Skip to content

Commit 4d9664e

Browse files
mtupitsynmtupitsyn
committed
CASMINST-6279: redesign build-sign-scan action
1 parent af9f813 commit 4d9664e

9 files changed

Lines changed: 1016 additions & 258 deletions

File tree

‎.github/workflows/build-sign-scan.yaml‎

Lines changed: 471 additions & 0 deletions
Large diffs are not rendered by default.

‎.github/workflows/test-build-sign-scan.yaml‎

Lines changed: 270 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,270 @@
1+
#
2+
# MIT License
3+
#
4+
# (C) Copyright 2025 Hewlett Packard Enterprise Development LP
5+
#
6+
# Permission is hereby granted, free of charge, to any person obtaining a
7+
# copy of this software and associated documentation files (the "Software"),
8+
# to deal in the Software without restriction, including without limitation
9+
# the rights to use, copy, modify, merge, publish, distribute, sublicense,
10+
# and/or sell copies of the Software, and to permit persons to whom the
11+
# Software is furnished to do so, subject to the following conditions:
12+
#
13+
# The above copyright notice and this permission notice shall be included
14+
# in all copies or substantial portions of the Software.
15+
#
16+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19+
# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
20+
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
21+
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
22+
# OTHER DEALINGS IN THE SOFTWARE.
23+
#
24+
name: Test build-sign-scan reusable workflow
25+
26+
on:
27+
push:
28+
paths:
29+
- .github/workflows/test-build-sign-scan.yaml
30+
- build-sign-scan/**
31+
workflow_dispatch:
32+
33+
jobs:
34+
test-docker-build-local:
35+
uses: ./.github/workflows/build-sign-scan.yaml
36+
with:
37+
context_path: build-sign-scan/tests/alpine
38+
docker_tag: artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-local-1
39+
docker_additional_tags: |
40+
41+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-local-2
42+
docker_build_args: |
43+
--label='Random label 1'
44+
45+
--label="Random label 2"
46+
env: |
47+
VAR1=var1
48+
49+
VAR2='var2 var2'
50+
VAR3="var3 var3"
51+
VAR4='var4
52+
var4'
53+
VAR5="var4
54+
var4"
55+
docker_push: false
56+
snyk: false
57+
sign: false
58+
59+
test-docker-build-single-platform:
60+
uses: ./.github/workflows/build-sign-scan.yaml
61+
with:
62+
context_path: build-sign-scan/tests/alpine
63+
docker_tag: artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-single-platform-1
64+
docker_additional_tags: |
65+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-single-platform-2
66+
snyk: true
67+
sign: true
68+
secrets: inherit
69+
70+
test-docker-build-multi-platform:
71+
uses: ./.github/workflows/build-sign-scan.yaml
72+
with:
73+
context_path: build-sign-scan/tests/alpine
74+
docker_tag: artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-multi-platform-1
75+
docker_build_platforms: linux/amd64,linux/arm64
76+
docker_additional_tags: |
77+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-multi-platform-2
78+
snyk: true
79+
sign: true
80+
secrets: inherit
81+
82+
test-docker-build-secrets:
83+
uses: ./.github/workflows/build-sign-scan.yaml
84+
with:
85+
context_path: build-sign-scan/tests/sles
86+
docker_tag: artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-secrets-1
87+
docker_build_platforms: linux/amd64,linux/arm64
88+
docker_additional_tags: |
