From d20e1b18af3ed98d1c6a0788431fb893251fad9f Mon Sep 17 00:00:00 2001 From: David Caravello <119438707+dcaravel@users.noreply.github.com> Date: Wed, 11 Feb 2026 22:00:31 -0600 Subject: [PATCH 01/11] test --- .../scanner-versioned-definitions-update.yaml | 350 +----------------- 1 file changed, 1 insertion(+), 349 deletions(-) diff --git a/.github/workflows/scanner-versioned-definitions-update.yaml b/.github/workflows/scanner-versioned-definitions-update.yaml index 12c7b57fe9f44..567672bcb5ff7 100644 --- a/.github/workflows/scanner-versioned-definitions-update.yaml +++ b/.github/workflows/scanner-versioned-definitions-update.yaml @@ -100,89 +100,6 @@ jobs: with: fetch-depth: 0 - - name: Download NVD PR - if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-nvd') - run: | - set -eu - since_time=$(date -u -d '24 hours ago' '+%a, %d %b %Y %H:%M:%S GMT') - NVD_BUNDLE_TYPE=${{ github.event.inputs.job || 'nvd-feeds' }} - case "$NVD_BUNDLE_TYPE" in - nvd-api) - nvd_file=nvd-api.zip - ;; - nvd-feeds) - nvd_file=nvd-feeds.zip - ;; - *) - echo >&2 "Warning: invalid NVD bundle type '$NVD_BUNDLE_TYPE'" - exit 1 - esac - branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}} - # Replace / with -, so the branch name isn't truncated when pushed to GCS. - dir=${branch////-} - url="https://storage.googleapis.com/scanner-v4-test/nvd/$dir/$nvd_file" - - code=$(curl \ - -o nvd.zip \ - -w "%{http_code}" \ - -H "If-Modified-Since: $since_time" \ - "$url") - - echo "code: $code" - echo "$code" | grep -q 200 - - - name: Download NVD - if: github.event_name != 'pull_request' || !contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-nvd') - run: | - set -eu - since_time=$(date -u -d '24 hours ago' '+%a, %d %b %Y %H:%M:%S GMT') - NVD_BUNDLE_TYPE=${{ github.event.inputs.job || 'nvd-feeds' }} - case "$NVD_BUNDLE_TYPE" in - nvd-api) - nvd_file=nvd-api.zip - ;; - nvd-feeds) - nvd_file=nvd-feeds.zip - ;; - *) - echo >&2 "Warning: invalid NVD bundle type '$NVD_BUNDLE_TYPE'" - exit 1 - esac - url="https://definitions.stackrox.io/v4/nvd/$nvd_file" - - code=$(curl \ - -o nvd.zip \ - -w "%{http_code}" \ - -H "If-Modified-Since: $since_time" \ - "$url") - - echo "code: $code" - echo "$code" | grep -q 200 - - - name: Set MANUAL_URL - id: set-manual-url - run: | - if [ "${{ github.event_name }}" == "schedule" ]; then - # Scheduled workflows should use the master branch - echo "manual_url=https://raw.githubusercontent.com/stackrox/stackrox/master/scanner/updater/manual/vulns.yaml" >> "$GITHUB_ENV" - else - # Determine the SHA to use - if [ -z "${{ github.event.pull_request.head.sha }}" ]; then - # Fallback to the current ref or SHA if it's not a pull request event - sha=${{ github.sha }} - else - sha=${{ github.event.pull_request.head.sha }} - fi - - echo "manual_url=https://raw.githubusercontent.com/stackrox/stackrox/$sha/scanner/updater/manual/vulns.yaml" >> "$GITHUB_ENV" - fi - - - uses: ./.github/actions/upload-artifact-with-retry - with: - name: nvd - path: nvd.zip - if-no-files-found: error - build-and-run: if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' needs: @@ -223,269 +140,4 @@ jobs: fetch-depth: 0 ref: ${{ env.ROX_GIT_REF }} - - name: Download NVD - uses: ./.github/actions/download-artifact-with-retry - with: - name: nvd - path: . - - - name: Build updater - run: | - echo "Building updater for version ${{ env.SCANNER_BUNDLE_VERSION }} based on git ref ${{ env.ROX_GIT_REF }}..." - make tag - make -C scanner bin/updater - - - name: Create bundle output directory - run: mkdir -p definitions/${{ env.SCANNER_BUNDLE_VERSION }} - - - name: Sanity check NVD zip - run: | - path="$PWD/nvd.zip" - echo "checking contents of $path" - unzip -l "$path" - echo "STACKROX_NVD_ZIP_PATH=$path" >> "$GITHUB_ENV" - - - name: Run Updater (single bundle) - if: ${{ env.SCANNER_BUNDLE_VERSION == 'v1' }} - run: | - scanner/bin/updater export --manual-url "${{ needs.prepare-environment.outputs.manual_url }}" "definitions/${SCANNER_BUNDLE_VERSION}" - - - name: Run updater (multi bundle) - run: | - tag=$(make -s --no-print-directory tag) - # In pre-4.9, the exporter requires --split to generate multi-bundles. - case "$tag" in - 4.[0-8].