Skip to content

Commit b6c970c

Browse files
authored
[internal] Fixes in CI, module structure and build (#92)
Signed-off-by: v.oleynikov <[email protected]>
1 parent 0557140 commit b6c970c

File tree

12 files changed

+86
-230
lines changed

12 files changed

+86
-230
lines changed

.github/workflows/build_prod.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -233,4 +233,4 @@ jobs:
233233
module_tag: ${{ github.ref_name }}
234234
secondary_repo: "${{ vars.DEV_MODULE_SOURCE }}/${{ vars.MODULE_NAME }}"
235235
source_repo: ${{ secrets.SOURCE_REPO }}
236-
source_repo_ssh_key: ${{ secrets.SOURCE_REPO_SSH_KEY }}
236+
source_repo_ssh_key: ${{ secrets.SOURCE_REPO_SSH_KEY }}

.github/workflows/deploy_dev.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,5 +70,4 @@ jobs:
7070
module_tag: ${{ github.event.inputs.tag }}
7171
source_repo: ${{ secrets.SOURCE_REPO }}
7272
source_repo_ssh_key: ${{ secrets.SOURCE_REPO_SSH_KEY }}
73-
7473
- uses: deckhouse/modules-actions/deploy@v2

.github/workflows/go_checks.yaml

Lines changed: 4 additions & 158 deletions
Original file line numberDiff line numberDiff line change
@@ -18,34 +18,8 @@ jobs:
1818
- name: Checkout repository
1919
uses: actions/checkout@v2
2020

21-
- name: Setup Go environment
22-
uses: actions/setup-go@v5
23-
with:
24-
go-version: "1.24"
25-
26-
- name: Install golangci-lint
27-
run: go install github.com/golangci/golangci-lint/cmd/[email protected]
28-
2921
- name: Run Go lint
30-
run: |
31-
basedir=$(pwd)
32-
failed='false'
33-
for i in $(find images -type f -name go.mod);do
34-
dir=$(echo $i | sed 's/go.mod$//')
35-
cd $basedir/$dir
36-
# check all editions
37-
for edition in $GO_BUILD_TAGS ;do
38-
echo "Running linter in $dir (edition: $edition)"
39-
golangci-lint run --build-tags $edition
40-
if [ $? -ne 0 ]; then
41-
echo "Linter failed in $dir (edition: $edition)"
42-
failed='true'
43-
fi
44-
done
45-
done
46-
if [ $failed == 'true' ]; then
47-
exit 1
48-
fi
22+
uses: deckhouse/modules-actions/go_linter@v2
4923

5024
go_tests:
5125
name: Go tests for images
@@ -55,31 +29,8 @@ jobs:
5529
- name: Checkout repository
5630
uses: actions/checkout@v2
5731

58-
- name: Setup Go environment
59-
uses: actions/setup-go@v5
60-
with:
61-
go-version: "1.24"
62-
6332
- name: Run Go tests
64-
run: |
65-
basedir=$(pwd)
66-
failed='false'
67-
for i in $(find images -type f -name '*_test.go');do
68-
dir=$(echo $i | sed 's/[a-z_A-Z0-9-]*_test.go$//')
69-
cd $basedir/$dir
70-
# check all editions
71-
for edition in $GO_BUILD_TAGS ;do
72-
echo "Running tests in $dir (edition: $edition)"
73-
go test -v -tags $edition
74-
if [ $? -ne 0 ]; then
75-
echo "Tests failed in $dir (edition: $edition)"
76-
failed='true'
77-
fi
78-
done
79-
done
80-
if [ $failed == 'true' ]; then
81-
exit 1
82-
fi
33+
uses: deckhouse/modules-actions/go_tests@v2
8334

8435
go_test_coverage:
8536
name: Go test coverage for images
@@ -89,35 +40,8 @@ jobs:
8940
- name: Checkout repository
9041
uses: actions/checkout@v2
9142

92-
- name: Setup Go environment
93-
uses: actions/setup-go@v5
94-
with:
95-
go-version: "1.24"
96-
9743
- name: Run Go test coverage count
98-
run: |
99-
if [ ! -d "images" ]; then
100-
echo "No images/ directory found. Please run this script from the root of the repository."
101-
exit 1
102-
fi
103-
104-
find images/ -type f -name "go.mod" | while read -r gomod; do
105-
dir=$(dirname "$gomod")
106-
107-
echo "Test coverage in $dir"
108-
109-
cd "$dir" || continue
110-
111-
for tag in $GO_BUILD_TAGS; do
112-
echo " Build tag: $tag"
113-
114-
go test ./... -cover -tags "$tag"
115-
done
116-
117-
cd - > /dev/null
118-
119-
echo "----------------------------------------"
120-
done
44+
uses: deckhouse/modules-actions/go_test_coverage@v2
12145

