Skip to content

Commit a83080c

Browse files
thardeckthardeck
authored
Backport Supply Chain Hardening and immutable Release changes (#4932)
1 parent 3b438c6 commit a83080c

21 files changed

Lines changed: 386 additions & 320 deletions

‎.github/scripts/determine-cache-key.sh‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎.github/scripts/install-crust-gather.sh‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
#!/bin/bash
2+
3+
# Install crust-gather from a pinned release, verifying the SHA-256 checksum
4+
# before placing the binary on PATH.
5+
#
6+
# renovate: datasource=github-releases depName=crust-gather/crust-gather
7+
CRUST_GATHER_VERSION="v0.13.0"
8+
# Strip leading 'v' for the archive name
9+
CRUST_GATHER_VER="${CRUST_GATHER_VERSION#v}"
10+
11+
# shellcheck disable=SC2034
12+
# renovate: datasource=github-release-attachments depName=crust-gather/crust-gather digestVersion=v0.13.0
13+
CRUST_GATHER_SUM_amd64="a5870ca76387d1c24ffceaa614671a92823a49113fb3ecd0f33dd23acf975f7c"
14+
# shellcheck disable=SC2034
15+
# renovate: datasource=github-release-attachments depName=crust-gather/crust-gather digestVersion=v0.13.0
16+
CRUST_GATHER_SUM_arm64="103deb2d2d67da03859125031caa34d1938974bb0e160dbbdbb23e41521d2a47"
17+
18+
set -euo pipefail
19+
20+
ARCH=$(uname -m)
21+
case "${ARCH}" in
22+
x86_64) ARCH="amd64" ;;
23+
aarch64) ARCH="arm64" ;;
24+
*) echo "Unsupported architecture: ${ARCH}"; exit 1 ;;
25+
esac
26+
27+
DEST="${INSTALL_DIR:-${HOME}/.local/bin}"
28+
mkdir -p "${DEST}"
29+
TMPDIR=$(mktemp -d)
30+
trap 'rm -rf "${TMPDIR}"' EXIT
31+
32+
ARCHIVE="kubectl-crust-gather_${CRUST_GATHER_VER}_linux_${ARCH}.tar.gz"
33+
curl -sSfL \
34+
"https://github.com/crust-gather/crust-gather/releases/download/${CRUST_GATHER_VERSION}/${ARCHIVE}" \
35+
-o "${TMPDIR}/${ARCHIVE}"
36+
37+
SUM_VAR="CRUST_GATHER_SUM_${ARCH}"
38+
echo "${!SUM_VAR} ${TMPDIR}/${ARCHIVE}" | sha256sum -c -
39+
40+
tar -xzf "${TMPDIR}/${ARCHIVE}" -C "${TMPDIR}" kubectl-crust-gather
41+
install -m 0755 "${TMPDIR}/kubectl-crust-gather" "${DEST}/crust-gather"
42+
echo "Installed crust-gather ${CRUST_GATHER_VERSION} (${ARCH}) to ${DEST}/crust-gather"

‎.github/scripts/install-k3d.sh‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/bin/bash
2+
3+
# Install k3d from a pinned release, verifying the SHA-256 checksum before
4+
# placing the binary on PATH.
5+
#
6+
# renovate: datasource=github-releases depName=k3d-io/k3d
7+
K3D_VERSION="v5.8.3"
8+
9+
# shellcheck disable=SC2034
10+
# renovate: datasource=github-release-attachments depName=k3d-io/k3d digestVersion=v5.8.3
11+
K3D_SUM_amd64="dbaa79a76ace7f4ca230a1ff41dc7d8a5036a8ad0309e9c54f9bf3836dbe853e"
12+
# shellcheck disable=SC2034
13+
# renovate: datasource=github-release-attachments depName=k3d-io/k3d digestVersion=v5.8.3
14+
K3D_SUM_arm64="0b8110f2229631af7402fb828259330985918b08fefd38b7f1b788a1c8687216"
15+
16+
set -euo pipefail
17+
18+
ARCH=$(uname -m)
19+
case "${ARCH}" in
20+
x86_64) ARCH="amd64" ;;
21+
aarch64) ARCH="arm64" ;;
22+
*) echo "Unsupported architecture: ${ARCH}"; exit 1 ;;
23+
esac
24+
25+
DEST="${INSTALL_DIR:-${HOME}/.local/bin}"
26+
mkdir -p "${DEST}"
27+
TMPDIR=$(mktemp -d)
28+
trap 'rm -rf "${TMPDIR}"' EXIT
29+
30+
curl -sSfL \
31+
"https://github.com/k3d-io/k3d/releases/download/${K3D_VERSION}/k3d-linux-${ARCH}" \
32+
-o "${TMPDIR}/k3d"
33+
34+
K3D_SUM_VAR="K3D_SUM_${ARCH}"
35+
echo "${!K3D_SUM_VAR} ${TMPDIR}/k3d" | sha256sum -c -
36+
37+
install -m 0755 "${TMPDIR}/k3d" "${DEST}/k3d"
38+
echo "Installed k3d ${K3D_VERSION} (${ARCH}) to ${DEST}/k3d"

