Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
The diff you're trying to view is too large. We only load the first 3000 changed files.
4 changes: 2 additions & 2 deletions .github/workflows/codecov.yml
Original file line number Diff line number Diff line change
Expand Up @@ -20,17 +20,17 @@
- main
jobs:
coverage-report:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- name: Checkout
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Set up Go 1.23.8
uses: actions/setup-go@v3
with:
go-version: 1.23.8
- name: Run unit tests
run: make test
- name: Build Codecov report
uses: codecov/codecov-action@v3
with:
files: cover.out

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
2 changes: 1 addition & 1 deletion .github/workflows/devfile-ci.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ jobs:
steps:
-
name: Checkout
uses: actions/checkout@v3
uses: actions/checkout@v4
-
name: Set up QEMU
uses: docker/setup-qemu-action@v2
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/minikube-test-helm.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -14,23 +14,23 @@
on: pull_request
jobs:
helm-on-minikube:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- name: Checkout source code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Start minikube cluster
id: run-minikube
uses: che-incubator/setup-minikube-action@next
with:
minikube-version: v1.29.0
- name: Install yq
run: sudo pip install yq
- name: Install chectl
run: bash <(curl -sL https://che-incubator.github.io/chectl/install.sh) --channel=next
- name: Run tests
run: /bin/bash build/scripts/minikube-tests/test-helm.sh
- uses: actions/upload-artifact@v4
if: ${{ always() }}
with:
name: artifacts
path: /tmp/artifacts-che

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
6 changes: 3 additions & 3 deletions .github/workflows/minikube-test-operator.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -17,14 +17,14 @@ jobs:
strategy:
fail-fast: false
matrix:
runners: ['ubuntu-22.04', 'ubuntu-22.04-arm']
runners: ['ubuntu-24.04', 'ubuntu-24.04-arm']
runs-on: ${{ matrix.runners }}
steps:
- name: Checkout source code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Set arch environment variable
run: |
if [[ ${{matrix.runners}} == 'ubuntu-22.04' ]]; then
if [[ ${{matrix.runners}} == 'ubuntu-24.04' ]]; then
echo arch="amd64" >> $GITHUB_ENV
else
echo arch="arm64" >> $GITHUB_ENV
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/minikube-test-upgrade-stable-to-next.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -17,25 +17,25 @@
- main
jobs:
upgrade-stable-to-next-on-minikube:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- name: Checkout source code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Start minikube cluster
id: run-minikube
uses: che-incubator/setup-minikube-action@next
with:
minikube-version: v1.29.0
- name: Install yq
run: sudo pip install yq
- name: Install chectl
run: bash <(curl -sL https://che-incubator.github.io/chectl/install.sh) --channel=next
- name: Run tests
run: /bin/bash build/scripts/minikube-tests/test-upgrade-from-stable-to-next.sh
env:
"GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
- uses: actions/upload-artifact@v4
if: ${{ always() }}
with:
name: artifacts
path: /tmp/artifacts-che

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
Original file line number Diff line number Diff line change
Expand Up @@ -17,25 +17,25 @@
- 7.*
jobs:
upgrade-stable-to-stable-on-minikube:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- name: Checkout source code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Start minikube cluster
id: run-minikube
uses: che-incubator/setup-minikube-action@next
with:
minikube-version: v1.29.0
- name: Install yq
run: sudo pip install yq
- name: Install chectl
run: bash <(curl -sL https://che-incubator.github.io/chectl/install.sh) --channel=next
- name: Run tests
run: /bin/bash build/scripts/minikube-tests/test-upgrade-from-stable-to-stable.sh
env:
"GITHUB_TOKEN": "${{ secrets.GITHUB_TOKEN }}"
- uses: actions/upload-artifact@v4
if: ${{ always() }}
with:
name: artifacts
path: /tmp/artifacts-che