12246
go_modules_check:
12347
name: Go modules version
@@ -127,83 +51,5 @@ jobs:
12751
- name: Checkout repository
12852
uses: actions/checkout@v2
12953

130-
- name: Setup Go environment
131-
uses: actions/setup-go@v5
132-
with:
133-
go-version: "1.24"
134-
13554
- name: Run Go modules version check
136-
run: |
137-
search_dir=$(pwd)"/images"
138-
139-
if [ ! -d "$search_dir" ]; then
140-
echo "Directory $search_dir does not exist."
141-
exit 1
142-
fi
143-
144-
temp_dir=$(mktemp -d)
145-
touch "$temp_dir/incorrect_alert"
146-
147-
trap 'rm -rf "$temp_dir"' EXIT
148-
149-
find images/ -type f -name "go.mod" | while read -r gomod; do
150-
dir=$(dirname "$gomod")
151-
152-
echo "Checking $dir"
153-
154-
cd "$dir" || continue
155-
156-
go list -m all | grep deckhouse | grep -v '=>' | while IFS= read -r line; do
157-
module_name=$(echo "$line" | awk '{print $1}')
158-
module_version=$(echo "$line" | awk '{print $2}')
159-
160-
if [ -z "$module_version" ]; then
161-
echo " Checking module name $module_name"
162-
correct_module_name="github.com"/"$GITHUB_REPOSITORY"/"$dir"
163-
if [ "$module_name" != "$correct_module_name" ]; then
164-
echo " Incorrect module name: $module_name, expected: $correct_module_name"
165-
echo " Incorrect module name: $module_name, expected: $correct_module_name" >> "$temp_dir/incorrect_alert"
166-
else
167-
echo " Correct module name: $module_name"
168-
fi
169-
else
170-
echo " Checking module tag $module_name"
171-
repository=$(echo "$line" | awk '{print $1}' | awk -F'/' '{ print "https://"$1"/"$2"/"$3".git" }')
172-
pseudo_tag=$(echo "$line" | awk '{print $2}')
173-
174-
echo " Cloning repo $repository into $temp_dir"
175-
if [ ! -d "$temp_dir/$repository" ]; then
176-
git clone "$repository" "$temp_dir/$repository" >/dev/null 2>&1
177-
fi
178-
179-
cd "$temp_dir/$repository" || continue
180-
181-
commit_info=$(git log -1 --pretty=format:"%H %cd" --date=iso-strict -- api/*)
182-
short_hash=$(echo "$commit_info" | awk '{print substr($1,1,12)}')
183-
commit_date=$(echo "$commit_info" | awk '{print $2}')
184-
commit_date=$(date -u -d "$commit_date" +"%Y%m%d%H%M%S")
185-
actual_pseudo_tag="v0.0.0-"$commit_date"-"$short_hash
186-
pseudo_tag_date=$(echo $pseudo_tag | awk -F'-' '{ print $2 }')
187-
echo " Latest pseudo tag for $repository: $pseudo_tag"
188-
echo " Actual pseudo tag for $repository: $actual_pseudo_tag"
189-
190-
if [[ "$pseudo_tag" != "$actual_pseudo_tag" ]]; then
191-
echo " Incorrect pseudo tag for repo $repository in file "$go_mod_file" (current: "$pseudo_tag", actual:"$actual_pseudo_tag")"
192-
echo " Incorrect pseudo tag for repo $repository in file "$go_mod_file" (current: "$pseudo_tag", actual:"$actual_pseudo_tag")" >> $temp_dir"/incorrect_alert"
193-
fi
194-
195-
cd - >/dev/null 2>&1
196-
fi
197-
done
198-
199-
cd - > /dev/null
200-
201-
echo "----------------------------------------"
202-
done
203-
204-
alert_lines_count=$(cat $temp_dir"/incorrect_alert" | wc -l)
205-
206-
if [ $alert_lines_count != 0 ]; then
207-
echo "We have non-actual pseudo-tags or modules names in repository's go.mod files"
208-
exit 1
209-
fi
55+
uses: deckhouse/modules-actions/go_modules_check@v2
Lines changed: 39 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
name: Build and checks
22

