Skip to content

Commit 699d32a

Browse files
raffisraffis
authored
fix!: update and refactor deps, ci, flags (#40)
* fix!: update and refactor deps, ci, flags * fix: update goreleaser * fix: update project * fix: update name * fix: remove unused var * x
1 parent cdb9f3a commit 699d32a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+1082
-1114
lines changed

‎.github/ISSUE_TEMPLATE/VULN-TEMPLATE.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
title: Vulnerabilities detected
3+
labels: security
4+
---
5+
High or critical vulnerabilities detected. Scan results are below:
6+
7+
{{ env.RESULTS }}

‎.github/workflows/main.yaml

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,26 +5,25 @@ on:
55
branches:
66
- master
77

8+
permissions: {}
9+
810
jobs:
911
build:
1012
runs-on: ubuntu-latest
1113
steps:
14+
- name: Harden Runner
15+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
16+
with:
17+
egress-policy: audit
1218
- name: Checkout
13-
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
19+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
1420
- name: Setup Go
15-
uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
16-
with:
17-
go-version: 1.20.x
18-
- name: Restore Go cache
19-
uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
21+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
2022
with:
21-
path: ~/go/pkg/mod
22-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
23-
restore-keys: |
24-
${{ runner.os }}-go-
23+
go-version: 1.22.x
2524
- name: Tests
2625
run: make test
2726
- name: Send go coverage report
28-
uses: shogo82148/actions-goveralls@31ee804b8576ae49f6dc3caa22591bc5080e7920 #v1.6.0
27+
uses: shogo82148/actions-goveralls@785c9d68212c91196d3994652647f8721918ba11 # v1.9.0
2928
with:
3029
path-to-profile: coverage.out

‎.github/workflows/pr-actions.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: pr-actions
2+
3+
permissions: {}
4+
5+
on:
6+
pull_request:
7+
branches:
8+
- 'master'
9+
10+
jobs:
11+
ensure-sha-pinned:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Harden Runner
15+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
16+
with:
17+
egress-policy: audit
18+
19+
- name: Checkout
20+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
21+
- name: Ensure SHA pinned actions
22+
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@0901cf7b71c7ea6261ec69a3dc2bd3f9264f893e # v3.0.12
23+
with:
24+
# slsa-github-generator requires using a semver tag for reusable workflows.
25+
# See: https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators
26+
allowlist: |
27+
slsa-framework/slsa-github-generator

‎.github/workflows/pr-build.yaml

Lines changed: 187 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -7,37 +7,110 @@ on:
77
- synchronize
88
- reopened
99