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
28 changes: 13 additions & 15 deletions .github/workflows/pr-check.yml
Original file line number Diff line number Diff line change
Expand Up @@ -14,94 +14,92 @@
on: pull_request
jobs:
unit-tests:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- name: Checkout source code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Set up Go 1.23.8
uses: actions/setup-go@v3
with:
go-version: 1.23.8
- name: Run unit tests
run: make test
multiplatform-image-build:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
strategy:
fail-fast: false
matrix:
runners: ['ubuntu-22.04', 'ubuntu-22.04-arm']
runners: ['ubuntu-24.04', 'ubuntu-24.04-arm']
runs-on: ${{matrix.runners}}
steps:
- name: Checkout source code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Set arch environment variable
run: |
if [[ ${{matrix.runners}} == 'ubuntu-22.04' ]]; then
if [[ ${{matrix.runners}} == 'ubuntu-24.04' ]]; then
echo arch="amd64" >> $GITHUB_ENV
else
echo arch="arm64" >> $GITHUB_ENV
fi
- name: Build image
run: docker buildx build --platform linux/${{env.arch}} .
source-code-validation:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- name: Checkout source code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Set up Go 1.23.8
uses: actions/setup-go@v3
with:
go-version: 1.23.8
- name: Cache go modules
id: cache-mod
uses: actions/cache@v3
with:
path: ~/go/pkg/mod
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
restore-keys: |
${{ runner.os }}-go-
- name: Download dependencies
run: go mod download
if: steps.cache-mod.outputs.cache-hit != 'true'
- name: Check go mod status
run: |
go mod tidy
if [[ ! -z $(git status -s) ]]
then
echo "Go mod state is not clean:"
git --no-pager diff
exit 1
fi
- name: Check format
run: |
go install golang.org/x/tools/cmd/goimports@latest
go install github.com/che-incubator/check-license-header@379ba18fdb906d341ae451ea155cc34f1c4b4f1a
git reset HEAD --hard
echo "[INFO] Check code format and imports."
make fmt
if [[ ! -z $(git status -s) ]]
then
echo "not well formatted sources are found."
echo "execute 'make fmt' to fix the following:"
git --no-pager diff
exit 1
fi

echo "[INFO] Check license headers."
FILES_TO_CHECK_LICENSE=$(find . \
-not -path "./mocks/*" \
-not -path "./vendor/*" \
-not -path "./testbin/*" \
-not -path "./bundle/stable/*" \
-not -path "./config/manager/controller_manager_config.yaml" \
\( -name '*.sh' -o -name "*.go" -o -name "*.yaml" -o -name "*.yml" \))
LICENSE_TEMPLATE="${GITHUB_WORKSPACE}/hack/license-header.txt"
check-license-header -f "${LICENSE_TEMPLATE}" ${FILES_TO_CHECK_LICENSE}
dependencies-md-validation:
runs-on: ubuntu-22.04
dependencies-validation:
runs-on: ubuntu-24.04
steps:
- name: Checkout source code
uses: actions/checkout@v3
- name: Validate DEPENDENCIES.md file
uses: che-incubator/[email protected]
env:
EXCLUDE_DEPS: "github.com/bmizerany/assert, gotest.tools/v3, github.com/dhui/dktest, gotest.tools, github.com/golangplus/testing"
- name: Checkout source code
uses: actions/checkout@v4
- name: Check dependencies
run: build/scripts/clear-defined-test.sh
Comment on lines +100 to +105

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI 5 months ago

To fix the problem, add a permissions block at the top level of the workflow file (.github/workflows/pr-check.yml), just below the name: and before the on: key. This will apply the specified permissions to all jobs in the workflow unless overridden at the job level. The minimal recommended permissions are contents: read, which allows jobs to read repository contents but not write to them. If any job needs to write to pull requests (e.g., to post comments or statuses), you can add pull-requests: write, but based on the provided steps, only contents: read is required. No additional imports or definitions are needed.

Suggested changeset 1
.github/workflows/pr-check.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml
--- a/.github/workflows/pr-check.yml
+++ b/.github/workflows/pr-check.yml
@@ -13,2 +13,4 @@
 name: PR check
+permissions:
+  contents: read
 on: pull_request
EOF
@@ -13,2 +13,4 @@
name: PR check
permissions:
contents: read
on: pull_request
Copilot is powered by AI and may make mistakes. Always verify output.
4 changes: 2 additions & 2 deletions .github/workflows/release-che-docs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -32,52 +32,52 @@

jobs:
build:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up environment
run: |
sudo apt-get update -y || true
sudo apt-get -y -q install curl bash git
- name: Set up Python 3.9
uses: actions/setup-python@v4
with:
python-version: 3.9
- name: Install yq
run: |
python -m pip install --upgrade pip
pip install yq
- name: Release che docs PRs
run: |
git config --global user.name "Mykhailo Kuznietsov"
git config --global user.email "[email protected]"
export GITHUB_TOKEN=${{ secrets.CHE_BOT_GITHUB_TOKEN }}
set -e
# if not run manually, need to compute che docs version from latest released CSV
if [[ "${{ github.event.inputs.version }}" == "" ]] || [[ "${{ github.event.inputs.version }}" == "7.y.z" ]]; then
chedocsVersion=$(grep Version version/version.go | cut -d \" -f2)
else
chedocsVersion="${{ github.event.inputs.version }}"
fi