89+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-secrets-2
90+
snyk: false
91+
sign: false
92+
secrets:
93+
docker_username: ${{ secrets.ARTIFACTORY_ALGOL60_USERNAME }}
94+
docker_password: ${{ secrets.ARTIFACTORY_ALGOL60_TOKEN }}
95+
docker_secrets: |
96+
SLES_REPO_USERNAME=${{ secrets.ARTIFACTORY_ALGOL60_READONLY_USERNAME }}
97+
SLES_REPO_PASSWORD=${{ secrets.ARTIFACTORY_ALGOL60_READONLY_TOKEN }}
98+
gcp_workload_identity_provider: ${{ secrets.COSIGN_GCP_WORKLOAD_IDENTITY_PROVIDER_RSA }}
99+
gcp_service_account: ${{ secrets.COSIGN_GCP_SERVICE_ACCOUNT_RSA }}
100+
gcp_cosign_key: ${{ secrets.COSIGN_KEY_RSA }}
101+
snyk_token: ${{ secrets.SNYK_TOKEN }}
102+
103+
test-docker-build-google:
104+
uses: ./.github/workflows/build-sign-scan.yaml
105+
with:
106+
context_path: build-sign-scan/tests/alpine
107+
docker_login: false
108+
docker_oidc: true
109+
docker_tag: us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable/test-build-sign-scan:test-docker-build-google-1
110+
docker_build_platforms: linux/amd64,linux/arm64
111+
docker_additional_tags: |
112+
us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable/test-build-sign-scan:test-docker-build-google-2
113+
snyk: true
114+
sign: true
115+
secrets: inherit
116+
117+
test-makefile-local:
118+
uses: ./.github/workflows/build-sign-scan.yaml
119+
with:
120+
context_path: build-sign-scan/tests/alpine
121+
make_target: local
122+
docker_login: false
123+
docker_additional_tags: |
124+
125+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-makefile-local-2
126+
docker_build_args: |
127+
--label='Random label 1'
128+
129+
--label="Random label 2"
130+
env: |
131+
VERSION=test-makefile-local-1
132+
VAR1=var1
133+
134+
VAR2='var2 var2'
135+
VAR3="var3 var3"
136+
VAR4='var4
137+
var4'
138+
VAR5="var4
139+
var4"
140+
snyk: false
141+
sign: false
142+
143+
test-makefile-single-platform:
144+
uses: ./.github/workflows/build-sign-scan.yaml
145+
with:
146+
context_path: build-sign-scan/tests/alpine
147+
make_target: unstable
148+
env: |
149+
PLATFORM=linux/amd64
150+
VERSION=test-makefile-single-platform-1
151+
docker_additional_tags: |
152+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-makefile-single-platform-2
153+
snyk: true
154+
sign: true
155+
secrets: inherit
156+
157+
test-makefile-multi-platform:
158+
uses: ./.github/workflows/build-sign-scan.yaml
159+
with:
160+
context_path: build-sign-scan/tests/alpine
161+
make_target: unstable
162+
env: |
163+
VERSION=test-makefile-multi-platform-1
164+
docker_additional_tags: |
165+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-makefile-multi-platform-2
166+
snyk: true
167+
sign: true
168+
secrets: inherit
169+
170+
test-makefile-secrets:
171+
uses: ./.github/workflows/build-sign-scan.yaml
172+
with:
173+
context_path: build-sign-scan/tests/sles
174+
make_target: unstable
175+
env: |
176+
VERSION=test-makefile-secrets-1
177+
docker_additional_tags: |
178+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-makefile-secrets-2
179+
snyk: false
180+
sign: false
181+
secrets:
182+
docker_username: ${{ secrets.ARTIFACTORY_ALGOL60_USERNAME }}
183+
docker_password: ${{ secrets.ARTIFACTORY_ALGOL60_TOKEN }}
184+
docker_secrets: |
185+
SLES_REPO_USERNAME=${{ secrets.ARTIFACTORY_ALGOL60_READONLY_USERNAME }}
186+
SLES_REPO_PASSWORD=${{ secrets.ARTIFACTORY_ALGOL60_READONLY_TOKEN }}
187+
gcp_workload_identity_provider: ${{ secrets.COSIGN_GCP_WORKLOAD_IDENTITY_PROVIDER_RSA }}
