|
| 1 | +# stub to call common GitHub Action (GA) as part of Continuous Integration (CI) Pull Request process checks for main branch |
| 2 | +# inputs are described in the chef/common-github-actions/<GA.yml> with same name as this stub |
| 3 | +# |
| 4 | +# secrets are inherited from the calling workflow, typically SONAR_TOKEN, SONAR_HOST_URL, GH_TOKEN, AKEYLESS_JWT_ID, POLARIS_SERVER_URL and POLARIS_ACCESS_TOKEN |
| 5 | + |
| 6 | +name: CI Pull Request on Main Branch |
| 7 | + |
| 8 | +on: |
| 9 | + pull_request: |
| 10 | + branches: [ main, release/** ] |
| 11 | + push: |
| 12 | + branches: [ main, release/** ] |
| 13 | + |
| 14 | + workflow_dispatch: |
| 15 | + |
| 16 | +permissions: |
| 17 | + contents: read |
| 18 | + |
| 19 | +env: |
| 20 | + STUB_VERSION: "1.0.7" |
| 21 | + |
| 22 | +jobs: |
| 23 | + echo_version: |
| 24 | + name: 'Echo stub version' |
| 25 | + runs-on: ubuntu-latest |
| 26 | + steps: |
| 27 | + - name: echo version of stub and inputs |
| 28 | + run: | |
| 29 | + echo "CI main pull request stub version $STUB_VERSION" |
| 30 | +
|
| 31 | + detect-custom-metadata: |
| 32 | + name: 'Detect custom properties' |
| 33 | + runs-on: ubuntu-latest |
| 34 | + outputs: |
| 35 | + primaryApp: ${{ steps.set-custom-metadata.outputs.primaryApplication }} |
| 36 | + appBuildLanguage: ${{ steps.set-custom-metadata.outputs.applicationBuildLanguage }} |
| 37 | + appBuildProfile: ${{ steps.set-custom-metadata.outputs.applicationBuildProfile }} |
| 38 | + steps: |
| 39 | + - name: 'Detect app, language, and build profile environment variables from repository custom properties' |
| 40 | + id: set-custom-metadata |
| 41 | + # GH API returns something like [{"property_name":"GABuildLanguage","value":"go"},{"property_name":"GABuildProfile","value":"cli"},{"property_name":"primaryApplication","value":"chef-360"}]' |
| 42 | + run: | |
| 43 | + response=$(gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" /repos/${{ github.repository }}/properties/values) |
| 44 | +
|
| 45 | + primaryApplication=$(echo "$response" | jq -r '.[] | select(.property_name=="primaryApplication") | .value') |
| 46 | + GABuildLanguage=$(echo "$response" | jq -r '.[] | select(.property_name=="GABuildLanguage") | .value') |
| 47 | + GABuildProfile=$(echo "$response" | jq -r '.[] | select(.property_name=="GABuildProfile") | .value') |
| 48 | + |
| 49 | + echo "PRIMARY APP... $primaryApplication" |
| 50 | + echo "BUILD LANG... $GABuildLanguage" |
| 51 | + echo "BUILD PROFILE... $GABuildProfile" |
| 52 | + |
| 53 | + echo "PRIMARY_APPLICATION=$primaryApplication" >> $GITHUB_ENV |
| 54 | + echo "GA_BUILD_LANGUAGE=$GABuildLanguage" >> $GITHUB_ENV |
| 55 | + echo "GA_BUILD_PROFILE=$GABuildProfile" >> $GITHUB_ENV |
| 56 | +
|
| 57 | + # If workflow_dispatch, use inputs (left), if other trigger, use default env (right) |
| 58 | + # echo "::set-output name=build-and-verify::${{ github.event.inputs.build-and-verify || 'true' }}" |
| 59 | + echo "::set-output name=primaryApplication::$primaryApplication" |
| 60 | + echo "::set-output name=applicationBuildLanguage::$GABuildLanguage" |
| 61 | + echo "::set-output name=applicationBuildProfile::$GABuildProfile" |
| 62 | + continue-on-error: true |
| 63 | + env: |
| 64 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 65 | + |
| 66 | + call-ci-main-pr-check-pipeline: |
| 67 | + uses: chef/common-github-actions/.github/workflows/ci-main-pull-request.yml@main |
| 68 | + needs: detect-custom-metadata |
| 69 | + secrets: inherit |
| 70 | + permissions: |
| 71 | + id-token: write |
| 72 | + contents: read |
| 73 | + |
| 74 | + with: |