# generic method to call a GH action and pass in a single var=val parameter
invokeAction() {
this_repo=$1
this_action_name=$2
this_workflow_id=$3
this_var=$4
this_val=$5

# can compute using GH API
# workflow_id=$(curl -sSL https://api.github.com/repos/${this_repo}/actions/workflows -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" | jq --arg search_field "${this_action_name}" '.workflows[] | select(.name == $search_field).id'); # echo "workflow_id = $workflow_id"
# or just pass it in
workflow_id=$this_workflow_id
set +e
curl -sSL https://api.github.com/repos/${this_repo}/actions/workflows/${workflow_id}/dispatches -X POST -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" -d "{\"ref\":\"main\",\"inputs\": {\"${this_var}\":\"${this_val}\"} }"
echo "[INFO] Invoked '${this_action_name}' action ($workflow_id) - see https://github.com/${this_repo}/actions?query=workflow%3A%22${this_action_name// /+}%22"
}

# invoke action from che-docs repo
invokeAction eclipse/che-docs "Release Che Docs" "5193493" version "${chedocsVersion}"

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
4 changes: 2 additions & 2 deletions .github/workflows/release-chectl.yml
Original file line number Diff line number Diff line change
Expand Up @@ -32,63 +32,63 @@

jobs:
build:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up environment
run: |
sudo apt-get update -y || true
sudo apt-get -y -q install curl bash git
- name: Set up Python 3.9
uses: actions/setup-python@v4
with:
python-version: 3.9
- name: Install yq
run: |
python -m pip install --upgrade pip
pip install yq
- name: Release chectl PRs
run: |
git config --global user.name "Mykhailo Kuznietsov"
git config --global user.email "[email protected]"
export GITHUB_TOKEN=${{ secrets.CHE_INCUBATOR_BOT_GITHUB_TOKEN }}
set -e
# if not run manually, need to compute chectl version from latest released CSV
if [[ "${{ github.event.inputs.version }}" == "" ]] || [[ "${{ github.event.inputs.version }}" == "7.y.z" ]]; then
chectlVersion=$(grep Version version/version.go | cut -d \" -f2)
else
chectlVersion="${{ github.event.inputs.version }}"
fi

# generic method to call a GH action and pass in a single var=val parameter
invokeAction() {
this_repo=$1
this_action_name=$2
this_workflow_id=$3
this_workflow_ref=$4
this_params=$5

# can compute using GH API
# workflow_id=$(curl -sSL https://api.github.com/repos/${this_repo}/actions/workflows -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" | jq --arg search_field "${this_action_name}" '.workflows[] | select(.name == $search_field).id'); # echo "workflow_id = $workflow_id"
# or just pass it in
workflow_id=$this_workflow_id

inputsJson="{}"

IFS=',' read -ra paramMap <<< "${this_params}"
for keyvalue in "${paramMap[@]}"
do
key=${keyvalue%=*}
value=${keyvalue#*=}
echo $var1
inputsJson=$(echo "${inputsJson}" | jq ". + {\"${key}\": \"${value}\"}")
done

curl -sSL https://api.github.com/repos/${this_repo}/actions/workflows/${workflow_id}/dispatches -X POST -H "Authorization: token ${GITHUB_TOKEN}" -H "Accept: application/vnd.github.v3+json" -d "{\"ref\":\"${this_workflow_ref}\",\"inputs\": ${inputsJson} }"
echo "[INFO] Invoked '${this_action_name}' action ($workflow_id) - see https://github.com/${this_repo}/actions?query=workflow%3A%22${this_action_name// /+}%22"
}

# invoke action from chectl repo
invokeAction che-incubator/chectl "Release - create pull request for upcoming release" "4008310" "main" "version=${chectlVersion}"