10+
permissions: {}
11+
1012
jobs:
11-
e2e:
13+
lint-chart:
1214
runs-on: ubuntu-latest
1315
steps:
16+
- name: Harden Runner
17+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
18+
with:
19+
egress-policy: audit
1420
- name: Checkout
15-
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
16-
- name: Setup Go
17-
uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 #v3.5.0
21+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
22+
with:
23+
fetch-depth: 0
24+
25+
- name: Set up Helm
26+
uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 #v3.5
1827
with:
19-
go-version: 1.20.x
20-
- name: Restore Go cache
21-
uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3.3.2
28+
version: v3.4.0
29+
30+
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
31+
with:
32+
python-version: 3.7
33+
34+
- name: Set up chart-testing
35+
uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
36+
37+
- name: Run chart-testing (list-changed)
38+
id: list-changed
39+
run: |
40+
changed=$(ct list-changed --target-branch=master --chart-dirs chart)
41+
if [[ -n "$changed" ]]; then
42+
echo "::set-output name=changed::true"
43+
fi
44+
- name: Run chart-testing (lint)
45+
run: ct lint --target-branch=master --chart-dirs chart --check-version-increment=false
46+
47+
fmt:
48+
runs-on: ubuntu-latest
49+
steps:
50+
- name: Harden Runner
51+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
52+
with:
53+
egress-policy: audit
54+
- name: Checkout
55+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
56+
- name: Setup Go
57+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
2258
with:
23-
path: ~/go/pkg/mod
24-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
25-
restore-keys: |
26-
${{ runner.os }}-go-
59+
go-version: 1.22.x
2760
- name: fmt
2861
run: make fmt
2962
- name: vet
3063
run: make vet
3164
- name: lint
3265
run: make lint
33-
- name: test
34-
run: make test
66+
- name: Check if working tree is dirty
67+
run: |
68+
if [[ $(git diff --stat) != '' ]]; then
69+
git --no-pager diff
70+
echo 'run <make test> and commit changes'
71+
exit 1
72+
fi
73+
74+
test:
75+
runs-on: ubuntu-latest
76+
strategy:
77+
matrix:
78+
kubernetes-version:
79+
- "1.27"
80+
- "1.28"
81+
- "1.29"
82+
- "1.30"
83+
steps:
84+
- name: Harden Runner
85+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
86+
with:
87+
egress-policy: audit
88+
- name: Checkout
89+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
90+
- name: Setup Go
91+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
92+
with:
93+
go-version: 1.22.x
94+
- name: run test
95+
run: make test ENVTEST_K8S_VERSION=${{ matrix.kubernetes-version }}
96+
97+
build:
98+
runs-on: ubuntu-latest
99+
outputs:
100+
profiles: ${{ steps.profiles.outputs.matrix }}
101+
steps:
102+
- name: Harden Runner
103+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
104+
with:
105+
egress-policy: audit
106+
- name: Checkout
107+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
108+
- name: Setup Go
109+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
110+
with:
111+
go-version: 1.22.x
35112
- name: build
36113
run: make build
37-
- name: Send go coverage report
38-
uses: shogo82148/actions-goveralls@31ee804b8576ae49f6dc3caa22591bc5080e7920 #v1.6.0
39-
with:
40-
path-to-profile: coverage.out
41114
- name: Check if working tree is dirty
42115
run: |
43116
if [[ $(git diff --stat) != '' ]]; then
@@ -48,19 +121,108 @@ jobs:
48121
- name: Build container image
49122
run: |
50123
make docker-build
124+
- name: Create image tarball
125+
run: |
126+
docker save --output oauth2-redirect-controller-container.tar oauth2-redirect-controller:latest
127+
- name: Upload image
128+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
129+
with:
130+
name: oauth2-redirect-controller-container
131+
path: oauth2-redirect-controller-container.tar
132+
- id: profiles
133+
name: Determine test profiles
134+
run: |
135+
profiles=$(ls config/tests/cases | jq -R -s -c 'split("\n")[:-1]')
136+
echo $profiles
137+
echo "::set-output name=matrix::$profiles"
138+
139+
e2e-tests:
140+
runs-on: ubuntu-latest
141+
needs:
142+
- build
143+
strategy:
144+
matrix:
145+
profile: ${{ fromJson(needs.build.outputs.profiles) }}
146+
steps:
147+
- name: Harden Runner
148+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
149+
with:
150+
egress-policy: audit
151+
- name: Checkout
152+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
51153
- name: Setup Kubernetes
52154
uses: engineerd/setup-kind@aa272fe2a7309878ffc2a81c56cfe3ef108ae7d0 #v0.5.0
53155
with:
54156
version: v0.17.0
55-
- name: Load test image
56-
run: kind load docker-image k8soauth2-proxy-controller:latest
57-
- name: Deploy controller
58-
run: make deploy
157+
- name: Download oauth2-redirect-controller container
158+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
159+
with:
160+
name: oauth2-redirect-controller-container
161+
path: /tmp
162+
- name: Load images
163+
run: |
164+
docker load --input /tmp/oauth2-redirect-controller-container.tar
165+
docker image ls -a
166+
- name: Setup Kustomize
167+
uses: imranismail/setup-kustomize@2ba527d4d055ab63514ba50a99456fc35684947f # v2.1.0
168+
- name: Run test
169+
run: |
170+
make kind-test TEST_PROFILE=${{ matrix.profile }}
59171
- name: Debug failure
60172
if: failure()
61173
run: |
62174
kubectl -n kube-system describe pods
63-
kubectl -n podinfo get pods
64-
kubectl -n k8soauth2-proxy-system describe pods
65-
kubectl -n k8soauth2-proxy-system get all
66-
kubectl -n k8soauth2-proxy-system logs deploy/k8soauth2-proxy-controller manager
175+
kubectl -n oauth2-system describe pods
176+
kubectl -n oauth2-system get all
177+
kubectl -n oauth2-system logs deploy/oauth2-redirect-controller
178+
kubectl -n oauth2-system get oauth2-redirectrealms -o yaml
179+
180+
test-chart:
181+
runs-on: ubuntu-latest
182+
needs:
183+
- build
184+
- lint-chart
185+
steps:
186+
- name: Harden Runner
187+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
188+
with:
189+
egress-policy: audit
190+
- name: Checkout
191+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
192+
with:
193+
fetch-depth: 0
194+
195+
- name: Set up Helm
196+
uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 #v3.5
197+
198+
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
199+
with:
200+
python-version: 3.7
201+
202+
- name: Set up chart-testing
203+
uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
204+
205+
- name: Create kind cluster
206+
uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
207+
208+
- name: Download oauth2-redirect-controller container
209+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
210+
with:
211+
name: oauth2-redirect-controller-container
212+
path: /tmp
213+
214+
- name: Load image
215+
run: |
216+
docker load --input /tmp/oauth2-redirect-controller-container.tar
217+
docker tag oauth2-redirect-controller:latest ghcr.io/doodlescheduling/oauth2-redirect-controller:v0.0.0
218+
kind load docker-image ghcr.io/doodlescheduling/oauth2-redirect-controller:v0.0.0 --name chart-testing
219+
docker image ls -a
220+
221+
- name: Run chart-testing (install)
222+
run: ct install --target-branch=master --chart-dirs chart
223+
224+
test-success:
225+
runs-on: ubuntu-latest
226+
needs: [test, e2e-tests]
227+
steps:
228+
- run: echo "all tests succeeded"

‎.github/workflows/pr-chart.yaml

Lines changed: 0 additions & 42 deletions
This file was deleted.

‎.github/workflows/pr-goreleaser.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: pr-gorelaser
2+
3+
permissions: {}
4+
5+
on:
6+
pull_request:
7+
branches:
8+
- 'master'
9+
10+
jobs:
11+
validate-config:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Harden Runner
15+
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
16+
with:
17+
egress-policy: audit
18+
- name: Checkout
19+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
20+
- name: Validate .goreleaser.yaml
21+
uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
22+
with:
23+
version: latest
24+
args: check
25+
env:
26+
RUNNER_TOKEN: ${{ github.token }}
27+
GITHUB_TOKEN: ${{ secrets.DOODLE_OSS_BOT}}

0 commit comments

Comments
 (0)