*) - scanner/bin/updater export --manual-url "${{ needs.prepare-environment.outputs.manual_url }}" --split bundles - ;; - *) - scanner/bin/updater export --manual-url "${{ needs.prepare-environment.outputs.manual_url }}" bundles - ;; - esac - zip definitions/"$SCANNER_BUNDLE_VERSION"/vulnerabilities.zip bundles/*.json.zst - - - name: Upload definitions artifacts - uses: actions/upload-artifact@v6 - with: - name: artifact_${{ env.SCANNER_BUNDLE_VERSION }} - path: definitions - - # Checkout again to get the latest local actions for cleanup phase - - name: Checkout repository - uses: actions/checkout@v6 - if: always() - with: - fetch-depth: 0 - - build-upload-pr-vulnerabilities: - if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-vulns') - needs: - - prepare-environment - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.5.1 - volumes: - # The updater makes heavy use of /tmp files. - - /tmp:/tmp - - /usr:/mnt/usr - - /opt:/mnt/opt - env: - STACKROX_RHEL_VEX_COMPRESSED_FILE_TIMEOUT: "10m" - steps: - # Checkout master to get the latest local actions - - name: Checkout repository - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - uses: ./.github/actions/job-preamble - with: - free-disk-space: 50 - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Checkout specific reference - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} - - - name: Authenticate with test GCS bucket - if: github.event_name == 'pull_request' - uses: google-github-actions/auth@v3 - with: - credentials_json: ${{ secrets.GOOGLE_SA_CIRCLECI_SCANNER }} - - - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@v3 - - - name: Download NVD - uses: ./.github/actions/download-artifact-with-retry - with: - name: nvd - path: . - - - name: Build updater - run: | - echo "Building updater for pull request ${{ env.PR_NAME }}..." - make tag - make -C scanner bin/updater - - - name: Sanity check NVD zip - run: | - path="$PWD/nvd.zip" - echo "checking contents of $path" - unzip -l "$path" - echo "STACKROX_NVD_ZIP_PATH=$path" >> "$GITHUB_ENV" - - - name: Create bundle output directory - run: mkdir -p definitions/${{ github.event.pull_request.number }} - - - name: Run updater (multi bundle) - run: | - scanner/bin/updater export --manual-url "${{ needs.prepare-environment.outputs.manual_url }}" bundles - zip definitions/${{ github.event.pull_request.number }}/vulnerabilities.zip bundles/*.json.zst - - # PR owner is responsible for verifying vulnerability bundles are generated - - name: Upload PR vulnerabilities - run: | - branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}} - # Replace / with -, so the branch name isn't truncated when pushed to GCS. - dir=${branch////-} - case "$dir" in - dev|1.0.0) - echo "Error: branch $dir is protected. Choose a different branch name." - exit 1 - esac - mkdir -p "$dir" - cp -r "definitions/${{ github.event.pull_request.number }}/." "$dir/" - gsutil -m cp -r "$dir" "gs://scanner-v4-test/vulnerability-bundles/" - - # Checkout again to get the latest local actions for cleanup phase - - name: Checkout repository - uses: actions/checkout@v6 - if: always() - with: - fetch-depth: 0 - - upload-definitions: - needs: - - build-and-run - if: ${{ (failure() || success()) && (github.event_name == 'schedule' || github.event_name == 'workflow_dispatch') }} - runs-on: ubuntu-latest - steps: - # Checkout to run ./.github/actions/download-artifact-with-retry - - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - uses: actions/download-artifact@v7 - with: - # Vulnerability bundles are named `artifact_${{ env.SCANNER_BUNDLE_VERSION }}`. - pattern: "artifact_*" - path: definitions_files - # Merge all artifacts (`/`) into the directory. - merge-multiple: true - - - name: Check vulnerability bundles - working-directory: ./definitions_files - run: | - set -eu - - empty() { - find "${1:-.}" -maxdepth 0 -type d -empty | grep -q . - } - - error() { - echo >&2 "error: $*" - exit 1 - } - - echo "Listing definitions files:" - pwd - ls -l - empty && error "definitions directory (current directory) is empty" - - # Look for version dirs (use globbing, dot files included). - shopt -s dotglob - for d in *; do - echo "Listing bundle version directory '$d':" - ls -l "$d" - [ -d "$d" ] || error "found a non-directory in definitions_files/: $d" - [[ "$d" = .