Skip to content

Commit fbb7a9a

Browse files
humblechumblec
committed
Squashed 'release-tools/' changes from dc4d0ae..4967685
4967685 Merge pull request #254 from bells17/add-github-actions d9bd160 Update skip list in codespell GitHub Action adb3af9 Merge pull request #252 from bells17/update-go-version f5aebfc Add GitHub Actions workflows b82ee38 Merge pull request #253 from bells17/fix-typo c317456 Fix typo 0a78505 Bump to Go 1.22.3 edd89ad Merge pull request #251 from jsafrane/add-logcheck 043fd09 Add test-logcheck target d7535ae Merge pull request #250 from jsafrane/go-1.22 b52e7ad Update go to 1.22.2 14fdb6f Merge pull request #247 from msau42/prow 9b4352e Update release playbook c7bb972 Fix release notes script to use fixed tags 463a0e9 Add script to update specific go modules git-subtree-dir: release-tools git-subtree-split: 4967685
1 parent 7654475 commit fbb7a9a

File tree

9 files changed

+212
-9
lines changed

9 files changed

+212
-9
lines changed

‎.github/dependabot.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
version: 2
2+
enable-beta-ecosystems: true
3+
updates:
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "daily"
8+
labels:
9+
- "area/dependency"
10+
- "release-note-none"
11+
- "ok-to-test"
12+
open-pull-requests-limit: 10

‎.github/workflows/codespell.yml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# GitHub Action to automate the identification of common misspellings in text files.
2+
# https://github.com/codespell-project/actions-codespell
3+
# https://github.com/codespell-project/codespell
4+
name: codespell
5+
on: [push, pull_request]
6+
jobs:
7+
codespell:
8+
name: Check for spelling errors
9+
runs-on: ubuntu-latest
10+
steps:
11+
- uses: actions/checkout@v4
12+
- uses: codespell-project/actions-codespell@master
13+
with:
14+
check_filenames: true
15+
skip: "*.png,*.jpg,*.svg,*.sum,./.git,./.github/workflows/codespell.yml,./prow.sh"

‎.github/workflows/trivy.yaml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Run Trivy scanner for Go version vulnerabilities
2+
on:
3+
push:
4+
branches:
5+
- master
6+
pull_request:
7+
jobs:
8+
trivy:
9+
name: Build
10+
runs-on: ubuntu-latest
11+
steps:
12+
- name: Checkout code
13+
uses: actions/checkout@v4
14+
15+
- name: Get Go version
16+
id: go-version
17+
run: |
18+
GO_VERSION=$(cat prow.sh | grep "configvar CSI_PROW_GO_VERSION_BUILD" | awk '{print $3}' | sed 's/"//g')
19+
echo "version=$GO_VERSION" >> $GITHUB_OUTPUT
20+
21+
- name: Run Trivy scanner for Go version vulnerabilities
22+
uses: aquasecurity/trivy-action@master
23+
with:
24+
image-ref: 'golang:${{ steps.go-version.outputs.version }}'
25+
format: 'table'
26+
exit-code: '1'
27+
ignore-unfixed: true
28+
vuln-type: 'library'
29+
severity: 'CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN'

‎SIDECAR_RELEASE_PROCESS.md

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -46,9 +46,12 @@ naming convention `<hostpath-deployment-version>-on-<kubernetes-version>`.
4646
## Release Process
4747
1. Identify all issues and ongoing PRs that should go into the release, and
4848
drive them to resolution.
49-
1. Update dependencies for sidecars via
50-
[go-modules-update.sh](https://github.com/kubernetes-csi/csi-driver-host-path/blob/HEAD/release-tools/go-modules-update.sh),
51-
and get PRs approved and merged.
49+
1. Update dependencies for sidecars
50+
1. For new minor versions, use
51+
[go-modules-update.sh](https://github.com/kubernetes-csi/csi-release-tools/blob/HEAD/go-modules-update.sh),
52+
1. For CVE fixes on patch versions, use
53+
[go-modules-targeted-update.sh](https://github.com/kubernetes-csi/csi-release-tools/blob/HEAD/go-modules-targeted-update.sh),
54+
Read the instructions at the top of the script.
5255
1. Check that all [canary CI
5356
jobs](https://testgrid.k8s.io/sig-storage-csi-ci) are passing,
5457
and that test coverage is adequate for the changes that are going into the release.