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
7 changes: 2 additions & 5 deletions .github/workflows/release-community-operator-PRs.yml
Original file line number Diff line number Diff line change
Expand Up @@ -28,52 +28,49 @@

jobs:
build:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Set up environment
run: |
sudo apt-get update -y || true
sudo apt-get -y -q install curl bash git
- name: Set up Python 3.9
uses: actions/setup-python@v4
with:
python-version: 3.9
- name: Install operator courier, yq
run: |
python -m pip install --upgrade pip
pip install yq
- name: Release community operator PR
run: |
git config --global user.name "Mykhailo Kuznietsov"
git config --global user.email "[email protected]"
export GITHUB_TOKEN=${{ secrets.CHE_INCUBATOR_BOT_GITHUB_TOKEN }}
set -e
OP_SDK_DIR=/opt/operator-sdk
mkdir -p $OP_SDK_DIR
make download-operator-sdk DEST="${OP_SDK_DIR}"
export PATH="$PATH:$OP_SDK_DIR"
export QUAY_ECLIPSE_CHE_USERNAME=${{ secrets.QUAY_USERNAME }}
export QUAY_ECLIPSE_CHE_PASSWORD=${{ secrets.QUAY_PASSWORD }}

export QUAY_USERNAME_K8S=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_KUBERNETES_USERNAME }}
export QUAY_PASSWORD_K8S=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_KUBERNETES_PASSWORD }}
export QUAY_USERNAME_OS=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_OPENSHIFT_USERNAME }}
export QUAY_PASSWORD_OS=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_OPENSHIFT_PASSWORD }}
build/scripts/release/make-release.sh --prepare-community-operators-update ${{ github.event.inputs.forceflag }}
# - name: Create failure MM message
# if: ${{ failure() }}
# run: |
# echo "{\"text\":\":no_entry_sign: Che Community Operator ${{ github.event.inputs.version }} release has failed: https://github.com/eclipse-che/che-operator/actions/workflows/release-community-operator-PRs.yml\"}" > mattermost.json
# - name: Create success MM message
# run: |
# echo "{\"text\":\":white_check_mark: Che Community Operator ${{ github.event.inputs.version }} release PR has been created: https://github.com/redhat-openshift-ecosystem/community-operators-prod/pulls?q=is%3Apr+is%3Aopen+eclipse-che\"}" > mattermost.json
# - name: Send MM message
# if: ${{ success() }} || ${{ failure() }}
# uses: mattermost/[email protected]
# env:
# MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK_URL }}
# MATTERMOST_CHANNEL: eclipse-che-releases
# MATTERMOST_USERNAME: che-bot

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
4 changes: 2 additions & 2 deletions .github/workflows/release-helm-charts.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -28,37 +28,37 @@

jobs:
release-helm-charts:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4
with:
fetch-depth: 0

- name: Install Helm
uses: azure/setup-helm@v3
with:
version: v3.4.0

- name: Release
run: |
helm version
cp -rf "${GITHUB_WORKSPACE}"/helmcharts/stable /tmp/charts
git checkout gh-pages
mkdir -p charts/stable
mkdir -p charts/next
cp -rf /tmp/charts "${GITHUB_WORKSPACE}"/charts/new
helm package ./charts/new
mv *.tgz charts/stable/
rm -rf ./charts/new

# Generate index.yaml with list Helm packages
helm repo index --url https://eclipse-che.github.io/che-operator/charts charts

git config --global user.name "Mykhailo Kuznietsov"
git config --global user.email "[email protected]"
export GITHUB_TOKEN=${{ secrets.CHE_BOT_GITHUB_TOKEN }}

git add .
git commit -am "Add new chart package." --signoff

git push origin gh-pages

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
18 changes: 9 additions & 9 deletions .github/workflows/release-next-catalog-and-operator-image.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -26,14 +26,14 @@
strategy:
fail-fast: false
matrix:
runners: ['ubuntu-22.04', 'ubuntu-22.04-arm']
runners: ['ubuntu-24.04', 'ubuntu-24.04-arm']
runs-on: ${{matrix.runners}}
steps:
- name: Checkout source code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Set arch environment variable
run: |
if [[ ${{matrix.runners}} == 'ubuntu-22.04' ]]; then
if [[ ${{matrix.runners}} == 'ubuntu-24.04' ]]; then
echo arch="amd64" >> $GITHUB_ENV
else
echo arch="arm64" >> $GITHUB_ENV
Expand All @@ -56,11 +56,11 @@

publish-operator-manifest:
name: publish operator image
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
needs: build-operator-image-multiarch
steps:
- name: Checkout source code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Login to Quay.io
uses: docker/login-action@v2
with:
Expand All @@ -83,61 +83,61 @@
docker manifest push quay.io/eclipse/che-operator:next

