Skip to content

Commit f47bbd7

Browse files
emosbaughemosbaugh
committed
Merge branch 'main' into k0s-1-29
2 parents 5901634 + e850198 commit f47bbd7

File tree

183 files changed

+4795
-2017
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

183 files changed

+4795
-2017
lines changed

‎.github/actions/e2e/action.yml

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -7,24 +7,6 @@ inputs:
77
is-large-runner:
88
description: 'Whether the test is running on a large runner'
99
required: true
10-
airgap-license-id:
11-
description: 'airgap-enabled license id to use for e2e tests'
12-
required: true
13-
snapshot-license-id:
14-
description: 'snapshot-enabled license id to use for e2e tests'
15-
required: true
16-
snapshot-license:
17-
description: 'snapshot-enabled license (b64) to use for e2e tests'
18-
required: true
19-
license-id:
20-
description: 'license id to use for e2e tests'
21-
required: true
22-
airgap-snapshot-license-id:
23-
description: 'airgap-snapshot-enabled license id to use for e2e tests'
24-
required: true
25-
license:
26-
description: 'license (b64) to use for e2e tests'
27-
required: true
2810
dr-aws-access-key-id:
2911
description: 'Disaster Recovery AWS Access Key ID'
3012
required: true
@@ -96,12 +78,6 @@ runs:
9678
run: |
9779
export SHORT_SHA=${{ inputs.version-specifier }}
9880
echo "${SHORT_SHA}"
99-
export LICENSE_ID=${{ inputs.license-id }}
100-
export AIRGAP_LICENSE_ID=${{ inputs.airgap-license-id }}
101-
export SNAPSHOT_LICENSE_ID=${{ inputs.snapshot-license-id }}
102-
export AIRGAP_SNAPSHOT_LICENSE_ID=${{ inputs.airgap-snapshot-license-id }}
103-
echo "${{ inputs.license }}" | base64 --decode > e2e/license.yaml
104-
echo "${{ inputs.snapshot-license }}" | base64 --decode > e2e/snapshot-license.yaml
10581
export DR_AWS_S3_ENDPOINT=https://s3.amazonaws.com
10682
export DR_AWS_S3_REGION=us-east-1
10783
export DR_AWS_S3_BUCKET=kots-testim-snapshots

‎.github/actions/scan-image/action.yml

Lines changed: 112 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: Scan image
1+
name: Scan Container Image Grype SARIF
22
description: 'Scan a container image for vulnerabilities and optionally upload the results for GitHub code scanning'
33
inputs:
44
image-ref:
@@ -7,7 +7,35 @@ inputs:
77
upload-sarif:
88
description: 'Whether to upload the scan results as a SARIF file'
99
required: false
10-
default: 'false'
10+
default: 'true'
11+
severity-cutoff:
12+
description: 'Minimum severity to report (critical, high, medium, low, negligible)'
13+
required: false
14+
default: 'medium'
15+
fail-build:
16+
description: 'Fail the workflow if vulnerabilities are found'
17+
required: false
18+
default: 'true'
19+
output-file:
20+
description: 'Output file name for SARIF results'
21+
required: false
22+
default: 'results.sarif'
23+
timeout-minutes:
24+
description: 'Maximum time in minutes to wait for the scan to complete'
25+
required: false
26+
default: '30'
27+
retention-days:
28+
description: 'Number of days to retain the scan results artifact'
29+
required: false
30+
default: '90'
31+
category-prefix:
32+
description: 'Prefix to use for the SARIF category name'
33+
required: false
34+
default: 'image-scan-'
35+
only-fixed:
36+
description: 'Only report vulnerabilities that have a fix available'
37+
required: false
38+
default: 'true'
1139

