Skip to content

Commit b74514d

Browse files
SgtCoDFishSgtCoDFish
authored
Merge pull request #640 from jetstack/fix-govulncheck
Fix govulncheck job by pulling more data from git
2 parents fbab5e1 + 8885746 commit b74514d

File tree

14 files changed

+184
-81
lines changed

14 files changed

+184
-81
lines changed

‎.github/workflows/govulncheck.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,16 @@ jobs:
1919

2020
steps:
2121
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
22+
# Adding `fetch-depth: 0` makes sure tags are also fetched. We need
23+
# the tags so `git describe` returns a valid version.
24+
# see https://github.com/actions/checkout/issues/701 for extra info about this option
25+
with: { fetch-depth: 0 }
2226

2327
- id: go-version
2428
run: |
2529
make print-go-version >> "$GITHUB_OUTPUT"
2630
27-
- uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
31+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
2832
with:
2933
go-version: ${{ steps.go-version.outputs.result }}
3034

‎.github/workflows/make-self-upgrade.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,12 +33,16 @@ jobs:
3333
exit 1
3434
3535
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
36+
# Adding `fetch-depth: 0` makes sure tags are also fetched. We need
37+
# the tags so `git describe` returns a valid version.
38+
# see https://github.com/actions/checkout/issues/701 for extra info about this option
39+
with: { fetch-depth: 0 }
3640

3741
- id: go-version
3842
run: |
3943
make print-go-version >> "$GITHUB_OUTPUT"
4044
41-
- uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
45+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
4246
with:
4347
go-version: ${{ steps.go-version.outputs.result }}
4448

‎klone.yaml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -10,50 +10,50 @@ targets:
1010
- folder_name: generate-verify
1111
repo_url: https://github.com/cert-manager/makefile-modules.git
1212
repo_ref: main
13-
repo_hash: fbd26411777b12c2574d05f146cee617c6c50b63
13+
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
1414
repo_path: modules/generate-verify
1515
- folder_name: go
1616
repo_url: https://github.com/cert-manager/makefile-modules.git
1717
repo_ref: main
18-
repo_hash: fbd26411777b12c2574d05f146cee617c6c50b63
18+
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
1919
repo_path: modules/go
2020
- folder_name: helm
2121
repo_url: https://github.com/cert-manager/makefile-modules.git
2222
repo_ref: main
23-
repo_hash: fbd26411777b12c2574d05f146cee617c6c50b63
23+
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
2424
repo_path: modules/helm
2525
- folder_name: help
2626
repo_url: https://github.com/cert-manager/makefile-modules.git
2727
repo_ref: main
28-
repo_hash: fbd26411777b12c2574d05f146cee617c6c50b63
28+
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
2929
repo_path: modules/help
3030
- folder_name: kind
3131
repo_url: https://github.com/cert-manager/makefile-modules.git
3232
repo_ref: main
33-
repo_hash: fbd26411777b12c2574d05f146cee617c6c50b63
33+
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
3434
repo_path: modules/kind
3535
- folder_name: klone
3636
repo_url: https://github.com/cert-manager/makefile-modules.git
3737
repo_ref: main
38-
repo_hash: fbd26411777b12c2574d05f146cee617c6c50b63
38+
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
3939
repo_path: modules/klone
4040
- folder_name: oci-build
4141
repo_url: https://github.com/cert-manager/makefile-modules.git
4242
repo_ref: main
43-
repo_hash: fbd26411777b12c2574d05f146cee617c6c50b63
43+
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
4444
repo_path: modules/oci-build
4545
- folder_name: oci-publish
4646
repo_url: https://github.com/cert-manager/makefile-modules.git
4747
repo_ref: main
48-
repo_hash: fbd26411777b12c2574d05f146cee617c6c50b63
48+
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
4949
repo_path: modules/oci-publish
5050
- folder_name: repository-base
5151
repo_url: https://github.com/cert-manager/makefile-modules.git
5252
repo_ref: main
53-
repo_hash: fbd26411777b12c2574d05f146cee617c6c50b63
53+
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
5454
repo_path: modules/repository-base
5555
- folder_name: tools
5656
repo_url: https://github.com/cert-manager/makefile-modules.git
5757
repo_ref: main
58-
repo_hash: fbd26411777b12c2574d05f146cee617c6c50b63
58+
repo_hash: 635a9ed0253409ac1543f59d97163d4a6a8c01b2
5959
repo_path: modules/tools

