CI #61
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - master | |
| - release-* | |
| pull_request: {} | |
| workflow_dispatch: | |
| inputs: | |
| version: | |
| description: 'Release version (e.g. v0.1.0)' | |
| required: false | |
| env: | |
| # Common versions | |
| GO_VERSION: '1.21.2' | |
| GOLANGCI_VERSION: 'v1.54.2' | |
| DOCKER_BUILDX_VERSION: 'v0.10.0' | |
| DOCKER_USR: ${{ github.actor }} | |
| jobs: | |
| check-diff: | |
| runs-on: ubuntu-22.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4 | |
| with: | |
| submodules: true | |
| - name: Setup Go | |
| uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Find the Go Build Cache | |
| id: go | |
| run: echo "cache=$(make go.cachedir)" >> $GITHUB_OUTPUT | |
| - name: Cache the Go Build Cache | |
| uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 | |
| with: | |
| path: ${{ steps.go.outputs.cache }} | |
| key: ${{ runner.os }}-build-check-diff-${{ hashFiles('**/go.sum') }} | |
| restore-keys: ${{ runner.os }}-build-check-diff- | |
| - name: Cache Go Dependencies | |
| uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 | |
| with: | |
| path: .work/pkg | |
| key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }} | |
| restore-keys: ${{ runner.os }}-pkg- | |
| - name: Vendor Dependencies | |
| run: make vendor vendor.check | |
| - name: Check Diff | |
| run: make check-diff | |
| detect-noop: | |
| runs-on: ubuntu-22.04 | |
| outputs: | |
| noop: ${{ steps.noop.outputs.should_skip }} | |
| steps: | |
| - name: Detect No-op Changes | |
| id: noop | |
| uses: fkirc/skip-duplicate-actions@12aca0a884f6137d619d6a8a09fcc3406ced5281 # v5.3.0 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| paths_ignore: '["**.md", "**.png", "**.jpg"]' | |
| do_not_skip: '["workflow_dispatch", "schedule", "push"]' | |
| concurrent_skipping: false | |
| report-breaking-changes: | |
| runs-on: ubuntu-22.04 | |
| needs: detect-noop | |
| if: needs.detect-noop.outputs.noop != 'true' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v2 | |
| with: | |
| submodules: true | |
| - name: Get modified CRDs | |
| id: modified-crds | |
| uses: tj-actions/changed-files@v34 | |
| with: | |
| files: | | |
| package/crds/** | |
| - name: Report breaking CRD OpenAPI v3 schema changes | |
| if: steps.modified-crds.outputs.any_changed == 'true' | |
| env: | |
| MODIFIED_CRD_LIST: ${{ steps.modified-crds.outputs.all_changed_files }} | |
| run: | | |
| make crddiff | |
| lint: | |
| runs-on: ubuntu-22.04 | |
| needs: detect-noop | |
| if: needs.detect-noop.outputs.noop != 'true' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4 | |
| with: | |
| submodules: true | |
| - name: Setup Go | |
| uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Find the Go Build Cache | |
| id: go | |
| run: echo "cache=$(make go.cachedir)" >> $GITHUB_OUTPUT | |
| - name: Cache the Go Build Cache | |
| uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 | |
| with: | |
| path: ${{ steps.go.outputs.cache }} | |
| key: ${{ runner.os }}-build-lint-${{ hashFiles('**/go.sum') }} | |
| restore-keys: ${{ runner.os }}-build-lint- | |
| - name: Cache Go Dependencies | |
| uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 | |
| with: | |
| path: .work/pkg | |
| key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }} | |
| restore-keys: ${{ runner.os }}-pkg- | |
| - name: Vendor Dependencies | |
| run: make vendor vendor.check | |
| # We could run 'make lint' to ensure our desired Go version, but we prefer | |
| # this action because it leaves 'annotations' (i.e. it comments on PRs to | |
| # point out linter violations). | |
| - name: Lint | |
| uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3 | |
| with: | |
| version: ${{ env.GOLANGCI_VERSION }} | |
| skip-cache: true # We do our own caching. | |
| # Disabled for now because it takes a very long time to run and we are not | |
| # using the results anywhere. | |
| # codeql: | |
| # runs-on: ubuntu-22.04 | |
| # needs: detect-noop | |
| # if: needs.detect-noop.outputs.noop != 'true' | |
| # steps: | |
| # - name: Checkout | |
| # uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4 | |
| # with: | |
