Skip to content

Commit 17097a8

Browse files
temblekingtembleking
authored
ci: change release workflow to use nix for reproducible builds (#30)
1 parent efa87ed commit 17097a8

31 files changed

+716
-992
lines changed

‎.envrc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
has nix && use flake
2+
watch_file *.nix
3+
dotenv_if_exists .env # You can create a .env file with your env vars for this project. You can also use .secrets if you are using act. See the line below.
4+
dotenv_if_exists .secrets # Used by [act](https://nektosact.com/) to load secrets into the pipelines

‎.github/git-chglog/CHANGELOG.tpl.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{{ range .Versions }}
2+
{{ range .CommitGroups -}}
3+
### {{ .Title }}
4+
5+
{{ range .Commits -}}
6+
* {{ if .Scope }}**{{ .Scope }}:** {{ end }}{{ .Subject }}
7+
{{ end }}
8+
{{ end -}}
9+
10+
{{- if .RevertCommits -}}
11+
### Reverts
12+
13+
{{ range .RevertCommits -}}
14+
* {{ .Revert.Header }}
15+
{{ end }}
16+
{{ end -}}
17+
18+
{{- if .NoteGroups -}}
19+
{{ range .NoteGroups -}}
20+
### {{ .Title }}
21+
22+
{{ range .Notes }}
23+
{{ .Body }}
24+
{{ end }}
25+
{{ end -}}
26+
{{ end -}}
27+
{{ end -}}

‎.github/git-chglog/config.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
style: github
2+
template: CHANGELOG.tpl.md
3+
info:
4+
title: CHANGELOG
5+
repository_url: https://github.com/sysdiglabs/harbor-scanner-sysdig-secure
6+
options:
7+
commits:
8+
# filters:
9+
# Type:
10+
# - feat
11+
# - fix
12+
# - perf
13+
# - refactor
14+
commit_groups:
15+
title_maps:
16+
feat: Features
17+
fix: Bug Fixes
18+
perf: Performance Improvements
19+
refactor: Code Refactoring
20+
ci: Continuous Integration
21+
docs: Documentation
22+
chore: Small Modifications
23+
build: Compilation & Dependencies
24+
header:
25+
pattern: "^(\\w*)(?:\\(([\\w\\$\\.\\-\\*\\s]*)\\))?\\:\\s(.*)$"
26+
pattern_maps:
27+
- Type
28+
- Scope
29+
- Subject
30+
notes:
31+
keywords:
32+
- BREAKING CHANGE

‎.github/workflows/ci.yaml‎

Lines changed: 52 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -1,66 +1,70 @@
1-
name: CI
1+
name: CI - Pull Request
22

33
on:
44
pull_request:
55
branches:
66
- master
7-
push:
8-
branches:
9-
- master
107

118
jobs:
12-
build-and-test:
13-
name: Build and Test
9+
lint:
10+
name: Lint
1411
runs-on: ubuntu-latest
15-
12+
defaults:
13+
run:
14+
shell: nix develop --command bash {0}
1615
steps:
17-
- name: Set up Go
18-
uses: actions/setup-go@v2
19-
with:
20-
go-version: ^1.16
16+
- name: Fetch code
17+
uses: actions/checkout@v4
2118

22-
- name: Check out code
23-
uses: actions/checkout@v2
19+
- name: Install nix
20+
uses: DeterminateSystems/nix-installer-action@main
2421

25-
- name: Cache Go modules
26-
uses: actions/cache@v3
27-
with:
28-
path: |
29-
~/.cache/go-build
30-
~/go/pkg/mod
31-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
32-
restore-keys: |
33-
${{ runner.os }}-go-
22+
- name: Configure Nix cache
23+
uses: DeterminateSystems/magic-nix-cache-action@main
3424

35-
- name: Get dependencies
36-
run: |
37-
go get -v -t -d ./...
38-
go install github.com/onsi/ginkgo/[email protected]
25+
- name: Run lint
26+
run: |
27+
just lint
3928
40-
- name: Build
41-
run: go build ./...
29+
pre-commit:
30+
name: Pre-commit
31+
runs-on: ubuntu-latest
32+
defaults:
33+
run:
34+
shell: nix develop --command bash {0}
35+
steps:
36+
- name: Fetch code
37+
uses: actions/checkout@v4
4238

43-
- name: Test
44-
run: make test
45-
env:
46-
SECURE_API_TOKEN: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
47-
SECURE_URL: ${{ vars.SECURE_URL }}
39+
- name: Install nix
40+
uses: DeterminateSystems/nix-installer-action@main
4841