‎make/_shared/go/01_mod.mk‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ ifndef repo_name
2020
$(error repo_name is not set)
2121
endif
2222

23-
go_base_dir := $(dir $(lastword $(MAKEFILE_LIST)))/base/
2423
golangci_lint_override := $(dir $(lastword $(MAKEFILE_LIST)))/.golangci.override.yaml
2524

2625
.PHONY: go-workspace
@@ -58,11 +57,17 @@ generate-go-mod-tidy: | $(NEEDS_GO)
5857

5958
shared_generate_targets += generate-go-mod-tidy
6059

60+
default_govulncheck_generate_base_dir := $(dir $(lastword $(MAKEFILE_LIST)))/base/
61+
# The base directory used to copy the govulncheck GH action from. This can be
62+
# overwritten with an action with extra authentication or with a totally different
63+
# pipeline (eg. a GitLab pipeline).
64+
govulncheck_generate_base_dir ?= $(default_govulncheck_generate_base_dir)
65+
6166
.PHONY: generate-govulncheck
6267
## Generate base files in the repository
6368
## @category [shared] Generate/ Verify
6469
generate-govulncheck:
65-
cp -r $(go_base_dir)/. ./
70+
cp -r $(govulncheck_generate_base_dir)/. ./
6671

6772
shared_generate_targets += generate-govulncheck
6873

@@ -79,7 +84,7 @@ shared_generate_targets += generate-govulncheck
7984
# `verify-govulncheck` not added to the `shared_verify_targets` variable and is
8085
# not run by `make verify`, because `make verify` is run for each PR, and we do
8186
# not want new vulnerabilities in existing code to block the merging of PRs.
82-
# Instead `make verify-govulnecheck` is intended to be run periodically by a CI job.
87+
# Instead `make verify-govulncheck` is intended to be run periodically by a CI job.
8388
verify-govulncheck: | $(NEEDS_GOVULNCHECK)
8489
@find . -name go.mod -not \( -path "./$(bin_dir)/*" -or -path "./make/_shared/*" \) \
8590
| while read d; do \
@@ -105,16 +110,18 @@ generate-golangci-lint-config: | $(NEEDS_YQ) $(bin_dir)/scratch
105110

106111
shared_generate_targets += generate-golangci-lint-config
107112

113+
golangci_lint_timeout ?= 10m
114+
108115
.PHONY: verify-golangci-lint
109116
## Verify all Go modules using golangci-lint
110117
## @category [shared] Generate/ Verify
111118
verify-golangci-lint: | $(NEEDS_GO) $(NEEDS_GOLANGCI-LINT) $(NEEDS_YQ) $(bin_dir)/scratch
112119
@find . -name go.mod -not \( -path "./$(bin_dir)/*" -or -path "./make/_shared/*" \) \
113120
| while read d; do \
114121
target=$$(dirname $${d}); \
115-
echo "Running '$(bin_dir)/tools/golangci-lint run --go $(VENDORED_GO_VERSION) -c $(CURDIR)/$(golangci_lint_config)' in directory '$${target}'"; \
122+
echo "Running '$(bin_dir)/tools/golangci-lint run --go $(VENDORED_GO_VERSION) -c $(CURDIR)/$(golangci_lint_config) --timeout $(golangci_lint_timeout)' in directory '$${target}'"; \
116123
pushd "$${target}" >/dev/null; \
117-
$(GOLANGCI-LINT) run --go $(VENDORED_GO_VERSION) -c $(CURDIR)/$(golangci_lint_config) --timeout 4m || exit; \
124+
$(GOLANGCI-LINT) run --go $(VENDORED_GO_VERSION) -c $(CURDIR)/$(golangci_lint_config) --timeout $(golangci_lint_timeout) || exit; \
118125
popd >/dev/null; \
119126
echo ""; \
120127
done

