Skip to content

Commit 602a9f7

Browse files
amitchell-mozamitchell-moz
committed
feat:add psa-checker reusable workflow
1 parent 1228f96 commit 602a9f7

File tree

1 file changed

+146
-0
lines changed

1 file changed

+146
-0
lines changed

‎.github/workflows/psa-checker.yml‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
# This Source Code Form is subject to the terms of the Mozilla Public
2+
# License, v. 2.0. If a copy of the MPL was not distributed with this
3+
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
4+
5+
# Reusable workflow to render helm charts and check if they meet PSS level restricted
6+
7+
name: render and diff helm charts
8+
on:
9+
workflow_call:
10+
inputs:
11+
pss_level:
12+
description: 'PSS level to check against'
13+
default: 'restricted'
14+
required: false
15+
type: string
16+
17+
env:
18+
HEAD_REF: ${{ github.head_ref }}
19+
20+
jobs:
21+
get_changed_helm_charts:
22+
runs-on: ubuntu-latest
23+
outputs:
24+
matrix_charts: ${{ steps.find_changed_charts.outputs.matrix_changed_charts }}
25+
charts: ${{ steps.find_changed_charts.outputs.changed_charts }}
26+
steps:
27+
- name: checkout repository
28+
uses: actions/checkout@v4
29+
with:
30+
fetch-depth: '100'
31+
persist-credentials: true # We are using these credentials in later steps
32+
33+
- name: find changed helm charts
34+
id: find_changed_charts
35+
run: |
36+
git fetch origin ${GITHUB_BASE_REF}:${GITHUB_BASE_REF}
37+
echo matrix_changed_charts=$(git diff --name-only ${GITHUB_BASE_REF}...HEAD -- '**/k8s/**/*.yaml' '**/k8s/**/*.yml' '**/k8s/**/*.tpl' '**/k8s/**/*.tmpl' | cut -d'/' -f1,2,3 | uniq | jq -R 'split("\n")' | jq -s 'flatten(1)') >> $GITHUB_OUTPUT
38+
echo changed_charts=$(git diff --name-only ${GITHUB_BASE_REF}...HEAD -- '**/k8s/**/*.yaml' '**/k8s/**/*.yml' '**/k8s/**/*.tpl' '**/k8s/**/*.tmpl' | cut -d'/' -f1,2,3 | uniq) >> $GITHUB_OUTPUT
39+
env:
40+
GITHUB_BASE_REF: ${{ github.base_ref }}
41+
42+
render_head_ref_charts:
43+
runs-on: ubuntu-latest
44+
needs: get_changed_helm_charts
45+
strategy:
46+
matrix:
47+
chart: ${{ fromJSON(needs.get_changed_helm_charts.outputs.matrix_charts) }}
48+
steps:
49+
- name: checkout repository
50+
uses: actions/checkout@v4
51+
with:
52+
persist-credentials: true # We are using these credentials in later steps
53+
54+
- name: setup helm
55+
uses: azure/setup-helm@29960d0f5f19214b88e1d9ba750a9914ab0f1a2f #v4.0.0
56+
57+
- name: render ${{ matrix.chart }} from head ref
58+
id: render_head
59+
run: |
60+
mkdir -p shared/head-charts
61+
git fetch origin "${HEAD_REF}"
62+
git checkout "${HEAD_REF}" --
63+
if [ -f "${MATRIX_CHART}/Chart.yaml" ]; then
64+
helm dependency update "${MATRIX_CHART}"
65+
values_files="${MATRIX_CHART}"/values-*
66+
for values_file in $(basename -a $values_files); do
67+
helm template "${MATRIX_CHART}" -f "${MATRIX_CHART}/values.yaml" -f "${MATRIX_CHART}/${values_file}" --output-dir "shared/head-charts/${MATRIX_CHART}/${values_file}"
68+
done
69+
fi
70+
echo sanitized_name=$(echo "${MATRIX_CHART}" | sed 's/\//-/g') >> $GITHUB_OUTPUT
71+
env:
72+
MATRIX_CHART: ${{ matrix.chart }}
73+
- name: upload artifact
74+
uses: actions/upload-artifact@v4
75+
with:
76+
name: "shared-head-${{ steps.render_head.outputs.sanitized_name }}"
77+
path: "shared"
78+
79+
render_base_ref_charts:
80+
runs-on: ubuntu-latest
81+
needs: get_changed_helm_charts
82+
strategy:
83+
matrix:
84+
chart: ${{ fromJSON(needs.get_changed_helm_charts.outputs.matrix_charts) }}
85+
steps:
86+
- name: checkout repository
87+
uses: actions/checkout@v4
88+
with:
89+
persist-credentials: true # We are using these credentials in later steps
90+
91+
- name: setup helm
92+
uses: azure/setup-helm@29960d0f5f19214b88e1d9ba750a9914ab0f1a2f #v4.0.0
93+
94+
- name: render ${{ matrix.chart }} from base ref
95+
id: render_base
96+
run: |
97+
mkdir -p shared/base-charts
98+
git fetch origin $GITHUB_BASE_REF
99+
git checkout $GITHUB_BASE_REF --
100+
if [ -f "${MATRIX_CHART}/Chart.yaml" ]; then
101+
helm dependency update "${MATRIX_CHART}"
102+
values_files="${MATRIX_CHART}"/values-*
103+
for values_file in $(basename -a $values_files); do
104+
helm template "${MATRIX_CHART}" -f "${MATRIX_CHART}/values.yaml" -f "${MATRIX_CHART}/${values_file}" --output-dir "shared/base-charts/${MATRIX_CHART}/${values_file}"
105+
done
106+
fi
107+
echo sanitized_name=$(echo "${MATRIX_CHART}" | sed 's/\//-/g') >> $GITHUB_OUTPUT
108+
env:
109+
MATRIX_CHART: ${{ matrix.chart }}
110+
GITHUB_BASE_REF: "${{ github.base_ref }}"
111+
112+
- name: upload artifact
113+
uses: actions/upload-artifact@v4
114+
with:
115+
name: "shared-base-${{ steps.render_base.outputs.sanitized_name }}"
116+
path: "shared"
117+
118+
check_pod_security_level:
119+
runs-on: ubuntu-latest
120+
needs:
121+
- get_changed_helm_charts
122+
- render_base_ref_charts
123+
- render_head_ref_charts
124+
steps:
125+
- uses: actions/setup-go@v5
126+
with:
127+
go-version: '>=1.18.0'
128+
- run: go install github.com/mozilla/psa-checker@20becf1189cf776e45a2ea27ea329e2e01de381a
129+
- name: setup helm
130+
uses: azure/setup-helm@29960d0f5f19214b88e1d9ba750a9914ab0f1a2f #v4.0.0
131+
132+
- name: download artifacts
133+
uses: actions/download-artifact@v4
134+
with:
135+
pattern: shared-*
136+
merge-multiple: true
137+
path: "shared"
138+
- name: run psa-checker
139+
id: diff_helm_charts
140+
run: |
141+
for chart in ${CHARTS}; do
142+
echo "$chart" | psa-checker --level ${{ inputs.pss_level }} -f -
143+
fi
144+
done
145+
env:
146+
CHARTS: ${{ needs.get_changed_helm_charts.outputs.charts }}

0 commit comments

Comments
 (0)