Skip to content

Commit 9e206dd

Browse files
pandatixpandatix
authored
Improvements before public release (#146)
1 parent aaf2ef1 commit 9e206dd

24 files changed

+1311
-532
lines changed

‎.github/dependabot.yml‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,18 @@
11
version: 2
22
updates:
3-
- package-ecosystem: "gomod"
4-
directory: "/"
3+
# GitHub Actions
4+
- package-ecosystem: 'github-actions'
5+
directory: '/'
56
schedule:
6-
interval: "weekly"
7+
interval: 'weekly'
78
assignees:
8-
- "pandatix"
9-
- "NicoFgrx"
9+
- 'pandatix'
10+
11+
# Go module
12+
- package-ecosystem: 'gomod'
13+
directories:
14+
- '/'
15+
schedule:
16+
interval: 'weekly'
17+
assignees:
18+
- 'pandatix'

‎.github/workflows/ci.yaml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
name: CI
2+
3+
on: [push, pull_request]
4+
5+
permissions:
6+
contents: read
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
11+
12+
jobs:
13+
unit-tests:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout code
17+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
18+
19+
- name: Setup Go
20+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
21+
with:
22+
go-version-file: "go.mod"
23+
24+
- name: Cache go modules
25+
uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
26+
with:
27+
path: ~/go/pkg/mod
28+
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
29+
restore-keys: ${{ runner.os }}-go-
30+
31+
- name: Unit tests
32+
run: |
33+
go test ./... -run=^Test_U_ -coverprofile=unit.cov
34+
35+
- name: Upload unit tests coverage
36+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
37+
with:
38+
name: unit.cov
39+
path: unit.cov
40+
41+
smoke-tests:
42+
uses: ./.github/workflows/smoke.yaml
43+
44+
coverages:
45+
name: Merge Coverage and Upload to Coveralls
46+
runs-on: ubuntu-latest
47+
needs: [unit-tests, smoke-tests]
48+
steps:
49+
- name: Checkout code
50+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
51+
52+
- name: Setup Go
53+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
54+
with:
55+
go-version-file: "go.mod"
56+
57+
- name: Download unit coverage
58+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v4.3.2
59+
with:
60+
name: unit.cov
61+
62+
- name: Download smoke coverage
63+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v4.3.2
64+
with:
65+
name: smoke.cov
66+
67+
- name: Merge coverage files
68+
run: |
69+
go install go.shabbyrobe.org/gocovmerge/cmd/gocovmerge@fa4f82cfbf4d57c646c1ed0f35002bf1b89fbf7a
70+
gocovmerge unit.cov smoke.cov > overall.cov
71+
72+
- name: Upload coverage to Coveralls
73+
uses: shogo82148/actions-goveralls@25f5320d970fb565100cf1993ada29be1bb196a1 # v1.10.0
74+
with:
75+
path-to-profile: overall.cov
76+
77+
go-lint:
78+
runs-on: ubuntu-latest
79+
steps:
80+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
81+
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
82+
with:
83+
go-version-file: "go.mod"
84+
85+
- name: Lint Module
86+
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0

‎.github/workflows/codeql-analysis.yaml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: 'CodeQL'
2+
3+
on:
4+
push:
5+
branches: ['main']
6+
pull_request:
7+
branches: ['main']
8+
schedule:
9+
- cron: '0 6 * * 5'
10+
11+
permissions:
12+
contents: read
13+
14+
jobs:
15+
analyze:
16+
name: Analyze
17+
runs-on: ubuntu-latest
18+
permissions:
19+
actions: read
20+
checks: write
21+
security-events: write
22+
23+
strategy:
24+
fail-fast: false
25+
matrix:
26+
language: [ 'go' ]
27+
28+
steps:
29+
- name: Checkout repository
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
31+
32+
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
33+
with:
34+
go-version-file: 'go.mod'
35+
36+
- name: Initialize CodeQL
37+
uses: github/codeql-action/init@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v3.29.5
38+
with:
39+
languages: ${{ matrix.language }}
40+
41+
- name: Autobuild
42+
uses: github/codeql-action/autobuild@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v3.29.5
43+
44+
- name: Perform CodeQL Analysis
45+
uses: github/codeql-action/analyze@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v3.29.5

‎.github/workflows/prs.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: 'Pull Requests reviews'
2+
3+
on: [pull_request]
4+
5+
permissions:
6+
contents: read
7+
8+
jobs:
9+
dependency-review:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: 'Checkout Repository'
13+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
15+
- name: 'Dependency Review'
16+
uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

