-
Notifications
You must be signed in to change notification settings - Fork 157
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(chart): release security and workflow updates
- Loading branch information
1 parent
c30de4b
commit 6cdcc48
Showing
7 changed files
with
169 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| name: Publish charts | ||
| permissions: read-all | ||
| on: | ||
| push: | ||
| tags: [ "helm-v*" ] | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| publish-helm: | ||
| # Skip this Release on forks | ||
| if: github.repository_owner == 'capsuleproject' | ||
| runs-on: ubuntu-20.04 | ||
| steps: | ||
| - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 | ||
| - name: Publish Helm chart | ||
| uses: stefanprodan/helm-gh-pages@0ad2bb377311d61ac04ad9eb6f252fb68e207260 # v1.7.0 | ||
| with: | ||
| token: "${{ secrets.GITHUB_TOKEN }}" | ||
| linting: off | ||
| charts_dir: charts | ||
| charts_url: https://${{ github.repository_owner }}.github.io/charts | ||
| owner: ${{ github.repository_owner }} | ||
| repository: charts | ||
| branch: gh-pages | ||
| commit_username: ${{ github.actor }} | ||
| publish-helm-oci: | ||
| runs-on: ubuntu-20.04 | ||
| permissions: | ||
| contents: write | ||
| id-token: write | ||
| packages: write | ||
| outputs: | ||
| chart-digest: ${{ steps.helm_publish.outputs.digest }} | ||
| steps: | ||
| - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 | ||
| - uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # v3.1.2 | ||
| - name: Helm | Publish | ||
| id: helm_publish | ||
| uses: oliverbaehler/github-actions/helm-oci-chart@8dfd42735c85f6c58d5d4d6f3232cd0e39d1fe73 # v0.1.0 | ||
| with: | ||
| registry: ghcr.io | ||
| repository: ${{ github.repository_owner }}/charts | ||
| name: "capsule" | ||
| registry-username: ${{ github.actor }} | ||
| registry-password: ${{ secrets.GITHUB_TOKEN }} | ||
| update-dependencies: 'true' # Defaults to false | ||
| sign-image: 'true' | ||
| signature-repository: ghcr.io/${{ github.repository_owner }}/signatures | ||
| helm-provenance: | ||
| needs: publish-helm-oci | ||
| permissions: | ||
| id-token: write # To sign the provenance. | ||
| packages: write # To upload assets to release. | ||
| actions: read # To read the workflow path. | ||
| uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected] | ||
| with: | ||
| image: ghcr.io/${{ github.repository_owner }}/charts/capsule | ||
| digest: "${{ needs.publish-helm-oci.outputs.chart-digest }}" | ||
| registry-username: ${{ github.actor }} | ||
| secrets: | ||
| registry-password: ${{ secrets.GITHUB_TOKEN }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| name: Test charts | ||
| permissions: {} | ||
|
|
||
| on: | ||
| pull_request: | ||
| branches: [ "main" ] | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }}-${{ github.ref }} | ||
| cancel-in-progress: true | ||
|
|
||
| jobs: | ||
| lint: | ||
| runs-on: ubuntu-20.04 | ||
| steps: | ||
| - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 | ||
| with: | ||
| fetch-depth: 0 | ||
| - uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # v3 | ||
| - name: Linting Chart | ||
| run: helm lint ./charts/capsule | ||
| - name: Setup Chart Linting | ||
| id: lint | ||
| uses: helm/chart-testing-action@e8788873172cb653a90ca2e819d79d65a66d4e76 # v2.4.0 | ||
| - name: Run chart-testing (list-changed) | ||
| id: list-changed | ||
| run: | | ||
| changed=$(ct list-changed --config ./.github/configs/ct.yaml) | ||
| if [[ -n "$changed" ]]; then | ||
| echo "::set-output name=changed::true" | ||
| fi | ||
| - name: Run chart-testing (lint) | ||
| run: ct lint --debug --config ./.github/configs/ct.yaml --lint-conf ./.github/configs/lintconf.yaml | ||
| - name: Run docs-testing (helm-docs) | ||
| id: helm-docs | ||
| run: | | ||
| make helm-docs | ||
| if [[ $(git diff --stat) != '' ]]; then | ||
| echo -e '\033[0;31mDocumentation outdated! (Run make helm-docs locally and commit)\033[0m ❌' | ||
| git diff --color | ||
| exit 1 | ||
| else | ||
| echo -e '\033[0;32mDocumentation up to date\033[0m ✔' | ||
| fi | ||
| # ATTENTION: This is a workaround for the upcoming ApiVersion Conversions for the capsule CRDs | ||
| # With this workflow the current docker image is build and loaded into kind, otherwise the install fails | ||
| # In the future this must be removed and the chart-testing-action must be used | ||
| - name: Run chart-testing (install) | ||
| run: make helm-test | ||
| if: steps.list-changed.outputs.changed == 'true' | ||
|
|
||
| ## Create KIND Cluster | ||
| - name: Create kind cluster | ||
| uses: helm/kind-action@dda0770415bac9fc20092cacbc54aa298604d140 # v1.8.0 | ||
| if: steps.list-changed.outputs.changed == 'true' | ||
| # Install Required Operators/CRDs | ||
| - name: Prepare Cluster Operators/CRDs | ||
| run: | | ||
| # Cert-Manager CRDs | ||
| kubectl create -f https://github.com/cert-manager/cert-manager/releases/download/v1.9.1/cert-manager.crds.yaml | ||
| # Prometheus CRDs | ||
| kubectl create -f https://github.com/prometheus-operator/prometheus-operator/releases/download/v0.58.0/bundle.yaml | ||
| if: steps.list-changed.outputs.changed == 'true' | ||
| # Install Charts | ||
| - name: Run chart-testing (install) | ||
| run: ct install --debug --config ./.github/configs/ct.yaml | ||
| if: steps.list-changed.outputs.changed == 'true' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters