Skip to content

Commit e6d8a29

Browse files
jiaqiluojiaqiluo
authored
Merge pull request #356 from jiaqiluo/gha-1-28
2 parents 84642f0 + 6a387b6 commit e6d8a29

File tree

7 files changed

+202
-139
lines changed

7 files changed

+202
-139
lines changed

‎.drone.yml‎

Lines changed: 0 additions & 126 deletions
This file was deleted.

‎.github/workflows/fossa.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: Run Fossa Scan
2+
3+
on:
4+
push:
5+
tags:
6+
- '*'
7+
8+
jobs:
9+
fossa:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
contents: read
13+
id-token: write # needed for the Vault authentication
14+
continue-on-error: true # we know that fossa test will report errors
15+
steps:
16+
- name: Load Secrets from Vault
17+
uses: rancher-eio/read-vault-secrets@main
18+
with:
19+
secrets: |
20+
secret/data/github/repo/${{ github.repository }}/fossa/credentials token | FOSSA
21+
- name: Checkout Repo
22+
uses: actions/checkout@v4
23+
- name: Run Fossa analyze
24+
uses: fossas/[email protected]
25+
with:
26+
api-key: ${{ env.FOSSA }}
27+
- name: Run Fossa test
28+
uses: fossas/[email protected]
29+
with:
30+
api-key: ${{ env.FOSSA }}
31+
run-tests: true

‎.github/workflows/release.yaml‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- '*'
7+
8+
env:
9+
IMAGE: rancher/hyperkube
10+
11+
jobs:
12+
build-push-images:
13+
runs-on: ubuntu-latest
14+
permissions:
15+
contents: read
16+
id-token: write # needed for the Vault authentication
17+
strategy:
18+
fail-fast: true
19+
matrix:
20+
os: [linux]
21+
arch: [amd64, arm64]
22+
steps:
23+
- name: Checkout code
24+
uses: actions/checkout@v4
25+
- name: Setup Environment Variables
26+
run: |
27+
echo "ARCH=${{ matrix.arch }}" >> "$GITHUB_ENV"
28+
echo "K8S_VERSION=$( echo ${{ github.ref_name }} | tr -s " " | cut -d "-" -f1 )" >> "$GITHUB_ENV"
29+
- name: Prepare binaries
30+
run: make k8s-binaries
31+
- name: Docker meta
32+
id: meta
33+
uses: docker/metadata-action@v5
34+
with:
35+
images: ${{ env.IMAGE }}
36+
flavor: |
37+
latest=false
38+
- name: Set up QEMU
39+
uses: docker/setup-qemu-action@v3
40+
- name: Set up Docker Buildx
41+
uses: docker/setup-buildx-action@v3
42+
- name: Load Secrets from Vault
43+
uses: rancher-eio/read-vault-secrets@main
44+
with:
45+
secrets: |
46+
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
47+
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD
48+
- name: Login to Docker Hub
49+
uses: docker/login-action@v3
50+
with:
51+
username: ${{ env.DOCKER_USERNAME }}
52+
password: ${{ env.DOCKER_PASSWORD }}
53+
- name: Build and push Docker image
54+
id: build
55+
uses: docker/build-push-action@v5
56+
with:
57+
context: .
58+
push: true
59+
tags: "${{ steps.meta.outputs.tags }}"
60+
platforms: "${{ matrix.os }}/${{ matrix.arch }}"
61+
labels: "${{ steps.meta.outputs.labels }}"
62+
- name: Export digest
63+
run: |
64+
mkdir -p /tmp/digests
65+
digest="${{ steps.build.outputs.digest }}"
66+
touch "/tmp/digests/${digest#sha256:}"
67+
- name: Upload digest
68+
uses: actions/upload-artifact@v4
69+
with:
70+
name: "digests-${{ matrix.os }}-${{ matrix.arch }}"
71+
path: /tmp/digests/*
72+
if-no-files-found: error
73+
retention-days: 7
74+
overwrite: true
75+
76+
merge:
77+
runs-on: ubuntu-latest
78+
needs:
79+
- build-push-images
80+
permissions:
81+
contents: read
82+
id-token: write # needed for the Vault authentication
83+
steps:
84+
- name: Download digests
85+
uses: actions/download-artifact@v4
86+
with:
87+
path: /tmp/digests
88+
pattern: digests-*
89+
merge-multiple: true
90+
- name: Set up Docker Buildx
91+
uses: docker/setup-buildx-action@v3
92+
- name: Docker meta
93+
id: meta
94+
uses: docker/metadata-action@v5
95+
with:
96+
images: ${{ env.IMAGE }}
97+
flavor: |
98+
latest=false
99+
- name: Load Secrets from Vault
100+
uses: rancher-eio/read-vault-secrets@main
101+
with:
102+
secrets: |
103+
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
104+
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD
105+
- name: Login to Docker Hub
106+
uses: docker/login-action@v3
107+
with:
108+
username: ${{ env.DOCKER_USERNAME }}
109+
password: ${{ env.DOCKER_PASSWORD }}
110+
- name: Create manifest list and push
111+
working-directory: /tmp/digests
112+
run: |
113+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
114+
$(printf '${{ env.IMAGE }}@sha256:%s ' *)
115+
- name: Inspect image
116+
run: |
117+
docker buildx imagetools inspect ${{ env.IMAGE }}:${{ steps.meta.outputs.version }}

‎.github/workflows/test-prepare-binaries.yaml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Test Prepare Binaries
2+
3+
on:
4+
push:
5+
branches:
6+
- "*"
7+
pull_request:
8+
9+
jobs:
10+
tests:
11+
runs-on: ubuntu-latest
12+
strategy:
13+
matrix:
14+
arch: [ amd64, arm64 ]
15+
permissions:
16+
contents: read
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v4
20+
- name: Setup Environment Variables
21+
run: |
22+
echo "ARCH=${{ matrix.arch }}" >> "$GITHUB_ENV"
23+
- name: Prepare binaries
24+
run: make k8s-binaries

‎.github/workflows/trivy.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: Run Trivy scan
2+
3+
on:
4+
push:
5+
tags:
6+
- '*'
7+
pull_request:
8+
9+
10+
jobs:
11+
trivy:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
steps:
16+
- name: Checkout Repo
17+
uses: actions/checkout@v4
18+
- name: Get base image
19+
run: |
20+
image=$(grep hyperkube-base Dockerfile | awk '{ print $2 }')
21+
echo "HYPERKUBE=${image}"
22+
echo "HYPERKUBE=${image}" >> "$GITHUB_ENV"
23+
- name: Run Trivy scanner
24+
uses: aquasecurity/[email protected]
25+
with:
26+
image-ref: ${{ env.HYPERKUBE }}
27+
exit-code: '1'
28+
severity: 'CRITICAL,HIGH'

‎.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
k8s-tars/
2-
k8s-binaries/
2+
k8s-binaries/
3+
.idea/

‎manifest.tmpl‎

Lines changed: 0 additions & 12 deletions
This file was deleted.

0 commit comments

Comments
 (0)