Skip to content

Commit a22409f

Browse files
mtupitsynmtupitsyn
committed
CASMINST-6279: redesign build-sign-scan action
1 parent af9f813 commit a22409f

9 files changed

Lines changed: 1016 additions & 258 deletions

File tree

‎.github/workflows/build-sign-scan.yaml‎

Lines changed: 471 additions & 0 deletions
Large diffs are not rendered by default.

‎.github/workflows/test-build-sign-scan.yaml‎

Lines changed: 270 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,270 @@
1+
#
2+
# MIT License
3+
#
4+
# (C) Copyright 2025 Hewlett Packard Enterprise Development LP
5+
#
6+
# Permission is hereby granted, free of charge, to any person obtaining a
7+
# copy of this software and associated documentation files (the "Software"),
8+
# to deal in the Software without restriction, including without limitation
9+
# the rights to use, copy, modify, merge, publish, distribute, sublicense,
10+
# and/or sell copies of the Software, and to permit persons to whom the
11+
# Software is furnished to do so, subject to the following conditions:
12+
#
13+
# The above copyright notice and this permission notice shall be included
14+
# in all copies or substantial portions of the Software.
15+
#
16+
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19+
# THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR
20+
# OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
21+
# ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
22+
# OTHER DEALINGS IN THE SOFTWARE.
23+
#
24+
name: Test build-sign-scan reusable workflow
25+
26+
on:
27+
push:
28+
paths:
29+
- .github/workflows/test-build-sign-scan.yaml
30+
- build-sign-scan/**
31+
workflow_dispatch:
32+
33+
jobs:
34+
test-docker-build-local:
35+
uses: ./.github/workflows/build-sign-scan.yaml
36+
with:
37+
context_path: build-sign-scan/tests/alpine
38+
docker_tag: artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-local-1
39+
docker_additional_tags: |
40+
41+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-local-2
42+
docker_build_args: |
43+
--label='Random label 1'
44+
45+
--label="Random label 2"
46+
env: |
47+
VAR1=var1
48+
49+
VAR2='var2 var2'
50+
VAR3="var3 var3"
51+
VAR4='var4
52+
var4'
53+
VAR5="var4
54+
var4"
55+
docker_push: false
56+
snyk: false
57+
sign: false
58+
59+
# test-docker-build-single-platform:
60+
# uses: ./.github/workflows/build-sign-scan.yaml
61+
# with:
62+
# context_path: build-sign-scan/tests/alpine
63+
# docker_tag: artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-single-platform-1
64+
# docker_additional_tags: |
65+
# artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-single-platform-2
66+
# snyk: true
67+
# sign: true
68+
# secrets: inherit
69+
70+
# test-docker-build-multi-platform:
71+
# uses: ./.github/workflows/build-sign-scan.yaml
72+
# with:
73+
# context_path: build-sign-scan/tests/alpine
74+
# docker_tag: artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-multi-platform-1
75+
# docker_build_platforms: linux/amd64,linux/arm64
76+
# docker_additional_tags: |
77+
# artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-multi-platform-2
78+
# snyk: true
79+
# sign: true
80+
# secrets: inherit
81+
82+
# test-docker-build-secrets:
83+
# uses: ./.github/workflows/build-sign-scan.yaml
84+
# with:
85+
# context_path: build-sign-scan/tests/sles
86+
# docker_tag: artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-secrets-1
87+
# docker_build_platforms: linux/amd64,linux/arm64
88+
# docker_additional_tags: |
89+
# artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-docker-build-secrets-2
90+
