Skip to content

Commit 7a0e6ca

Browse files
ccwienkccwienk
committed
migrate CICD-Pipeline to GitHub-Actions
see: https://gardener.github.io/cc-utils/github_actions.html
1 parent a187aa6 commit 7a0e6ca

8 files changed

Lines changed: 255 additions & 204 deletions

File tree

‎.ci/pipeline_definitions‎

Lines changed: 0 additions & 196 deletions
This file was deleted.

‎.ci/set_dependency_version‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎.github/actions/prepare-release/action.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Prepare Release
2+
3+
runs:
4+
using: composite
5+
steps:
6+
- uses: actions/setup-go@v5
7+
with:
8+
go-version: '1.24'
9+
- name: make-generate
10+
shell: bash
11+
run: |
12+
set -eu
13+
make generate

‎.github/actions/prepare-release/prepare-release/action.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Prepare Release
2+
3+
runs:
4+
using: composite
5+
steps:
6+
- uses: actions/setup-go@v5
7+
with:
8+
go-version: '1.24'
9+
- name: make-generate
10+
shell: bash
11+
run: |
12+
set -eu
13+
make generate

‎.github/workflows/build.yaml‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
name: Build
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
mode:
7+
required: true
8+
type: string
9+
default: snapshot
10+
description: |
11+
the mode to use. either `snapshot` or `release`. Will affect effective version, as well
12+
as target-oci-registry.
13+
14+
jobs:
15+
prepare:
16+
uses: gardener/cc-utils/.github/workflows/prepare.yaml@master
17+
with:
18+
mode: ${{ inputs.mode }}
19+
version-commit-callback-action-path:
20+
permissions:
21+
contents: read
22+
23+
oci-images:
24+
name: Build OCI-Images
25+
needs:
26+
- prepare
27+
permissions:
28+
contents: read
29+
packages: write
30+
id-token: write
31+
secrets: inherit
32+
uses: gardener/cc-utils/.github/workflows/oci-ocm.yaml@master
33+
strategy:
34+
matrix:
35+
args:
36+
- name: gardener-extension-shoot-falco-service
37+
target: gardener-extension-shoot-falco-service
38+
oci-repository: gardener/extensions/shoot-falco-service
39+
- name: gardener-extension-admission-shoot-falco-service
40+
target: gardener-extension-admission-shoot-falco-service
41+
oci-repository: gardener/extensions/shoot-falco-service
42+
with:
43+
name: ${{ matrix.args.name }}
44+
version: ${{ needs.prepare.outputs.version }}
45+
target: ${{ matrix.args.target }}
46+
oci-registry: ${{ needs.prepare.outputs.oci-registry }}
47+
oci-repository: ${{ matrix.args.oci-repository }}
48+
oci-platforms: linux/amd64,linux/arm64
49+
50+
helmcharts:
51+
name: Build Helmcharts
52+
needs:
53+
- prepare
54+
- oci-images
55+
permissions:
56+
contents: read
57+
packages: write
58+
id-token: write
59+
uses: gardener/cc-utils/.github/workflows/helmchart-ocm.yaml@master
60+
strategy:
61+
matrix:
62+
args:
63+
- name: shoot-falco-service
64+
dir: charts/gardener-extension-shoot-falco-service
65+
oci-repository: charts/gardener/extensions
66+
ocm-mappings:
67+
- ref: ocm-resource:gardener-extension-shoot-falco-service.repository
68+
attribute: image.repository
69+
- ref: ocm-resource:gardener-extension-shoot-falco-service.tag
70+
attribute: image.tag
71+
- name: shoot-falco-service-admission-application
72+
dir: charts/gardener-extension-admission-shoot-falco-service/charts/application
73+
oci-repository: charts/gardener/extensions
74+
ocm-mappings:
75+
- ref: ocm-resource:gardener-extension-admission-shoot-falco-service.repository
76+
attribute: image.repository
77+
- ref: ocm-resource:gardener-extension-admission-shoot-falco-service.tag
78+
attribute: image.tag
79+
- name: shoot-falco-service-admission-runtime
80+
dir: charts/gardener-extension-admission-shoot-falco-service/charts/runtime
81+
oci-repository: charts/gardener/extensions
82+
ocm-mappings:
83+
- ref: ocm-resource:gardener-extension-admission-shoot-falco-service.repository
84+
attribute: image.repository
85+
- ref: ocm-resource:gardener-extension-admission-shoot-falco-service.tag
86+
attribute: image.tag
87+
88+
with:
89+
name: ${{ matrix.args.name }}
90+
dir: ${{ matrix.args.dir }}
91+
oci-registry: ${{ needs.prepare.outputs.oci-registry }}
92+
oci-repository: ${{ matrix.args.oci-repository }}
93+
ocm-mappings: ${{ toJSON(matrix.args.ocm-mappings) }}
94+
95+
export-falco-files:
96+
runs-on: ubuntu-latest
97+
permissions:
98+
contents: read
99+
steps:
100+
- uses: actions/checkout@v4
101+
- name: prepare
102+
run: |
103+
set -eu
104+
mkdir /tmp/blobs.d
105+
cp falco/falco-profile.yaml /tmp/blobs.d/
106+
tar czf /tmp/blobs.d/falco-rules.tar.gz -C falco/rules .
107+
tar czf /tmp/blobs.d/falco-crds.tar.gz falco-crds
108+
- uses: gardener/cc-utils/.github/actions/export-ocm-fragments@master
109+
with:
110+
ocm-resources: |
111+
- name: falcoprofile
112+
relation: local
113+
access:
114+
type: localBlob
115+
localReference: falco-profile.yaml
116+
- name: falco-rules
117+
relation: local
118+
access:
119+
type: localBlob
120+
localReference: falco-rules.tar.gz
121+
- name: falco-crds
122+
relation: local
123+
access:
124+
type: localBlob
125+
localReference: falco-crds.tar.gz
126+
blobs-directory: /tmp/blobs.d
127+
128+
verify:
129+
runs-on: ubuntu-latest
130+
permissions:
131+
contents: read
132+
steps:
133+
- uses: actions/setup-go@v5
134+
with:
135+
go-version: '1.24'
136+
- uses: gardener/cc-utils/.github/actions/trusted-checkout@master
137+
- name: run-verify
138+
run: |
139+
set -eu
140+
.ci/verify
141+
# verify calls `make sast-report`, which generates `gosec-report.sarif`
142+
mkdir /tmp/blobs.d
143+
tar czf /tmp/blobs.d/gosec-report.tar.gz gosec-report.sarif
144+
- name: add-sast-report-to-component-descriptor
145+
uses: gardener/cc-utils/.github/actions/export-ocm-fragments@master
146+
with:
147+
blobs-directory: /tmp/blobs.d
148+
ocm-resources: |
149+
name: gosec-report
150+
relation: local
151+
access:
152+
type: localBlob
153+
localReference: gosec-report.tar.gz
154+
labels:
155+
- name: gardener.cloud/purposes
156+
value:
157+
- lint
158+
- sast
159+
- gosec
160+
- name: gardener.cloud/comment
161+
value: |
162+
we use gosec (linter) for SAST scans
163+
see: https://github.com/securego/gosec

0 commit comments

Comments
 (0)