Skip to content

Commit 0946f74

Browse files
csatib02csatib02
committed
initial commit
Signed-off-by: Bence Csati <bence.csati@axoflow.com>
1 parent 50c9700 commit 0946f74

29 files changed

+1444
-0
lines changed

‎.dockerignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
bin/

‎.github/actionlint-matcher.json‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
{
2+
"problemMatcher": [
3+
{
4+
"owner": "actionlint",
5+
"pattern": [
6+
{
7+
"regexp": "^(?:\\x1b\\[\\d+m)?(.+?)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*:(?:\\x1b\\[\\d+m)*(\\d+)(?:\\x1b\\[\\d+m)*: (?:\\x1b\\[\\d+m)*(.+?)(?:\\x1b\\[\\d+m)* \\[(.+?)\\]$",
8+
"file": 1,
9+
"line": 2,
10+
"column": 3,
11+
"message": 4,
12+
"code": 5
13+
}
14+
]
15+
}
16+
]
17+
}

‎.github/workflows/ci.yaml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
- "release-[0-9]+.[0-9]+*"
8+
pull_request:
9+
10+
jobs:
11+
verification:
12+
name: Verification
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
17+
18+
- name: Run Actionlint
19+
run: |
20+
echo "::add-matcher::.github/actionlint-matcher.json"
21+
make lint-actions
22+
echo "::remove-matcher owner=actionlint::"
23+
24+
- name: Run Hadolint
25+
uses: hadolint/hadolint-action@v3.1.0
26+
with:
27+
dockerfile: Dockerfile
28+
config: .hadolint.yaml
29+
30+
- name: Run Yamllint
31+
run: |
32+
pip install --user yamllint
33+
yamllint .
34+
35+
- name: Run Helm lint
36+
run: |
37+
make lint-helm
38+
39+
image-build:
40+
name: Image build
41+
uses: ./.github/workflows/image-build.yaml
42+
with:
43+
publish: ${{ github.event_name == 'push' }}
44+
permissions:
45+
contents: read
46+
packages: write
47+
id-token: write

