Attach OIDC Native to Ingress Resource #16238
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Run build for Renovate PRs | |
| on: | |
| pull_request: | |
| types: [opened, synchronize] | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| shell: bash | |
| concurrency: | |
| group: ${{ github.ref_name }}-renovate | |
| cancel-in-progress: true | |
| jobs: | |
| check: | |
| name: Check for changes | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| generate: ${{ steps.filter.outputs.generate }} | |
| helm: ${{ steps.filter.outputs.helm }} | |
| permissions: | |
| pull-requests: read | |
| if: github.repository == 'nginx/kubernetes-ingress' && (github.actor == 'renovate[bot]') | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Check for changes | |
| uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 | |
| id: filter | |
| with: | |
| filters: | | |
| generate: | |
| - go.mod | |
| - go.sum | |
| helm: | |
| - '.github/workflows/*.yml' | |
| build: | |
| name: Build for renovate PRs | |
| runs-on: ubuntu-24.04 | |
| needs: check | |
| permissions: | |
| contents: write | |
| id-token: write | |
| if: >- | |
| github.repository == 'nginx/kubernetes-ingress' && | |
| (needs.check.outputs.generate == 'true' || needs.check.outputs.helm == 'true') | |
| steps: | |
| - name: Azure login | |
| uses: azure/login@f5d393ae46f8fde4be8b75f32e3fc50e654ad0ca # v3.0.1 | |
| with: | |
| client-id: ${{ secrets.AZURE_COMMON_VAULT_CLIENT_ID }} | |
| tenant-id: ${{ secrets.AZURE_COMMON_VAULT_TENANT_ID }} | |
| subscription-id: ${{ secrets.AZURE_COMMON_VAULT_SUBSCRIPTION_ID }} | |
| - name: Get secrets from vault | |
| uses: nginx/ci-self-hosted/.github/actions/get-from-vault@5c3e1f8b51f66a851fdba80f70e19cf966199730 # main @ 2026-05-22 | |
| with: | |
| vault-name: ${{ secrets.COMMON_KEYVAULT_NAME }} | |
| secret-names: "nginx-bot-nic-create-pr-app-client-id, nginx-bot-nic-create-pr-app-private-key" | |
| env-names: "APP_CLIENT_ID, APP_PRIVATE_KEY_B64" | |
| - name: Decode GitHub App private key | |
| id: app_key | |
| run: | | |
| set +x | |
| # Mask the raw base64 value | |
| echo "::add-mask::$APP_PRIVATE_KEY_B64" | |
| private_key=$(printf '%s' "$APP_PRIVATE_KEY_B64" | base64 -d) | |
| # Mask every line of the decoded PEM key individually | |
| while IFS= read -r line; do | |
| if [[ -n "$line" ]]; then | |
| echo "::add-mask::$line" | |
| fi | |
| done <<< "$private_key" | |
| delimiter="GHEOF_$(openssl rand -hex 12)" | |
| { | |
| echo "private_key<<$delimiter" | |
| echo "$private_key" | |
| echo "$delimiter" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Generate GitHub App token | |
| id: app_token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ env.APP_CLIENT_ID }} | |
| private-key: ${{ steps.app_key.outputs.private_key }} | |
| owner: ${{ github.repository_owner }} | |
| repositories: ${{ github.event.repository.name }} | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ github.head_ref }} | |
| token: ${{ steps.app_token.outputs.token }} | |
| - name: Configure GOPROXY | |
| id: goproxy | |
| run: | | |
| GOPROXY_VALUE=https://proxy.golang.org,direct | |
| if [ "${{ github.ref_name }}" = "${{ github.event.repository.default_branch }}" ] || [[ "${{ github.ref_name }}" =~ "release-" ]]; then | |
| GOPROXY_VALUE=${{ secrets.ARTIFACTORY_DEV_ENDPOINT }} | |
| fi | |
| echo "GOPROXY=${GOPROXY_VALUE}" >> $GITHUB_ENV | |
| - name: Setup Golang Environment | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version-file: go.mod | |
| # go mod tidy can be removed once https://github.com/renovatebot/renovate/issues/12999 is implemented | |
| - name: Update files for renovate | |
| run: | | |
| make update-crds | |
| make update-codegen | |
| if: needs.check.outputs.generate == 'true' | |
| - name: Check for Helm version changes | |
| id: helm-diff | |
| run: | | |
| if git diff "origin/${{ github.base_ref }}..HEAD" -- '.github/workflows/*.yml' | grep -q 'depName=helm/helm'; then | |
| echo "changed=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| if: needs.check.outputs.helm == 'true' | |
| - name: Setup Helm | |
| uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 | |
| with: | |
| version: v3.21.3 # renovate: datasource=github-releases depName=helm/helm | |
| if: steps.helm-diff.outputs.changed == 'true' | |
| - name: Update snapshots | |
| run: make test-update-snaps | |
| if: steps.helm-diff.outputs.changed == 'true' | |
| - name: Commit changes | |
| id: commit | |
| uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0 | |
| with: | |
| commit_message: "Update files for renovate" | |
| commit_author: "renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>" |