# snyk: false
91+
# sign: false
92+
# secrets:
93+
# docker_username: ${{ secrets.ARTIFACTORY_ALGOL60_USERNAME }}
94+
# docker_password: ${{ secrets.ARTIFACTORY_ALGOL60_TOKEN }}
95+
# docker_secrets: |
96+
# SLES_REPO_USERNAME=${{ secrets.ARTIFACTORY_ALGOL60_READONLY_USERNAME }}
97+
# SLES_REPO_PASSWORD=${{ secrets.ARTIFACTORY_ALGOL60_READONLY_TOKEN }}
98+
# gcp_workload_identity_provider: ${{ secrets.COSIGN_GCP_WORKLOAD_IDENTITY_PROVIDER_RSA }}
99+
# gcp_service_account: ${{ secrets.COSIGN_GCP_SERVICE_ACCOUNT_RSA }}
100+
# gcp_cosign_key: ${{ secrets.COSIGN_KEY_RSA }}
101+
# snyk_token: ${{ secrets.SNYK_TOKEN }}
102+
103+
# test-docker-build-google:
104+
# uses: ./.github/workflows/build-sign-scan.yaml
105+
# with:
106+
# context_path: build-sign-scan/tests/alpine
107+
# docker_login: false
108+
# docker_oidc: true
109+
# docker_tag: us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable/test-build-sign-scan:test-docker-build-google-1
110+
# docker_build_platforms: linux/amd64,linux/arm64
111+
# docker_additional_tags: |
112+
# us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable/test-build-sign-scan:test-docker-build-google-2
113+
# snyk: true
114+
# sign: true
115+
# secrets: inherit
116+
117+
test-makefile-local:
118+
uses: ./.github/workflows/build-sign-scan.yaml
119+
with:
120+
context_path: build-sign-scan/tests/alpine
121+
make_target: local
122+
docker_login: false
123+
docker_additional_tags: |
124+
125+
artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-makefile-local-2
126+
docker_build_args: |
127+
--label='Random label 1'
128+
129+
--label="Random label 2"
130+
env: |
131+
VERSION=test-makefile-local-1
132+
VAR1=var1
133+
134+
VAR2='var2 var2'
135+
VAR3="var3 var3"
136+
VAR4='var4
137+
var4'
138+
VAR5="var4
139+
var4"
140+
snyk: false
141+
sign: false
142+
143+
# test-makefile-single-platform:
144+
# uses: ./.github/workflows/build-sign-scan.yaml
145+
# with:
146+
# context_path: build-sign-scan/tests/alpine
147+
# make_target: unstable
148+
# env: |
149+
# PLATFORM=linux/amd64
150+
# VERSION=test-makefile-single-platform-1
151+
# docker_additional_tags: |
152+
# artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-makefile-single-platform-2
153+
# snyk: true
154+
# sign: true
155+
# secrets: inherit
156+
157+
# test-makefile-multi-platform:
158+
# uses: ./.github/workflows/build-sign-scan.yaml
159+
# with:
160+
# context_path: build-sign-scan/tests/alpine
161+
# make_target: unstable
162+
# env: |
163+
# VERSION=test-makefile-multi-platform-1
164+
# docker_additional_tags: |
165+
# artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-makefile-multi-platform-2
166+
# snyk: true
167+
# sign: true
168+
# secrets: inherit
169+
170+
# test-makefile-secrets:
171+
# uses: ./.github/workflows/build-sign-scan.yaml
172+
# with:
173+
# context_path: build-sign-scan/tests/sles
174+
# make_target: unstable
175+
# env: |
176+
# VERSION=test-makefile-secrets-1
177+
# docker_additional_tags: |
178+
# artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan:test-makefile-secrets-2
179+
# snyk: false
180+
# sign: false
181+
# secrets:
182+
# docker_username: ${{ secrets.ARTIFACTORY_ALGOL60_USERNAME }}
183+
# docker_password: ${{ secrets.ARTIFACTORY_ALGOL60_TOKEN }}
184+
# docker_secrets: |
185+
# SLES_REPO_USERNAME=${{ secrets.ARTIFACTORY_ALGOL60_READONLY_USERNAME }}
186+
# SLES_REPO_PASSWORD=${{ secrets.ARTIFACTORY_ALGOL60_READONLY_TOKEN }}
187+
# gcp_workload_identity_provider: ${{ secrets.COSIGN_GCP_WORKLOAD_IDENTITY_PROVIDER_RSA }}
188+