| 75 | + application: ${{ needs.detect-custom-metadata.outputs.primaryApp }} |
| 76 | + visibility: ${{ github.event.repository.visibility }} # private, public, or internal |
| 77 | + # go-private-modules: GOPRIVATE for Go private modules, default is 'github.com/progress-platform-services/* |
| 78 | + |
| 79 | + # if version specified, it takes precedence; can be a semver like 1.0.2-xyz or a tag like "latest" |
| 80 | + version: '15.1.2' # ${{ github.event.repository.version }} |
| 81 | + detect-version-source-type: 'file' # options include "none" (do not detect), "file", "github-tag" or "github-release" |
| 82 | + detect-version-source-parameter: '' # use for file name |
| 83 | + language: ${{ needs.detect-custom-metadata.outputs.appBuildLanguage }} # Go, Ruby, Rust, JavaScript, TypeScript, Python, Java, C#, PHP, other - used for build and SonarQube language setting |
| 84 | + |
| 85 | + # complexity-checks, linting, trufflehog and trivy |
| 86 | + perform-complexity-checks: true |
| 87 | + # scc-output-filename: 'scc-output.txt' |
| 88 | + perform-language-linting: true # Perform language-specific linting and pre-compilation checks |
| 89 | + perform-trufflehog-scan: true |
| 90 | + perform-trivy-scan: true |
| 91 | + |
| 92 | + # perform application build and unit testing, will use custom repository properties when implemented for chef-primary-application, chef-build-profile, and chef-build-language |
| 93 | + build: true |
| 94 | + build-profile: ${{ needs.detect-custom-metadata.outputs.appBuildProfile }} |
| 95 | + unit-tests: false |
| 96 | + unit-test-output-path: "path/to/file.out" |
| 97 | + unit-test-command-override: "" |
| 98 | + |
| 99 | + # BlackDuck SAST (Polaris) require a build or binary present in repo to do SAST testing |
| 100 | + # requires these secrets: POLARIS_SERVER_URL, POLARIS_ACCESS_TOKEN |
| 101 | + perform-blackduck-polaris: false |
| 102 | + polaris-application-name: "Chef-Agents" # one of these: Chef-Agents, Chef-Automate, Chef-Chef360, Chef-Habitat, Chef-Infrastructure-Server, Chef-Shared-Services, Chef-Other, Chef-Non-Product |
| 103 | + polaris-project-name: ${{ github.event.repository.name }} # arch-sample-cli |
| 104 | + polaris-working-directory: '.' # Working directory for the scan, defaults to . but usually lang-dependent like ./src |
| 105 | + polaris-coverity-build-command: 'go build -o bin/chef-cli.exe' # Coverity build command, typically done in build stage by language or here as param 1-liner like "mvn clean install" |
| 106 | + polaris-coverity-clean-command: 'go clean' # Coverity clean command, typically done before build stage by language or here as param 1-liner like "mvn clean" |
| 107 | + polaris-detect-search-depth: '5' # Detect search depth, blank but can be set to "3" to search up to 3 levels of subdirectories for code to scan' |
| 108 | + polaris-assessment-mode: 'SAST' # Assessment mode (SAST, CI or SOURCE_UPLOAD) |
| 109 | + wait-for-scan: true |
| 110 | + # polaris-detect-args: '' # Additional Detect arguments, can supply extra arguments like "--detect.diagnostic=true" |
| 111 | + # coverity_build_command: "go build" |
| 112 | + # coverity_clean_command: "go clean" |
| 113 | + # polaris-config-path: '' # Path to Detect configuration file, typically a file supplied at root level like ./detect-config.yml |
| 114 | + # polaris-coverity-config-path: '' # Path to Coverity configuration file, typically a file supplied at root level like ./coverity.yml |
| 115 | + # polaris-coverity-args: '' # Additional Coverity arguments,can supply extra arguments like "--config-override capture.build.build-command=make |
