Skip to content

Commit ab640ee

Browse files
DariuszPorowskiDariuszPorowski
authored
ci(workflows): pin actions to full sha (#84)
* ci(workflows): pin actions to full sha Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> * ci(dependabot): add configuration for GitHub Actions updates Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> * fix: add missing steps to install oras Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com> --------- Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
1 parent 376be38 commit ab640ee

File tree

5 files changed

+157
-87
lines changed

5 files changed

+157
-87
lines changed

‎.github/dependabot.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# yaml-language-server: $schema=https://www.schemastore.org/dependabot-2.0.json
2+
# See GitHub's documentation for more information on this file:
3+
# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
4+
---
5+
version: 2
6+
7+
updates:
8+
- package-ecosystem: github-actions
9+
directory: /
10+
schedule:
11+
interval: weekly
12+
commit-message:
13+
prefix: ci
14+
include: scope
15+
groups:
16+
all:
17+
patterns:
18+
- "*"

‎.github/workflows/devops-board.yaml‎

Lines changed: 16 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
2+
---
13
name: Sync issue to Azure DevOps work item
24

35
on:
@@ -23,27 +25,31 @@ jobs:
2325
# Auth using Azure Service Principals was added as a part of v2.3
2426
# reference: https://github.com/danhellem/github-actions-issue-to-work-item/pull/143
2527
- name: Login to Azure
26-
uses: azure/login@v2
28+
uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
2729
with:
2830
client-id: ${{ vars.AZURE_SP_DEVOPS_SYNC_CLIENT_ID }}
2931
tenant-id: ${{ vars.AZURE_SP_DEVOPS_SYNC_TENANT_ID }}
3032
allow-no-subscriptions: true
33+
3134
- name: Get Azure DevOps token
3235
id: get_ado_token
3336
run:
3437
# The resource ID for Azure DevOps is always 499b84ac-1321-427f-aa17-267ca6975798
3538
# https://learn.microsoft.com/azure/devops/integrate/get-started/authentication/service-principal-managed-identity
36-
echo "ADO_TOKEN=$(az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query "accessToken" --output tsv)" >> $GITHUB_ENV
39+
ADO_TOKEN=$(az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query "accessToken" --output tsv)
40+
echo "::add-mask::$ADO_TOKEN"
41+
echo "ADO_TOKEN=$ADO_TOKEN" >> $GITHUB_ENV
42+
3743
- name: Sync issue to Azure DevOps
38-
uses: danhellem/github-actions-issue-to-work-item@v2.3
44+
uses: danhellem/github-actions-issue-to-work-item@8d0ead9b49a65aa66dac6949b1ff149d7ef8b4de # v2.5
3945
env:
4046
ado_token: ${{ env.ADO_TOKEN }}
41-
github_token: '${{ secrets.GH_RAD_CI_BOT_PAT }}'
42-
ado_organization: 'azure-octo'
43-
ado_project: 'Incubations'
47+
github_token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
48+
ado_organization: azure-octo
49+
ado_project: Incubations
4450
ado_area_path: "Incubations\\Radius"
4551
ado_iteration_path: "Incubations\\Radius"
46-
ado_new_state: 'New'
47-
ado_active_state: 'Active'
48-
ado_close_state: 'Closed'
49-
ado_wit: 'GitHub Issue'
52+
ado_new_state: New
53+
ado_active_state: Active
54+
ado_close_state: Closed
55+
ado_wit: GitHub Issue

‎.github/workflows/publish-recipes.yaml‎

Lines changed: 81 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# Licensed under the Apache License, Version 2.0 (the "License");
55
# you may not use this file except in compliance with the License.
66
# You may obtain a copy of the License at
7-
#
7+
#
88
# http://www.apache.org/licenses/LICENSE-2.0
99
#
1010
# Unless required by applicable law or agreed to in writing, software
@@ -14,6 +14,8 @@
1414
# limitations under the License.
1515
# ------------------------------------------------------------
1616

17+
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
18+
---
1719
name: Publish Recipes
1820

1921
on:
@@ -39,29 +41,35 @@ jobs:
3941
contents: read
4042
packages: write
4143
steps:
42-
- name: Check out repo
43-
uses: actions/checkout@v3
44-
- name: Parse release version and set environment variables
45-
run: python ./.github/scripts/get_release_version.py
46-
- name: Set up ORAS
47-
uses: oras-project/setup-oras@v1
48-
with:
49-
version: '1.2.0'
50-
- name: Verify ORAS installation
51-
run: oras version
52-
- name: Download rad CLI
53-
run: |
54-
echo "Downloading latest rad CLI"
55-
wget -q "${{ env.RAD_CLI_URL }}" -O - | /bin/bash -s edge
56-
- name: Login to GitHub Container Registry
57-
uses: docker/login-action@v2
58-
with:
59-
registry: ghcr.io
60-
username: ${{ github.actor }}
61-
password: ${{ secrets.GITHUB_TOKEN }}
62-
- name: Publish Recipes to GHCR
63-
# Uses REL_VERSION as the recipe version so PR builds result in a `pr-<pr number>` tag
64-
run: ./.github/scripts/publish-recipes.sh radius-project dev/recipes ${{ env.REL_VERSION }}
44+
- name: Check out repo
45+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
46+
47+
- name: Parse release version and set environment variables
48+
run: python ./.github/scripts/get_release_version.py
49+
50+
- name: Set up ORAS
51+
uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
52+
with:
53+
version: "1.2.0"
54+
55+
- name: Verify ORAS installation
56+
run: oras version
57+
58+
- name: Download rad CLI
59+
run: |
60+
echo "Downloading latest rad CLI"
61+
wget -q "${{ env.RAD_CLI_URL }}" -O - | /bin/bash -s edge
62+
63+
- name: Login to GitHub Container Registry
64+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
65+
with:
66+
registry: ghcr.io
67+
username: ${{ github.actor }}
68+
password: ${{ secrets.GITHUB_TOKEN }}
69+
70+
- name: Publish Recipes to GHCR
71+
# Uses REL_VERSION as the recipe version so PR builds result in a `pr-<pr number>` tag
72+
run: ./.github/scripts/publish-recipes.sh radius-project dev/recipes ${{ env.REL_VERSION }}
6573