‎make/_shared/go/base/.github/workflows/govulncheck.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,12 +19,16 @@ jobs:
1919

2020
steps:
2121
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
22+
# Adding `fetch-depth: 0` makes sure tags are also fetched. We need
23+
# the tags so `git describe` returns a valid version.
24+
# see https://github.com/actions/checkout/issues/701 for extra info about this option
25+
with: { fetch-depth: 0 }
2226

2327
- id: go-version
2428
run: |
2529
make print-go-version >> "$GITHUB_OUTPUT"
2630
27-
- uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0
31+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
2832
with:
2933
go-version: ${{ steps.go-version.outputs.result }}
3034

‎make/_shared/helm/crds.mk‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,8 @@ generate-crds: | $(NEEDS_CONTROLLER-GEN) $(NEEDS_YQ)
6767
done
6868

6969
@if [ -n "$$(ls $(crds_gen_temp) 2>/dev/null)" ]; then \
70-
cp -Tr $(crds_gen_temp) $(crds_dir); \
71-
cp $(crds_dir_readme) $(crds_dir)/README.md; \
70+
cp $(crds_gen_temp)/* $(crds_dir)/ ; \
71+
cp $(crds_dir_readme) $(crds_dir)/README.md ; \
7272
fi
7373

7474
shared_generate_targets += generate-crds

‎make/_shared/helm/helm.mk‎

Lines changed: 40 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,14 @@ helm_chart_name := $(notdir $(helm_chart_image_name))
4545
helm_chart_image_registry := $(dir $(helm_chart_image_name))
4646
helm_chart_image_tag := $(helm_chart_version)
4747
helm_chart_sources := $(shell find $(helm_chart_source_dir) -maxdepth 1 -type f) $(shell find $(helm_chart_source_dir)/templates -type f)
48-
helm_chart_archive := $(bin_dir)/scratch/image/$(helm_chart_name)-$(helm_chart_version).tgz
48+
helm_chart_archive := $(bin_dir)/scratch/helm/$(helm_chart_name)-$(helm_chart_version).tgz
49+
helm_digest_path := $(bin_dir)/scratch/helm/$(helm_chart_name)-$(helm_chart_version).digests
50+
helm_digest = $(shell head -1 $(helm_digest_path) 2> /dev/null)
4951

50-
$(helm_chart_archive): $(helm_chart_sources) | $(NEEDS_HELM) $(NEEDS_YQ) $(bin_dir)/scratch/image
52+
$(bin_dir)/scratch/helm:
53+
@mkdir -p $@
54+
55+
$(helm_chart_archive): $(helm_chart_sources) | $(NEEDS_HELM) $(NEEDS_YQ) $(bin_dir)/scratch/helm
5156
$(eval helm_chart_source_dir_versioned := $@.tmp)
5257
rm -rf $(helm_chart_source_dir_versioned)
5358
mkdir -p $(dir $(helm_chart_source_dir_versioned))
@@ -59,7 +64,7 @@ $(helm_chart_archive): $(helm_chart_sources) | $(NEEDS_HELM) $(NEEDS_YQ) $(bin_d
5964
echo "Chart name does not match the name in the helm_chart_name variable"; \
6065
exit 1; \
6166
fi
62-
67+
6368
$(YQ) '.annotations."artifacthub.io/prerelease" = "$(IS_PRERELEASE)"' \
6469
--inplace $(helm_chart_source_dir_versioned)/Chart.yaml
6570