1240
runs:
1341
using: composite
@@ -18,29 +46,92 @@ runs:
1846
run: |
1947
image_id=$(${{github.action_path}}/image_id.sh '${{ inputs.image-ref }}')
2048
echo "image_id=$image_id" >> $GITHUB_OUTPUT
49+
50+
- name: Extract image details
51+
id: image_details
52+
shell: bash
53+
run: |
54+
IMAGE_NAME=$(echo "${{ inputs.image-ref }}" | cut -d':' -f1)
55+
IMAGE_TAG=$(echo "${{ inputs.image-ref }}" | cut -d':' -f2 | cut -d'@' -f1)
56+
[[ "$IMAGE_TAG" == "$IMAGE_NAME" ]] && IMAGE_TAG="latest"
57+
SAFE_NAME=$(echo "${IMAGE_NAME}-${IMAGE_TAG}" | sed 's/[\/:]/-/g')
58+
SAFE_IMAGE_NAME=$(echo "${IMAGE_NAME}" | sed 's/[\/:]/-/g')
59+
{
60+
echo "image_name=${IMAGE_NAME}"
61+
echo "image_tag=${IMAGE_TAG}"
62+
echo "safe_name=${SAFE_NAME}"
63+
echo "safe_image_name=${SAFE_IMAGE_NAME}"
2164
22-
- name: Scan image
23-
uses: aquasecurity/[email protected]
65+
} >> "$GITHUB_OUTPUT"
66+
67+
- name: Scan image with Grype
68+
uses: anchore/scan-action@v6
69+
id: scan
70+
continue-on-error: ${{ inputs.fail-build != 'true' }}
2471
with:
25-
image-ref: '${{ inputs.image-ref }}'
26-
ignore-unfixed: true
27-
severity: CRITICAL,HIGH,MEDIUM
28-
exit-code: 1
29-
trivyignores: .trivyignore
30-
31-
- name: Output sarif
32-
uses: aquasecurity/[email protected]
72+
image: "${{ inputs.image-ref }}"
73+
fail-build: "${{ inputs.fail-build }}"
74+
severity-cutoff: "${{ inputs.severity-cutoff }}"
75+
output-format: sarif
76+
output-file: "${{ inputs.output-file }}"
77+
by-cve: true
78+
only-fixed: "${{ inputs.only-fixed }}"
79+
80+
- name: Check scan status
81+
if: steps.scan.outcome == 'failure' && inputs.fail-build == 'true'
82+
shell: bash
83+
run: |
84+
echo "::error::Scan failed for image ${{ inputs.image-ref }}"
85+
echo "Please check the scan logs above for details"
86+
exit 1
87+
88+
- name: Enrich or generate SARIF
3389
if: ${{ !cancelled() && inputs.upload-sarif == 'true' }}
34-
with:
35-
image-ref: '${{ matrix.image }}'
36-
format: sarif
37-
output: trivy-results.sarif
38-
ignore-unfixed: true
39-
severity: CRITICAL,HIGH,MEDIUM
90+
shell: bash
91+
run: |
92+
if [ ! -f ${{ inputs.output-file }} ]; then
93+
echo "No SARIF file found — creating minimal empty SARIF"
94+
echo '{"version":"2.1.0","runs":[{"tool":{"driver":{"name":"Anchore Grype","informationUri":"https://github.com/anchore/grype","rules":[]}},"results":[],"properties":{"isFallbackSarif":true}}]}' > ${{ inputs.output-file }}
95+
fi
96+
97+
jq --arg imageRef "${{ inputs.image-ref }}" \
98+
--arg repo "replicatedhq/embedded-cluster" \
99+
--arg name "${{ steps.image_details.outputs.image_name }}" \
100+
--arg tag "${{ steps.image_details.outputs.image_tag }}" \
101+
--arg scanTime "$(date -u +"%Y-%m-%dT%H:%M:%SZ")" \
102+
--arg digest "$(echo "${{ inputs.image-ref }}" | grep -o 'sha256:[a-f0-9]*' || true)" \
103+
'.runs[0].properties = {
104+
"imageRef": (if ($name | startswith("replicatedhq/embedded-cluster/")) then $name else ($name | sub("proxy\\.replicated\\.com/anonymous/(?:ttl\\.sh/runner/|registry\\.k8s\\.io/|kotsadm/|ttl\\.sh/replicated/|replicated/)"; "replicatedhq/embedded-cluster/")) end + ":" + $tag + (if $digest != "" then "@" + $digest else "" end)),
105+
"repository": $repo,
106+
"scanTime": $scanTime,
107+
"imageMetadata": {
108+
"name": (if ($name | startswith("replicatedhq/embedded-cluster/")) then $name else ($name | sub("proxy\\.replicated\\.com/anonymous/(?:ttl\\.sh/runner/|registry\\.k8s\\.io/|kotsadm/|ttl\\.sh/replicated/|replicated/)"; "replicatedhq/embedded-cluster/")) end),
109+
"tag": $tag,
110+
"digest": ($digest | if . == "" then null else . end),
111+
"repoDigest": (if ($name | startswith("replicatedhq/embedded-cluster/")) then $name else ($name | sub("proxy\\.replicated\\.com/anonymous/(?:ttl\\.sh/runner/|registry\\.k8s\\.io/|kotsadm/|ttl\\.sh/replicated/|replicated/)"; "replicatedhq/embedded-cluster/")) end + "@" + ($digest | if . == "" then null else . end)),
112+
"labels": {},
113+
"annotations": {
114+
"scanTime": $scanTime,
115+
"tool": "grype",
116+
"toolVersion": "latest"
117+
}
118+
}
119+
}' ${{ inputs.output-file }} > enriched-results.sarif
40120
41-
- name: Upload sarif
121+
mv enriched-results.sarif ${{ inputs.output-file }}
122+
123+
- name: Upload SARIF file
42124
if: ${{ !cancelled() && inputs.upload-sarif == 'true' }}
43125
uses: github/codeql-action/upload-sarif@v3
44126
with:
45-
sarif_file: trivy-results.sarif
46-
category: 'image-scan:${{ steps.image-id.outputs.image_id }}'
127+
sarif_file: ${{ inputs.output-file }}
128+
category: '${{ inputs.category-prefix }}${{ steps.image_details.outputs.safe_image_name }}'
129+
130+
131+
- name: Archive scan results
132+
if: ${{ !cancelled() && inputs.upload-sarif == 'true' }}
133+
uses: actions/upload-artifact@v4
134+
with:
135+
name: "sarif-${{ steps.image_details.outputs.safe_name }}"
136+
path: ${{ inputs.output-file }}
137+
retention-days: ${{ inputs.retention-days }}

