build: v1.37.2 release #8308
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_call: | |
| inputs: | |
| run_all: | |
| description: "Run all checks (ignore path filtering)" | |
| required: false | |
| type: boolean | |
| default: true | |
| push: | |
| pull_request: | |
| types: [opened, synchronize, reopened, labeled] | |
| workflow_dispatch: | |
| inputs: | |
| run_all: | |
| description: "Run all checks (ignore path filtering)" | |
| required: false | |
| type: boolean | |
| default: false | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Detect which files changed to run appropriate checks | |
| changes: | |
| name: Detect changes | |
| runs-on: ubuntu-latest | |
| outputs: | |
| go: ${{ steps.changed-files.outputs.go }} | |
| rust: ${{ steps.changed-files.outputs.rust }} | |
| ci-full: ${{ steps.changed-files.outputs.ci-full }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Detect changed files | |
| id: changed-files | |
| env: | |
| RUN_ALL: ${{ inputs.run_all }} | |
| EVENT_NAME: ${{ github.event_name }} | |
| PR_LABELS: ${{ toJson(github.event.pull_request.labels.*.name) }} | |
| EVENT_ACTION: ${{ github.event.action }} | |
| EVENT_LABEL_NAME: ${{ github.event.label.name }} | |
| PR_BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| EVENT_BEFORE: ${{ github.event.before }} | |
| run: | | |
| # If run_all input is true (from workflow_call or workflow_dispatch), run everything | |
| if [ "$RUN_ALL" = "true" ]; then | |
| echo "run_all=true, running all checks" | |
| echo "go=true" >> $GITHUB_OUTPUT | |
| echo "rust=true" >> $GITHUB_OUTPUT | |
| echo "ci-full=true" >> $GITHUB_OUTPUT | |
| exit 0 | |
| fi | |
| # Check for CI trigger labels on PRs | |
| if [ "$EVENT_NAME" = "pull_request" ]; then | |
| LABELS="$PR_LABELS" | |
| echo "PR Labels: $LABELS" | |
| if echo "$LABELS" | grep -q "ci-full"; then | |
| echo "Label 'ci-full' found, running all checks" | |
| echo "go=true" >> $GITHUB_OUTPUT | |
| echo "rust=true" >> $GITHUB_OUTPUT | |
| echo "ci-full=true" >> $GITHUB_OUTPUT | |
| exit 0 | |
| fi | |
| if echo "$LABELS" | grep -q "ci-go"; then | |
| echo "Label 'ci-go' found, running Go checks" | |
| echo "go=true" >> $GITHUB_OUTPUT | |
| fi | |
| if echo "$LABELS" | grep -q "ci-rust"; then | |
| echo "Label 'ci-rust' found, running Rust checks" | |
| echo "rust=true" >> $GITHUB_OUTPUT | |
| fi | |
| # If triggered by label event and we found a matching label, skip path detection | |
| if [ "$EVENT_ACTION" = "labeled" ]; then | |
| LABEL_NAME="$EVENT_LABEL_NAME" | |
| if [ "$LABEL_NAME" = "ci-full" ] || [ "$LABEL_NAME" = "ci-go" ] || [ "$LABEL_NAME" = "ci-rust" ]; then | |
| echo "Triggered by label event, skipping path detection" | |
| exit 0 | |
| fi | |
| fi | |
| fi | |
| # Determine base ref for comparison | |
| if [ "$EVENT_NAME" = "pull_request" ]; then | |
| BASE_REF="$PR_BASE_SHA" | |
| else | |
| # For push events, compare with previous commit | |
| BASE_REF="$EVENT_BEFORE" | |
| # If first push to branch, compare with parent | |
| if [ "$BASE_REF" = "0000000000000000000000000000000000000000" ]; then | |
| BASE_REF="HEAD^" | |
| fi | |
| fi | |
| echo "Comparing against base: $BASE_REF" | |
| # Check for Go file changes | |
| GO_CHANGES=$(git diff --name-only "$BASE_REF" HEAD | grep -E '\.(go)$|^go\.(mod|sum)$|^Makefile$|^\.golangci\.yml$|^cmd/|^api/|^internal/|^audit-scanner/' || true) | |
| if [ -n "$GO_CHANGES" ]; then | |
| echo "go=true" >> $GITHUB_OUTPUT | |
| echo "Go files changed:" | |
| echo "$GO_CHANGES" | |
| else | |
| echo "go=false" >> $GITHUB_OUTPUT | |
| echo "No Go files changed" | |
| fi | |
| # Check for Rust file changes | |
| RUST_CHANGES=$(git diff --name-only "$BASE_REF" HEAD | grep -E '^crates/.*\.rs$|^crates/.*/Cargo\.(toml|lock)$|^Cargo\.(toml|lock)$|^rust-toolchain\.toml$|^crates/Makefile$' || true) | |
| if [ -n "$RUST_CHANGES" ]; then | |
| echo "rust=true" >> $GITHUB_OUTPUT | |
| echo "Rust files changed:" | |
| echo "$RUST_CHANGES" | |
| else | |
| echo "rust=false" >> $GITHUB_OUTPUT | |
| echo "No Rust files changed" | |
| fi | |
| # Go jobs | |
| test-go: | |
| name: Go tests | |
| needs: changes | |
| if: needs.changes.outputs.go == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26" | |
| check-latest: true # Always check for the latest patch release | |
| - run: make test-go | |
| - name: Upload Go test coverage to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| env: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_ORG_TOKEN }} # zizmor: ignore[secrets-outside-env] | |
| with: | |
| name: go-tests | |
| files: coverage/cover.out | |
| flags: go-tests | |
| verbose: true | |