@@ -74,8 +79,13 @@ $(helm_chart_archive): $(helm_chart_sources) | $(NEEDS_HELM) $(NEEDS_YQ) $(bin_d
7479
## Will also create a non-v-prefixed tag for the OCI image.
7580
## @category [shared] Publish
7681
helm-chart-oci-push: $(helm_chart_archive) | $(NEEDS_HELM) $(NEEDS_CRANE)
77-
$(HELM) push "$(helm_chart_archive)" "oci://$(helm_chart_image_registry)"
78-
$(CRANE) copy "$(helm_chart_image_name):$(helm_chart_image_tag)" "$(helm_chart_image_name):$(helm_chart_image_tag:v%=%)"
82+
$(HELM) push "$(helm_chart_archive)" "oci://$(helm_chart_image_registry)" 2>&1 \
83+
| tee >(grep -o "sha256:.\+" | tee $(helm_digest_path))
84+
85+
@# $(helm_chart_image_tag:v%=%) removes the v prefix from the value stored in helm_chart_image_tag.
86+
@# See https://www.gnu.org/software/make/manual/html_node/Substitution-Refs.html for the manual on the syntax.
87+
helm_digest=$$(cat $(helm_digest_path)) && \
88+
$(CRANE) copy "$(helm_chart_image_name)@$$helm_digest" "$(helm_chart_image_name):$(helm_chart_image_tag:v%=%)"
7989

8090
.PHONY: helm-chart
8191
## Create a helm chart
@@ -109,12 +119,34 @@ verify-helm-values: | $(NEEDS_HELM-TOOL) $(NEEDS_GOJQ)
109119

110120
shared_verify_targets += verify-helm-values
111121

122+
$(bin_dir)/scratch/kyverno:
123+
@mkdir -p $@
124+
125+
$(bin_dir)/scratch/kyverno/pod-security-policy.yaml: | $(NEEDS_KUSTOMIZE) $(bin_dir)/scratch/kyverno
126+
@$(KUSTOMIZE) build https://github.com/kyverno/policies/pod-security/enforce > $@
127+
128+
# Extra arguments for kyverno apply.
129+
kyverno_apply_extra_args :=
130+
# Allows known policy violations to be skipped by supplying Kyverno policy
131+
# exceptions.
132+
ifneq ("$(wildcard make/verify-pod-security-standards-exceptions.yaml)","")
133+
kyverno_apply_extra_args += --exceptions make/verify-pod-security-standards-exceptions.yaml
134+
endif
135+
112136
.PHONY: verify-pod-security-standards
113137
## Verify that the Helm chart complies with the pod security standards.
138+
##
139+
## You can add Kyverno policy exceptions to
140+
## `make/verify-pod-security-standards-exceptions.yaml`, to skip some of the pod
141+
## security policy rules.
142+
##
114143
## @category [shared] Generate/ Verify
115-
verify-pod-security-standards: $(helm_chart_archive) | $(NEEDS_KYVERNO) $(NEEDS_KUSTOMIZE) $(NEEDS_HELM)
116-
$(KYVERNO) apply <($(KUSTOMIZE) build https://github.com/kyverno/policies/pod-security/enforce) \
117-
--resource <($(HELM) template $(helm_chart_archive)) 2>/dev/null
144+
verify-pod-security-standards: $(helm_chart_archive) $(bin_dir)/scratch/kyverno/pod-security-policy.yaml | $(NEEDS_KYVERNO) $(NEEDS_HELM)
145+
@$(HELM) template $(helm_chart_archive) $(INSTALL_OPTIONS) \
146+
| $(KYVERNO) apply $(bin_dir)/scratch/kyverno/pod-security-policy.yaml \
147+
$(kyverno_apply_extra_args) \
148+
--resource - \
149+
--table
118150

119151
shared_verify_targets_dirty += verify-pod-security-standards
120152

‎make/_shared/kind/00_kind_image_versions.mk‎

Lines changed: 11 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -15,22 +15,16 @@
1515
# This file is auto-generated by the learn_kind_images.sh script in the makefile-modules repo.
1616
# Do not edit manually.
1717