‎.github/workflows/add_issue_to_project.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
if: >
1616
github.repository == 'rancher/fleet'
1717
steps:
18-
- uses: actions/add-to-project@main
18+
- uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
1919
with:
2020
project-url: https://github.com/orgs/rancher/projects/12
2121
github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

‎.github/workflows/benchmark.yml‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ concurrency:
2424
env:
2525
GOARCH: amd64
2626
CGO_ENABLED: 0
27-
SETUP_K3D_VERSION: "v5.8.3"
2827
SETUP_K3S_VERSION: "v1.35.1-k3s1"
2928
# Defaults for both manual and scheduled runs
3029
BENCH_TIMEOUT: ${{ github.event.inputs.timeout || '2m' }}
@@ -45,7 +44,6 @@ jobs:
4544
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
4645
with:
4746
go-version-file: "go.mod"
48-
check-latest: true
4947

5048
# No extra host dependencies required
5149

@@ -60,8 +58,24 @@ jobs:
6058
docker --version
6159
docker info
6260
61+
- name: Cache k3d CLI
62+
id: cache-k3d
63+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
64+
with:
65+
path: ~/.local/bin/k3d
66+
key: ${{ runner.os }}-k3d-${{ hashFiles('.github/scripts/install-k3d.sh') }}
67+
restore-keys: |
68+
${{ runner.os }}-k3d-
69+
6370
- name: Install k3d
64-
run: curl --silent --fail https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG=${{ env.SETUP_K3D_VERSION }} bash
71+
run: |
72+
if [ "${{ steps.cache-k3d.outputs.cache-hit }}" != "true" ]; then
73+
./.github/scripts/install-k3d.sh
74+
else
75+
echo "Using cached k3d"
76+
chmod +x ~/.local/bin/k3d
77+
fi
78+
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
6579
6680
- name: Verify k3d installation
6781
run: |
@@ -109,7 +123,7 @@ jobs:
109123
echo "Found report: $safe_file"
110124
111125
- name: Upload benchmark JSON
112-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
126+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
113127
with:
114128
name: benchmark-report
115129
path: ${{ steps.report.outputs.report }}

‎.github/workflows/check-changes.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@ name: Check for unallowed changes
22

33
on:
44
pull_request:
5+
push:
6+
branches:
7+
- '*-hotfix-*'
58

69
env:
710
MAIN_BRANCH: origin/main
@@ -21,7 +24,6 @@ jobs:
2124
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
2225
with:
2326
go-version-file: 'go.mod'
24-
check-latest: true
2527
-
2628
name: Install Ginkgo CLI
2729
run: go install github.com/onsi/ginkgo/v2/ginkgo
@@ -33,4 +35,5 @@ jobs:
3335
run: ./.github/scripts/check-for-auto-generated-changes.sh
3436
-
3537
name: known-hosts
36-
run: ./.github/scripts/check-for-known-hosts-changes.sh $GITHUB_BASE_REF
38+
if: github.event_name == 'pull_request'
39+
run: ./.github/scripts/check-for-known-hosts-changes.sh "$GITHUB_BASE_REF"

‎.github/workflows/ci.yml‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
pull_request:
77
push:
88
branches:
9-
- 'release/*'
9+
- '*-hotfix-*'
1010

