Skip to content

Commit 8f23550

Browse files
ccwienkccwienk
committed
migrate CICD-Pipeline to GitHub-Actions
see: https://gardener.github.io/cc-utils/github_actions.html
1 parent a187aa6 commit 8f23550

8 files changed

Lines changed: 256 additions & 204 deletions

File tree

‎.ci/pipeline_definitions‎

Lines changed: 0 additions & 196 deletions
This file was deleted.

‎.ci/set_dependency_version‎

Lines changed: 0 additions & 8 deletions
This file was deleted.

‎.github/actions/prepare-release/action.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Prepare Release
2+
3+
runs:
4+
using: composite
5+
steps:
6+
- uses: actions/setup-go@v5
7+
with:
8+
go-version: '1.24'
9+
- name: make-generate
10+
shell: bash
11+
run: |
12+
set -eu
13+
make generate

‎.github/actions/prepare-release/prepare-release/action.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Prepare Release
2+
3+
runs:
4+
using: composite
5+
steps:
6+
- uses: actions/setup-go@v5
7+
with:
8+
go-version: '1.24'
9+
- name: make-generate
10+
shell: bash
11+
run: |
12+
set -eu
13+
make generate

‎.github/workflows/build.yaml‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
name: Build
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
mode:
7+
required: true
8+
type: string
9+
default: snapshot
10+
description: |
11+
the mode to use. either `snapshot` or `release`. Will affect effective version, as well
12+
as target-oci-registry.
13+
14+
jobs:
15+
prepare:
16+
uses: gardener/cc-utils/.github/workflows/prepare.yaml@master
17+
with:
18+
mode: ${{ inputs.mode }}
19+
version-commit-callback-action-path:
20+
permissions:
21+
contents: read
22+
23+
oci-images:
24+
name: Build OCI-Images
25+
needs:
26+
- prepare
27+
permissions:
28+
contents: read
29+
packages: write
30+
id-token: write
31+
secrets: inherit
32+
uses: gardener/cc-utils/.github/workflows/oci-ocm.yaml@master
33+
strategy:
34+
matrix:
35+
args:
36+
- name: gardener-extension-shoot-falco-service
37+
target: gardener-extension-shoot-falco-service
38+
oci-repository: gardener/extensions/shoot-falco-service
39+
- name: gardener-extension-admission-shoot-falco-service
40+
target: gardener-extension-admission-shoot-falco-service
41+
oci-repository: gardener/extensions/shoot-falco-service
42+
with:
43+
name: ${{ matrix.args.name }}
44+
version: ${{ needs.prepare.outputs.version }}
45+
target: ${{ matrix.args.target }}
46+
oci-registry: ${{ needs.prepare.outputs.oci-registry }}
47+
oci-repository: ${{ matrix.args.oci-repository }}
48+
oci-platforms: linux/amd64,linux/arm64
49+
50+
helmcharts:
51+
name: Build Helmcharts
52+
needs:
53+
- prepare
54+
- oci-images
55+
permissions:
56+
contents: read
57+
packages: write
58+
id-token: write
59+
uses: gardener/cc-utils/.github/workflows/helmchart-ocm.yaml@master
60+
strategy:
61+
matrix:
62+
args:
63+
- name: shoot-falco-service
64+
dir: charts/gardener-extension-shoot-falco-service
65+
oci-repository: charts/gardener/extensions
66+
ocm-mappings:
67+
- ref: ocm-resource:gardener-extension-shoot-falco-service.repository
68+
attribute: image.repository
69+
- ref: ocm-resource:gardener-extension-shoot-falco-service.tag
70+
attribute: image.tag
71+
- name: shoot-falco-service-admission-application
72+
dir: charts/gardener-extension-admission-shoot-falco-service/charts/application
73+
oci-repository: charts/gardener/extensions
74+
ocm-mappings:
75+
- ref: ocm-resource:gardener-extension-admission-shoot-falco-service.repository
76+
attribute: image.repository
77+
- ref: ocm-resource:gardener-extension-admission-shoot-falco-service.tag
78+
attribute: image.tag
79+
- name: shoot-falco-service-admission-runtime
80+
dir: charts/gardener-extension-admission-shoot-falco-service/charts/runtime
81+
oci-repository: charts/gardener/extensions
82+
ocm-mappings:
83+
- ref: ocm-resource:gardener-extension-admission-shoot-falco-service.repository
84+
attribute: image.repository
85+
- ref: ocm-resource:gardener-extension-admission-shoot-falco-service.tag
86+
attribute: image.tag
87+
88+
with:
89+
name: ${{ matrix.args.name }}
90+
dir: ${{ matrix.args.dir }}
91+
oci-registry: ${{ needs.prepare.outputs.oci-registry }}
92+
oci-repository: ${{ matrix.args.oci-repository }}
93+
ocm-mappings: ${{ toJSON(matrix.args.ocm-mappings) }}
94+
95+
export-falco-files:
96+
runs-on: ubuntu-latest
97+
permissions:
98+
contents: read
99+
steps:
100+
- uses: actions/checkout@v4
101+
- name: prepare
102+
run: |
103+
set -eu
104+
mkdir /tmp/blobs.d
105+
cp falco/falco-profile.yaml /tmp/blobs.d/
106+
tar czf /tmp/blobs.d/falco-rules.tar.gz -C falco/rules .
107+
mv crds falco-crds
108+
tar czf /tmp/blobs.d/falco-crds.tar.gz falco-crds
109+
- uses: gardener/cc-utils/.github/actions/export-ocm-fragments@master
110+
with:
111+
ocm-resources: |
112+
- name: falcoprofile
113+
relation: local
114+
access:
115+
type: localBlob
116+
localReference: falco-profile.yaml
117+
- name: falco-rules
118+
relation: local
119+
access:
120+
type: localBlob
121+
localReference: falco-rules.tar.gz
122+
- name: falco-crds
123+
relation: local
124+
access:
125+
type: localBlob
126+
localReference: falco-crds.tar.gz
127+
blobs-directory: /tmp/blobs.d
128+
129+
verify:
130+
runs-on: ubuntu-latest
131+
permissions:
132+
contents: read
133+
steps:
134+
- uses: actions/setup-go@v5
135+
with:
136+
go-version: '1.24'
137+
- uses: gardener/cc-utils/.github/actions/trusted-checkout@master
138+
- name: run-verify
139+
run: |
140+
set -eu
141+
.ci/verify
142+
# verify calls `make sast-report`, which generates `gosec-report.sarif`
143+
mkdir /tmp/blobs.d
144+
tar czf /tmp/blobs.d/gosec-report.tar.gz gosec-report.sarif
145+
- name: add-sast-report-to-component-descriptor
146+
uses: gardener/cc-utils/.github/actions/export-ocm-fragments@master
147+
with:
148+
blobs-directory: /tmp/blobs.d
149+
ocm-resources: |
150+
name: gosec-report
151+
relation: local
152+
access:
153+
type: localBlob
154+
localReference: gosec-report.tar.gz
155+
labels:
156+
- name: gardener.cloud/purposes
157+
value:
158+
- lint
159+
- sast
160+
- gosec
161+
- name: gardener.cloud/comment
162+
value: |
163+
we use gosec (linter) for SAST scans
164+
see: https://github.com/securego/gosec

0 commit comments

Comments
 (0)