33
on:
4+
schedule:
5+
- cron: "0 01 * * 0,3"
46
pull_request:
57
types: [opened, reopened, labeled, synchronize]
68
push:
@@ -9,7 +11,16 @@ on:
911
workflow_dispatch:
1012
inputs:
1113
release_branch:
12-
description: "release branch name, example: release-1.68"
14+
description: "Optional. Set minor version of release you want to scan. e.g.: 1.23"
15+
required: false
16+
scan_several_lastest_releases:
17+
description: "Optional. Whether to scan last several releases or not. true/false. For scheduled pipelines it is always true. Default is: false."
18+
required: false
19+
latest_releases_amount:
20+
description: "Optional. Number of latest releases to scan. Default is: 3"
21+
required: false
22+
severity:
23+
description: "Optional. Vulnerabilities severity to scan. Default is: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
1324
required: false
1425

1526
jobs:
@@ -19,40 +30,44 @@ jobs:
1930
secrets: inherit
2031
cve_scan_on_pr:
2132
if: github.event_name == 'pull_request'
22-
name: Trivy images check
33+
name: CVE scan for PR
2334
runs-on: [self-hosted, regular]
2435
needs: [build_dev]
2536
steps:
2637
- uses: actions/checkout@v4
27-
- uses: deckhouse/modules-actions/cve_scan@v2
38+
- uses: deckhouse/modules-actions/cve_scan@v4
2839
with:
29-
image: ${{ vars.DEV_MODULE_SOURCE }}/${{ vars.MODULE_NAME }}
3040
tag: pr${{ github.event.number }}
3141
module_name: ${{ vars.MODULE_NAME }}
32-
dd_url: ${{secrets.DEFECTDOJO_HOST}}
33-
dd_token: ${{secrets.DEFECTDOJO_API_TOKEN}}
34-
trivy_registry: ${{ vars.PROD_REGISTRY }}
35-
trivy_registry_user: ${{ vars.PROD_MODULES_REGISTRY_LOGIN }}
36-
trivy_registry_password: ${{ secrets.PROD_MODULES_READ_REGISTRY_PASSWORD }}
37-
deckhouse_private_repo: ${{secrets.DECKHOUSE_PRIVATE_REPO}}
42+
dd_url: ${{ secrets.DEFECTDOJO_HOST }}
43+
dd_token: ${{ secrets.DEFECTDOJO_API_TOKEN }}
44+
prod_registry: "registry.deckhouse.io"
45+
prod_registry_user: "license-token"
46+
prod_registry_password: ${{ secrets.PROD_MODULES_READ_REGISTRY_PASSWORD }}
47+
dev_registry: ${{ vars.DEV_REGISTRY }}
48+
dev_registry_user: ${{ vars.DEV_MODULES_REGISTRY_LOGIN }}
49+
dev_registry_password: ${{ secrets.DEV_MODULES_REGISTRY_PASSWORD }}
50+
deckhouse_private_repo: ${{ secrets.DECKHOUSE_PRIVATE_REPO }}
51+
severity: "HIGH,CRITICAL"
3852
cve_scan:
3953
if: github.event_name != 'pull_request'
40-
name: Trivy images check
54+
name: Regular CVE scan
4155
runs-on: [self-hosted, regular]
4256
steps:
4357
- uses: actions/checkout@v4
44-
- name: Sets env vars for manual run
45-
run: |
46-
echo "MODULE_IMAGE_TAG=${{ github.event.inputs.release_branch || 'main' }}" >> $GITHUB_ENV
47-
if: github.event_name != 'workflow_dispatch'
48-
- uses: deckhouse/modules-actions/cve_scan@v2
58+
- uses: deckhouse/modules-actions/cve_scan@v4
4959
with:
50-
image: ${{ vars.DEV_MODULE_SOURCE }}/${{ vars.MODULE_NAME }}
51-
tag: ${{ env.MODULE_IMAGE_TAG || 'main' }}
60+
tag: ${{ github.event.inputs.release_branch || github.event.repository.default_branch }}
5261
module_name: ${{ vars.MODULE_NAME }}
53-
dd_url: ${{secrets.DEFECTDOJO_HOST}}
54-
dd_token: ${{secrets.DEFECTDOJO_API_TOKEN}}
55-
trivy_registry: ${{ vars.PROD_REGISTRY }}
56-
trivy_registry_user: ${{ vars.PROD_MODULES_REGISTRY_LOGIN }}
57-
trivy_registry_password: ${{ secrets.PROD_MODULES_READ_REGISTRY_PASSWORD }}
58-
deckhouse_private_repo: ${{secrets.DECKHOUSE_PRIVATE_REPO}}
62+
dd_url: ${{ secrets.DEFECTDOJO_HOST }}
63+
dd_token: ${{ secrets.DEFECTDOJO_API_TOKEN }}
64+
prod_registry: "registry.deckhouse.io"
65+
prod_registry_user: "license-token"
66+
prod_registry_password: ${{ secrets.PROD_MODULES_READ_REGISTRY_PASSWORD }}
67+
dev_registry: ${{ vars.DEV_REGISTRY }}
68+
dev_registry_user: ${{ vars.DEV_MODULES_REGISTRY_LOGIN }}
69+
dev_registry_password: ${{ secrets.DEV_MODULES_REGISTRY_PASSWORD }}
70+
deckhouse_private_repo: ${{ secrets.DECKHOUSE_PRIVATE_REPO }}
71+
scan_several_lastest_releases: ${{ github.event.inputs.scan_several_lastest_releases }}
72+
latest_releases_amount: ${{ github.event.inputs.latest_releases_amount || '3' }}
73+
severity: ${{ github.event.inputs.severity }}