build-catalog:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
needs: publish-operator-manifest
steps:
- name: Checkout source code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Install yq
run: sudo pip install yq
- name: Login to quay.io
uses: docker/login-action@v2
with:
username: ${{ secrets.QUAY_USERNAME }}
password: ${{ secrets.QUAY_PASSWORD }}
registry: quay.io
- name: Build catalog source
run: |
${GITHUB_WORKSPACE}/build/scripts/olm/release-catalog.sh \
--channel next \
--image-tool docker \
--multi-arch \
--catalog-image quay.io/eclipse/eclipse-che-olm-catalog:next

build-catalog-with-digest:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
needs: build-catalog
steps:
- name: Checkout source code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Install yq
run: sudo pip install yq
- name: Login to quay.io
uses: docker/login-action@v2
with:
username: ${{ secrets.QUAY_USERNAME }}
password: ${{ secrets.QUAY_PASSWORD }}
registry: quay.io
- name: Build catalog source
run: |
${GITHUB_WORKSPACE}/build/scripts/release/editors-definitions.sh update-manager-yaml \
--yaml-path ${GITHUB_WORKSPACE}/config/manager/manager.yaml
${GITHUB_WORKSPACE}/build/scripts/release/samples.sh update-manager-yaml \
--yaml-path ${GITHUB_WORKSPACE}/config/manager/manager.yaml \
--index-json-url "https://raw.githubusercontent.com/eclipse-che/che-dashboard/main/packages/devfile-registry/air-gap/index.json"
make update-dev-resources
${GITHUB_WORKSPACE}/build/scripts/release/addDigests.sh -s $(make csv-path CHANNEL=next) -t next
${GITHUB_WORKSPACE}/build/scripts/olm/release-catalog.sh \
--channel next \
--image-tool docker \
--multi-arch \
--catalog-image quay.io/eclipse/eclipse-che-olm-catalog:next-digest \
--bundle-image quay.io/eclipse/eclipse-che-olm-bundle:$(make bundle-version CHANNEL=next)-digest

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
8 changes: 2 additions & 6 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -29,116 +29,112 @@

jobs:
build:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Check existing tags
run: |
set +e
RECREATE_TAGS=${{ github.event.inputs.forceRecreateTags }}
VERSION=${{ github.event.inputs.version }}
EXISTING_TAG=$(git ls-remote --exit-code origin refs/tags/${VERSION})
if [[ -n ${EXISTING_TAG} ]]; then
if [[ ${RECREATE_TAGS} == "true" ]]; then
echo "[INFO] Removing tag for ${VERSION} version. New tag will be recreated during release."
git push origin :$VERSION
else
echo "[ERROR] Cannot proceed with release - tag ${EXISTING_TAG} already exists."
exit 1
fi
else
echo "[INFO] No existing tags detected for $VERSION"
fi
- name: Set up QEMU
uses: docker/setup-qemu-action@v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Set up Python 3.9
uses: actions/setup-python@v4
with:
python-version: 3.9
- name: Install operator courier, yq and base32 wrapper
run: |
python -m pip install --upgrade pip
pip install yq
pip install semver
sudo apt-get -y -q install
# get base32 util from che-release project
wget https://raw.githubusercontent.com/eclipse/che-release/master/utils/base32
# copy base32 python-based helper script into dir that's accessed from PATH (so it's accessible to this and other called scripts)
sudo cp -f $(pwd)/base32 /usr/local/bin/
sudo chmod +x /usr/local/bin/base32
#remove base32 from current directory to avoid it being commited during release
rm $(pwd)/base32
- name: Set up Go 1.23.8
uses: actions/setup-go@v3
with:
go-version: 1.23.8
- name: Release operator
env:
IMAGE_REGISTRY_HOST: quay.io
IMAGE_REGISTRY_USER_NAME: eclipse
run: |
CHE_VERSION=${{ github.event.inputs.version }}
if [[ ${{ github.event.inputs.dryRun }} == "true" ]]; then DRY_RUN_FLAG="--dry-run"; fi
echo "CHE_VERSION=${CHE_VERSION}"
echo "DRY_RUN_FLAG=${DRY_RUN_FLAG}"
BRANCH=${CHE_VERSION%.*}.x
echo "BRANCH=${BRANCH}"
git config --global user.name "Mykhailo Kuznietsov"
git config --global user.email "[email protected]"
export GITHUB_TOKEN=${{ secrets.CHE_BOT_GITHUB_TOKEN }}
set -e