| e2e-go: | |
| name: Go e2e tests | |
| needs: changes | |
| if: needs.changes.outputs.go == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26" | |
| check-latest: true # Always check for the latest patch release | |
| - run: make test-e2e | |
| - name: Upload cluster logs | |
| if: failure() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: e2e-test-cluster-logs | |
| path: e2e/logs | |
| if-no-files-found: warn | |
| retention-days: 7 | |
| golangci: | |
| name: Golangci-lint | |
| needs: changes | |
| if: needs.changes.outputs.go == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26" | |
| check-latest: true # Always check for the latest patch release | |
| - name: golangci-lint | |
| uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0 | |
| with: | |
| version: v2.12.2 | |
| # Rust jobs | |
| calculate-crates-matrix: | |
| name: Calculate crates matrix | |
| needs: changes | |
| if: needs.changes.outputs.rust == 'true' | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: List crate folders | |
| id: set-matrix | |
| run: | | |
| # Exclude context-aware-test-policy as it's a test fixture, not a standalone crate | |
| CRATES=$(ls -1 crates | grep -v "^Makefile$" | grep -v "^context-aware-test-policy$" | jq -R -s -c 'split("\n")[:-1]') | |
| echo "matrix={\"crate\":$CRATES}" >> $GITHUB_OUTPUT | |
| fmt-rust-per-crate: | |
| needs: calculate-crates-matrix | |
| name: Rustfmt (${{ matrix.crate }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: ${{fromJson(needs.calculate-crates-matrix.outputs.matrix)}} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: "Run cargo fmt" | |
| env: | |
| CRATE: ${{ matrix.crate }} | |
| run: | | |
| make -C crates/$CRATE fmt | |
| clippy-rust-per-crate: | |
| needs: calculate-crates-matrix | |
| name: Clippy (${{ matrix.crate }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: ${{fromJson(needs.calculate-crates-matrix.outputs.matrix)}} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: "Run cargo clippy" | |
| env: | |
| CRATE: ${{ matrix.crate }} | |
| run: | | |
| make -C crates/$CRATE lint | |
| unit-tests-rust-per-crate: | |
| needs: calculate-crates-matrix | |
| name: Unit tests (${{ matrix.crate }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| matrix: ${{fromJson(needs.calculate-crates-matrix.outputs.matrix)}} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: "Run cargo test" | |
| env: | |
| CRATE: ${{ matrix.crate }} | |
| run: | | |
| make -C crates/$CRATE unit-tests | |
| integration-tests-burrego: | |
| needs: [changes, calculate-crates-matrix] | |
| if: needs.changes.outputs.rust == 'true' | |
| name: E2E tests (burrego) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install opa | |
| uses: kubewarden/github-actions/opa-installer@143b9e4b11ddc47370482267383586e6f1bc7efe # v7.0.1 | |
| with: | |
| opa-version: v1.12.2 | |
| checksum: a4ba8734ed95ceaac850c12684a42467ed6b0dc9633a9db8dd14d47d05e37751 | |
| - name: Install bats | |
| run: sudo apt-get install -y bats | |
| - name: Run e2e tests | |
| run: make -C crates/burrego e2e-tests | |
| integration-tests-kwctl: | |
| needs: [changes, calculate-crates-matrix] | |
| if: needs.changes.outputs.rust == 'true' | |
| name: E2E tests (kwctl) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run e2e tests | |
| run: make -C crates/kwctl e2e-tests | |
| e2e-tests-sigstore-kwctl: | |
| needs: [changes, calculate-crates-matrix] | |
| if: needs.changes.outputs.rust == 'true' | |
| name: E2E tests sigstore (kwctl) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Prepare sigstore environment for testing | |
| uses: ./.github/actions/setup-sigstore-env | |
| - name: Run kwctl Sigstore E2E tests | |
| run: make -C crates/kwctl e2e-tests-sigstore | |
| e2e-tests-sigstore-policy-server: | |
| needs: [changes, calculate-crates-matrix] | |
| if: needs.changes.outputs.rust == 'true' | |
| name: E2E tests sigstore (policy-server) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Prepare sigstore environment for testing | |
| uses: ./.github/actions/setup-sigstore-env | |
| - name: Run policy-server Sigstore E2E tests | |
| run: make -C crates/policy-server e2e-tests-sigstore | |
| integration-tests-policy-server: | |
| needs: [changes, calculate-crates-matrix] | |
| if: needs.changes.outputs.rust == 'true' | |
| name: Integration tests (policy-server) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run integration tests | |
| run: make -C crates/policy-server integration-tests | |
| integration-tests-policy-evaluator: | |
| needs: [changes, calculate-crates-matrix] | |
| if: needs.changes.outputs.rust == 'true' | |
