Skip to content

Commit 17d923a

Browse files
mythimythi
authored
Merge pull request #1511 from tkatila/workflows/rework-trivy-publish
workflows: rework, trivy & publish
2 parents 0d8c686 + ff32f36 commit 17d923a

File tree

13 files changed

+481
-152
lines changed

13 files changed

+481
-152
lines changed

‎.github/workflows/ci.yaml

Lines changed: 14 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -2,142 +2,29 @@ name: CI
22
on:
33
push:
44
branches:
5-
- main
65
- 'release-*'
76
pull_request:
87
branches:
98
- main
109
- 'release-*'
11-
env:
12-
K8S_VERSION: 1.27.1
1310
permissions:
1411
contents: read
12+
pull-requests: read
1513

1614
jobs:
15+
trivy:
16+
uses: "./.github/workflows/lib-trivy.yaml"
1717

18-
docs:
19-
name: Check docs are buildable
20-
runs-on: ubuntu-22.04
21-
steps:
22-
- name: Install dependencies
23-
run: |
24-
sudo apt-get update
25-
sudo apt-get install -y python3-venv
26-
- uses: actions/checkout@v3
27-
with:
28-
fetch-depth: 0
29-
- name: Set up doc directory
30-
run: |
31-
mkdir $HOME/output
32-
touch $HOME/output/.nojekyll
33-
- name: Build latest
34-
run: |
35-
GITHUB_SHA=$(git rev-parse HEAD)
36-
export GITHUB_SHA
37-
rm -rf _work/venv
38-
make vhtml
39-
mv _build/html/* $HOME/output/
40-
41-
golangci:
42-
permissions:
43-
contents: read # for actions/checkout to fetch code
44-
pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
45-
name: lint
46-
runs-on: ubuntu-22.04
47-
steps:
48-
- uses: actions/checkout@v3
49-
- uses: actions/setup-go@v4
50-
with:
51-
go-version-file: go.mod
52-
check-latest: true
53-
- name: golangci-lint
54-
uses: golangci/golangci-lint-action@v3
55-
with:
56-
version: v1.52.1
57-
args: -v --timeout 5m
18+
validate:
19+
uses: "./.github/workflows/lib-validate.yaml"
5820