6674
delete-dev:
6775
name: Delete GHCR recipes - Dev
@@ -72,55 +80,64 @@ jobs:
7280
contents: read
7381
packages: write
7482
steps:
75-
- name: Check out repo
76-
uses: actions/checkout@v3
77-
- name: Parse release version and set environment variables
78-
run: python ./.github/scripts/get_release_version.py
79-
- name: Login to GitHub Container Registry
80-
uses: docker/login-action@v2
81-
with:
82-
registry: ghcr.io
83-
username: ${{ github.actor }}
84-
password: ${{ secrets.GITHUB_TOKEN }}
85-
- name: Delete Recipes from GHCR
86-
# Uses REL_VERSION as the recipe version so PR builds result in a `pr-<pr number>` tag
87-
run: ./.github/scripts/delete-recipes.sh radius-project dev/recipes ${{ env.REL_VERSION }}
83+
- name: Check out repo
84+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
85+
86+
- name: Parse release version and set environment variables
87+
run: python ./.github/scripts/get_release_version.py
88+
89+
- name: Login to GitHub Container Registry
90+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
91+
with:
92+
registry: ghcr.io
93+
username: ${{ github.actor }}
94+
password: ${{ secrets.GITHUB_TOKEN }}
95+
96+
- name: Delete Recipes from GHCR
97+
# Uses REL_VERSION as the recipe version so PR builds result in a `pr-<pr number>` tag
98+
run: ./.github/scripts/delete-recipes.sh radius-project dev/recipes ${{ env.REL_VERSION }}
8899

89100
# This is where we can add integration tests in the future
90101

91102
publish-public:
92103
if: github.event_name != 'pull_request'
93104
name: Publish Recipes to GHCR - Public
94105
runs-on: ubuntu-latest
95-
environment:
106+
environment:
96107
name: Public
97108
permissions:
98109
contents: read
99110
packages: write
100111
steps:
101-
- name: Check out repo
102-
uses: actions/checkout@v3
103-
- name: Parse release version and set environment variables
104-
run: python ./.github/scripts/get_release_version.py
105-
- name: Set up ORAS
106-
uses: oras-project/setup-oras@v1
107-
with:
108-
version: '1.2.0'
109-
- name: Verify ORAS installation
110-
run: oras version
111-
- name: Download rad CLI
112-
run: |
113-
echo "Downloading latest rad CLI"
114-
wget -q "${{ env.RAD_CLI_URL }}" -O - | /bin/bash -s edge
115-
- name: Login to GitHub Container Registry
116-
uses: docker/login-action@v2
117-
with:
118-
registry: ghcr.io
119-
username: ${{ github.actor }}
120-
password: ${{ secrets.GITHUB_TOKEN }}
121-
- name: Publish Recipes to GHCR
122-
run: |
123-
./.github/scripts/publish-recipes.sh radius-project recipes ${{ env.REL_CHANNEL }}
124-
if [ "${{ env.REL_TAG }}" != "${{ env.REL_CHANNEL }}" ]; then
125-
./.github/scripts/publish-recipes.sh radius-project recipes ${{ env.REL_TAG }}
126-
fi
112+
- name: Check out repo
113+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
114+
115+
- name: Parse release version and set environment variables
116+
run: python ./.github/scripts/get_release_version.py
117+
118+
- name: Set up ORAS
119+
uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
120+
with:
121+
version: "1.2.0"
122+
123+
- name: Verify ORAS installation
124+
run: oras version
125+
126+
- name: Download rad CLI
127+
run: |
128+
echo "Downloading latest rad CLI"
129+
wget -q "${{ env.RAD_CLI_URL }}" -O - | /bin/bash -s edge
130+
131+
- name: Login to GitHub Container Registry
132+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
133+
with:
134+
registry: ghcr.io
135+
username: ${{ github.actor }}
136+
password: ${{ secrets.GITHUB_TOKEN }}
137+
138+
- name: Publish Recipes to GHCR
139+
run: |
140+
./.github/scripts/publish-recipes.sh radius-project recipes ${{ env.REL_CHANNEL }}
141+
if [ "${{ env.REL_TAG }}" != "${{ env.REL_CHANNEL }}" ]; then
142+
./.github/scripts/publish-recipes.sh radius-project recipes ${{ env.REL_TAG }}
143+
fi

