Skip to content

Commit dbb7d11

Browse files
oliverbaehlerprometherion
oliverbaehler
authored and
prometherion
committed
feat(all): establish new build process
Signed-off-by: Oliver Bähler <[email protected]>
1 parent adc0d33 commit dbb7d11

25 files changed

+818
-253
lines changed

‎.github/PULL_REQUEST_TEMPLATE.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
<!--
2+
Read the contribution guidelines before creating a pull request.
3+
4+
https://github.com/projectcapsule/capsule-proxy/blob/main/CONTRIBUTING.md
5+
6+
Thanks for spending some time for improving and fixing Capsule!
7+
-->

‎.github/actions/exists/action.yaml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Checks if an input is defined
2+
3+
description: Checks if an input is defined and outputs 'true' or 'false'.
4+
5+
inputs:
6+
value:
7+
description: value to test
8+
required: true
9+
10+
outputs:
11+
result:
12+
description: outputs 'true' or 'false' if input value is defined or not
13+
value: ${{ steps.check.outputs.result }}
14+
15+
runs:
16+
using: composite
17+
steps:
18+
- shell: bash
19+
id: check
20+
run: |
21+
echo "result=${{ inputs.value != '' }}" >> $GITHUB_OUTPUT

‎.github/actions/setup-caches/action.yaml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: Setup caches
2+
3+
description: Setup caches for go modules and build cache.
4+
5+
inputs:
6+
build-cache-key:
7+
description: build cache prefix
8+
9+
runs:
10+
using: composite
11+
steps:
12+
- uses: actions/cache@4723a57e26efda3a62cbde1812113b730952852d # v3.2.2
13+
with:
14+
path: ~/go/pkg/mod
15+
key: ${{ runner.os }}-go-pkg-mod-${{ hashFiles('**/go.sum') }}-${{ hashFiles('Makefile') }}
16+
- uses: actions/cache@4723a57e26efda3a62cbde1812113b730952852d # v3.2.2
17+
if: ${{ inputs.build-cache-key }}
18+
with:
19+
path: ~/.cache/go-build
20+
key: ${{ runner.os }}-build-cache-${{ inputs.build-cache-key }}-${{ hashFiles('**/go.sum') }}-${{ hashFiles('Makefile') }}

‎.github/configs/ct.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
remote: origin
2-
target-branch: master
2+
target-branch: main
33
chart-dirs:
44
- charts
55
helm-extra-args: "--timeout 600s"

‎.github/dependabot.yml

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: gomod
4+
directory: /
5+
schedule:
6+
interval: weekly
7+
rebase-strategy: disabled
8+
commit-message:
9+
prefix: "feat(deps)"
10+
- package-ecosystem: github-actions
11+
directory: /
12+
schedule:
13+
interval: weekly
14+
rebase-strategy: disabled
15+
commit-message:
16+
prefix: "ci(deps)"

‎.github/workflows/check-actions.yml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: Check actions
2+
permissions: {}
3+
4+
on:
5+
pull_request:
6+
branches: [ "*" ]
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
12+
jobs:
13+
check:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
18+
- name: Ensure SHA pinned actions
19+
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@f32435541e24cd6a4700a7f52bb2ec59e80603b1 # v2.1.4
20+
with:
21+
# slsa-github-generator requires using a semver tag for reusable workflows.
22+
# See: https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators
23+
allowlist: |
24+
slsa-framework/slsa-github-generator

‎.github/workflows/check-commit.yml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: Check Commit
2+
permissions: {}
3+
4+
on:
5+
pull_request:
6+
branches: [ "*" ]
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
12+
jobs:
13+
commit_lint:
14+
runs-on: ubuntu-20.04
15+
steps:
16+
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
17+
with:
18+
fetch-depth: 0
19+
- uses: wagoid/commitlint-github-action@6319f54d83768b60acd6fd60e61007ccc583e62f #v5.4.3
20+
with:
21+
firstParent: true