‎.github/workflows/image-build.yaml‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
name: Image build
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
publish:
7+
description: Publish artifacts to ghcr.io
8+
default: false
9+
required: false
10+
type: boolean
11+
release:
12+
description: Whether this is a release build
13+
default: false
14+
required: false
15+
type: boolean
16+
outputs:
17+
container-image-name:
18+
description: Container image name
19+
value: ${{ jobs.container-image.outputs.name }}
20+
container-image-digest:
21+
description: Container image digest
22+
value: ${{ jobs.container-image.outputs.digest }}
23+
container-image-tag:
24+
description: Container image tag
25+
value: ${{ jobs.container-image.outputs.tag }}
26+
27+
permissions:
28+
contents: read
29+
30+
jobs:
31+
container-image:
32+
name: Container image
33+
runs-on: ubuntu-latest
34+
35+
permissions:
36+
contents: read
37+
packages: write
38+
id-token: write
39+
40+
outputs:
41+
name: ${{ steps.image-name.outputs.value }}
42+
digest: ${{ steps.build.outputs.digest }}
43+
tag: ${{ steps.meta.outputs.version }}
44+
45+
steps:
46+
- name: Checkout repository
47+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
48+
49+
- name: Set up QEMU
50+
uses: docker/setup-qemu-action@53851d14592bedcffcf25ea515637cff71ef929a # v3.3.0
51+
52+
- name: Set up Docker Buildx
53+
uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3.8.0
54+
55+
- name: Set up Cosign
56+
uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da # v3.7.0
57+
if: inputs.publish
58+
59+
- name: Set image name
60+
id: image-name
61+
run: echo "value=ghcr.io/axoflow/cloudconnectors" >> "$GITHUB_OUTPUT"
62+
63+
- name: Gather build metadata
64+
id: meta
65+
uses: docker/metadata-action@369eb591f429131d6889c46b94e711f089e6ca96 # v5.6.1
66+
with:
67+
images: ${{ steps.image-name.outputs.value }}
68+
flavor: |
69+
latest = false
70+
tags: |
71+
type=ref,event=branch
72+
type=ref,event=pr,prefix=pr-
73+
type=semver,pattern={{raw}}
74+
type=raw,value=latest,enable={{is_default_branch}}
75+
labels: |
76+
org.opencontainers.image.description=Axoflow cloudconnectors helps collecting logs from various cloud-providers.
77+
org.opencontainers.image.title=Axoflow cloudconnectors
78+
org.opencontainers.image.authors=Axoflow
79+
80+
- name: Login to GitHub Container Registry
81+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
82+
with:
83+
registry: ghcr.io
84+
username: ${{ github.actor }}
85+
password: ${{ github.token }}
86+
if: inputs.publish
87+
88+
- name: Build and push image
89+
id: build
90+
uses: docker/build-push-action@ca877d9245402d1537745e0e356eab47c3520991 # v6.13.0
91+
with:
92+
context: .
93+
platforms: linux/amd64,linux/arm64
94+
tags: ${{ steps.meta.outputs.tags }}
95+
labels: ${{ steps.meta.outputs.labels }}
96+
cache-from: type=gha
97+
cache-to: type=gha,mode=max
98+
outputs: |
99+
type=image,push=${{ inputs.publish }},name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
100+
type=oci,dest=image.tar,name=target,annotation-index.org.opencontainers.image.description=${{ fromJSON(steps.meta.outputs.json).labels['org.opencontainers.image.description'] }}
101+
102+
- name: Sign image with GitHub OIDC Token
103+
if: ${{ inputs.publish && github.repository_owner == 'axoflow' }} # Check if the workflow is called by the same GitHub organization
104+
env:
105+
DIGEST: ${{ steps.build.outputs.digest }}
106+
TAGS: ${{ steps.meta.outputs.tags }}
107+
run: |
108+
readarray -t tag_array <<< "$TAGS"
109+
for tag in "${tag_array[@]}"; do
110+
full_image="${tag}@${DIGEST}"
111+
cosign sign --yes --rekor-url "https://rekor.sigstore.dev/" "${full_image}"
112+
done
113+
114+
- name: Verify signed image with cosign
115+
if: ${{ inputs.publish && github.repository_owner == 'axoflow' }} # Check if the workflow is called by the same GitHub organization
116+
env:
117+
DIGEST: ${{ steps.build.outputs.digest }}
118+
TAGS: ${{ steps.meta.outputs.tags }}
119+
run: |
120+
for tag in $TAGS; do
121+
cosign verify "${tag}@${DIGEST}" \
122+
--rekor-url "https://rekor.sigstore.dev/" \
123+
--certificate-identity "https://github.com/${{ github.repository }}/.github/workflows/image-build.yaml@${{ github.ref }}" \
124+
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" | jq
125+
done
126+
127+
- name: Extract OCI tarball
128+
run: |
129+
mkdir -p image
130+
tar -xf image.tar -C image
131+
132+
- name: Run Trivy vulnerability scanner
133+
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
134+
env:
135+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db:2
136+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db:1
137+
with:
138+
input: image
139+
format: sarif
140+
output: trivy-results.sarif
141+
142+
- name: Upload Trivy scan results as artifact
143+
uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
144+
with:
145+
name: "[${{ github.job }}] Trivy scan results"
146+
path: trivy-results.sarif
147+
retention-days: 5

‎.github/workflows/release.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags: ["[0-9]+.[0-9]+.[0-9]+*"]
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
image-build:
12+
name: Image build
13+
uses: ./.github/workflows/image-build.yaml
14+
with:
15+
publish: true
16+
release: true
17+
permissions:
18+
contents: read
19+
packages: write
20+
id-token: write

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
.DS_Store
2+
bin/
3+
connectors/storage/*

‎.hadolint.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
ignored:
2+
- DL3018

‎.yamlignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
/.github/
2+
/charts/

‎.yamllint.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
ignore-from-file: [.gitignore, .yamlignore]
2+
3+
extends: default
4+
5+
rules:
6+
line-length: disable
7+
document-start: disable

‎Dockerfile‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
FROM ghcr.io/axoflow/axoflow-otel-collector/axoflow-otel-collector:0.120.0-axoflow1 AS axo-otelcol
2+
3+
FROM alpine:3.21 AS base
4+
5+
WORKDIR /cloudconnectors
6+
ENV HOME=/cloudconnectors
7+
8+
COPY --from=axo-otelcol /axoflow-otel-collector .
9+
COPY --from=axo-otelcol /etc/axoflow-otel-collector/ /etc/axoflow-otel-collector/
10+
COPY --from=axo-otelcol /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
11+
12+
RUN apk add --no-cache bash
13+
14+
# Set user
15+
ARG USER_UID=10001
16+
USER ${USER_UID}
17+
18+
# Copy application files
19+
COPY entrypoint.sh ./
20+
COPY connectors/ /etc/axoflow-otel-collector/connectors/
21+
22+
ENTRYPOINT ["./entrypoint.sh"]

0 commit comments

Comments
 (0)