‎.github/workflows/ci.yaml

Lines changed: 7 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,8 @@ jobs:
176176

177177
- uses: oras-project/setup-oras@v1
178178

179+
- uses: imjasonh/[email protected]
180+
179181
- name: Install dagger
180182
run: |
181183
curl -fsSL https://dl.dagger.io/dagger/install.sh | sh
@@ -248,6 +250,8 @@ jobs:
248250

249251
- uses: oras-project/setup-oras@v1
250252

253+
- uses: imjasonh/[email protected]
254+
251255
- name: Install dagger
252256
run: |
253257
curl -fsSL https://dl.dagger.io/dagger/install.sh | sh
@@ -355,6 +359,8 @@ jobs:
355359

356360
- uses: oras-project/setup-oras@v1
357361

362+
- uses: imjasonh/[email protected]
363+
358364
- name: Install dagger
359365
run: |
360366
curl -fsSL https://dl.dagger.io/dagger/install.sh | sh
@@ -682,17 +688,9 @@ jobs:
682688
password: ${{ secrets.DOCKERHUB_PASSWORD }}
683689
- name: Free up runner disk space
684690
uses: ./.github/actions/free-disk-space
685-
- name: Write license files
686-
run: |
687-
echo "${{ secrets.STAGING_EMBEDDED_CLUSTER_LICENSE }}" | base64 --decode > e2e/license.yaml
688-
echo "${{ secrets.STAGING_EMBEDDED_CLUSTER_SNAPSHOT_LICENSE }}" | base64 --decode > e2e/snapshot-license.yaml
689691
- name: Run test
690692
env:
691693
SHORT_SHA: dev-${{ needs.git-sha.outputs.git_sha }}
692-
LICENSE_ID: ${{ secrets.STAGING_EMBEDDED_CLUSTER_LICENSE_ID }}
693-
AIRGAP_LICENSE_ID: ${{ secrets.STAGING_EMBEDDED_CLUSTER_AIRGAP_LICENSE_ID }}
694-
SNAPSHOT_LICENSE_ID: ${{ secrets.STAGING_EMBEDDED_CLUSTER_SNAPSHOT_LICENSE_ID }}
695-
AIRGAP_SNAPSHOT_LICENSE_ID: ${{ secrets.STAGING_EMBEDDED_CLUSTER_AIRGAP_SNAPSHOT_LICENSE_ID }}
696694
DR_AWS_S3_ENDPOINT: https://s3.amazonaws.com
697695
DR_AWS_S3_REGION: us-east-1
698696
DR_AWS_S3_BUCKET: kots-testim-snapshots
@@ -764,12 +762,6 @@ jobs:
764762
with:
765763
test-name: '${{ matrix.test }}'
766764
is-large-runner: ${{ matrix.runner == 'embedded-cluster-2' }}
767-
airgap-license-id: ${{ secrets.STAGING_EMBEDDED_CLUSTER_AIRGAP_LICENSE_ID }}
768-
snapshot-license-id: ${{ secrets.STAGING_EMBEDDED_CLUSTER_SNAPSHOT_LICENSE_ID }}
769-
snapshot-license: ${{ secrets.STAGING_EMBEDDED_CLUSTER_SNAPSHOT_LICENSE }}
770-
airgap-snapshot-license-id: ${{ secrets.STAGING_EMBEDDED_CLUSTER_AIRGAP_SNAPSHOT_LICENSE_ID }}
771-
license-id: ${{ secrets.STAGING_EMBEDDED_CLUSTER_LICENSE_ID }}
772-
license: ${{ secrets.STAGING_EMBEDDED_CLUSTER_LICENSE }}
