From c5438b53010cdaa539996d7768ea1268f42b90a9 Mon Sep 17 00:00:00 2001 From: Nikos Date: Tue, 17 Oct 2023 20:33:05 +0300 Subject: [PATCH 1/3] ci: add repo initial files --- .gitignore | 21 +++++++++++++++++++++ CODEOWNERS | 1 + CONTRIBUTING.md | 9 +++++++++ renovate.json | 18 ++++++++++++++++++ 4 files changed, 49 insertions(+) create mode 100644 .gitignore create mode 100644 CODEOWNERS create mode 100644 CONTRIBUTING.md create mode 100644 renovate.json diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..559c7c9 --- /dev/null +++ b/.gitignore @@ -0,0 +1,21 @@ +openfga_*.rock + +# IntelliJ project files +.idea +*.iml +out +gen + +# VisualStudioCode template +.vscode/* +!.vscode/settings.json +!.vscode/tasks.json +!.vscode/launch.json +!.vscode/extensions.json +!.vscode/*.code-snippets + +# Local History for Visual Studio Code +.history/ + +# Built Visual Studio Code Extensions +*.vsix \ No newline at end of file diff --git a/CODEOWNERS b/CODEOWNERS new file mode 100644 index 0000000..ffeec6e --- /dev/null +++ b/CODEOWNERS @@ -0,0 +1 @@ +* @canonical/identity diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md new file mode 100644 index 0000000..cd05496 --- /dev/null +++ b/CONTRIBUTING.md @@ -0,0 +1,9 @@ +# Contributing + +## Build and deploy + +```bash +rockcraft pack -v +sudo skopeo --insecure-policy copy oci-archive:./openfga_1.3.3_amd64.rock docker-daemon:openfga:latest +docker run openfga:latest +``` diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..d87ccae --- /dev/null +++ b/renovate.json @@ -0,0 +1,18 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:base", + ":disableDependencyDashboard", + ":automergeDigest", + ":automergePatch", + ":automergeMinor", + ":rebaseStalePrs", + ":semanticCommits", + ":semanticCommitScope(deps)", + "helpers:pinGitHubActionDigests" + ], + "automergeType": "pr", + "rebaseWhen": "behind-base-branch", + "automerge": true, + "additionalBranchPrefix": "auto-" +} \ No newline at end of file From 44d2c6339d25e78317289ce7ebd5fc8c17b81cfb Mon Sep 17 00:00:00 2001 From: Nikos Date: Tue, 17 Oct 2023 20:33:27 +0300 Subject: [PATCH 2/3] ci: add github worklows --- .github/.jira_sync_config.yaml | 18 ++++++++++++ .github/workflows/auto-approver.yaml | 24 ++++++++++++++++ .github/workflows/build.yaml | 37 ++++++++++++++++++++++++ .github/workflows/publish.yaml | 43 ++++++++++++++++++++++++++++ .github/workflows/push_any.yaml | 16 +++++++++++ .github/workflows/push_main.yaml | 27 +++++++++++++++++ .github/workflows/scan.yaml | 30 +++++++++++++++++++ 7 files changed, 195 insertions(+) create mode 100644 .github/.jira_sync_config.yaml create mode 100644 .github/workflows/auto-approver.yaml create mode 100644 .github/workflows/build.yaml create mode 100644 .github/workflows/publish.yaml create mode 100644 .github/workflows/push_any.yaml create mode 100644 .github/workflows/push_main.yaml create mode 100644 .github/workflows/scan.yaml diff --git a/.github/.jira_sync_config.yaml b/.github/.jira_sync_config.yaml new file mode 100644 index 0000000..270968a --- /dev/null +++ b/.github/.jira_sync_config.yaml @@ -0,0 +1,18 @@ +# From https://github.com/canonical/gh-jira-sync-bot#client-side-configuration +settings: + jira_project_key: "IAM" + status_mapping: + opened: Untriaged + closed: done + components: + - OpenFGA + labels: + - bug + - enhancement + add_gh_comment: true + sync_description: true + sync_comments: true + epic_key: "IAM-471" + label_mapping: + enhancement: Story + bug: Bug diff --git a/.github/workflows/auto-approver.yaml b/.github/workflows/auto-approver.yaml new file mode 100644 index 0000000..ac90c42 --- /dev/null +++ b/.github/workflows/auto-approver.yaml @@ -0,0 +1,24 @@ +name: auto-approver +run-name: CI for approving PRs + +on: + push: + branches: + - "renovate/**" + +jobs: + autoapprove: + runs-on: ubuntu-22.04 + steps: + - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4 + - name: Approve PR + run: | + gh pr review --approve || true + env: + GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }} + - name: Enable automerge if required + if: startsWith(github.ref_name, 'renovate/auto-') + run: | + gh pr merge --auto --merge || true + env: + GITHUB_TOKEN: ${{ secrets.PAT_TOKEN }} diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml new file mode 100644 index 0000000..2e3ad31 --- /dev/null +++ b/.github/workflows/build.yaml @@ -0,0 +1,37 @@ +# Build the rock +name: Build + +on: + workflow_call: + +jobs: + build: + runs-on: ubuntu-22.04 + steps: + - name: Checkout repository + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4 + + - name: Get name + id: name + run: echo "name=$(yq '.name' rockcraft.yaml)" >> "$GITHUB_OUTPUT" + + - uses: canonical/craft-actions/rockcraft-pack@main + id: rockcraft + + - name: Install Syft + run: | + curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin + + - name: Create SBOM + run: syft ${{ steps.rockcraft.outputs.rock }} -o spdx-json=${{ steps.name.outputs.name }}.sbom.json + + - name: Upload SBOM + uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3 + with: + name: ${{ steps.name.outputs.name }}-sbom + path: "${{ steps.name.outputs.name }}.sbom.json" + + - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3 + with: + name: rock + path: ${{ steps.rockcraft.outputs.rock }} diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml new file mode 100644 index 0000000..fc8e436 --- /dev/null +++ b/.github/workflows/publish.yaml @@ -0,0 +1,43 @@ +# Publish the rock image to ghcr +name: Publish + +on: + workflow_call: + +jobs: + publish: + runs-on: ubuntu-22.04 + steps: + - name: Checkout repository + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4 + + - name: Log in to the Container registry + uses: docker/login-action@b4bedf8053341df3b5a9f9e0f2cf4e79e27360c6 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Install skopeo + run: | + sudo snap install --devmode --channel edge skopeo + + - name: Install yq + run: | + sudo snap install yq + + - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3 + with: + name: rock + + - name: Import and push to github package + run: | + image_name="$(yq '.name' rockcraft.yaml)" + version="$(yq '.version' rockcraft.yaml)" + rock_file=$(ls *.rock | tail -n 1) + sudo skopeo \ + --insecure-policy \ + copy \ + oci-archive:"${rock_file}" \ + docker-daemon:"ghcr.io/canonical/${image_name}:${version}" + docker push ghcr.io/canonical/${image_name}:${version} diff --git a/.github/workflows/push_any.yaml b/.github/workflows/push_any.yaml new file mode 100644 index 0000000..6e80374 --- /dev/null +++ b/.github/workflows/push_any.yaml @@ -0,0 +1,16 @@ +name: Push (any) + +# When pushing to any branch other than "main", we: +# * build the rock image + +on: + push: + branches-ignore: + - "main" + paths: + - "rockcraft.yaml" + - ".github/workflows/**.yaml" + +jobs: + build: + uses: ./.github/workflows/build.yaml diff --git a/.github/workflows/push_main.yaml b/.github/workflows/push_main.yaml new file mode 100644 index 0000000..1b97527 --- /dev/null +++ b/.github/workflows/push_main.yaml @@ -0,0 +1,27 @@ +name: Push (main) + +# When pushing to the "main" branch, we: +# * build the rock image +# * publish the image +# * scan the image and upload the artifacts to the repository + +on: + push: + branches: + - main + paths: + - "rockcraft.yaml" + - ".github/workflows/**.yaml" + workflow_dispatch: + +jobs: + build: + uses: ./.github/workflows/build.yaml + + publish: + needs: build + uses: ./.github/workflows/publish.yaml + + scan: + needs: publish + uses: ./.github/workflows/scan.yaml diff --git a/.github/workflows/scan.yaml b/.github/workflows/scan.yaml new file mode 100644 index 0000000..6705460 --- /dev/null +++ b/.github/workflows/scan.yaml @@ -0,0 +1,30 @@ +# Scan the published rock image and upload the results +name: Scan + +on: + workflow_call: + +jobs: + scan: + runs-on: ubuntu-22.04 + steps: + - name: Checkout repository + uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4 + + - name: Get name and version + id: image_info + run: | + echo "image_name=$(yq '.name' rockcraft.yaml)" >> "$GITHUB_OUTPUT" + echo "version=$(yq '.version' rockcraft.yaml)" >> "$GITHUB_OUTPUT" + + - name: Scan image with Trivy + uses: aquasecurity/trivy-action@master + with: + image-ref: "ghcr.io/canonical/${{ steps.image_info.outputs.image_name }}:${{ steps.image_info.outputs.version }}" + format: 'sarif' + output: 'trivy-results.sarif' + + - name: Upload scan results to GitHub + uses: github/codeql-action/upload-sarif@fdcae64e1484d349b3366718cdfef3d404390e85 # v2 + with: + sarif_file: 'trivy-results.sarif' From 9e6eb0be97b3670507bfeb57e7e30f7fb0dcc07a Mon Sep 17 00:00:00 2001 From: Nikos Date: Tue, 17 Oct 2023 20:33:44 +0300 Subject: [PATCH 3/3] build: add rockcraft.yaml --- rockcraft.yaml | 63 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 rockcraft.yaml diff --git a/rockcraft.yaml b/rockcraft.yaml new file mode 100644 index 0000000..09f5668 --- /dev/null +++ b/rockcraft.yaml @@ -0,0 +1,63 @@ +name: openfga +base: bare +build-base: ubuntu:22.04 +version: "1.3.3" +summary: Openfga Authorization Server +description: | + OpenFGA is a flexible Authorization system inspired by Google's Zanzibar, designed for reliability and low latency at scale. +license: Apache-2.0 +run-user: _daemon_ +platforms: + amd64: + +services: + openfga: + override: replace + command: openfga run + startup: disabled +checks: + up: + override: replace + level: alive + exec: + command: grpc_health_probe -addr localhost:8081 + + +parts: + util: + plugin: nil + stage-packages: + # This is needed to pipe the stdout/stderr to a file for log forwarding + - coreutils + prime: + - usr/bin/tee + + shell: + plugin: nil + stage-packages: + # This is needed to pipe the stdout/stderr to a file for log forwarding + - dash + + openfga: + plugin: go + build-snaps: + - go/1.21/stable + build-environment: + - CGO_ENABLED: 0 + source: https://github.com/openfga/openfga + source-type: git + source-tag: v1.3.3 + override-build: | + go build -o ${CRAFT_PART_INSTALL}/bin/openfga ./cmd/openfga + + grpc_health_probe: + plugin: go + build-snaps: + - go/1.21/stable + build-environment: + - CGO_ENABLED: 0 + source: https://github.com/grpc-ecosystem/grpc-health-probe + source-type: git + source-tag: v0.4.21 + override-build: | + go build -a -tags netgo -ldflags=-w -o ${CRAFT_PART_INSTALL}/bin/grpc_health_probe