49-
docker:
50-
name: Build Docker Image
51-
runs-on: ubuntu-latest
52-
needs: build-and-test
42+
- name: Configure Nix cache
43+
uses: DeterminateSystems/magic-nix-cache-action@main
5344

45+
- name: Run pre-commit
46+
run: |
47+
pre-commit run -a
48+
49+
build-and-test:
50+
name: Build and test
51+
runs-on: ubuntu-latest
52+
defaults:
53+
run:
54+
shell: nix develop --command bash {0}
5455
steps:
55-
- name: Check out code
56-
uses: actions/checkout@v2
56+
- name: Fetch code
57+
uses: actions/checkout@v4
58+
59+
- name: Install nix
60+
uses: DeterminateSystems/nix-installer-action@main
61+
62+
- name: Configure Nix cache
63+
uses: DeterminateSystems/magic-nix-cache-action@main
5764

58-
- name: Build and push Docker image
59-
uses: docker/build-push-action@v1
60-
with:
61-
username: ${{ secrets.SYSDIGLABS_DOCKERHUB_USER }}
62-
password: ${{ secrets.SYSDIGLABS_DOCKERHUB_TOKEN }}
63-
repository: sysdiglabs/harbor-scanner-sysdig-secure
64-
dockerfile: build/Dockerfile
65-
add_git_labels: true
66-
tags: ci
65+
- name: Run tests
66+
run: |
67+
just test
68+
env:
69+
SECURE_API_TOKEN: ${{ secrets.KUBELAB_SECURE_API_TOKEN }}
70+
SECURE_URL: ${{ vars.SECURE_URL }}

‎.github/workflows/release.yaml‎

Lines changed: 110 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,117 @@
1-
name: Release
1+
name: Release new version
22

