Skip to content

Commit cba9c7f

Browse files
migmartrimigmartri
committed
initializing chainloop
0 parents  commit cba9c7f

File tree

531 files changed

+388768
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

531 files changed

+388768
-0
lines changed

‎.gitattributes‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
app/frontend/gen linguist-generated=true

‎.github/workflows/contracts/build-and-test.cue‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
schemaVersion: "v1"
2+
runner: type: "GITHUB_ACTION"

‎.github/workflows/contracts/releases.cue‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
schemaVersion: "v1"
2+
materials: [
3+
// Binaries
4+
{type: "ARTIFACT", name: "cli-linux-amd64", output: true},
5+
{type: "ARTIFACT", name: "control-plane-linux-amd64", output: true},
6+
{type: "ARTIFACT", name: "artifact-cas-linux-amd64", output: true},
7+
// Container images
8+
{type: "CONTAINER_IMAGE", name: "control-plane-image", output: true},
9+
{type: "CONTAINER_IMAGE", name: "artifact-cas-image", output: true},
10+
// SBOMS for those container images
11+
{type: "SBOM_CYCLONEDX_JSON", name: "sbom-control-plane"},
12+
{type: "SBOM_CYCLONEDX_JSON", name: "sbom-artifact-cas"},
13+
]
14+
runner: type: "GITHUB_ACTION"

‎.github/workflows/cosign.pub‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
-----BEGIN PUBLIC KEY-----
2+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEMBSJAtPWo4hhThSBJXF9pfheP1x7
3+
JQRD2meyc92McFO96WlRB1yW11kC24gVdxOyZvOz+qk8CR+/2GuQYleKsQ==
4+
-----END PUBLIC KEY-----

‎.github/workflows/lint.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Lint
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
permissions:
9+
contents: read
10+
# Optional: allow read access to pull request. Use with `only-new-issues` option.
11+
pull-requests: read
12+
jobs:
13+
golangci:
14+
name: lint
15+
strategy:
16+
fail-fast: false
17+
matrix:
18+
app:
19+
- main-module
20+
- cli
21+
- controlplane
22+
- artifact-cas
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/setup-go@v3
26+
with:
27+
go-version: "1.20"
28+
29+
- uses: actions/checkout@v3
30+
31+
- name: Lint main module
32+
uses: golangci/golangci-lint-action@v3
33+
if: ${{ matrix.app == 'main-module' }}
34+
35+
- name: Lint ${{ matrix.app }}
36+
uses: golangci/golangci-lint-action@v3
37+
if: ${{ matrix.app != 'main-module' }}
38+
with:
39+
working-directory: app/${{ matrix.app }}
40+
41+
lint-protos:
42+
runs-on: ubuntu-latest
43+
steps:
44+
- uses: actions/checkout@v2
45+
- uses: bufbuild/buf-setup-action@v1
46+
with:
47+
buf_user: ${{ secrets.buf_user }}
48+
buf_api_token: ${{ secrets.buf_api_token }}
49+
- uses: bufbuild/buf-lint-action@v1

‎.github/workflows/release.yaml‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*.*.*"
7+
8+
jobs:
9+
test:
10+
uses: chainloop-dev/bedrock-old/.github/workflows/test.yml@main
11+
# secrets required to run the attestation on the testing job, otherwise the chainloop token is not available
12+
secrets: inherit
13+
14+
release:
15+
name: Release CLI and control-plane/artifact-cas container images
16+
needs: test
17+
runs-on: ubuntu-latest
18+
if: github.ref_type == 'tag' # Guard to make sure we are releasing once
19+
permissions:
20+
id-token: write # required to use OIDC and retrieve Google Cloud Credentials
21+
contents: write # required for goreleaser
22+
env:
23+
CHAINLOOP_VERSION: 0.8.89
24+
CHAINLOOP_ROBOT_ACCOUNT: ${{ secrets.CHAINLOOP_WF_RELEASE }}
25+
CONTAINER_IMAGE_CP: us-east1-docker.pkg.dev/bedrock-371810/chainloop/control-plane:${{ github.ref_name }}
26+
CONTAINER_IMAGE_CAS: us-east1-docker.pkg.dev/bedrock-371810/chainloop/artifact-cas:${{ github.ref_name }}
27+
steps:
28+
- name: Install Cosign
29+
uses: sigstore/[email protected]
30+
31+
- name: Install ChainLoop
32+
run: |
33+
curl -sfL https://chainloop.dev/install.sh | bash -s -- --version v${{ env.CHAINLOOP_VERSION }}
34+
35+
- name: Download jq
36+
run: |
37+
sudo wget -q https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 -O /usr/local/bin/jq
38+
sudo chmod u+x /usr/local/bin/jq
39+
40+
- name: Checkout
41+
uses: actions/checkout@v3
42+
with:
43+
fetch-depth: 0
44+
45+
- name: Initialize Attestation
46+
run: |
47+
chainloop attestation init
48+
- name: Set up Go
49+
uses: actions/setup-go@v3
50+
with:
51+
go-version: "1.20"
52+
53+
- name: "Configure Google Cloud credentials"
54+
id: "auth-google"
55+
uses: "google-github-actions/auth@v0"
56+
with:
57+
token_format: "access_token"
58+
workload_identity_provider: projects/1044976554810/locations/global/workloadIdentityPools/chainloop-github-pool/providers/github-provider
59+
service_account: [email protected]
60+
61+
- name: Login to GAR
62+
uses: docker/login-action@v2
63+
with:
64+
registry: us-east1-docker.pkg.dev
65+
username: oauth2accesstoken
66+
password: ${{ steps.auth-google.outputs.access_token }}
67+
68+
- name: Run GoReleaser
69+
id: release
70+
uses: goreleaser/goreleaser-action@v3
71+
with:
72+
distribution: goreleaser
73+
version: latest
74+
args: release --rm-dist
75+
env:
76+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
77+
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
78+
COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
79+
80+
- uses: anchore/sbom-action@v0
81+
with:
82+
image: ${{ env.CONTAINER_IMAGE_CP }}
83+
format: cyclonedx-json
84+
artifact-name: controlplane.cyclonedx.json
85+
output-file: /tmp/sbom.cp.cyclonedx.json
86+
87+
- uses: anchore/sbom-action@v0
88+
with:
89+
image: ${{ env.CONTAINER_IMAGE_CAS }}
90+
format: cyclonedx-json
91+
artifact-name: cas.cyclonedx.json
92+
output-file: /tmp/sbom.cas.cyclonedx.json
93+
94+
- name: Add Attestation Artifacts (SBOM)
95+
run: |
96+
chainloop attestation add --name sbom-control-plane --value /tmp/sbom.cp.cyclonedx.json
97+
chainloop attestation add --name sbom-artifact-cas --value /tmp/sbom.cas.cyclonedx.json
98+
99+
- name: Add Attestation Artifacts (container images)
100+
run: |
101+
# Control plane image
102+
chainloop attestation add --name control-plane-image --value ${{ env.CONTAINER_IMAGE_CP }}
103+
# CAS image
104+
chainloop attestation add --name artifact-cas-image --value ${{ env.CONTAINER_IMAGE_CAS }}
105+
106+
- name: Add Attestation Artifacts (binaries)
107+
run: |
108+
# Binaries x86_64
109+
# TODO: add the rest of binaries
110+
echo -n '${{ steps.release.outputs.artifacts }}' | jq -r '.[] | select(.type=="Binary" and .goos=="linux" and .goarch=="amd64") | { "name": "\(.extra.ID)-\(.goos)-\(.goarch)", "path":"\(.path)"} | @base64' | while read i; do
111+
BINARY_NAME=$(echo "${i}" | base64 --decode | jq -r ${1} .name)
112+
BINARY_PATH=$(echo "${i}" | base64 --decode | jq -r ${1} .path)
113+
chainloop attestation add --name ${BINARY_NAME} --value ${BINARY_PATH}
114+
done
115+
116+
- name: Finish and Record Attestation
117+
if: ${{ success() }}
118+
run: |
119+
chainloop attestation status --full
120+
chainloop attestation push --key env://CHAINLOOP_SIGNING_KEY
121+
env:
122+
CHAINLOOP_SIGNING_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
123+
CHAINLOOP_SIGNING_KEY: ${{ secrets.COSIGN_KEY }}
124+
125+
- name: Mark attestation as failed
126+
if: ${{ failure() }}
127+
run: |
128+
chainloop attestation reset
129+
- name: Mark attestation as cancelled
130+
if: ${{ cancelled() }}
131+
run: |
132+
chainloop attestation reset --trigger cancellation
133+
134+
deploy:
135+
name: Deploy to Kubernetes
136+
runs-on: ubuntu-latest
137+
needs: release
138+
strategy:
139+
fail-fast: false
140+
matrix:
141+
app:
142+
- controlplane
143+
- frontend
144+
- artifact-cas
145+
if: github.ref_type == 'tag' # Guard to make sure we are releasing once
146+
permissions:
147+
id-token: write
148+
contents: write
149+
steps:
150+
- name: Checkout
151+
uses: actions/checkout@v3
152+
with:
153+
fetch-depth: 0
154+
155+
- name: "Configure Google Cloud credentials"
156+
id: "auth-google"
157+
uses: "google-github-actions/auth@v0"
158+
with:
159+
token_format: "access_token"
160+
workload_identity_provider: projects/1044976554810/locations/global/workloadIdentityPools/chainloop-github-pool/providers/github-provider
161+
service_account: [email protected]
162+
163+
- name: "Get Google Kubernetes Engine credentials"
164+
uses: "google-github-actions/get-gke-credentials@v1"
165+
with:
166+
cluster_name: "bedrock"
167+
location: "us-central1"
168+
169+
- name: Check kubectl
170+
run: kubectl cluster-info
171+
172+
- name: Check Helm version
173+
run: helm version
174+
175+
- name: Bump Helm Chart
176+
if: ${{ matrix.app == 'controlplane' || matrix.app == 'artifact-cas' }}
177+
run: cd deployment && ./bump-chart-app-version.sh ${{ matrix.app }}/chart/Chart.yaml ${{ github.ref_name }}
178+
179+
- name: Bump Helm Chart Frontend
180+
if: ${{ matrix.app == 'frontend' }}
181+
run: |
182+
# The frontend follows upstream frontend version instead
183+
LATEST_FRONTEND=$(gh api repos/chainloop-dev/frontend/tags -q ".[0].name")
184+
cd deployment && ./bump-chart-app-version.sh ${{ matrix.app }}/chart/Chart.yaml ${LATEST_FRONTEND}
185+
env:
186+
# PAT token with permissions to access the frontend private repository
187+
GITHUB_TOKEN: ${{ secrets.PAT_FRONTEND_TAGS_LIST }}
188+
189+
- name: Deploy to production
190+
run: make -C deployment/${{ matrix.app }} upgrade-prod
191+
192+
- name: Commit new Helm Chart
193+
uses: stefanzweifel/git-auto-commit-action@v4
194+
with:
195+
commit_message: Bump ${{ matrix.app }} Chart Version to ${{github.ref_name}}
196+
skip_checkout: false
197+
file_pattern: "*/*/chart/Chart.yaml"
198+
branch: main
199+
commit_author: Chainloop bot <[email protected]>
200+
push_options: "--force"