| name: Integration tests (policy-evaluator) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Build kwctl | |
| run: make -C crates/kwctl build-release | |
| - name: Setup kwctl | |
| run: | | |
| mkdir -p $HOME/.kwctl | |
| cp target/release/kwctl $HOME/.kwctl/kwctl | |
| chmod +x $HOME/.kwctl/kwctl | |
| echo "$HOME/.kwctl" >> $GITHUB_PATH | |
| - name: Install bats | |
| run: sudo apt install -y bats | |
| - name: Run integration tests | |
| run: make -C crates/policy-evaluator integration-tests | |
| coverage-rust: | |
| name: coverage-rust | |
| runs-on: ubuntu-latest | |
| continue-on-error: true | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install cargo-llvm-cov | |
| uses: taiki-e/install-action@288e746965032cfcc232e09af2daf5f23c14d780 # v2.86.1 | |
| with: | |
| tool: cargo-llvm-cov | |
| - name: Install cosign # this is needed by some of the e2e tests | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| - run: cargo llvm-cov --ignore-run-fail --lcov --output-path coverage/rust/lcov.info | |
| - name: Upload Rust test coverage to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 | |
| env: | |
| CODECOV_TOKEN: ${{ secrets.CODECOV_ORG_TOKEN }} # zizmor: ignore[secrets-outside-env] | |
| with: | |
| name: rust-tests | |
| files: coverage/rust/lcov.info | |
| flags: rust-tests | |
| verbose: true | |
| build-kwctl: | |
| name: Build kwctl | |
| needs: changes | |
| if: needs.changes.outputs.rust == 'true' | |
| permissions: | |
| id-token: write | |
| attestations: write | |
| contents: read | |
| uses: ./.github/workflows/build-kwctl.yml | |
| with: | |
| force_build: true | |
| build_only: true | |
| shellcheck: | |
| name: Shellcheck | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - run: shellcheck $(find scripts/ -name '*.sh') | |
| spelling: | |
| name: Spelling check | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Check spelling with typos | |
| uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0 | |
| charts: | |
| name: Helm unittest | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install helm | |
| uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 | |
| with: | |
| # helm --verify=false flag only exists on Helm >= 4 | |
| version: v4.2.4 | |
| # Disable plugin verification until the following issue is addressed https://github.com/helm-unittest/helm-unittest/issues/777 | |
| - name: Install Helm-unittest | |
| run: helm plugin install https://github.com/helm-unittest/helm-unittest --verify=false | |
| - name: helm unit tests | |
| run: make helm-unittest | |
| validate-hauler-manifest: | |
| name: Validate Hauler manifest | |
| needs: changes | |
| if: needs.changes.outputs.ci-full == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run validation script | |
| run: ./scripts/validate-hauler-manifest.sh | |
| check-kwctl-cross-platform: | |
| name: Check kwctl (${{ matrix.os }}) | |
| needs: changes | |
| if: needs.changes.outputs.rust == 'true' | |
| strategy: | |
| matrix: | |
| os: [macos-latest, windows-latest] | |
| runs-on: ${{ matrix.os }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: enable git long paths on Windows | |
| if: matrix.os == 'windows-latest' | |
| run: git config --global core.longpaths true | |
| - name: Run cargo check | |
| run: make -C crates/kwctl check | |
| check-generated-code: | |
| name: Check if the generated code is up to date | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: "1.26" | |
| check-latest: true | |
| - run: | | |
| make check-generate | |
| # Rollup job for branch protection - single stable job name that depends on all checks | |
| ci-success: | |
| name: CI Success | |
| if: always() | |
| needs: | |
| - changes | |
| - test-go | |
| - e2e-go | |
| - golangci | |
| - calculate-crates-matrix | |
| - fmt-rust-per-crate | |
| - clippy-rust-per-crate | |
| - unit-tests-rust-per-crate | |
| - integration-tests-burrego | |
| - integration-tests-kwctl | |
| - e2e-tests-sigstore-kwctl | |
| - e2e-tests-sigstore-policy-server | |
| - integration-tests-policy-server | |
| - integration-tests-policy-evaluator | |
| - build-kwctl | |
| - shellcheck | |
| - spelling | |
| - charts | |
| - validate-hauler-manifest | |
| - check-kwctl-cross-platform | |
| - check-generated-code | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check all jobs status | |
| run: | | |
| # Check if any job failed or was cancelled | |
| if [[ "${{ contains(needs.*.result, 'failure') }}" == "true" || "${{ contains(needs.*.result, 'cancelled') }}" == "true" ]]; then | |
| echo "One or more jobs failed or were cancelled" | |
| exit 1 | |
| fi | |
| echo "All jobs passed or were skipped" |