5921
build:
60-
name: Build and check device plugins
61-
runs-on: ubuntu-22.04
62-
steps:
63-
- uses: actions/checkout@v3
64-
- uses: actions/setup-go@v4
65-
with:
66-
go-version-file: go.mod
67-
check-latest: true
68-
- name: Check Dockerfiles
69-
run: make check-dockerfiles
70-
- run: make go-mod-tidy
71-
- run: make BUILDTAGS=kerneldrv
72-
- run: make test BUILDTAGS=kerneldrv
73-
- name: Install envtest tool and run envtest
74-
run: |
75-
go install sigs.k8s.io/controller-runtime/tools/setup-envtest@latest
76-
setup-envtest use ${K8S_VERSION}
77-
- run: |
78-
KUBEBUILDER_ASSETS=$(setup-envtest use -i -p path ${K8S_VERSION}) make envtest
79-
- run: make check-github-actions
80-
- name: Codecov report
81-
run: bash <(curl -s https://codecov.io/bash)
82-
83-
image:
84-
name: Build image
85-
runs-on: ubuntu-22.04
86-
strategy:
87-
matrix:
88-
image:
89-
- intel-fpga-admissionwebhook
90-
- intel-fpga-initcontainer
91-
- intel-gpu-fakedev
92-
- intel-gpu-initcontainer
93-
- intel-gpu-plugin
94-
- intel-fpga-plugin
95-
- intel-qat-initcontainer
96-
- intel-qat-plugin
97-
- intel-qat-plugin-kerneldrv
98-
- intel-deviceplugin-operator
99-
- intel-sgx-admissionwebhook
100-
- intel-sgx-plugin
101-
- intel-sgx-initcontainer
102-
- intel-dsa-plugin
103-
- intel-iaa-plugin
104-
- intel-idxd-config-initcontainer
105-
- intel-dlb-plugin
106-
- intel-dlb-initcontainer
107-
- intel-xpumanager-sidecar
108-
109-
# Demo images
110-
- crypto-perf
111-
- accel-config-demo
112-
- intel-opencl-icd
113-
- opae-nlb-demo
114-
- openssl-qat-engine
115-
- sgx-sdk-demo
116-
- sgx-aesmd-demo
117-
- dlb-dpdk-demo
118-
- dlb-libdlb-demo
119-
builder: [buildah, docker]
120-
steps:
121-
- uses: actions/checkout@v3
122-
- uses: actions/setup-go@v4
123-
- run: make -e vendor
124-
- name: Build image
125-
env:
126-
IMAGE_NAME: ${{ matrix.image }}
127-
BUILDER_NAME: ${{ matrix.builder }}
128-
run: |
129-
make ${IMAGE_NAME} BUILDER=${BUILDER_NAME}
130-
131-
terrascan:
132-
runs-on: ubuntu-22.04
133-
steps:
134-
- name: Checkout repository
135-
uses: actions/checkout@v3
136-
- name: Install terrascan
137-
run: |
138-
curl -sL "$(curl -sL https://github.com/api/repos/tenable/terrascan/releases/latest | grep -o -E "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz
139-
tar -xf terrascan.tar.gz terrascan && rm terrascan.tar.gz
140-
install terrascan /usr/local/bin && rm terrascan
141-
- name: Run Terrascan
142-
run: make terrascan
143-
22+
needs:
23+
- trivy
24+
- validate
25+
uses: "./.github/workflows/lib-build.yaml"
26+
27+
e2e:
28+
needs:
29+
- build
30+
uses: "./.github/workflows/lib-e2e.yaml"

‎.github/workflows/devel.yaml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
name: Devel
2+
on:
3+
push:
4+
branches:
5+
- main
6+
permissions:
7+
contents: read
8+
pull-requests: read
9+
security-events: write
10+
11+
jobs:
12+
trivy:
13+
uses: "./.github/workflows/lib-trivy.yaml"
14+
with:
15+
upload-to-github-security-tab: true
16+
17+
validate:
18+
uses: "./.github/workflows/lib-validate.yaml"
19+
20+
build:
21+
needs:
22+
- validate
23+
- trivy
24+
uses: "./.github/workflows/lib-build.yaml"
25+
26+
e2e:
27+
needs:
28+
- build
29+
uses: "./.github/workflows/lib-e2e.yaml"
30+
31+
# devel image push
32+
publish:
33+
needs:
34+
- e2e
35+
- build
36+
uses: "./.github/workflows/lib-publish.yaml"
37+
secrets: inherit

‎.github/workflows/e2e.yaml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: e2e
2+
on:
3+
schedule:
4+
- cron: '0 4 * * *'
5+
6+
permissions:
7+
contents: read
8+
pull-requests: read
9+
10+
jobs:
11+
e2e:
12+
uses: "./.github/workflows/lib-e2e.yaml"