| # submodules: true | |
| # - name: Setup Go | |
| # uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4 | |
| # with: | |
| # go-version: ${{ env.GO_VERSION }} | |
| # - name: Find the Go Build Cache | |
| # id: go | |
| # run: echo "cache=$(make go.cachedir)" >> $GITHUB_OUTPUT | |
| # - name: Cache the Go Build Cache | |
| # uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 | |
| # with: | |
| # path: ${{ steps.go.outputs.cache }} | |
| # key: ${{ runner.os }}-build-check-diff-${{ hashFiles('**/go.sum') }} | |
| # restore-keys: ${{ runner.os }}-build-check-diff- | |
| # - name: Cache Go Dependencies | |
| # uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 | |
| # with: | |
| # path: .work/pkg | |
| # key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }} | |
| # restore-keys: ${{ runner.os }}-pkg- | |
| # - name: Vendor Dependencies | |
| # run: make vendor vendor.check | |
| # - name: Initialize CodeQL | |
| # uses: github/codeql-action/init@ddccb873888234080b77e9bc2d4764d5ccaaccf9 # v2 | |
| # with: | |
| # languages: go | |
| # - name: Perform CodeQL Analysis | |
| # uses: github/codeql-action/analyze@ddccb873888234080b77e9bc2d4764d5ccaaccf9 # v2 | |
| trivy-scan-fs: | |
| runs-on: ubuntu-22.04 | |
| needs: detect-noop | |
| if: needs.detect-noop.outputs.noop != 'true' && github.ref == 'refs/heads/master' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4 | |
| with: | |
| submodules: true | |
| - name: Run Trivy vulnerability scanner in fs mode | |
| uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # 0.12.0 | |
| with: | |
| scan-type: 'fs' | |
| ignore-unfixed: true | |
| skip-dirs: design | |
| scan-ref: '.' | |
| exit-code: '1' | |
| severity: 'CRITICAL,HIGH' | |
| unit-tests: | |
| runs-on: ubuntu-22.04 | |
| needs: detect-noop | |
| if: needs.detect-noop.outputs.noop != 'true' | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4 | |
| with: | |
| submodules: true | |
| - name: Fetch History | |
| run: git fetch --prune --unshallow | |
| - name: Setup Go | |
| uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Find the Go Build Cache | |
| id: go | |
| run: echo "cache=$(make go.cachedir)" >> $GITHUB_OUTPUT | |
| - name: Cache the Go Build Cache | |
| uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 | |
| with: | |
| path: ${{ steps.go.outputs.cache }} | |
| key: ${{ runner.os }}-build-unit-tests-${{ hashFiles('**/go.sum') }} | |
| restore-keys: ${{ runner.os }}-build-unit-tests- | |
| - name: Cache Go Dependencies | |
| uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 | |
| with: | |
| path: .work/pkg | |
| key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }} | |
| restore-keys: ${{ runner.os }}-pkg- | |
| - name: Vendor Dependencies | |
| run: make vendor vendor.check | |
| - name: Run Unit Tests | |
| run: make -j2 test | |
| - name: Publish Unit Test Coverage | |
| uses: codecov/codecov-action@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d # v3 | |
| with: | |
| flags: unittests | |
| file: _output/tests/linux_amd64/coverage.txt | |
| e2e-tests: | |
| runs-on: ubuntu-22.04 | |
| needs: detect-noop | |
| if: needs.detect-noop.outputs.noop != 'true' | |
| steps: | |
| - name: Setup QEMU | |
| uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3 | |
| with: | |
| platforms: all | |
| - name: Setup Docker Buildx | |
| uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3 | |
| with: | |
| version: ${{ env.DOCKER_BUILDX_VERSION }} | |
| install: true | |
| - name: Checkout | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4 | |
| with: | |
| submodules: true | |
| - name: Fetch History | |
| run: git fetch --prune --unshallow | |
| - name: Setup Go | |
| uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Find the Go Build Cache | |
| id: go | |
| run: echo "cache=$(make go.cachedir)" >> $GITHUB_OUTPUT | |
| - name: Cache the Go Build Cache | |
| uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 | |
| with: | |
| path: ${{ steps.go.outputs.cache }} | |
| key: ${{ runner.os }}-build-e2e-tests-${{ hashFiles('**/go.sum') }} | |
| restore-keys: ${{ runner.os }}-build-e2e-tests- | |
| - name: Cache Go Dependencies | |
| uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 | |
| with: | |
| path: .work/pkg | |
| key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }} | |
| restore-keys: | | |
| ${{ runner.os }}-pkg- | |
| - name: Vendor Dependencies | |
| run: make vendor vendor.check | |
| - name: Build Helm Chart | |
| run: make -j2 build | |
| env: | |
| # We're using docker buildx, which doesn't actually load the images it | |
| # builds by default. Specifying --load does so. | |
| BUILD_ARGS: "--load" | |
| - name: Run E2E Tests | |
| run: make e2e USE_HELM3=true | |
| publish-artifacts: | |
| runs-on: ubuntu-22.04 | |
| needs: detect-noop | |
| if: needs.detect-noop.outputs.noop != 'true' | |
| steps: | |
| - name: Cleanup Disk | |
| uses: jlumbroso/free-disk-space@d5af243ce7bacb67384aa6c5b1fc5f169e30903e | |
| with: | |
| android: true | |
| dotnet: true | |
| haskell: true | |
| tool-cache: true | |
| large-packages: false | |
| swap-storage: false | |
| - name: Setup QEMU | |
| uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3 | |
| with: | |
| platforms: all | |
| - name: Setup Docker Buildx | |
| uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3 | |
| with: | |
| version: ${{ env.DOCKER_BUILDX_VERSION }} | |
| install: true | |
| - name: Checkout | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4 | |
| with: | |
| submodules: true | |
| - name: Fetch History | |
| run: git fetch --prune --unshallow | |
| - name: Setup Go | |
| uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4 | |
| with: | |
| go-version: ${{ env.GO_VERSION }} | |
| - name: Find the Go Build Cache | |
| id: go | |
| run: echo "cache=$(make go.cachedir)" >> $GITHUB_OUTPUT | |
| - name: Cache the Go Build Cache | |
| uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 | |
| with: | |
| path: ${{ steps.go.outputs.cache }} | |
| key: ${{ runner.os }}-build-publish-artifacts-${{ hashFiles('**/go.sum') }} | |
| restore-keys: ${{ runner.os }}-build-publish-artifacts- | |
| - name: Cache Go Dependencies | |
| uses: actions/cache@704facf57e6136b1bc63b828d79edcd491f0ee84 # v3 | |
| with: | |
| path: .work/pkg | |
| key: ${{ runner.os }}-pkg-${{ hashFiles('**/go.sum') }} | |
| restore-keys: ${{ runner.os }}-pkg- | |
| - name: Vendor Dependencies | |
| run: make vendor vendor.check | |
| - name: Build Artifacts with Version | |
| run: make -j2 build.all VERSION=${XPKG_VERSION} | |
| if: env.XPKG_VERSION != '' | |
| env: | |
| # We're using docker buildx, which doesn't actually load the images it | |
| # builds by default. Specifying --load does so. | |
| BUILD_ARGS: "--load" | |
| XPKG_VERSION: ${{ github.event.inputs.version }} | |
| - name: Build Artifacts without Version | |
| run: make -j2 build.all | |
| if: env.XPKG_VERSION == '' | |
| env: | |
| # We're using docker buildx, which doesn't actually load the images it | |
| # builds by default. Specifying --load does so. | |
| BUILD_ARGS: "--load" | |
| XPKG_VERSION: ${{ github.event.inputs.version }} | |
| - name: Publish Artifacts to GitHub | |
| uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3 | |
| with: | |
| name: output | |
| path: _output/** | |
| - name: Login to GHCR | |
| uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3 | |
| if: env.DOCKER_USR != '' | |
| with: | |
| registry: ghcr.io | |
| username: ${{ env.DOCKER_USR }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Publish Artifacts to GHCR with Version | |
| run: make -j2 publish BRANCH_NAME=${GITHUB_REF##*/} VERSION=${XPKG_VERSION} | |
| if: env.DOCKER_USR != '' && env.XPKG_VERSION != '' | |
| env: | |
| GIT_API_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| XPKG_VERSION: ${{ github.event.inputs.version }} | |
| - name: Publish Artifacts to GHCR without Version | |
| run: make -j2 publish BRANCH_NAME=${GITHUB_REF##*/} | |
| if: env.DOCKER_USR != '' && env.XPKG_VERSION == '' | |
| env: | |
| GIT_API_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| XPKG_VERSION: ${{ github.event.inputs.version }} | |
| - name: Promote Artifacts in Docker Hub | |
| if: github.ref == 'refs/heads/master' && env.DOCKER_USR != '' | |
| run: make -j2 promote | |
| env: | |
| BRANCH_NAME: master | |
| CHANNEL: master |