Skip to content

Commit afc390d

Browse files
oliverbaehleroliverbaehler
authored
sec(release): release sboms and signatures in same repository as artefact (#640)
* feat(helm): change cert-gen job image Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * sec(release): release sboms and signatures in same repository as artefact Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * ci(helm): update workflows and correct testing Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * ci(helm): update workflows and correct testing Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * ci(helm): update workflows and correct testing Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * ci(test): fix helm testing and golint Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> * ci(test): fix helm testing and golint Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com> --------- Signed-off-by: Oliver Bähler <oliverbaehler@hotmail.com>
1 parent cd47a88 commit afc390d

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+1413
-487
lines changed

‎.github/ISSUE_TEMPLATE/config.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@ blank_issues_enabled: false
22
contact_links:
33
- name: Chat on Slack
44
url: https://kubernetes.slack.com/archives/C03GETTJQRL
5-
about: Maybe chatting with the community can help
5+
about: Maybe chatting with the community can help

‎.github/actions/exists/action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,4 @@ runs:
1818
- shell: bash
1919
id: check
2020
run: |
21-
echo "result=${{ inputs.value != '' }}" >> $GITHUB_OUTPUT
21+
echo "result=${{ inputs.value != '' }}" >> $GITHUB_OUTPUT

‎.github/actions/setup-caches/action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,4 @@ runs:
1717
if: ${{ inputs.build-cache-key }}
1818
with:
1919
path: ~/.cache/go-build
20-
key: ${{ runner.os }}-build-cache-${{ inputs.build-cache-key }}-${{ hashFiles('**/go.sum') }}-${{ hashFiles('Makefile') }}
20+
key: ${{ runner.os }}-build-cache-${{ inputs.build-cache-key }}-${{ hashFiles('**/go.sum') }}-${{ hashFiles('Makefile') }}

‎.github/configs/ct.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@ remote: origin
22
target-branch: main
33
chart-dirs:
44
- charts
5-
helm-extra-args: "--timeout 600s"
5+
helm-extra-args: "--timeout 600s"
66
validate-chart-schema: false
77
validate-maintainers: false
88
validate-yaml: true
99
exclude-deprecated: true
10-
check-version-increment: false
10+
check-version-increment: false

‎.github/configs/lintconf.yaml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
---
2+
ignore:
3+
- config/
4+
- charts/*/templates/
5+
- charts/**/templates/
26
rules:
7+
truthy:
8+
level: warning
9+
check-keys: false
310
braces:
411
min-spaces-inside: 0
512
max-spaces-inside: 0
@@ -38,5 +45,3 @@ rules:
3845
new-lines:
3946
type: unix
4047
trailing-spaces: enable
41-
truthy:
42-
level: warning

‎.github/workflows/check-actions.yml‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ permissions: {}
33

44
on:
55
pull_request:
6-
branches: [ "*" ]
6+
branches:
7+
- "*"
78

89
concurrency:
910
group: ${{ github.workflow }}-${{ github.ref }}
@@ -18,7 +19,7 @@ jobs:
1819
- name: Ensure SHA pinned actions
1920
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@c3a2b64f69b7a1542a68f44d9edbd9ec3fc1455e # v3.0.20
2021
with:
21-
# slsa-github-generator requires using a semver tag for reusable workflows.
22+
# slsa-github-generator requires using a semver tag for reusable workflows.
2223
# See: https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators
2324
allowlist: |
24-
slsa-framework/slsa-github-generator
25+
slsa-framework/slsa-github-generator

‎.github/workflows/check-commit.yml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ permissions: {}
33

44
on:
55
pull_request:
6-
branches: [ "*" ]
6+
branches:
7+
- "*"
78

89
concurrency:
910
group: ${{ github.workflow }}-${{ github.ref }}
@@ -16,6 +17,4 @@ jobs:
1617
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1718
with:
1819
fetch-depth: 0
19-
- uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1
20-
with:
21-
firstParent: true
20+
- uses: wagoid/commitlint-github-action@3d28780bbf0365e29b144e272b2121204d5be5f3 # v6.1.2

‎.github/workflows/codecov.yml‎

Lines changed: 0 additions & 38 deletions
This file was deleted.