‎.github/workflows/lib-build.yaml

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: build
2+
on:
3+
workflow_call:
4+
jobs:
5+
image:
6+
name: Build image
7+
runs-on: ubuntu-22.04
8+
strategy:
9+
matrix:
10+
image:
11+
- intel-fpga-admissionwebhook
12+
- intel-fpga-initcontainer
13+
- intel-gpu-fakedev
14+
- intel-gpu-initcontainer
15+
- intel-gpu-plugin
16+
- intel-fpga-plugin
17+
- intel-qat-initcontainer
18+
- intel-qat-plugin
19+
- intel-qat-plugin-kerneldrv
20+
- intel-deviceplugin-operator
21+
- intel-sgx-admissionwebhook
22+
- intel-sgx-plugin
23+
- intel-sgx-initcontainer
24+
- intel-dsa-plugin
25+
- intel-iaa-plugin
26+
- intel-idxd-config-initcontainer
27+
- intel-dlb-plugin
28+
- intel-dlb-initcontainer
29+
- intel-xpumanager-sidecar
30+
31+
# # Demo images
32+
- crypto-perf
33+
- accel-config-demo
34+
- intel-opencl-icd
35+
- opae-nlb-demo
36+
- openssl-qat-engine
37+
- sgx-sdk-demo
38+
- sgx-aesmd-demo
39+
- dlb-dpdk-demo
40+
- dlb-libdlb-demo
41+
builder: [buildah, docker]
42+
steps:
43+
- uses: actions/checkout@v3
44+
- uses: actions/setup-go@v4
45+
- run: make -e vendor
46+
- name: Build image
47+
env:
48+
IMAGE_NAME: ${{ matrix.image }}
49+
BUILDER_NAME: ${{ matrix.builder }}
50+
run: |
51+
make ${IMAGE_NAME} BUILDER=${BUILDER_NAME}

‎.github/workflows/e2e.yml renamed to ‎.github/workflows/lib-e2e.yaml

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,6 @@
11
name: e2e
22
on:
3-
workflow_dispatch:
4-
schedule:
5-
- cron: '0 4 * * *'
6-
pull_request:
7-
branches:
8-
- main
9-
- 'release-*'
10-
push:
11-
branches:
12-
- main
13-
- 'release-*'
3+
workflow_call:
144

155
permissions:
166
contents: read

‎.github/workflows/lib-publish.yaml

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: publish
2+
on:
3+
workflow_call:
4+
inputs:
5+
image_tag:
6+
default: "devel"
7+
required: false
8+
type: string
9+
jobs:
10+
image:
11+
name: Build image
12+
runs-on: ubuntu-22.04
13+
strategy:
14+
matrix:
15+
image:
16+
- intel-fpga-admissionwebhook
17+
- intel-fpga-initcontainer
18+
- intel-gpu-initcontainer
19+
- intel-gpu-plugin
20+
- intel-fpga-plugin
21+
- intel-qat-initcontainer
22+
- intel-qat-plugin
23+
- intel-qat-plugin-kerneldrv
24+
- intel-deviceplugin-operator
25+
- intel-sgx-admissionwebhook
26+
- intel-sgx-plugin
27+
- intel-sgx-initcontainer
28+
- intel-dsa-plugin
29+
- intel-iaa-plugin
30+
- intel-idxd-config-initcontainer
31+
- intel-dlb-plugin
32+
- intel-dlb-initcontainer
33+
- intel-xpumanager-sidecar
34+
35+
# # Demo images
36+
- crypto-perf
37+
- opae-nlb-demo
38+
steps:
39+
- uses: actions/checkout@v3
40+
- uses: actions/setup-go@v4
41+
- run: make -e vendor
42+
- name: Build image
43+
env:
44+
IMAGE_NAME: ${{ matrix.image }}
45+
run: |
46+
REG=intel/ make ${IMAGE_NAME} BUILDER=docker
47+
- name: Trivy scan for image
48+
uses: aquasecurity/trivy-action@master
49+
with:
50+
scan-type: image
51+
image-ref: intel/${{ matrix.image }}:${{ inputs.image_tag }}
52+
exit-code: 1
53+
- name: Test image base layer
54+
run: IMG=intel/${{ matrix.image }}:${{ inputs.image_tag }} make test-image-base-layer BUILDER=docker
55+
- name: Login
56+
uses: docker/login-action@v2
57+
with:
58+
username: ${{ secrets.DOCKERHUB_USER }}
59+
password: ${{ secrets.DOCKERHUB_PASS }}
60+
- name: Push
61+
run: docker push intel/${{ matrix.image }}:${{ inputs.image_tag }}

0 commit comments

Comments
 (0)