‎.github/workflows/test.yml‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
name: Test
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
# We want to call this workflow during release too
9+
workflow_call:
10+
11+
jobs:
12+
build_and_test:
13+
name: Test
14+
runs-on: ubuntu-latest
15+
strategy:
16+
fail-fast: false
17+
matrix:
18+
app:
19+
- main-module
20+
- cli
21+
- controlplane
22+
- artifact-cas
23+
steps:
24+
- name: Install Cosign
25+
uses: sigstore/[email protected]
26+
- name: Install ChainLoop
27+
run: |
28+
curl -sfL https://chainloop.dev/install.sh | bash -s -- --version v${{ env.CHAINLOOP_VERSION }}
29+
- uses: actions/checkout@v3
30+
- uses: actions/setup-go@v3
31+
if: ${{ matrix.app != 'main-module' }}
32+
with:
33+
go-version-file: app/${{ matrix.app }}/go.mod
34+
cache: true
35+
cache-dependency-path: app/${{ matrix.app }}/go.sum
36+
37+
- uses: actions/setup-go@v3
38+
if: ${{ matrix.app == 'main-module' }}
39+
with:
40+
go-version-file: go.mod
41+
cache: true
42+
cache-dependency-path: go.sum
43+
44+
- name: Initialize Attestation
45+
run: |
46+
chainloop attestation init
47+
48+
# Check that the generated ent code is up to date
49+
# see https://entgo.io/docs/ci/
50+
- uses: ent/contrib/ci@master
51+
name: "Check all generated code is checked in"
52+
if: ${{ matrix.app != 'main-module' }}
53+
with:
54+
working-directory: app/${{ matrix.app }}
55+
56+
- name: Test
57+
if: ${{ matrix.app != 'main-module' }}
58+
run: make -C app/${{ matrix.app }} test
59+
60+
- name: Test top level modules
61+
if: ${{ matrix.app == 'main-module' }}
62+
run: make test
63+
64+
- name: Finish and Record Attestation
65+
if: ${{ success() }}
66+
run: |
67+
chainloop attestation status --full
68+
chainloop attestation push --key env://CHAINLOOP_SIGNING_KEY
69+
env:
70+
CHAINLOOP_SIGNING_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
71+
CHAINLOOP_SIGNING_KEY: ${{ secrets.COSIGN_KEY }}
72+
73+
- name: Mark attestation as failed
74+
if: ${{ failure() }}
75+
run: |
76+
chainloop attestation reset
77+
- name: Mark attestation as cancelled
78+
if: ${{ cancelled() }}
79+
run: |
80+
chainloop attestation reset --trigger cancellation
81+
env:
82+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
83+
CHAINLOOP_VERSION: 0.8.89
84+
CHAINLOOP_ROBOT_ACCOUNT: ${{ secrets.CHAINLOOP_WF_BUILD_AND_TEST }}

0 commit comments

Comments
 (0)