18-
kind_image_kindversion := v0.24.0
18+
kind_image_kindversion := v0.26.0
1919

20-
kind_image_kube_1.25_amd64 := docker.io/kindest/node:v1.25.16@sha256:fedeb7ebef9794b3acbe656901f87231fb33381e0f586033ed18d2587bd9b73d
21-
kind_image_kube_1.25_arm64 := docker.io/kindest/node:v1.25.16@sha256:f16a9c7caa65d394176ce2e628eb371d5af8b7bd913e88c826a357cadde698c7
22-
kind_image_kube_1.26_amd64 := docker.io/kindest/node:v1.26.15@sha256:290e3765fbabbeb2ddcde36bdf3e8452166dc94a4c970a25c10290ebd480ca6e
23-
kind_image_kube_1.26_arm64 := docker.io/kindest/node:v1.26.15@sha256:7b34bc4f381a4aa0bd81239bbc2af5f44d933c11b3510da85f13cf8b2a34c9fd
24-
kind_image_kube_1.27_amd64 := docker.io/kindest/node:v1.27.16@sha256:84aff282b523c3943c374d95807e1e748ccd43432dce614d6c7a148a7028fb01
25-
kind_image_kube_1.27_arm64 := docker.io/kindest/node:v1.27.16@sha256:2c6de687b6ea20b385c0b18b85d4e55e214882b3cbde857974ccfe010f4a90a9
26-
kind_image_kube_1.28_amd64 := docker.io/kindest/node:v1.28.13@sha256:d97df9fff48099bf9a94c92fdc39adde65bec2aa1d011f84233b96172c1003c9
27-
kind_image_kube_1.28_arm64 := docker.io/kindest/node:v1.28.13@sha256:ddef612bb93a9aa3a989f9d3d4e01c0a7c4d866a4b949264146c182cd202d738
28-
kind_image_kube_1.29_amd64 := docker.io/kindest/node:v1.29.8@sha256:b69a150f9951ef41158ec76de381a920df2be3582fd16fc19cf4757eef0dded9
29-
kind_image_kube_1.29_arm64 := docker.io/kindest/node:v1.29.8@sha256:0d5623800cf6290edbc1007ca8a33a5f7e2ad92b41dc7022b4d20a66447db23c
30-
kind_image_kube_1.30_amd64 := docker.io/kindest/node:v1.30.4@sha256:34cb98a38a57a3357fde925a41d61232bbbbeb411b45a25c0d766635d6c3b975
31-
kind_image_kube_1.30_arm64 := docker.io/kindest/node:v1.30.4@sha256:6becd630a18e77730e31f3833f0b129bbcc9c09ee49c3b88429b3c1fdc30bfc4
32-
kind_image_kube_1.31_amd64 := docker.io/kindest/node:v1.31.0@sha256:919a65376fd11b67df05caa2e60802ad5de2fca250c9fe0c55b0dce5c9591af3
33-
kind_image_kube_1.31_arm64 := docker.io/kindest/node:v1.31.0@sha256:0ccfb11dc66eae4abc20c30ee95687bab51de8aeb04e325e1c49af0890646548
20+
kind_image_kube_1.29_amd64 := docker.io/kindest/node:v1.29.12@sha256:c1b696872c6d4d41889c1c7ca460d6c6349665061e6dd2a9cc5abda7dd8e21bc
21+
kind_image_kube_1.29_arm64 := docker.io/kindest/node:v1.29.12@sha256:a29e3189829c4784b31507c793b5d186914a6ed81d2296c39d32543988911f36
22+
kind_image_kube_1.30_amd64 := docker.io/kindest/node:v1.30.8@sha256:da9368e0cfa74ca1a7e2c6d6c7abf890e627a94d9c8300dd9d951f63947a456c
23+
kind_image_kube_1.30_arm64 := docker.io/kindest/node:v1.30.8@sha256:27b247e13bac7271e013ea4118843f8072e5a4f1fa8ce2c5c47018e6b2d45cce
24+
kind_image_kube_1.31_amd64 := docker.io/kindest/node:v1.31.4@sha256:29370cbe44fd9798ac1e47e7ad04e53c375c0c683a25cc0cc7db331ad07c9952
25+
kind_image_kube_1.31_arm64 := docker.io/kindest/node:v1.31.4@sha256:496ab674cddaa72e97f2aa70729df5b403f46ee5834fb9a44773284998fea6d5
26+
kind_image_kube_1.32_amd64 := docker.io/kindest/node:v1.32.0@sha256:dd45e7e76478f76d2881cf031e64512f51be63dcb61420307982a24913badf8f
27+
kind_image_kube_1.32_arm64 := docker.io/kindest/node:v1.32.0@sha256:eff24f9d99bc56271a456484d87cd6e6fc0beec7d4418958d589804703c00588
3428

