ci: sign images with cosign #6433
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Test | |
| # This workflow will run on master branch and on any pull requests targeting master | |
| on: | |
| push: | |
| branches: | |
| - master | |
| paths: | |
| - '**' | |
| - '!docs/**' | |
| - '!*.md' | |
| - '!.github/**' | |
| - '.github/workflows/docs.yaml' | |
| - '!codespell/**' | |
| - 'LICENSE' | |
| - 'PROJECT' | |
| pull_request: | |
| branches: | |
| - master | |
| - release-* | |
| types: | |
| - opened | |
| - reopened | |
| - synchronize | |
| - ready_for_review | |
| - converted_to_draft | |
| paths: | |
| - '**' | |
| - '!docs/**' | |
| - '!*.md' | |
| - '!.github/**' | |
| - '.github/workflows/docs.yaml' | |
| - '!codespell/**' | |
| - 'LICENSE' | |
| - 'PROJECT' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| build: | |
| name: Build and Test | |
| runs-on: ubuntu-latest | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| checks: write | |
| steps: | |
| - name: Free space | |
| run: | | |
| # cleanup up space to free additional ~20GiB of memory | |
| # which are lacking for multiplaform images build | |
| formatByteCount() { echo $(numfmt --to=iec-i --suffix=B --padding=7 $1'000'); } | |
| getAvailableSpace() { echo $(df -a $1 | awk 'NR > 1 {avail+=$4} END {print avail}'); } | |
| BEFORE=$(getAvailableSpace) | |
| sudo rm -rf /usr/local/lib/android || true | |
| sudo rm -rf /usr/share/dotnet || true | |
| sudo rm -rf /opt/ghc || true | |
| sudo rm -rf /usr/local/.ghcup || true | |
| AFTER=$(getAvailableSpace) | |
| SAVED=$((AFTER-BEFORE)) | |
| echo "Saved $(formatByteCount $SAVED)" | |
| - name: Checkout code | |
| uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98 | |
| - name: Prepare binary cache | |
| uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 | |
| with: | |
| path: ./bin | |
| key: binary | |
| - name: Setup Go | |
| uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 | |
| with: | |
| go-version-file: "go.mod" | |
| check-latest: true | |
| cache: true | |
| id: go | |
| - name: Run Trivy vulnerability scanner in repo mode | |
| uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 | |
| with: | |
| scan-type: "fs" | |
| ignore-unfixed: true | |
| format: "sarif" | |
| output: "trivy-results.sarif" | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@c6f931105cb2c34c8f901cc885ba1e2e259cf745 | |
| with: | |
| sarif_file: "trivy-results.sarif" | |
| - name: Set output variables | |
| id: vars | |
| run: | | |
| IMAGE_TAG=${GITHUB_SHA:0:7} | |
| echo "IMAGE_TAG=$IMAGE_TAG" >> $GITHUB_OUTPUT | |
| - name: Lint, Test and Build | |
| if: github.event.pull_request.draft == false | |
| env: | |
| DOCKER_BUILD_ARGS: --cache-from=type=gha --cache-to=type=gha,mode=max | |
| TAG: ${{ steps.vars.outputs.IMAGE_TAG }} | |
| LICENSE_KEY: ${{ secrets.ENTERPRISE_COMPONENTS_LICENSE_KEY }} | |
| run: | | |
| sudo apt update | |
| sudo apt install -y libgpgme-dev | |
| make lint | |
| make manifests | |
| make api-gen | |
| make docs | |
| # check for uncommited changes to crds, docs or API | |
| git diff --exit-code | |
| make test | |
| git fetch origin ${{ github.base_ref || 'master' }} | |
| BASE_REF=origin/${{ github.base_ref || 'master' }} TAG=${TAG} make test-e2e | |
| - name: Publish Test Report | |
| uses: mikepenz/action-junit-report@49b2ca06f62aa7ef83ae6769a2179271e160d8e4 | |
| if: success() || failure() | |
| with: | |
| report_paths: 'report.xml' | |
| - name: Generate Allure Report | |
| if: github.event.pull_request.draft == false && failure() | |
| run: make allure-report | |
| - name: Archive Allure report | |
| if: github.event.pull_request.draft == false && failure() | |
| uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f | |
| with: | |
| name: allure-report | |
| path: ./allure-report |