.werf/bundle.yaml

Lines changed: 35 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -3,39 +3,39 @@
33
image: bundle
44
fromImage: builder/scratch
55
import:
6-
# Rendering .werf/images-digests.yaml is required!
7-
- image: images-digests
8-
add: /images_digests.json
9-
to: /images_digests.json
10-
after: setup
11-
# Rendering .werf/python-deps.yaml is required!
12-
- image: python-dependencies
13-
add: /lib/python/dist
14-
to: /lib/python/dist
15-
after: setup
16-
# Rendering .werf/go-hooks.yaml is required!
17-
- image: go-hooks-artifact
18-
add: /usr/local/bin/go-hooks
19-
to: /hooks/go-hooks
20-
after: setup
21-
# Rendering .werf/choice-edition.yaml is required!
22-
- image: choice-edition
23-
add: /openapi
24-
to: /openapi
25-
after: setup
6+
# Rendering .werf/images-digests.yaml is required!
7+
- image: images-digests
8+
add: /images_digests.json
9+
to: /images_digests.json
10+
after: setup
11+
# Rendering .werf/python-deps.yaml is required!
12+
- image: python-dependencies
13+
add: /lib/python/dist
14+
to: /lib/python/dist
15+
after: setup
16+
# Rendering .werf/go-hooks.yaml is required!
17+
- image: go-hooks-artifact
18+
add: /usr/local/bin/go-hooks
19+
to: /hooks/go-hooks
20+
after: setup
21+
# Rendering .werf/choose-edition.yaml is required!
22+
- image: choose-edition
23+
add: /openapi
24+
to: /openapi
25+
after: setup
2626
git:
27-
- add: /
28-
to: /
29-
excludePaths:
30-
- hooks/go
31-
includePaths:
32-
- .helmignore
33-
- charts
34-
- crds
35-
- docs
36-
- enabled
37-
- hooks
38-
- monitoring
39-
- module.yaml
40-
- templates
41-
- Chart.yaml
27+
- add: /
28+
to: /
29+
excludePaths:
30+
- hooks/go
31+
includePaths:
32+
- .helmignore
33+
- charts
34+
- crds
35+
- docs
36+
- enabled
37+
- hooks
38+
- monitoring
39+
- module.yaml
40+
- templates
41+
- Chart.yaml

.werf/choice-edition.yaml renamed to .werf/choose-edition.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# TODO comment here
22
---
3-
image: choice-edition
3+
image: choose-edition
44
fromImage: builder/alt
55

66
git:

module.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,5 @@ descriptions:
44
en: "CSI NFS module"
55
requirements:
66
bootstrapped: true
7+
deckhouse: ">= 1.67"
78
namespace: "d8-csi-nfs"

0 commit comments

Comments
 (0)