773765
dr-aws-access-key-id: ${{ secrets.TESTIM_AWS_ACCESS_KEY_ID }}
774766
dr-aws-secret-access-key: ${{ secrets.TESTIM_AWS_SECRET_ACCESS_KEY }}
775767
k0s-version: ${{ needs.build-current.outputs.k0s_version }}
@@ -807,12 +799,6 @@ jobs:
807799
with:
808800
test-name: '${{ matrix.test }}'
809801
is-large-runner: ${{ matrix.runner == 'embedded-cluster-2' }}
810-
airgap-license-id: ${{ secrets.STAGING_EMBEDDED_CLUSTER_AIRGAP_LICENSE_ID }}
811-
snapshot-license-id: ${{ secrets.STAGING_EMBEDDED_CLUSTER_SNAPSHOT_LICENSE_ID }}
812-
snapshot-license: ${{ secrets.STAGING_EMBEDDED_CLUSTER_SNAPSHOT_LICENSE }}
813-
airgap-snapshot-license-id: ${{ secrets.STAGING_EMBEDDED_CLUSTER_AIRGAP_SNAPSHOT_LICENSE_ID }}
814-
license-id: ${{ secrets.STAGING_EMBEDDED_CLUSTER_LICENSE_ID }}
815-
license: ${{ secrets.STAGING_EMBEDDED_CLUSTER_LICENSE }}
816802
dr-aws-access-key-id: ${{ secrets.TESTIM_AWS_ACCESS_KEY_ID }}
817803
dr-aws-secret-access-key: ${{ secrets.TESTIM_AWS_SECRET_ACCESS_KEY }}
818804
k0s-version: ${{ needs.build-current.outputs.k0s_version }}
@@ -824,7 +810,7 @@ jobs:
824810
# it is used for the github branch protection rule
825811
validate-success:
826812
name: Validate success # this name is used by .github/workflows/automated-prs-manager.yaml
827-
runs-on: ubuntu-20.04
813+
runs-on: ubuntu-latest
828814
needs:
829815
- e2e
830816
- e2e-main

‎.github/workflows/image-deps-updater.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ on:
2626

2727
jobs:
2828
compile-buildtools:
29-
runs-on: ubuntu-20.04
29+
runs-on: ubuntu-latest
3030
steps:
3131
- name: Checkout
3232
uses: actions/checkout@v4
@@ -48,7 +48,7 @@ jobs:
4848
path: output/bin/buildtools
4949

5050
update-addon-images:
51-
runs-on: ubuntu-20.04
51+
runs-on: ubuntu-latest
5252
needs: [compile-buildtools]
5353
strategy:
5454
fail-fast: false

‎.github/workflows/image-scan.yaml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,3 +135,9 @@ jobs:
135135
with:
136136
image-ref: '${{ matrix.image }}'
137137
upload-sarif: ${{ github.ref == 'refs/heads/main' }}
138+
fail-build: 'true'
139+
severity-cutoff: 'medium'
140+
output-file: 'results.sarif'
141+
retention-days: '90'
142+
category-prefix: 'image-scan-'
143+
only-fixed: 'true'

‎.github/workflows/release-prod.yaml

Lines changed: 5 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -150,6 +150,8 @@ jobs:
150150

