTAINER_NAME }} \
107102
--account-name ${{ secrets.AZURE_ACCOUNT_NAME }} --overwrite -n ${dest}

‎Makefile.packaging‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,12 @@ package: gpg-key $(PACKAGES_DIR) #### Create final packages for all supported di
152152

153153
.PHONY: gpg-key
154154
gpg-key: ## Generate GPG public key
155-
$$(gpg --import $(NFPM_SIGNING_KEY_FILE)); \
155+
@if [ -z "$(NFPM_SIGNING_KEY_FILE)" ]; then \
156+
echo "NFPM_SIGNING_KEY_FILE is not set. Exiting..."; \
157+
exit 1; \
158+
fi
159+
@echo "Generating GPG public key for package signing...";
160+
@$$(gpg --import $(NFPM_SIGNING_KEY_FILE)); \
156161
keyid=$$(gpg --list-keys NGINX | egrep -A1 "^pub" | egrep -v "^pub" | tr -d '[:space:]'); \
157162
if [ -z "$$keyid" ]; then echo "Error: GPG key not found."; exit 1; fi; \
158163
# Check if the key is expired \

0 commit comments

Comments
 (0)