Skip to content

Commit 44d0d10

Browse files
mtupitsynmtupitsyn
committed
CASMINST-6279: redesign build-sign-scan action
1 parent af9f813 commit 44d0d10

9 files changed

Lines changed: 977 additions & 258 deletions

File tree

‎.github/workflows/build-sign-scan.yaml‎

Lines changed: 471 additions & 0 deletions
Large diffs are not rendered by default.

‎.github/workflows/test-build-sign-scan.yaml‎

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
#
2+
# MIT License
3+
#
4+
# (C) Copyright 2025 Hewlett Packard Enterprise Development LP
5+
#
6+
# Permission is hereby granted, free of charge, to any person obtaining a
7+
# copy of this software and associated documentation files (the "Software"),
8+
# to deal in the Software without restriction, including without limitation
9+
# the rights to use, copy, modify, merge, publish, distribute, sublicense,
10+
# and/or sell copies of the Software, and to permit persons to whom the
11+
# Software is furnished to do so, subject to the following conditions:
12+
#
13+
# The above copyright notice and this permission notice shall be included
14+
# in all copies or substantial portions of the Software.
15+
#
16+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19+
# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
20+
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
21+
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
22+
# OTHER DEALINGS IN THE SOFTWARE.
23+
#
24+
name: Test build-sign-scan reusable workflow
25+
26+
on:
27+
push:
28+
paths:
29+
- .github/workflows/test-build-sign-scan.yaml
30+
- build-sign-scan/**
31+
workflow_dispatch:
32+
33+
jobs:
34+
test-docker-build-local:
35+
uses: ./.github/workflows/build-sign-scan.yaml
36+
with:
37+
context_path: build-sign-scan/tests/alpine
38+
docker_tag: artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-local-1
39+
docker_additional_tags: |
40+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-local-2
41+
docker_push: false
42+
snyk: false
43+
sign: false
44+
45+
test-docker-build-single-platform:
46+
uses: ./.github/workflows/build-sign-scan.yaml
47+
with:
48+
context_path: build-sign-scan/tests/alpine
49+
docker_tag: artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-single-platform-1
50+
docker_additional_tags: |
51+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-single-platform-2
52+
snyk: true
53+
sign: true
54+
secrets: inherit
55+
56+
test-docker-build-multi-platform:
57+
uses: ./.github/workflows/build-sign-scan.yaml
58+
with:
59+
context_path: build-sign-scan/tests/alpine
60+
docker_tag: artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-multi-platform-1
61+
docker_build_platforms: linux/amd64,linux/arm64
62+
docker_additional_tags: |
63+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-multi-platform-2
64+
snyk: true
65+
sign: true
66+
secrets: inherit
67+
68+
test-docker-build-secrets:
69+
uses: ./.github/workflows/build-sign-scan.yaml
70+
with:
71+
context_path: build-sign-scan/tests/sles
72+
docker_tag: artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-secrets-1
73+
docker_build_platforms: linux/amd64,linux/arm64
74+
docker_additional_tags: |
75+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-secrets-2
76+
snyk: false
77+
sign: false
78+
secrets:
79+
docker_username: ${{ secrets.ARTIFACTORY_ALGOL60_USERNAME }}
80+
docker_password: ${{ secrets.ARTIFACTORY_ALGOL60_TOKEN }}
81+
docker_secrets: |
82+
SLES_REPO_USERNAME=${{ secrets.ARTIFACTORY_ALGOL60_READONLY_USERNAME }}
83+
SLES_REPO_PASSWORD=${{ secrets.ARTIFACTORY_ALGOL60_READONLY_TOKEN }}
84+
gcp_workload_identity_provider: ${{ secrets.COSIGN_GCP_WORKLOAD_IDENTITY_PROVIDER_RSA }}
85+
gcp_service_account: ${{ secrets.COSIGN_GCP_SERVICE_ACCOUNT_RSA }}
86+
gcp_cosign_key: ${{ secrets.COSIGN_KEY_RSA }}
87+
snyk_token: ${{ secrets.SNYK_TOKEN }}
88+
89+
test-docker-build-google:
90+
uses: ./.github/workflows/build-sign-scan.yaml
91+
with:
92+
context_path: build-sign-scan/tests/alpine
93+
docker_login: false
94+
docker_oidc: true
95+
docker_tag: us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable/test-build-sign-scan:test-docker-build-google-1
96+
docker_build_platforms: linux/amd64,linux/arm64
97+
docker_additional_tags: |
98+
us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable/test-build-sign-scan:test-docker-build-google-2
99+
snyk: true
100+
sign: true
101+
secrets: inherit
102+
103+
test-makefile-local:
104+
uses: ./.github/workflows/build-sign-scan.yaml
105+
with:
106+