1111
env:
1212
GOARCH: amd64
@@ -37,7 +37,6 @@ jobs:
3737
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
3838
with:
3939
go-version-file: 'go.mod'
40-
check-latest: true
4140
-
4241
name: unit-test
4342
run: go test -shuffle=on $(go list ./... | grep -v -e /e2e -e /integrationtests -e /benchmarks)
@@ -53,7 +52,6 @@ jobs:
5352
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
5453
with:
5554
go-version-file: 'go.mod'
56-
check-latest: true
5755
-
5856
name: Install Ginkgo CLI
5957
run: go install github.com/onsi/ginkgo/v2/ginkgo
@@ -75,7 +73,6 @@ jobs:
7573
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
7674
with:
7775
go-version-file: 'go.mod'
78-
check-latest: true
7976
-
8077
name: Install Ginkgo CLI
8178
run: go install github.com/onsi/ginkgo/v2/ginkgo

‎.github/workflows/e2e-ci.yml‎

Lines changed: 21 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,11 @@ on:
55
pull_request:
66
push:
77
branches:
8-
- 'release/*'
8+
- '*-hotfix-*'
99

1010
env:
1111
GOARCH: amd64
1212
CGO_ENABLED: 0
13-
SETUP_K3D_VERSION: 'v5.8.3'
1413

1514
jobs:
1615
e2e-fleet-test:
@@ -47,43 +46,28 @@ jobs:
4746
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
4847
with:
4948
go-version-file: 'go.mod'
50-
check-latest: true
5149
-
5250
name: Install Ginkgo CLI
5351
run: go install github.com/onsi/ginkgo/v2/ginkgo
54-
-
55-
name: Determine cache key
56-
id: cache-key
57-
run: ./.github/scripts/determine-cache-key.sh
5852
-
5953
name: Cache crust-gather CLI
6054
id: cache-crust
6155
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
6256
with:
6357
path: ~/.local/bin/crust-gather
64-
key: ${{ runner.os }}-crust-gather-${{ steps.cache-key.outputs.value }}
58+
key: ${{ runner.os }}-crust-gather-${{ hashFiles('.github/scripts/install-crust-gather.sh') }}
6559
restore-keys: |
6660
${{ runner.os }}-crust-gather-
6761
-
6862
name: Install crust-gather CLI
6963
run: |
7064
if [ "${{ steps.cache-crust.outputs.cache-hit }}" != "true" ]; then
71-
echo "Cache not found, downloading from source"
72-
mkdir -p ~/.local/bin
73-
if curl -sSfL https://github.com/crust-gather/crust-gather/raw/main/install.sh | sh -s -- --yes; then
74-
# Cache the binary for future runs
75-
if [ ! -f ~/.local/bin/crust-gather ]; then
76-
which crust-gather && cp $(which crust-gather) ~/.local/bin/
77-
fi
78-
else
79-
echo "Failed to download crust-gather"
80-
exit 1
81-
fi
65+
./.github/scripts/install-crust-gather.sh
8266
else
8367
echo "Using cached crust-gather CLI"
8468
chmod +x ~/.local/bin/crust-gather
85-
sudo ln -sf ~/.local/bin/crust-gather /usr/local/bin/
8669
fi
70+
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
8771
-
8872
name: Build Fleet
8973
run: |
@@ -99,9 +83,24 @@ jobs:
9983
cd e2e/assets/gitrepo
10084
# Buildkit needed here for proper here-document support
10185
DOCKER_BUILDKIT=1 docker build -f Dockerfile.gitserver -t nginx-git:test --build-arg="passwd=$(openssl passwd foo)" .
86+
-
87+
name: Cache k3d CLI
88+
id: cache-k3d
89+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
90+
with:
91+
path: ~/.local/bin/k3d
92+
key: ${{ runner.os }}-k3d-${{ hashFiles('.github/scripts/install-k3d.sh') }}
93+
restore-keys: |
94+
${{ runner.os }}-k3d-
10295
-
10396
name: Install k3d
104-
run: curl --silent --fail https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG=${{ env.SETUP_K3D_VERSION }} bash
97+
run: |
98+
if [ "${{ steps.cache-k3d.outputs.cache-hit }}" != "true" ]; then
99+
./.github/scripts/install-k3d.sh
100+
else
101+
echo "Using cached k3d"
102+
chmod +x ~/.local/bin/k3d
103+
fi
105104
-
106105
name: Provision k3d Cluster
107106
run: |
@@ -270,7 +269,7 @@ jobs:
270269
ginkgo --github-output --trace e2e/require-secrets
271270
-
272271
name: Upload Logs
273-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
272+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
274273
if: failure()
275274
with:
276275
name: gha-fleet-e2e-logs-${{ github.sha }}-${{ matrix.k3s.version }}-${{ matrix.test_type.name }}-${{ github.run_id }}