151151
- uses: oras-project/setup-oras@v1
152152

153+
- uses: imjasonh/[email protected]
154+
153155
- name: Download buildtools artifact
154156
uses: actions/download-artifact@v4
155157
with:
@@ -427,7 +429,8 @@ jobs:
427429
path: output/bin
428430
- name: Download current binary
429431
env:
430-
LICENSE_ID: ${{ secrets.STAGING_EMBEDDED_CLUSTER_LICENSE_ID }}
432+
# staging ci license id
433+
LICENSE_ID: 2cQCFfBxG7gXDmq1yAgPSM4OViF
431434
run: |
432435
export APP_VERSION="appver-${{ github.ref_name }}"
433436
curl --retry 5 --retry-all-errors -fL -o embedded-cluster-smoke-test-staging-app-ci.tgz "https://ec-e2e-replicated-app.testcluster.net/embedded/embedded-cluster-smoke-test-staging-app/ci/${APP_VERSION}" -H "Authorization: $LICENSE_ID"
@@ -514,17 +517,9 @@ jobs:
514517
password: ${{ secrets.DOCKERHUB_PASSWORD }}
515518
- name: Free up runner disk space
516519
uses: ./.github/actions/free-disk-space
517-
- name: Write license files
518-
run: |
519-
echo "${{ secrets.STAGING_EMBEDDED_CLUSTER_LICENSE }}" | base64 --decode > e2e/license.yaml
520-
echo "${{ secrets.STAGING_EMBEDDED_CLUSTER_SNAPSHOT_LICENSE }}" | base64 --decode > e2e/snapshot-license.yaml
521520
- name: Run test
522521
env:
523522
SHORT_SHA: ${{ github.ref_name }}
524-
LICENSE_ID: ${{ secrets.STAGING_EMBEDDED_CLUSTER_LICENSE_ID }}
525-
AIRGAP_LICENSE_ID: ${{ secrets.STAGING_EMBEDDED_CLUSTER_AIRGAP_LICENSE_ID }}
526-
SNAPSHOT_LICENSE_ID: ${{ secrets.STAGING_EMBEDDED_CLUSTER_SNAPSHOT_LICENSE_ID }}
527-
AIRGAP_SNAPSHOT_LICENSE_ID: ${{ secrets.STAGING_EMBEDDED_CLUSTER_AIRGAP_SNAPSHOT_LICENSE_ID }}
528523
DR_AWS_S3_ENDPOINT: https://s3.amazonaws.com
529524
DR_AWS_S3_REGION: us-east-1
530525
DR_AWS_S3_BUCKET: kots-testim-snapshots
@@ -598,12 +593,6 @@ jobs:
598593
with:
599594
test-name: '${{ matrix.test }}'
600595
is-large-runner: ${{ matrix.runner == 'embedded-cluster-2' }}
601-
airgap-license-id: ${{ secrets.STAGING_EMBEDDED_CLUSTER_AIRGAP_LICENSE_ID }}
602-
snapshot-license-id: ${{ secrets.STAGING_EMBEDDED_CLUSTER_SNAPSHOT_LICENSE_ID }}
603-
snapshot-license: ${{ secrets.STAGING_EMBEDDED_CLUSTER_SNAPSHOT_LICENSE }}
604-
airgap-snapshot-license-id: ${{ secrets.STAGING_EMBEDDED_CLUSTER_AIRGAP_SNAPSHOT_LICENSE_ID }}
605-
license-id: ${{ secrets.STAGING_EMBEDDED_CLUSTER_LICENSE_ID }}
606-
license: ${{ secrets.STAGING_EMBEDDED_CLUSTER_LICENSE }}
607596
dr-aws-access-key-id: ${{ secrets.TESTIM_AWS_ACCESS_KEY_ID }}
608597
dr-aws-secret-access-key: ${{ secrets.TESTIM_AWS_SECRET_ACCESS_KEY }}
609598
version-specifier: ${{ github.ref_name }}
@@ -616,7 +605,7 @@ jobs:
616605
# this job will validate that all the tests passed
617606
validate-release-success:
618607
name: Validate success
619-
runs-on: ubuntu-20.04
608+
runs-on: ubuntu-latest
620609
needs:
621610
- e2e
622611
- e2e-docker

0 commit comments

Comments
 (0)