‎.github/workflows/coverage.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
name: Coverage
2+
3+
on:
4+
push:
5+
branches:
6+
- "main"
7+
pull_request:
8+
types: [opened, reopened, synchronize]
9+
branches:
10+
- "main"
11+
12+
concurrency:
13+
group: ${{ github.workflow }}-${{ github.ref }}
14+
cancel-in-progress: true
15+
16+
jobs:
17+
compliance:
18+
name: "License Compliance"
19+
runs-on: ubuntu-24.04
20+
steps:
21+
- name: "Checkout Code"
22+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
23+
- name: Check secret
24+
id: checksecret
25+
uses: ./.github/actions/exists
26+
with:
27+
value: ${{ secrets.FOSSA_API_KEY }}
28+
- name: "Run FOSSA Scan"
29+
if: steps.checksecret.outputs.result == 'true'
30+
uses: fossas/fossa-action@93a52ecf7c3ac7eb40f5de77fd69b1a19524de94 # v1.5.0
31+
with:
32+
api-key: ${{ secrets.FOSSA_API_KEY }}
33+
- name: "Run FOSSA Test"
34+
if: steps.checksecret.outputs.result == 'true'
35+
uses: fossas/fossa-action@93a52ecf7c3ac7eb40f5de77fd69b1a19524de94 # v1.5.0
36+
with:
37+
api-key: ${{ secrets.FOSSA_API_KEY }}
38+
run-tests: true
39+
sast:
40+
name: "SAST"
41+
runs-on: ubuntu-24.04
42+
env:
43+
GO111MODULE: on
44+
permissions:
45+
security-events: write
46+
actions: read
47+
contents: read
48+
steps:
49+
- name: Checkout Source
50+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
51+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
52+
with:
53+
go-version-file: 'go.mod'
54+
- name: Run Gosec Security Scanner
55+
uses: securego/gosec@e0cca6fe95306b7e7790d6f1bf6a7bec6d622459 # v2.22.0
56+
with:
57+
args: '-no-fail -fmt sarif -out gosec.sarif ./...'
58+
- name: Upload SARIF file
59+
uses: github/codeql-action/upload-sarif@24e1c2d337459cce262cbca8d69998e56cd5eb8e
60+
with:
61+
sarif_file: gosec.sarif
62+
unit_tests:
63+
name: "Unit tests"
64+
runs-on: ubuntu-24.04
65+
steps:
66+
- name: Checkout
67+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
68+
- uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
69+
with:
70+
go-version-file: 'go.mod'
71+
- name: Unit Test
72+
run: make test
73+
- name: Check secret
74+
id: checksecret
75+
uses: ./.github/actions/exists
76+
with:
77+
value: ${{ secrets.CODECOV_TOKEN }}
78+
- name: Upload Report to Codecov
79+
if: ${{ steps.checksecret.outputs.result == 'true' }}
80+
uses: codecov/codecov-action@13ce06bfc6bbe3ecf90edbbf1bc32fe5978ca1d3 # v5.3.1
81+
with:
82+
token: ${{ secrets.CODECOV_TOKEN }}
83+
slug: projectcapsule/capsule-proxy
84+
files: ./coverage.out
85+
fail_ci_if_error: true
86+
verbose: true

‎.github/workflows/docker-build.yml‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: Build images
2+
permissions: {}
3+
on:
4+
pull_request:
5+
branches:
6+
- "main"
7+
paths:
8+
- '.github/workflows/docker-*.yml'
9+
- 'api/**'
10+
- 'controllers/**'
11+
- 'pkg/**'
12+
- 'e2e/*'
13+
- '.ko.yaml'
14+
- 'go.*'
15+
- 'main.go'
16+
- 'Makefile'
17+
18+
jobs:
19+
build-images:
20+
runs-on: ubuntu-latest
21+
permissions:
22+
security-events: write
23+
actions: read
24+
contents: read
25+
steps:
26+
- name: Checkout
27+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
- name: ko build
29+
run: VERSION=${{ github.sha }} make ko-build-all
30+
- name: Trivy Scan Image
31+
uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # v0.29.0
32+
with:
33+
scan-type: 'fs'
34+
ignore-unfixed: true
35+
format: 'sarif'
36+
output: 'trivy-results.sarif'
37+
severity: 'CRITICAL,HIGH'
38+
env:
39+
# Trivy is returning TOOMANYREQUESTS
40+
# See: https://github.com/aquasecurity/trivy-action/issues/389#issuecomment-2385416577
41+
TRIVY_DB_REPOSITORY: 'public.ecr.aws/aquasecurity/trivy-db:2'
42+
- name: Upload Trivy scan results to GitHub Security tab
43+
uses: github/codeql-action/upload-sarif@24e1c2d337459cce262cbca8d69998e56cd5eb8e
44+
with:
45+
sarif_file: 'trivy-results.sarif'

0 commit comments

Comments
 (0)