‎.github/workflows/e2e-fleet-upgrade-ci.yml‎

Lines changed: 20 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ on:
99
env:
1010
GOARCH: amd64
1111
CGO_ENABLED: 0
12-
SETUP_K3D_VERSION: 'v5.8.3'
1312

1413
jobs:
1514
fleet-upgrade-test:
@@ -31,46 +30,46 @@ jobs:
3130
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
3231
with:
3332
go-version-file: 'go.mod'
34-
check-latest: true
3533
-
3634
name: Install Ginkgo CLI
3735
run: go install github.com/onsi/ginkgo/v2/ginkgo
38-
-
39-
name: Determine cache key
40-
id: cache-key
41-
run: ./.github/scripts/determine-cache-key.sh
4236
-
4337
name: Cache crust-gather CLI
4438
id: cache-crust
4539
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
4640
with:
4741
path: ~/.local/bin/crust-gather
48-
key: ${{ runner.os }}-crust-gather-${{ steps.cache-key.outputs.value }}
42+
key: ${{ runner.os }}-crust-gather-${{ hashFiles('.github/scripts/install-crust-gather.sh') }}
4943
restore-keys: |
5044
${{ runner.os }}-crust-gather-
5145
-
5246
name: Install crust-gather CLI
5347
run: |
5448
if [ "${{ steps.cache-crust.outputs.cache-hit }}" != "true" ]; then
55-
echo "Cache not found, downloading from source"
56-
mkdir -p ~/.local/bin
57-
if curl -sSfL https://github.com/crust-gather/crust-gather/raw/main/install.sh | sh -s -- --yes; then
58-
# Cache the binary for future runs
59-
if [ ! -f ~/.local/bin/crust-gather ]; then
60-
which crust-gather && cp $(which crust-gather) ~/.local/bin/
61-
fi
62-
else
63-
echo "Failed to download crust-gather"
64-
exit 1
65-
fi
49+
./.github/scripts/install-crust-gather.sh
6650
else
6751
echo "Using cached crust-gather CLI"
6852
chmod +x ~/.local/bin/crust-gather
69-
sudo ln -sf ~/.local/bin/crust-gather /usr/local/bin/
7053
fi
54+
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
55+
-
56+
name: Cache k3d CLI
57+
id: cache-k3d
58+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
59+
with:
60+
path: ~/.local/bin/k3d
61+
key: ${{ runner.os }}-k3d-${{ hashFiles('.github/scripts/install-k3d.sh') }}
62+
restore-keys: |
63+
${{ runner.os }}-k3d-
7164
-
7265
name: Install k3d
73-
run: curl --silent --fail https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | TAG=${{ env.SETUP_K3D_VERSION }} bash
66+
run: |
67+
if [ "${{ steps.cache-k3d.outputs.cache-hit }}" != "true" ]; then
68+
./.github/scripts/install-k3d.sh
69+
else
70+
echo "Using cached k3d"
71+
chmod +x ~/.local/bin/k3d
72+
fi
7473
-
7574
name: Provision k3d Cluster
7675
run: |
@@ -116,7 +115,7 @@ jobs:
116115
ginkgo --github-output --trace --label-filter="!multi-cluster" e2e/installation
117116
-
118117
name: Upload Logs
119-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
118+
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
120119
if: failure()
121120
with:
122121
name: gha-fleet-e2e-logs-${{ github.sha }}-${{ matrix.k3s.version }}-${{ github.run_id }}

0 commit comments

Comments
 (0)