35-
kind_image_latest_amd64 := $(kind_image_kube_1.31_amd64)
36-
kind_image_latest_arm64 := $(kind_image_kube_1.31_arm64)
29+
kind_image_latest_amd64 := $(kind_image_kube_1.32_amd64)
30+
kind_image_latest_arm64 := $(kind_image_kube_1.32_arm64)

‎make/_shared/oci-build/00_mod.mk‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,14 +16,15 @@ oci_platforms ?= linux/amd64,linux/arm/v7,linux/arm64,linux/ppc64le
1616

1717
# Use distroless as minimal base image to package the manager binary
1818
# To get latest SHA run "crane digest quay.io/jetstack/base-static:latest"
19-
base_image_static := quay.io/jetstack/base-static@sha256:6dd468efaceafb7d2b5ba437bb81500636237bac747fd751b75b0cb375600fae
19+
base_image_static := quay.io/jetstack/base-static@sha256:9202d031a2bf364519a07629e51daca08233e3096936563ea5f35f0e19003853
2020

2121
# Use custom apko-built image as minimal base image to package the manager binary
2222
# To get latest SHA run "crane digest quay.io/jetstack/base-static-csi:latest"
23-
base_image_csi-static := quay.io/jetstack/base-static-csi@sha256:b88c19bfe28a83799e08817ffb7205a3aac1b99ad07739a5433a7fb554b4d223
23+
base_image_csi-static := quay.io/jetstack/base-static-csi@sha256:2e159b417e03b3d454c202f8281922784ef7153873dc5a62bdb5e456de9dc6db
2424

2525
# Utility functions
2626
fatal_if_undefined = $(if $(findstring undefined,$(origin $1)),$(error $1 is not set))
27+
fatal_if_deprecated_defined = $(if $(findstring undefined,$(origin $1)),,$(error $1 is deprecated, use $2 instead))
2728

2829
# Validate globals that are required
2930
$(call fatal_if_undefined,bin_dir)
@@ -37,9 +38,13 @@ GOEXPERIMENT ?= # empty by default
3738
#
3839
# $1 - build_name
3940
define default_per_build_variables
40-
cgo_enabled_$1 ?= $(CGO_ENABLED)
41-
goexperiment_$1 ?= $(GOEXPERIMENT)
42-
oci_additional_layers_$1 ?=
41+
go_$1_cgo_enabled ?= $(CGO_ENABLED)
42+
go_$1_goexperiment ?= $(GOEXPERIMENT)
43+
go_$1_flags ?= -tags=
44+
oci_$1_additional_layers ?=
45+
oci_$1_linux_capabilities ?=
46+
oci_$1_image_annotation ?=
47+
oci_$1_image_label ?=
4348
endef
4449

4550
$(foreach build_name,$(build_names),$(eval $(call default_per_build_variables,$(build_name))))
@@ -48,6 +53,11 @@ $(foreach build_name,$(build_names),$(eval $(call default_per_build_variables,$(
4853
#
4954
# $1 - build_name
5055
define check_per_build_variables
56+
# Validate deprecated variables
57+
$(call fatal_if_deprecated_defined,cgo_enabled_$1,go_$1_cgo_enabled)
58+
$(call fatal_if_deprecated_defined,goexperiment_$1,go_$1_goexperiment)
59+
$(call fatal_if_deprecated_defined,oci_additional_layers_$1,oci_$1_additional_layers)
60+
5161
# Validate required config exists
5262
$(call fatal_if_undefined,go_$1_ldflags)
5363
$(call fatal_if_undefined,go_$1_main_dir)