‎.github/workflows/test.yaml‎

Lines changed: 33 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,15 @@
1+
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
2+
---
13
name: Test Recipes
24

35
on:
46
workflow_dispatch:
5-
inputs:
6-
version:
7-
description: 'Radius version number to use (e.g. 0.1.0, 0.1.0-rc1, edge). Defaults to edge.'
8-
required: false
9-
default: 'edge'
10-
type: string
7+
inputs:
8+
version:
9+
description: "Radius version number to use (e.g. 0.1.0, 0.1.0-rc1, edge). Defaults to edge."
10+
required: false
11+
default: "edge"
12+
type: string
1113
push:
1214
branches:
1315
- v*.*
@@ -17,10 +19,12 @@ on:
1719
- ".github/workflows/**"
1820
pull_request:
1921
types: [opened, synchronize, reopened]
22+
2023
env:
2124
RUN_IDENTIFIER: recipestest-${{ github.run_id }}-${{ github.run_attempt }}
2225
APP_NAME: local-dev-recipe-app
2326
APP_NAMESPACE: local-dev-recipe-app
27+
2428
jobs:
2529
test:
2630
name: "Recipe tests"
@@ -31,21 +35,35 @@ jobs:
3135
run: |
3236
# Set output variables to be used in the other jobs
3337
echo "RUN_IDENTIFIER=${RUN_IDENTIFIER}" >> $GITHUB_OUTPUT
38+
3439
- name: Checkout code
35-
uses: actions/checkout@v3
40+
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
41+
3642
- name: Setup Node
37-
uses: actions/setup-node@v3
43+
uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
3844
with:
3945
node-version: 16
46+
4047
- name: Download k3d
4148
run: wget -q -O - https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash
49+
4250
- name: Create k3d cluster
4351
# Map localhost port 80 on the external load balancer, and disable traefik and the internal load balancer.
4452
run: k3d cluster create --agents 2 -p "80:80@loadbalancer" --k3s-arg "--disable=traefik@server:*" --k3s-arg "--disable=servicelb@server:*" --registry-create reciperegistry:51351
53+
4554
- name: Install Dapr
4655
run: |
4756
helm repo add dapr https://dapr.github.io/helm-charts/
4857
helm install dapr dapr/dapr --version=1.12 --namespace dapr-system --create-namespace --wait
58+
59+
- name: Install ORAS
60+
uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
61+
with:
62+
version: "1.2.0"
63+
64+
- name: Verify ORAS installation
65+
run: oras version
66+
4967
- name: Download rad CLI
5068
run: |
5169
RADIUS_VERSION="${{ inputs.version }}"
@@ -54,6 +72,7 @@ jobs:
5472
fi
5573
chmod +x ./.github/scripts/install-radius.sh
5674
./.github/scripts/install-radius.sh $RADIUS_VERSION
75+
5776
- name: Publish Recipes
5877
run: |
5978
files_list=$(ls "local-dev" | grep '\.bicep$')
@@ -62,6 +81,7 @@ jobs:
6281
recipeName="${file%.*}"
6382
rad bicep publish --file local-dev/$file --target br:localhost:51351/recipes/local-dev/$recipeName:latest --plain-http
6483
done
84+
6585
- name: Initialize default environment
6686
run: |
6787
rad install kubernetes --set rp.publicEndpointOverride=localhost
@@ -70,14 +90,17 @@ jobs:
7090
rad group switch default
7191
rad env create default
7292
rad env switch default
93+
7394
- name: Deploy app
7495
id: deploy-app
7596
run: rad deploy ./tests/test-local-dev-recipes.bicep --parameters magpieimage="ghcr.io/radius-project/magpiego:latest" --parameters registry="reciperegistry:5000" --parameters version="latest"
97+
7698
- name: Wait for all pods to be ready
7799
id: wait-for-pods
78100
run: |
79101
label="radapp.io/application=${APP_NAME}"
80102
kubectl rollout status deployment -l $label -n ${APP_NAMESPACE} --timeout=90s
103+
81104
- name: Get Pod logs for failed tests
82105
id: get-pod-logs
83106
if: failure() && (steps.deploy-app.outcome == 'failure' || steps.wait-for-pods.outcome == 'failure')
@@ -93,8 +116,9 @@ jobs:
93116
echo "Pod logs saved to recipe-tests/pod-logs/local_dev_recipe_test_container_logs/"
94117
# Get kubernetes events and save to file
95118
kubectl get events -n ${APP_NAMESPACE} > recipe-tests/pod-logs/local_dev_recipe_test_container_logs/events.txt
119+
96120
- name: Upload Pod logs for failed tests
97-
uses: actions/upload-artifact@v3
121+
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
98122
if: failure() && steps.get-pod-logs.outcome == 'success'
99123
with:
100124
name: local_dev_recipe_test_container_logs-pod-logs

0 commit comments

Comments
 (0)