188+
gcp_service_account: ${{ secrets.COSIGN_GCP_SERVICE_ACCOUNT_RSA }}
189+
gcp_cosign_key: ${{ secrets.COSIGN_KEY_RSA }}
190+
snyk_token: ${{ secrets.SNYK_TOKEN }}
191+
192+
test-makefile-google:
193+
uses: ./.github/workflows/build-sign-scan.yaml
194+
with:
195+
context_path: build-sign-scan/tests/alpine
196+
make_target: unstable
197+
docker_login: false
198+
docker_oidc: true
199+
env: |
200+
REGISTRY=us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable
201+
VERSION=test-makefile-google-1
202+
docker_additional_tags: |
203+
us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable/test-build-sign-scan:test-makefile-google-2
204+
snyk: true
205+
sign: true
206+
secrets: inherit
207+
208+
review:
209+
runs-on: ubuntu-latest
210+
211+
permissions:
212+
contents: 'read'
213+
id-token: 'write'
214+
215+
needs:
216+
- test-docker-build-local
217+
- test-docker-build-single-platform
218+
- test-docker-build-multi-platform
219+
- test-docker-build-secrets
220+
- test-docker-build-google
221+
- test-makefile-local
222+
- test-makefile-single-platform
223+
- test-makefile-multi-platform
224+
- test-makefile-secrets
225+
- test-makefile-google
226+
227+
steps:
228+
- name: Report Test Results
229+
env:
230+
NEEDS_CONTEXT: ${{ toJSON(needs) }}
231+
run: |
232+
function assert() {
233+
if ! [[ "${2}" =~ ${3} ]]; then
234+
echo "::error::Test ${test_name}: ${1}: expected \"${3}\", got \"${2}\"."
235+
exit_code=$((exit_code+1))
236+
fi
237+
}
238+
239+
echo "$NEEDS_CONTEXT" > outputs.json
240+
exit_code=0
241+
for build_type in docker-build makefile; do
242+
for image_type in local single-platform multi-platform secrets google; do
243+
test_name="test-${build_type}-${image_type}"
244+
245+
# Test built tags
246+
image_name=artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan
247+
test "${image_type}" == google && image_name=us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable/test-build-sign-scan
248+
tags=$(jq -r ".\"${test_name}\".outputs.image_tags" outputs.json | tr ',' '\n' | sort | tr '\n' ',' | sed -e 's/,$//')
249+
assert tags "${tags}" "${image_name}:${test_name}-1,${image_name}:${test_name}-2"
250+
251+
# Test built platforms
252+
platforms=$(jq -r ".\"${test_name}\".outputs.image_platforms" outputs.json)
253+
test "${image_type}" == single && assert platforms "${platforms}" '["linux/amd64"]'
254+
test "${image_type}" != local -a "${image_type}" != single-platform && assert platforms "${platforms}" '["linux/amd64","linux/arm64"]'
255+
256+
# Test Snyk output
257+
snyk_summary=$(jq -r ".\"${test_name}\".outputs.snyk_summary" outputs.json)
258+
test "${image_type}" != local -a "${image_type}" != secrets && assert snyk_summary "${snyk_summary}" 'crtitical: [0-9]+, high: [0-9]+, medium: [0-9]+, low: [0-9]+'
259+
260+
# Test Trivy output
261+
trivy_summary=$(jq -r ".\"${test_name}\".outputs.trivy_summary" outputs.json)
262+
test "${image_type}" != local -a "${image_type}" != secrets && assert trivy_summary "${trivy_summary}" '(Tests: [0-9]+ \(SUCCESSES: [0-9]+, FAILURES: [0-9]+\)|PASS)'
263+
264+
# Test Scan output
265+
sign_summary=$(jq -r ".\"${test_name}\".outputs.sign_summary" outputs.json)
266+
test "${image_type}" != local -a "${image_type}" != secrets && assert sign_summary "${sign_summary}" 'Signed .+ with Cosign'
267+
done
268+
done
269+
exit $exit_code
270+
shell: bash

0 commit comments

Comments
 (0)