33
on:
44
push:
5-
tags:
6-
- v*
7-
5+
branches:
6+
- master
7+
paths:
8+
- package.nix
89
jobs:
9-
release:
10+
get-newer-version:
1011
runs-on: ubuntu-latest
12+
outputs:
13+
new-version: ${{ steps.check.outputs.new_version }}
14+
steps:
15+
- name: Checkout repository
16+
uses: actions/checkout@v4
17+
with:
18+
fetch-tags: true
19+
fetch-depth: 0
20+
21+
- name: Extract version from package.nix
22+
id: extract
23+
run: |
24+
VERSION=$(grep -m1 'version\s*=' package.nix | sed -E 's/.*version\s*=\s*"([^"]+)".*/\1/')
25+
echo "Extracted version: $VERSION"
26+
echo "version=$VERSION" >> $GITHUB_OUTPUT
27+
28+
- name: Get latest tag
29+
id: latest
30+
run: |
31+
LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "none")
32+
echo "Latest tag: $LATEST_TAG"
33+
echo "latest_tag=$LATEST_TAG" >> $GITHUB_OUTPUT
34+
35+
- name: Check if version is new
36+
id: check
37+
run: |
38+
VERSION="${{ steps.extract.outputs.version }}"
39+
LATEST="${{ steps.latest.outputs.latest_tag }}"
40+
if [ "v$VERSION" = "$LATEST" ]; then
41+
echo "No new version detected."
42+
echo "new_version=" >> $GITHUB_OUTPUT
43+
else
44+
echo "New version detected: $VERSION"
45+
echo "new_version=$VERSION" >> $GITHUB_OUTPUT
46+
fi
1147
48+
build-push-dockerhub:
49+
name: Build and Push to DockerHub
50+
needs: [ get-newer-version ]
51+
if: needs.get-newer-version.outputs.new-version != ''
52+
runs-on: ubuntu-latest
1253
steps:
13-
- uses: actions/checkout@v2
14-
15-
- name: Extract tag name
16-
id: tag
17-
run: echo ::set-output name=VERSION::$(echo "${{ github.ref }}" | sed -e 's/.*\/v\(.*\)/\1/')
18-
19-
- name: Create release
20-
id: create_release
21-
uses: actions/create-release@v1
22-
env:
23-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
24-
with:
25-
tag_name: ${{ github.ref }}
26-
release_name: ${{ github.ref }}
27-
draft: true
28-
prerelease: false
29-
body: |
30-
This is the ${{ github.ref }} release of Harbor Scanner Adapter for Sysdig Secure
31-
32-
### Major Changes
33-
### Minor Changes
34-
### Bug fixes
35-
36-
- name: Build and push Docker image
37-
uses: docker/build-push-action@v1
38-
with:
39-
username: ${{ secrets.SYSDIGLABS_DOCKERHUB_USER }}
40-
password: ${{ secrets.SYSDIGLABS_DOCKERHUB_TOKEN }}
41-
repository: sysdiglabs/harbor-scanner-sysdig-secure
42-
add_git_labels: true
43-
dockerfile: build/Dockerfile
44-
tags: latest, ${{ steps.tag.outputs.VERSION }}
54+
- name: Checkout code
55+
uses: actions/checkout@v4
56+
57+
- name: Install Nix
58+
uses: DeterminateSystems/nix-installer-action@main
59+
60+
- name: Configure Nix cache
61+
uses: DeterminateSystems/magic-nix-cache-action@main
62+
63+
- name: Build
64+
run: nix build -L .#harbor-adapter-docker
65+
66+
- name: Load in docker
67+
run: |
68+
docker load -i ./result
69+
docker tag sysdiglabs/harbor-scanner-sysdig-secure:${{ needs.get-newer-version.outputs.new-version }} sysdiglabs/harbor-scanner-sysdig-secure:latest
70+
docker images
71+
72+
- name: Login to Docker Hub
73+
uses: docker/login-action@v3
74+
with:
75+
username: ${{ secrets.SYSDIGLABS_DOCKERHUB_USER }}
76+
password: ${{ secrets.SYSDIGLABS_DOCKERHUB_TOKEN }}
77+
78+
- name: Push to Docker Hub
79+
run: |
80+
docker push sysdiglabs/harbor-scanner-sysdig-secure:${{ needs.get-newer-version.outputs.new-version }}
81+
docker push sysdiglabs/harbor-scanner-sysdig-secure:latest
82+
83+
release:
84+
name: Create release at Github
85+
needs: [ get-newer-version ]
86+
if: needs.get-newer-version.outputs.new-version != ''
87+
runs-on: ubuntu-latest
88+
permissions:
89+
contents: write # Required for release creation
90+
steps:
91+
- uses: actions/checkout@v4
92+
with:
93+
fetch-depth: 0
94+
fetch-tags: true
95+
96+
- name: Install Nix
97+
uses: DeterminateSystems/nix-installer-action@main
98+
99+
- name: Configure Nix cache
100+
uses: DeterminateSystems/magic-nix-cache-action@main
101+
102+
- name: Install git-chglog
103+
run: nix profile install nixpkgs#git-chglog
104+
105+
- name: Tag with version v${{ needs.get-newer-version.outputs.new-version }}
106+
run: git tag v${{ needs.get-newer-version.outputs.new-version }}
107+
108+
- name: Generate changelog
109+
run: git-chglog -c .github/git-chglog/config.yml -o RELEASE_CHANGELOG.md $(git describe --tags $(git rev-list --tags --max-count=1))
110+
111+
- name: Create release
112+
uses: softprops/action-gh-release@v2
113+
with:
114+
name: v${{ needs.get-newer-version.outputs.new-version }}
115+
tag_name: v${{ needs.get-newer-version.outputs.new-version }}
116+
prerelease: false
117+
body_path: RELEASE_CHANGELOG.md

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,6 @@
1616
# vendor/
1717

1818
.idea
19+
.direnv/
20+
.secrets
21+
result

‎.pre-commit-config.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
repos:
2+
- repo: https://github.com/pre-commit/pre-commit-hooks
3+
rev: v5.0.0
4+
hooks:
5+
- id: trailing-whitespace
6+
- id: check-yaml
7+
args:
8+
- --allow-multiple-documents
9+
- --unsafe
10+
- id: no-commit-to-branch
11+
- repo: https://github.com/python-jsonschema/check-jsonschema
12+
rev: 0.33.0
13+
hooks:
14+
- id: check-github-workflows
15+
- repo: local
16+
hooks:
17+
- id: format
18+
pass_filenames: false
19+
name: Go fmt
20+
entry: just fmt
21+
language: system
22+
- id: lint
23+
pass_filenames: false
24+
name: Go lint
25+
entry: just lint
26+
language: system
27+
- id: check_vulns
28+
pass_filenames: false
29+
name: Check vulnerabilities
30+
entry: trivy fs . --exit-code 1 --ignore-unfixed --quiet
31+
language: system

0 commit comments

Comments
 (0)