‎build.make

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -322,3 +322,10 @@ test-spelling:
322322
test-boilerplate:
323323
@ echo; echo "### $@:"
324324
@ ./release-tools/verify-boilerplate.sh "$(pwd)"
325+
326+
# Test klog usage. This test is optional and must be explicitly added to `test` target in the main Makefile:
327+
# test: test-logcheck
328+
.PHONY: test-logcheck
329+
test-logcheck:
330+
@ echo; echo "### $@:"
331+
@ ./release-tools/verify-logcheck.sh

‎generate_patch_release_notes.sh renamed to ‎generate-patch-release-notes.sh

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ function gen_patch_relnotes() {
4848
rm out.md || true
4949
rm -rf /tmp/k8s-repo || true
5050
GITHUB_TOKEN="$CSI_RELEASE_TOKEN" \
51-
release-notes --discover=patch-to-latest --branch="$2" \
51+
release-notes --start-rev="$3" --end-rev="$2" --branch="$2" \
5252
--org=kubernetes-csi --repo="$1" \
5353
--required-author="" --markdown-links --output out.md
5454
}
@@ -57,11 +57,14 @@ for rel in "${releases[@]}"; do
5757
read -r repo version <<< "$rel"
5858

5959
# Parse minor version
60-
minorPattern="(^[[:digit:]]+\.[[:digit:]]+)\."
61-
[[ "$version" =~ $minorPattern ]]
60+
minorPatchPattern="(^[[:digit:]]+\.[[:digit:]]+)\.([[:digit:]]+)"
61+
[[ "$version" =~ $minorPatchPattern ]]
6262
minor="${BASH_REMATCH[1]}"
63+
patch="${BASH_REMATCH[2]}"
6364

64-
echo "$repo" "$version" "$minor"
65+
echo "$repo $version $minor $patch"
66+
prevPatch="$((patch-1))"
67+
prevVer="v$minor.$prevPatch"
6568

6669
pushd "$repo/CHANGELOG"
6770

@@ -74,7 +77,7 @@ for rel in "${releases[@]}"; do
7477
git checkout --track "upstream/release-$minor" -b "$branch"
7578

7679
# Generate release notes
77-
gen_patch_relnotes "$repo" "release-$minor"
80+
gen_patch_relnotes "$repo" "release-$minor" "$prevVer"
7881
cat > tmp.md <<EOF
7982
# Release notes for v$version
8083
@@ -84,6 +87,7 @@ EOF
8487

8588
cat out.md >> tmp.md
8689
echo >> tmp.md
90+
rm out.md
8791

8892
file="CHANGELOG-$minor.md"
8993
cat "$file" >> tmp.md

‎go-modules-targeted-update.sh

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
#!/bin/bash
2+
3+
# Copyright 2023 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
18+
# Usage: go-modules-targeted-update.sh
19+
#
20+
# Batch update specific dependencies for sidecars.
21+
#
22+
# Required environment variables
23+
# CSI_RELEASE_TOKEN: Github token needed for generating release notes
24+
# GITHUB_USER: Github username to create PRs with
25+
#
26+
# Instructions:
27+
# 1. Login with "gh auth login"
28+
# 2. Copy this script to the Github org directory (one directory above the
29+
# repos)
30+
# 3. Change $modules, $releases and $org if needed.
31+
# 4. Set environment variables
32+
# 5. Run script from the Github org directory
33+
#
34+
# Caveats:
35+
# - This script doesn't handle interface incompatibility of updates.
36+
# You need to resolve interface incompatibility case by case. The
37+
# most frequent case is to update the interface(new parameters,
38+
# name change of the method, etc.)in the sidecar repo and make sure
39+
# the build and test pass.
40+
41+
42+
set -e
43+
set -x
44+
45+
org="kubernetes-csi"
46+
47+
modules=(
48+
"github.com/kubernetes-csi/[email protected]"
49+
)
50+
51+
releases=(
52+
#"external-attacher release-4.4"
53+
#"external-provisioner release-3.6"
54+
#"external-resizer release-1.9"
55+
#"external-snapshotter release-6.3"
56+
#"node-driver-registrar release-2.9"
57+
)
58+
59+
for rel in "${releases[@]}"; do
60+
61+
read -r repo branch <<< "$rel"
62+
if [ "$repo" != "#" ]; then
63+
(
64+
cd "$repo"
65+
git fetch upstream
66+
67+
if [ "$(git rev-parse --verify "module-update-$branch" 2>/dev/null)" ]; then
68+
git checkout master && git branch -D "module-update-$branch"
69+
fi
70+
git checkout -B "module-update-$branch" "upstream/$branch"
71+
72+
for mod in "${modules[@]}"; do
73+
go get "$mod"
74+
done
75+
go mod tidy
76+
go mod vendor
77+
78+
git add --all
79+
git commit -m "Update go modules"
80+
git push origin "module-update-$branch" --force
81+
82+
# Create PR
83+
prbody=$(cat <<EOF
84+
Updated the following go modules:
85+
86+
${modules[@]}
87+
88+
\`\`\`release-note
89+
NONE
90+
\`\`\`
91+
EOF
92+
)
93+
gh pr create --title="[$branch] Update go modules" --body "$prbody" --head "$GITHUB_USER:module-update-$branch" --base "$branch" --repo="$org/$repo"
94+
)
95+
fi
96+
done