OP_SDK_DIR=/opt/operator-sdk
mkdir -p $OP_SDK_DIR
make download-operator-sdk DEST="${OP_SDK_DIR}"

go install golang.org/x/tools/cmd/goimports@latest

export PATH="$PATH:$OP_SDK_DIR"
export QUAY_ECLIPSE_CHE_USERNAME=${{ secrets.QUAY_USERNAME }}
export QUAY_ECLIPSE_CHE_PASSWORD=${{ secrets.QUAY_PASSWORD }}

if [[ ${CHE_VERSION} == *".0" ]]; then
build/scripts/release/make-release.sh ${CHE_VERSION} --release --check-resources --release-olm-files ${DRY_RUN_FLAG}
else
git checkout ${BRANCH}
build/scripts/release/make-release.sh ${CHE_VERSION} --release --release-olm-files ${DRY_RUN_FLAG}
fi

# default robot account on quay does not have permissions for application repos
# so we provide credentials for accounts that do
export QUAY_USERNAME_K8S=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_KUBERNETES_USERNAME }}
export QUAY_PASSWORD_K8S=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_KUBERNETES_PASSWORD }}
export QUAY_USERNAME_OS=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_OPENSHIFT_USERNAME }}
export QUAY_PASSWORD_OS=${{ secrets.QUAY_ECLIPSE_CHE_OPERATOR_OPENSHIFT_PASSWORD }}
# echo "[DEBUG] Using credentials:"
# echo "[DEBUG] QUAY_USERNAME_K8S = ${QUAY_USERNAME_K8S} and"
# echo "[DEBUG] QUAY_USERNAME_OS = ${QUAY_USERNAME_OS}"

git checkout ${CHE_VERSION}-release
build/scripts/release/make-release.sh ${CHE_VERSION} --push-olm-bundles ${DRY_RUN_FLAG}

# perform extra checkouts to ensure branches exist locally
git checkout ${BRANCH}
git checkout ${CHE_VERSION}-release
force_update=""
if [[ ${{ github.event.inputs.forceRecreateTags }} == "true" ]]; then force_update="--force"; fi
build/scripts/release/make-release.sh ${CHE_VERSION} --push-git-changes --pull-requests ${force_update} ${DRY_RUN_FLAG}
#- name: Create failure MM message
#if: ${{ failure() }}
#run: |
#echo "{\"text\":\":no_entry_sign: Che Operator ${{ github.event.inputs.version }} release has failed: https://github.com/eclipse-che/che-operator/actions/workflows/release.yml\"}" > mattermost.json
#- name: Create success MM message
#run: |
#echo "{\"text\":\":white_check_mark: Che Operator ${{ github.event.inputs.version }} release PR have been created: https://github.com/eclipse-che/che-operator/pulls/che-bot\"}" > mattermost.json
#- name: Send MM message
#if: ${{ success() }} || ${{ failure() }}
#uses: mattermost/[email protected]
#env:
#MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK_URL }}
#MATTERMOST_CHANNEL: eclipse-che-releases
#MATTERMOST_USERNAME: che-bot

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
8 changes: 4 additions & 4 deletions .github/workflows/resources-check-main.yml
Original file line number Diff line number Diff line change
Expand Up @@ -17,30 +17,30 @@
- main
jobs:
resources-validation:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- name: Checkout source code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Install yq
run: sudo pip install yq
- name: Set up Go 1.23.8
uses: actions/setup-go@v3
with:
go-version: 1.23.8
- name: Validate operator resources
run: |
go install golang.org/x/tools/cmd/goimports@latest
${GITHUB_WORKSPACE}/build/scripts/check-resources.sh
bundle-version-validation:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- name: Checkout source code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Install yq
run: sudo pip install yq
- name: Set up Go 1.23.8
uses: actions/setup-go@v3
with:
go-version: 1.23.8
- name: Validate OLM bundle version
run: ${GITHUB_WORKSPACE}/build/scripts/check-bundle-version.sh

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
2 changes: 1 addition & 1 deletion .github/workflows/try-in-web-ide.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,10 @@

jobs:
add-web-ide-link:
runs-on: ubuntu-22.04
runs-on: ubuntu-24.04
steps:
- name: Web IDE Pull Request Check
uses: redhat-actions/try-in-web-ide@v1
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
add_comment: false

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}
2 changes: 1 addition & 1 deletion .vscode/launch.json
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"type": "go",
"request": "launch",
"mode": "auto",
"program": "${workspaceFolder}/main.go",
"program": "${workspaceFolder}/cmd/main.go",
"envFile": "/tmp/che-operator-dev/vscode.env",
"cwd": "${workspaceFolder}",
},
Expand Down
Loading
Loading