| 116 | + |
| 117 | + # perform SonarQube scan, with or without unit test coverage data |
| 118 | + # requires secrets SONAR_TOKEN and SONAR_HOST_URL (progress.sonar.com) |
| 119 | + perform-sonarqube-scan: true |
| 120 | + # perform-sonar-build: true |
| 121 | + # build-profile: 'default' |
| 122 | + # report-unit-test-coverage: true |
| 123 | + perform-docker-scan: false # scan Dockerfile and built images with Docker Scout or Trivy; see repo custom properties matching "container" |
| 124 | + |
| 125 | + # report to central developer dashboard |
| 126 | + report-to-atlassian-dashboard: false |
| 127 | + quality-product-name: 'Chef-Agents' # product name for quality reporting, like Chef360, Courier, Inspec |
| 128 | + # quality-product-name: ${{ github.event.repository.name }} # like 'Chef-360' - the product name for quality reporting, like Chef360, Courier, Inspec |
| 129 | + # quality-sonar-app-name: 'YourSonarAppName' |
| 130 | + # quality-testing-type: 'Integration' like Unit, Integration, e2e, api, Performance, Security |
| 131 | + # quality-service-name: 'YourServiceOrRepoName' |
| 132 | + # quality-junit-report: 'path/to/junit/report'' |
| 133 | + |
| 134 | + # perform Habitat-based and native packaging, publish to package repositories |
| 135 | + package-binaries: false # Package binaries (e.g., RPM, DEB, MSI, dpkg + signing + SHA) |
| 136 | + habitat-build: false # Create Habitat packages |
| 137 | + publish-habitat-packages: false # Publish Habitat packages to Builder |
| 138 | + publish-habitat-hab_package: false # Chef Habitat package to install (e.g., core/nginx) |
| 139 | + publish-habitat-hab_version: "1.0.0" # Chef Habitat package version (optional) |
| 140 | + publish-habitat-hab_release: "20240101010101" # Chef Habitat package release (optional) |
| 141 | + publish-habitat-hab_channel: "stable" # Chef Habitat package channel (e.g., stable, base, base-2025); default is stable |
| 142 | + publish-habitat-hab_auth_token: "" # Chef Habitat Builder authentication token (uses secret if not provided) |
| 143 | + publish-habitat-runner_os: "ubuntu-latest" # OS runner for Habitat package publishing job, can also be windows-latest |
| 144 | + habitat-grype-scan: false # Scan built Habitat packages with Grype for vulnerabilities |
| 145 | + publish-packages: false # Publish packages (e.g., container from Dockerfile to ECR, go-releaser binary to releases page, omnibus to artifactory, gems, choco, homebrew, other app stores) |
| 146 | + |
| 147 | + # generate and export Software Bill of Materials (SBOM) in various formats |
| 148 | + generate-sbom: true |
| 149 | + export-github-sbom: true # SPDX JSON artifact on job instance |
| 150 | + generate-msft-sbom: false |
| 151 | + license_scout: false # Run license scout for license compliance (uses .license_scout.yml) |
| 152 | + |
| 153 | + # perform Blackduck software composition analysis (SCA) for 3rd party CVEs, licensing, and operational risk |
| 154 | + perform-blackduck-sca-scan: true # combined with generate sbom & generate github-sbom, also needs version above |
| 155 | + blackduck-project-group-name: 'Chef-Agents' # typically one of (Chef), Chef-Agents, Chef-Automate, Chef-Chef360, Chef-Habitat, Chef-Infrastructure-Server, Chef-Shared-Services, Chef-Non-Product' |
| 156 | + blackduck-project-name: ${{ github.event.repository.name }} # BlackDuck project name, typically the repository name |
| 157 | + |
| 158 | + # udf1: 'default' # user defined flag 1 |
| 159 | + # udf2: 'default' # user defined flag 2 |
| 160 | + # udf3: 'default' # user defined flag 3 |
0 commit comments