# gcp_service_account: ${{ secrets.COSIGN_GCP_SERVICE_ACCOUNT_RSA }}
189+
# gcp_cosign_key: ${{ secrets.COSIGN_KEY_RSA }}
190+
# snyk_token: ${{ secrets.SNYK_TOKEN }}
191+
192+
# test-makefile-google:
193+
# uses: ./.github/workflows/build-sign-scan.yaml
194+
# with:
195+
# context_path: build-sign-scan/tests/alpine
196+
# make_target: unstable
197+
# docker_login: false
198+
# docker_oidc: true
199+
# env: |
200+
# REGISTRY=us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable
201+
# VERSION=test-makefile-google-1
202+
# docker_additional_tags: |
203+
# us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable/test-build-sign-scan:test-makefile-google-2
204+
# snyk: true
205+
# sign: true
206+
# secrets: inherit
207+
208+
# review:
209+
# runs-on: ubuntu-latest
210+
211+
# permissions:
212+
# contents: 'read'
213+
# id-token: 'write'
214+
215+
# needs:
216+
# - test-docker-build-local
217+
# - test-docker-build-single-platform
218+
# - test-docker-build-multi-platform
219+
# - test-docker-build-secrets
220+
# - test-docker-build-google
221+
# - test-makefile-local
222+
# - test-makefile-single-platform
223+
# - test-makefile-multi-platform
224+
# - test-makefile-secrets
225+
# - test-makefile-google
226+
227+
# steps:
228+
# - name: Report Test Results
229+
# env:
230+
# NEEDS_CONTEXT: ${{ toJSON(needs) }}
231+
# run: |
232+
# function assert() {
233+
# if ! [[ "${2}" =~ ${3} ]]; then
234+
# echo "::error::Test ${test_name}: ${1}: expected \"${3}\", got \"${2}\"."
235+
# exit_code=$((exit_code+1))
236+
# fi
237+
# }
238+
239+
# echo "$NEEDS_CONTEXT" > outputs.json
240+
# exit_code=0
241+
# for build_type in docker-build makefile; do
242+
# for image_type in local single-platform multi-platform secrets google; do
243+
# test_name="test-${build_type}-${image_type}"
244+
245+
# # Test built tags
246+
# image_name=artifactory.algol60.net/csm-docker-backup/unstable/test-build-sign-scan
247+
# test "${image_type}" == google && image_name=us-docker.pkg.dev/hpe-stage-csm-release/csm-docker/unstable/test-build-sign-scan
248+
# tags=$(jq -r ".\"${test_name}\".outputs.image_tags" outputs.json | tr ',' '\n' | sort | tr '\n' ',' | sed -e 's/,$//')
249+
# assert tags "${tags}" "${image_name}:${test_name}-1,${image_name}:${test_name}-2"
250+
251+
# # Test built platforms
252+
# platforms=$(jq -r ".\"${test_name}\".outputs.image_platforms" outputs.json)
253+
# test "${image_type}" == single && assert platforms "${platforms}" '["linux/amd64"]'
254+
# test "${image_type}" != local -a "${image_type}" != single-platform && assert platforms "${platforms}" '["linux/amd64","linux/arm64"]'
255+
256+
# # Test Snyk output
257+
# snyk_summary=$(jq -r ".\"${test_name}\".outputs.snyk_summary" outputs.json)
258+
# test "${image_type}" != local -a "${image_type}" != secrets && assert snyk_summary "${snyk_summary}" 'crtitical: [0-9]+, high: [0-9]+, medium: [0-9]+, low: [0-9]+'
259+
260+
# # Test Trivy output
261+
# trivy_summary=$(jq -r ".\"${test_name}\".outputs.trivy_summary" outputs.json)
262+
# test "${image_type}" != local -a "${image_type}" != secrets && assert trivy_summary "${trivy_summary}" '(Tests: [0-9]+ \(SUCCESSES: [0-9]+, FAILURES: [0-9]+\)|PASS)'
263+
264+
# # Test Scan output
265+
# sign_summary=$(jq -r ".\"${test_name}\".outputs.sign_summary" outputs.json)
266+
# test "${image_type}" != local -a "${image_type}" != secrets && assert sign_summary "${sign_summary}" 'Signed .+ with Cosign'
267+
# done
268+
# done
269+
# exit $exit_code
270+
# shell: bash

0 commit comments

Comments
 (0)