Merge branch 'main' into add-labels-to-headers

Author: dhurley

.github/workflows/ci.yml

@@ -93,10 +93,12 @@ jobs:
     strategy:
       matrix:
         container:
+        - image: "ubuntu"
+          version: "24.04"
         - image: "redhatenterprise"
           version: "9"
         - image: "alpine"
-          version: "3.19"
+          version: "3.22"
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0

.github/workflows/mend.yml

@@ -0,0 +1,33 @@
+name: Mend
+
+on:
+  push:
+    branches:
+      - main
+      - release-*
+    tags:
+      - "v[0-9]+.[0-9]+.[0-9]+*"
+    paths-ignore:
+      - docs/**
+  pull_request:
+    branches:
+      - main
+      - release-*
+    paths-ignore:
+      - docs/**
+
+concurrency:
+  group: ${{ github.ref_name }}-mend
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  mend:
+    if: ${{ (github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false) || (github.event_name == 'push' && github.event.repository.fork == false) }}
+    uses: nginxinc/compliance-rules/.github/workflows/mend.yml@a27656f8f9a8748085b434ebe007f5b572709aad # v0.2
+    secrets: inherit
+    with:
+      product_name: nginx-agent-v3_${{ github.ref_name }}
+      project_name: nginx-agent-v3

.github/workflows/scorecards.yml

@@ -37,7 +37,6 @@ jobs:
         with:
           results_file: results.sarif
           results_format: sarif
-          repo_token: ${{ secrets.SCORECARD_TOKEN }}
 
           # Publish the results for public repositories to enable scorecard badges. For more details, see
           # https://github.com/ossf/scorecard-action#publishing-results.

.github/workflows/upload-release-assets.yml

@@ -6,7 +6,7 @@ on:
       pkgRepo:
         description: "Source repository to pull packages from"
         type: string
-        default: ""
+        default: "packages.nginx.org"
       pkgVersion:
         description: 'Agent version'
         type: string
@@ -57,46 +57,57 @@ jobs:
         with:
           ref: ${{ inputs.releaseBranch }}
 
-      - name: Azure Login
-        if: ${{ inputs.uploadAzure == true }}
-        uses: azure/login@8c334a195cbb38e46038007b304988d888bf676a # v2.0.0
-        with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
-
       - name: Download Packages
         run:
           |
           echo "Checking Packages in ${{inputs.pkgRepo}}/nginx-agent"
-          PKG_REPO=${{inputs.pkgRepo}} CERT=${{secrets.PUBTEST_CERT}} KEY=${{secrets.PUBTEST_KEY}} DL=1 scripts/packages/package-check.sh ${{inputs.pkgVersion}}
+          echo "${{secrets.PUBTEST_CERT}}" > pubtest.crt
+          echo "${{secrets.PUBTEST_KEY}}" > pubtest.key
+          PKG_REPO=${{inputs.pkgRepo}} CERT=pubtest.crt KEY=pubtest.key DL=1 scripts/packages/package-check.sh ${{inputs.pkgVersion}}
+          for i in $(find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}"); do
+            if [[ "$i" == *.deb ]]; then
+              echo "Renaming ${i} to ${i/_/-}"
+              mv "${i}" "${i/_/-}"
+            fi 
+            if [[ "$i" == *.apk ]]; then
+              ver=$(echo "$i" | grep -o -e "v[0-9]*\.[0-9]*")
+              arch=$(echo "$i" | grep -o -F -e "x86_64" -e "aarch64")
+              dest="$(dirname "$i")/nginx-agent-${{inputs.pkgVersion}}-$ver-$arch.apk"
+              echo "Renaming ${i} to ${dest}"
+              mv "${i}" "${dest}"
+            fi
+          done
           find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}"
 
-      - name: Azure Upload Release Packages
+      - name: GitHub Upload
+        continue-on-error: true
+        if: ${{ needs.vars.outputs.github_release == 'true' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        # clobber overwrites existing assets of the same name
+        run: |
+          gh release upload --clobber v${{ inputs.pkgVersion }} \
+            $(find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}")
+
+      - name: Azure Login
+        if: ${{ inputs.uploadAzure == true }}
+        uses: azure/login@8c334a195cbb38e46038007b304988d888bf676a # v2.0.0
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - name: Azure Upload
         if: ${{ inputs.uploadAzure == true }}
         uses: azure/CLI@965c8d7571d2231a54e321ddd07f7b10317f34d9 # v2.0.0
         with:
           inlineScript: |
             for i in $(find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}"); do
               dest="nginx-agent/${GITHUB_REF##*/}/${i##*/}"
-              if [[ "$i" == *.apk ]]; then
-                ver=$(echo "$i" | grep -o -e "v[0-9]*\.[0-9]*")
-                arch=$(echo "$i" | grep -o -F -e "x86_64" -e "aarch64")
-                dest="nginx-agent/${GITHUB_REF##*/}/nginx-agent-$VER-$ver-$arch.apk"
-              fi
               echo "Uploading ${i} to ${dest}"
               az storage blob upload --auth-mode=login -f "$i" -c ${{ secrets.AZURE_CONTAINER_NAME }} \
               --account-name ${{ secrets.AZURE_ACCOUNT_NAME }} --overwrite -n ${dest}
             done
 
       - name: Azure Logout
+        if: ${{ inputs.uploadAzure == true }}
         run: |
-          az logout
-        if: always()
-
-      - name: GitHub Upload Release Assets
-        if: ${{ needs.vars.outputs.github_release == 'true' }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        # clobber overwrites existing assets of the same name
-        run: |
-          gh release upload --clobber v${{ inputs.pkgVersion }} \
-            $(find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}")
+          az logout || exit 0