‎prow.sh

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -86,7 +86,7 @@ configvar CSI_PROW_BUILD_PLATFORMS "linux amd64 amd64; linux ppc64le ppc64le -pp
8686
# which is disabled with GOFLAGS=-mod=vendor).
8787
configvar GOFLAGS_VENDOR "$( [ -d vendor ] && echo '-mod=vendor' )" "Go flags for using the vendor directory"
8888

89-
configvar CSI_PROW_GO_VERSION_BUILD "1.21.5" "Go version for building the component" # depends on component's source code
89+
configvar CSI_PROW_GO_VERSION_BUILD "1.22.3" "Go version for building the component" # depends on component's source code
9090
configvar CSI_PROW_GO_VERSION_E2E "" "override Go version for building the Kubernetes E2E test suite" # normally doesn't need to be set, see install_e2e
9191
configvar CSI_PROW_GO_VERSION_SANITY "${CSI_PROW_GO_VERSION_BUILD}" "Go version for building the csi-sanity test suite" # depends on CSI_PROW_SANITY settings below
9292
configvar CSI_PROW_GO_VERSION_KIND "${CSI_PROW_GO_VERSION_BUILD}" "Go version for building 'kind'" # depends on CSI_PROW_KIND_VERSION below

‎verify-logcheck.sh

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
#!/usr/bin/env bash
2+
3+
# Copyright 2024 The Kubernetes Authors.
4+
#
5+
# Licensed under the Apache License, Version 2.0 (the "License");
6+
# you may not use this file except in compliance with the License.
7+
# You may obtain a copy of the License at
8+
#
9+
# http://www.apache.org/licenses/LICENSE-2.0
10+
#
11+
# Unless required by applicable law or agreed to in writing, software
12+
# distributed under the License is distributed on an "AS IS" BASIS,
13+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
# See the License for the specific language governing permissions and
15+
# limitations under the License.
16+
17+
# This script uses the logcheck tool to analyze the source code
18+
# for proper usage of klog contextual logging.
19+
20+
set -o errexit
21+
set -o nounset
22+
set -o pipefail
23+
24+
LOGCHECK_VERSION=${1:-0.8.2}
25+
26+
# This will canonicalize the path
27+
CSI_LIB_UTIL_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")"/.. && pwd -P)
28+
29+
# Create a temporary directory for installing logcheck and
30+
# set up a trap command to remove it when the script exits.
31+
CSI_LIB_UTIL_TEMP=$(mktemp -d 2>/dev/null || mktemp -d -t csi-lib-utils.XXXXXX)
32+
trap 'rm -rf "${CSI_LIB_UTIL_TEMP}"' EXIT
33+
34+
echo "Installing logcheck to temp dir: sigs.k8s.io/logtools/logcheck@v${LOGCHECK_VERSION}"
35+
GOBIN="${CSI_LIB_UTIL_TEMP}" go install "sigs.k8s.io/logtools/logcheck@v${LOGCHECK_VERSION}"
36+
echo "Verifying logcheck: ${CSI_LIB_UTIL_TEMP}/logcheck -check-contextual ${CSI_LIB_UTIL_ROOT}/..."
37+
"${CSI_LIB_UTIL_TEMP}/logcheck" -check-contextual -check-with-helpers "${CSI_LIB_UTIL_ROOT}/..."

0 commit comments

Comments
 (0)