‎.github/workflows/release.yaml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*"
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
goreleaser:
13+
outputs:
14+
hashes: ${{ steps.hash.outputs.hashes }}
15+
permissions:
16+
contents: write # for goreleaser/goreleaser-action to create a GitHub release
17+
runs-on: ubuntu-latest
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
21+
with:
22+
fetch-depth: 0
23+
24+
- name: Set up Go
25+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
26+
with:
27+
go-version-file: 'go.mod'
28+
29+
- name: Install Syft
30+
uses: anchore/sbom-action/download-syft@28d71544de8eaf1b958d335707167c5f783590ad # v0.22.2
31+
32+
- name: Run GoReleaser
33+
id: run-goreleaser
34+
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
35+
with:
36+
version: latest
37+
args: release --clean --skip=validate
38+
env:
39+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
40+
41+
- name: Generate subject
42+
id: hash
43+
env:
44+
ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
45+
run: |
46+
set -euo pipefail
47+
48+
checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
49+
echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT"
50+
51+
provenance:
52+
needs: [goreleaser]
53+
permissions:
54+
actions: read # To read the workflow path.
55+
id-token: write # To sign the provenance.
56+
contents: write # To add assets to a release.
57+
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0 # not pinned to avoid breaking it, use it to target refs/tags/vX.Y.Z
58+
with:
59+
base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
60+
upload-assets: true # upload to a new release

‎.github/workflows/scoreboard.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Scorecard supply-chain security
2+
on:
3+
branch_protection_rule:
4+
schedule:
5+
- cron: '16 0 * * 6'
6+
push:
7+
branches: [ "main" ]
8+
9+
permissions: read-all
10+
11+
jobs:
12+
analysis:
13+
name: Scorecard analysis
14+
runs-on: ubuntu-latest
15+
permissions:
16+
security-events: write
17+
id-token: write
18+
19+
steps:
20+
- name: Checkout repository
21+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
22+
with:
23+
persist-credentials: false
24+
25+
- name: Run analysis
26+
uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
27+
with:
28+
results_file: results.sarif
29+
results_format: sarif
30+
publish_results: true
31+
32+
- name: Upload to code-scanning
33+
uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v3.29.5
34+
with:
35+
sarif_file: results.sarif

‎.github/workflows/smoke.yaml‎

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
name: Smoke tests
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
smoke-tests:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Checkout code
11+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
12+
13+
- name: Setup Go
14+
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
15+
with:
16+
go-version-file: "go.mod"
17+
18+
- name: Write config file
19+
run: |
20+
cat <<EOF > kind-config.yaml
21+
apiVersion: kind.x-k8s.io/v1alpha4
22+
kind: Cluster
23+
kubeadmConfigPatches:
24+
- |
25+
kind: ClusterConfiguration
26+
apiServer:
27+
extraArgs:
28+
"service-node-port-range": "30000-30005"
29+
nodes:
30+
- role: control-plane
31+
extraPortMappings:
32+
- containerPort: 30000
33+
hostPort: 30000
34+
- containerPort: 30001
35+
hostPort: 30001
36+
- containerPort: 30002
37+
hostPort: 30002
38+
- containerPort: 30003
39+
hostPort: 30003
40+
- containerPort: 30004
41+
hostPort: 30004
42+
- containerPort: 30005
43+
hostPort: 30005
44+
networking:
45+
disableDefaultCNI: true
46+
EOF
47+
- name: Set up Kind cluster
48+
uses: helm/kind-action@92086f6be054225fa813e0a4b13787fc9088faab # v1.13.0
49+
with:
50+
config: kind-config.yaml
51+
cluster_name: kind
52+
env:
53+
KIND_EXPERIMENTAL_DOCKER_NETWORK: kind
54+
55+
- name: Patch local-path to mount shared filesystem path on the single kind node
56+
run: |
57+
# From https://github.com/kubernetes-sigs/kind/issues/1487#issuecomment-2211072952
58+
kubectl -n local-path-storage patch configmap local-path-config -p '{"data": {"config.json": "{\n\"sharedFileSystemPath\": \"/var/local-path-provisioner\"\n}"}}'
59+
60+
- name: Setup Cilium as Kind CNI
61+
run: |
62+
# See https://docs.cilium.io/en/stable/installation/kind/#install-cilium
63+
helm repo add cilium https://helm.cilium.io/
64+
65+
helm install cilium cilium/cilium --version 1.19.1 \
66+
--namespace kube-system \
67+
--set image.pullPolicy=IfNotPresent \
68+
--set ipam.mode=kubernetes
69+
70+
- name: Setup CNPG
71+
run: |
72+
helm repo add cnpg https://cloudnative-pg.github.io/charts
73+
helm upgrade --install cnpg \
74+
--namespace cnpg-system \
75+
--create-namespace \
76+
cnpg/cloudnative-pg
77+
78+
- name: Install Pulumi
79+
uses: pulumi/actions@8582a9e8cc630786854029b4e09281acd6794b58 # v6.6.1
80+
- name: Prepare environment
81+
run: |
82+
pulumi login --local
83+
84+
- name: Run Smoke Tests
85+
run: |
86+
mkdir coverdir # Directory in which coverage data are exported
87+
go test -v ./smoke/ -run=^Test_S_ -timeout=30m
88+
89+
- name: Merge coverages
90+
run: |
91+
go tool covdata textfmt -i=coverdir -o=smoke.cov
92+
93+
# Point back to the actual Go module tested.
94+
# It cannot be inferred, leading to this highly precise step.
95+
sed -i 's|^/home/runner/work/ctfer/ctfer|github.com/ctfer-io/ctfer|' smoke.cov
96+
97+
- name: Upload smoke tests coverage
98+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
99+
with:
100+
name: smoke.cov
101+
path: smoke.cov

0 commit comments

Comments
 (0)