context_path: build-sign-scan/tests/alpine
107+
make_target: local
108+
docker_login: false
109+
env: |
110+
VERSION=test-makefile-local-1
111+
docker_additional_tags: |
112+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-makefile-local-2
113+
snyk: false
114+
sign: false
115+
116+
test-makefile-single-platform:
117+
uses: ./.github/workflows/build-sign-scan.yaml
118+
with:
119+
context_path: build-sign-scan/tests/alpine
120+
make_target: unstable
121+
env: |
122+
PLATFORM=linux/amd64
123+
VERSION=test-makefile-single-platform-1
124+
docker_additional_tags: |
125+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-makefile-single-platform-2
126+
snyk: true
127+
sign: true
128+
secrets: inherit
129+
130+
test-makefile-multi-platform:
131+
uses: ./.github/workflows/build-sign-scan.yaml
132+
with:
133+
context_path: build-sign-scan/tests/alpine
134+
make_target: unstable
135+
env: |
136+
VERSION=test-makefile-multi-platform-1
137+
docker_additional_tags: |
138+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-makefile-multi-platform-2
139+
snyk: true
140+
sign: true
141+
secrets: inherit
142+
143+
test-makefile-secrets:
144+
uses: ./.github/workflows/build-sign-scan.yaml
145+
with:
146+
context_path: build-sign-scan/tests/sles
147+
make_target: unstable
148+
env: |
149+
VERSION=test-makefile-secrets-1
150+
docker_additional_tags: |
151+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-makefile-secrets-2
152+
snyk: false
153+
sign: false
154+
secrets:
155+
docker_username: ${{ secrets.ARTIFACTORY_ALGOL60_USERNAME }}
156+
docker_password: ${{ secrets.ARTIFACTORY_ALGOL60_TOKEN }}
157+
docker_secrets: |
158+
SLES_REPO_USERNAME=${{ secrets.ARTIFACTORY_ALGOL60_READONLY_USERNAME }}
159+
SLES_REPO_PASSWORD=${{ secrets.ARTIFACTORY_ALGOL60_READONLY_TOKEN }}
160+
gcp_workload_identity_provider: ${{ secrets.COSIGN_GCP_WORKLOAD_IDENTITY_PROVIDER_RSA }}
161+
gcp_service_account: ${{ secrets.COSIGN_GCP_SERVICE_ACCOUNT_RSA }}
162+
gcp_cosign_key: ${{ secrets.COSIGN_KEY_RSA }}
163+
snyk_token: ${{ secrets.SNYK_TOKEN }}
164+
165+
test-makefile-google:
166+
uses: ./.github/workflows/build-sign-scan.yaml
167+
with:
168+
context_path: build-sign-scan/tests/alpine
169+
make_target: unstable
170+
docker_login: false
171+
docker_oidc: true
172+
env: |
173+
REGISTRY=us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable
174+
VERSION=test-makefile-google-1
175+
docker_additional_tags: |
176+
us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable/test-build-sign-scan:test-makefile-google-2
177+
snyk: true
178+
sign: true
179+
secrets: inherit
180+
181+
review:
182+
runs-on: ubuntu-latest
183+
184+
permissions:
185+
contents: 'read'
186+
id-token: 'write'
187+
188+
needs:
189+
- test-docker-build-local
190+
- test-docker-build-single-platform
191+
- test-docker-build-multi-platform
192+
- test-docker-build-secrets
193+
- test-docker-build-google
194+
- test-makefile-local
195+
- test-makefile-single-platform
196+
- test-makefile-multi-platform
197+
- test-makefile-secrets
198+
- test-makefile-google
199+
200+
steps:
201+
- name: Report Test Results
202+
env:
203+
NEEDS_CONTEXT: ${{ toJSON(needs) }}
204+
run: |
205+
function assert() {
206+
if [ "${2}" != "${3}" ]; then
207+
echo "::error::Test ${test_name}: unexpected ${1}: \"${3}\". Expected values is \"${2}\"."
208+
exit_code=$((exit_code+1))
209+
fi
210+
}
211+
212+
echo "$NEEDS_CONTEXT" > outputs.json
213+
exit_code=0
214+
for build_type in docker-build makefile; do
215+
for image_type in local single-platform multi-platform secrets google; do
216+
test_name="test-${build_type}-${image_type}"
217+
218+
# Test built tags
219+
image_name=artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan
220+
test "${image_type}" == google && image_name=us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable/test-build-sign-scan
221+
tags=$(jq -r ".\"${test_name}\".outputs.image_tags" outputs.json | tr ',' '\n' | sort | tr '\n' ',' | sed -e 's/,$//')
222+
assert tags "${tags}" "${image_name}:${test_name}-1,${image_name}:${test_name}-2" ]
223+
224+
# Test built platforms
225+
platforms=$(jq -r ".\"${test_name}\".outputs.image_platforms" outputs.json)
226+
test "${image_type}" == single && assert platforms "${platforms}" '[]"linux/amd64"]'
227+
test "${image_type}" != local -a "${image_type}" != local && assert platforms "${platforms}" '["linux/amd64","linux/arm64"]'
228+
done
229+
done
230+
exit $exit_code
231+
shell: bash

0 commit comments

Comments
 (0)