[CVE Fix] Update rabbitmq to 4.3.4-management-alpine #277
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: SUSE LLC | |
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Continuous Integration | |
| on: | |
| push: | |
| branches: | |
| - "main" | |
| pull_request: | |
| env: | |
| HELM_VERSION: v4.2.0 # https://github.com/helm/helm/releases | |
| BATS_VERSION: "1.13.0" # https://github.com/bats-core/bats-core/releases | |
| HELM_UNITTEST_VERSION: "1.1.2" # https://github.com/helm-unittest/helm-unittest/releases | |
| SEMVER_VERSION: 1a547a75f946717223fb7ca821ba6f3f337e9aca # https://api.github.com/repos/fsaintjacques/semver-tool/commits?per_page=1 | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # We have to prevent CI from running when VERSION file is changed, | |
| # eg on release trigger time. However, with Helm charts we have to | |
| # modify additional files along with the VERSION file which can't be | |
| # handles with the built-in paths-ignore logic in GH actions. Thus, | |
| # we do the enabling/disabling logic manually. | |
| paths-check: | |
| name: Release check | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| is-release: ${{ steps.filter.outputs.release }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2 | |
| id: filter | |
| with: | |
| filters: | | |
| release: | |
| - 'VERSION' | |
| test-ci-scripts: | |
| name: Test CI scripts | |
| needs: paths-check | |
| runs-on: ubuntu-24.04 | |
| if: needs.paths-check.outputs.is-release == 'false' | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup BATS | |
| uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 #v4.0.0 | |
| with: | |
| bats-version: ${{ env.BATS_VERSION }} | |
| - name: Install semver-tool | |
| run: | | |
| sudo wget -O /usr/local/bin/semver https://raw.githubusercontent.com/fsaintjacques/semver-tool/${{ env.SEMVER_VERSION }}/src/semver | |
| sudo chmod +x /usr/local/bin/semver | |
| - name: Run Bats tests | |
| run: | | |
| bats .github/scripts/tests/*.bats | |
| test-helm-charts: | |
| needs: paths-check | |
| runs-on: ubuntu-24.04 | |
| if: needs.paths-check.outputs.is-release == 'false' | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 | |
| with: | |
| version: ${{ env.HELM_VERSION }} | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: 3.13 | |
| - name: Check license headers | |
| uses: apache/skywalking-eyes/header@61275cc80d0798a405cb070f7d3a8aaf7cf2c2c1 # v0.8.0 | |
| - name: Set up chart-testing | |
| uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0 | |
| - name: Lint | |
| run: ct lint --config=ct.yaml --lint-conf=helmlintconf.yaml --helm-lint-extra-args="--set prometheus.server.auth.type=none" | |
| - name: Setup helm-unittest | |
| run: | | |
| helm plugin install --verify=false \ | |
| "https://github.com/helm-unittest/helm-unittest/releases/download/v${HELM_UNITTEST_VERSION}/unittest-${HELM_UNITTEST_VERSION}.tgz" | |
| - name: Test chart templates | |
| run: | | |
| # Dynamically add helm repos from Chart.yaml dependencies | |
| while IFS='|' read -r dep_name dep_repo; do | |
| if [ -n "$dep_repo" ] && [ "$dep_repo" != "null" ]; then | |
| echo "Adding helm repo: $dep_name ($dep_repo)" | |
| helm repo add "$dep_name" "$dep_repo" --force-update | |
| fi | |
| done < <(yq eval '.dependencies[] | .name + "|" + (.repository // "")' charts/trento-server/Chart.yaml) | |
| helm dependency build charts/trento-server | |
| helm unittest charts/trento-server | |
| gh-release-rolling: | |
| name: Chart rolling release on GitHub | |
| needs: | |
| - test-helm-charts | |
| - test-ci-scripts | |
| - paths-check | |
| if: github.event_name == 'push' && needs.paths-check.outputs.is-release == 'false' | |
| uses: ./.github/workflows/publish-oci.yaml | |
| with: | |
| branch: ${{ github.ref_name }} | |
| prerelease: true | |
| secrets: | |
| gh_token: ${{ secrets.TRENTOBOT_GH_PAT }} | |
| ssh_key: ${{ secrets.TRENTOBOT_SSH_KEY }} | |
| obs-sync: | |
| name: OBS sync | |
| needs: | |
| - test-helm-charts | |
| - test-ci-scripts | |
| - paths-check | |
| if: fromJSON(vars.OBS_ENABLED) && github.event_name == 'push' && needs.paths-check.outputs.is-release == 'false' | |
| uses: trento-project/.github/.github/workflows/obs-sync.yaml@7ea6a8a1c3ed8a1f2185328219be4a724dd3686e # v1.8.0 | |
| with: | |
| obs_project: ${{ vars.OBS_PROJECT_ROLLING }} | |
| obs_package: ${{ vars.OBS_PACKAGE }} | |
| secrets: | |
| gh_token: ${{ secrets.TRENTOBOT_GH_PAT }} | |
| obs_user: ${{ secrets.OBS_USER }} | |
| obs_pass: ${{ secrets.OBS_PASS }} | |
| obs_ssh_key: ${{ secrets.OBS_SSH_KEY }} |