Cleanup ci and add trivy #1239
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,31 +1,55 @@ | ||
| name: CI | ||
| on: | ||
| pull_request: | ||
| pull_request_target: | ||
| workflow_call: | ||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| check-signed-commits: | ||
| name: Check signed commits in PR | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| pull-requests: write | ||
| steps: | ||
| - name: Check signed commits in PR | ||
| uses: 1Password/check-signed-commits-action@v1 | ||
|
|
||
| security_scan: | ||
| name: Security Scan | ||
| runs-on: ubuntu-22.04 | ||
| timeout-minutes: 45 | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
|
|
||
| with: | ||
| fetch-tags: true | ||
| fetch-depth: 0 | ||
|
|
||
| - name: Run govulncheck | ||
| uses: golang/govulncheck-action@v1 | ||
|
|
||
| - name: Run Trivy vulnerability scanner in repo mode | ||
| uses: aquasecurity/[email protected] | ||
| with: | ||
| scan-type: 'fs' | ||
| ignore-unfixed: true | ||
| format: 'table' | ||
| # output: 'trivy-results.sarif' # TODO(ale8k) Turn on when uploading to gh and change above line to sarif | ||
| severity: 'CRITICAL' | ||
| exit-code: '1' | ||
|
|
||
| # TODO(ale8k): Setup GH security | ||
| # - name: Upload Trivy scan results to GitHub Security tab | ||
| # uses: github/codeql-action/upload-sarif@v2 | ||
| # with: | ||
| # sarif_file: 'trivy-results.sarif' | ||
|
|
||
| build_test: | ||
| name: Build and Test | ||
| runs-on: ubuntu-22.04 | ||
| timeout-minutes: 45 | ||
| needs: [security_scan] | ||
| steps: | ||
| - uses: actions/checkout@v4 | ||
| with: | ||
|
|
@@ -60,6 +84,7 @@ jobs: | |
| smoke_test: | ||
| name: Smoke Test | ||
| runs-on: ubuntu-22.04 | ||
| needs: [security_scan] | ||
| # The docker compose has a healthcheck on the JIMM container. | ||
| # So if the compose returns with exit code 0 then the JIMM server successfully started. | ||
| steps: | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,4 @@ | ||
| name: Release Server ROCK | ||
|
|
||
| on: | ||
| # Note that when running via workflow_dispatch, the github.ref_name | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,31 @@ | ||
| name: Release Snaps | ||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| push: | ||
| tags: | ||
| - 'v3*' | ||
|
|
||
| jobs: | ||
| build-and-release-jimmctl: | ||
| uses: ./.github/workflows/snap-release.yaml | ||
ale8k marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| with: | ||
| folder: jimmctl | ||
| release-channel: 3/edge | ||
| secrets: inherit | ||
|
|
||
| build-and-release-jaas-plugin: | ||
| uses: ./.github/workflows/snap-release.yaml | ||
ale8k marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| with: | ||
| folder: jaas | ||
| release-channel: 3/edge | ||
| secrets: inherit | ||
|
|
||
| build-and-release-jimm-server: | ||
| uses: ./.github/workflows/snap-release.yaml | ||
|
There was a problem hiding this comment. It's a composite workflow, cannot be named |
||
| with: | ||
| jobs: build # Only build, this snap isn't released to snapcraft | ||
| folder: jimm | ||
| release-channel: 3/edge # Not used for this snap | ||
| secrets: inherit | ||
|
|
||
|
There was a problem hiding this comment. Shouldn't this be moved to the actions folder like you suggested? There was a problem hiding this comment. no no, i was gonna break it into one actions but not really any point after looking at them, think composite workflow is fine .. if we break into one action we can't use "jobs" param to run up to a point as you know, it's just a single action... |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why have we removed this?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I haven't I just moved it into CI
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah it's in the CI job. I think that's a bad idea because of the
pull_request_targetkeywordThere was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why do you think it's a bad idea?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Checkout this SO post https://stackoverflow.com/questions/74957218/what-is-the-difference-between-pull-request-and-pull-request-target-event-in-git
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
How would moving it back protect us?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
actions/labeler#121 (comment) ?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Idk if I'm understanding correctly, but if they made a pr regardless and it wanted to get secrets, doesn't seem to matter where the job is, it's just the fact you're using that trigger? So our solution is to remove the use of it?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
From the SO post,
I believe this means that the CI job will not check the code from your fork, so the test will pass not because your code is necessarily correct but because the test will check out code from e.g.
v3JIMM.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Not really sure what you mean? Let's move this to MM.