‎.github/workflows/check-pr.yml

+37
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: "Check Pull Request"
2+
3+
on:
4+
pull_request_target:
5+
types:
6+
- opened
7+
- edited
8+
- synchronize
9+
10+
permissions:
11+
pull-requests: write
12+
13+
jobs:
14+
main:
15+
name: Validate PR title
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: amannn/action-semantic-pull-request@47b15d52c5c30e94a17ec87eb8dd51ff5221fed9
19+
env:
20+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
21+
with:
22+
types: |
23+
chore
24+
ci
25+
docs
26+
feat
27+
fix
28+
test
29+
sec
30+
requireScope: false
31+
wip: false
32+
# If the PR only contains a single commit, the action will validate that
33+
# it matches the configured pattern.
34+
validateSingleCommit: true
35+
# Related to `validateSingleCommit` you can opt-in to validate that the PR
36+
# title matches a single commit to avoid confusion.
37+
validateSingleCommitMatchesPrTitle: true

‎.github/workflows/ci.yaml

-23
This file was deleted.

‎.github/workflows/codecov.yml

+38
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Codecov
2+
permissions: {}
3+
4+
on:
5+
pull_request:
6+
branches: [ "main" ]
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.ref }}
10+
cancel-in-progress: true
11+
12+
jobs:
13+
codecov:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
18+
- name: Setup caches
19+
uses: ./.github/actions/setup-caches
20+
timeout-minutes: 5
21+
continue-on-error: true
22+
with:
23+
build-cache-key: codecov
24+
- name: Check secret
25+
id: checksecret
26+
uses: ./.github/actions/exists
27+
with:
28+
value: ${{ secrets.CODECOV_TOKEN }}
29+
- name: Generate Code Coverage Report
30+
if: steps.checksecret.outputs.result == 'true'
31+
run: make test
32+
- name: Upload Report to Codecov
33+
if: steps.checksecret.outputs.result == 'true'
34+
uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3.1.4
35+
with:
36+
file: ./coverage.out
37+
fail_ci_if_error: true
38+
verbose: true

‎.github/workflows/docker-ci.yaml

-97
This file was deleted.

‎.github/workflows/docker-publish.yml

+69
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
name: Publish images
2+
permissions: {}
3+
4+
on:
5+
push:
6+
tags:
7+
- "v*"
8+
9+
concurrency:
10+
group: ${{ github.workflow }}-${{ github.ref }}
11+
cancel-in-progress: true
12+
13+
jobs:
14+
publish-images:
15+
runs-on: ubuntu-latest
16+
permissions:
17+
packages: write
18+
id-token: write
19+
outputs:
20+
capsule-digest: ${{ steps.publish-capsule.outputs.digest }}
21+
steps:
22+
- name: Checkout
23+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
24+
- name: Setup caches
25+
uses: ./.github/actions/setup-caches
26+
timeout-minutes: 5
27+
continue-on-error: true
28+
with:
29+
build-cache-key: publish-images
30+
- name: Run Trivy vulnerability (Repo)
31+
uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # v0.12.0
32+
with:
33+
scan-type: 'fs'
34+
ignore-unfixed: true
35+
format: 'sarif'
36+
output: 'trivy-results.sarif'
37+
severity: 'CRITICAL,HIGH'
38+
- name: Install Cosign
39+
uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2
40+
- name: Publish Capsule
41+
id: publish-capsule
42+
uses: oliverbaehler/github-actions/ko-publish-image@979018716f7d0cbe8d2711f572b350afad4ef211 # v0.1.1
43+
with:
44+
makefile-target: ko-publish-capsule
45+
registry: ghcr.io
46+
registry-username: ${{ github.actor }}
47+
registry-password: ${{ secrets.GITHUB_TOKEN }}
48+
repository: ${{ github.repository_owner }}
49+
version: ${{ github.ref_name }}
50+
sign-image: true
51+
sbom-name: capsule
52+
sbom-repository: ghcr.io/${{ github.repository_owner }}/sbom
53+
signature-repository: ghcr.io/${{ github.repository_owner }}/signatures
54+
main-path: ./
55+
env:
56+
REPOSITORY: ${{ github.repository }}
57+
generate-capsule-provenance:
58+
needs: publish-images
59+
permissions:
60+
id-token: write # To sign the provenance.
61+
packages: write # To upload assets to release.
62+
actions: read # To read the workflow path.
63+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
64+
with:
65+
image: ghcr.io/${{ github.repository_owner }}/capsule
66+
digest: "${{ needs.publish-images.outputs.capsule-digest }}"
67+
registry-username: ${{ github.actor }}
68+
secrets:
69+
registry-password: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)