‎make/_shared/oci-build/01_mod.mk‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,10 @@ IMAGE_TOOL := $(CURDIR)/$(bin_dir)/tools/image_tool
2222
NEEDS_IMAGE_TOOL := $(bin_dir)/tools/image_tool
2323
$(NEEDS_IMAGE_TOOL): $(wildcard $(image_tool_dir)/*.go) | $(NEEDS_GO)
2424
cd $(image_tool_dir) && GOWORK=off GOBIN=$(CURDIR)/$(dir $@) $(GO) install .
25-
25+
26+
$(bin_dir)/scratch/image:
27+
@mkdir -p $@
28+
2629
define ko_config_target
2730
.PHONY: $(ko_config_path_$1:$(CURDIR)/%=%)
2831
$(ko_config_path_$1:$(CURDIR)/%=%): | $(NEEDS_YQ) $(bin_dir)/scratch/image
@@ -31,11 +34,13 @@ $(ko_config_path_$1:$(CURDIR)/%=%): | $(NEEDS_YQ) $(bin_dir)/scratch/image
3134
$(YQ) '.builds[0].id = "$1"' | \
3235
$(YQ) '.builds[0].dir = "$(go_$1_mod_dir)"' | \
3336
$(YQ) '.builds[0].main = "$(go_$1_main_dir)"' | \
34-
$(YQ) '.builds[0].env[0] = "CGO_ENABLED=$(cgo_enabled_$1)"' | \
35-
$(YQ) '.builds[0].env[1] = "GOEXPERIMENT=$(goexperiment_$1)"' | \
37+
$(YQ) '.builds[0].env[0] = "CGO_ENABLED=$(go_$1_cgo_enabled)"' | \
38+
$(YQ) '.builds[0].env[1] = "GOEXPERIMENT=$(go_$1_goexperiment)"' | \
3639
$(YQ) '.builds[0].ldflags[0] = "-s"' | \
3740
$(YQ) '.builds[0].ldflags[1] = "-w"' | \
38-
$(YQ) '.builds[0].ldflags[2] = "{{.Env.LDFLAGS}}"' \
41+
$(YQ) '.builds[0].ldflags[2] = "{{.Env.LDFLAGS}}"' | \
42+
$(YQ) '.builds[0].flags[0] = "$(go_$1_flags)"' | \
43+
$(YQ) '.builds[0].linux_capabilities = "$(oci_$1_linux_capabilities)"' \
3944
> $(CURDIR)/$(oci_layout_path_$1).ko_config.yaml
4045

4146
ko-config-$1: $(ko_config_path_$1:$(CURDIR)/%=%)
@@ -58,6 +63,8 @@ $(oci_build_targets): oci-build-%: ko-config-% | $(NEEDS_KO) $(NEEDS_GO) $(NEEDS
5863
LDFLAGS="$(go_$*_ldflags)" \
5964
$(KO) build $(go_$*_mod_dir)/$(go_$*_main_dir) \
6065
--platform=$(oci_platforms) \
66+
--image-annotation=$(oci_$*_image_annotation) \
67+
--image-label=$(oci_$*_image_label) \
6168
--oci-layout-path=$(oci_layout_path_$*) \
6269
--sbom-dir=$(CURDIR)/$(oci_layout_path_$*).sbom \
6370
--sbom=spdx \
@@ -66,7 +73,7 @@ $(oci_build_targets): oci-build-%: ko-config-% | $(NEEDS_KO) $(NEEDS_GO) $(NEEDS
6673

6774
$(IMAGE_TOOL) append-layers \
6875
$(CURDIR)/$(oci_layout_path_$*) \
69-
$(oci_additional_layers_$*)
76+
$(oci_$*_additional_layers)
7077

7178
$(IMAGE_TOOL) list-digests \
7279
$(CURDIR)/$(oci_layout_path_$*) \

0 commit comments

Comments
 (0)