* ]] && error "version directory name not allowed (starts with dot): $d" - empty "$d" && error "bundle version directory is empty" - for f in "$d"/*; do - case "$f" in - */vulnerabilities.zip) ;; - */vulns.json.zst) ;; - *) error "found unexpected file name in bundle version '$d/': $f" ;; - esac - [ -f "$f" ] || error "non-regular file in bundle version '$d/': $f" - [ -s "$f" ] || error "empty file in bundle version '$d/': $f" - done - done - - - name: Authenticate with Google Cloud - uses: google-github-actions/auth@v3 - with: - credentials_json: ${{ secrets.GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER }} - - - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@v3 - - - name: Upload vulnerability bundles to GCS - working-directory: ./definitions_files - run: | - # Upload all bundle directories (preserving the `/` structure). - bucket="gs://definitions.stackrox.io/v4/vulnerability-bundles" - echo "Uploading all dir(s) to $bucket/" - gsutil -m cp -r . "$bucket/" - - - name: Update downstream dev - # Run on schedule or when dispatched to build "dev" (only possible if RC was not requested). - if: github.event_name == 'schedule' || (github.event.inputs.rc_ref == '' && github.event.inputs.stream == 'dev') - run: | - echo "Copy upstream dev (dev) to downstream dev (1.0.0)" - gsutil cp -r gs://definitions.stackrox.io/v4/vulnerability-bundles/dev/* gs://definitions.stackrox.io/v4/vulnerability-bundles/1.0.0/ - - - name: Copy v1 to pre-versioned bundles - # Run on schedule or when dispatched to build "GA" (only possible if RC was not requested). - if: github.event.inputs.rc_ref == '' - run: | - # Only execute if v1 files were created by the build job. - if ! [ -d "definitions_files/v1" ]; then - echo "error: no definition files for v1 were created: skipping..." - exit 0 - fi - # Using v1 bundle for released versions listed in RELEASE_VERSION. - single=gs://definitions.stackrox.io/v4/vulnerability-bundles/v1/vulns.json.zst - multi=gs://definitions.stackrox.io/v4/vulnerability-bundles/v1/vulnerabilities.zip - # Parse all supported pre-4.6 releases and copy the versioned bundle v1 to ensure - # these releases get updates. - grep -E "^4\.(4|5)\.[0-9]+$" scanner/updater/version/RELEASE_VERSION | while read -r release; do - case "$release" in - 4.4.*) - gsutil cp "$single" "gs://definitions.stackrox.io/v4/vulnerability-bundles/$release/" - ;; - 4.5.*) - gsutil cp "$single" "gs://definitions.stackrox.io/v4/vulnerability-bundles/$release/" - gsutil cp "$multi" "gs://definitions.stackrox.io/v4/vulnerability-bundles/$release/" - ;; - *) - echo "Should not happen!" - echo "Error: unexpected release version: $release" - echo "Ignoring..." - ;; - esac - echo "Copied v1 into $release" - done - - send-notification: - needs: - - build-and-run - - upload-definitions - runs-on: ubuntu-latest - if: ${{ failure() && github.ref_name == 'master' }} - steps: - - name: Send Slack notification on workflow failure - run: | - curl -X POST -H 'Content-type: application/json' --data '{"text":"<${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|Workflow ${{ github.workflow }}> failed in repository ${{ github.repository }}: Failed to update vulnerabilities"}' ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }} + \ No newline at end of file From f2af03d5008f0427f1bc09baede2d03f36cded6a Mon Sep 17 00:00:00 2001 From: David Caravello <119438707+dcaravel@users.noreply.github.com> Date: Wed, 11 Feb 2026 22:02:00 -0600 Subject: [PATCH 02/11] updates --- .github/workflows/README.md | 16 - .../workflows/add-new-pr-to-oss-triaging.yml | 25 - .github/workflows/auto-merge.yml | 30 - .github/workflows/backport-pr.yaml | 27 - .github/workflows/batch-load-test-metrics.yml | 27 - .github/workflows/build.yaml | 950 ------------------ .../workflows/check-crd-compatibility.yaml | 82 -- .github/workflows/check-pr-title.yaml | 46 - .github/workflows/ci-failures-report.yml | 40 - .github/workflows/create-clusters.yml | 79 -- .github/workflows/cut-rc.yml | 341 ------- .../emailsender-central-compatibility.yaml | 84 -- .github/workflows/finish-release.yml | 240 ----- .github/workflows/fixxxer.yaml | 79 -- .github/workflows/konflux-auto-retest.yml | 17 - .github/workflows/labeler.yaml | 17 - .github/workflows/nightly-tag.yml | 37 - .github/workflows/notify-milestone-change.yml | 123 --- .github/workflows/performance-tests.yml | 205 ---- .github/workflows/release-ci.yaml | 161 --- .github/workflows/retest_periodic.yml | 30 - .../workflows/scan-image-vulnerabilities.yaml | 160 --- .github/workflows/scanner-build.yaml | 379 ------- .../scanner-db-integration-tests.yaml | 43 - .github/workflows/scanner-e2e-test.yaml | 134 --- .github/workflows/scanner-mapping-update.yaml | 40 - .github/workflows/scanner-nvd-update.yaml | 220 ---- .../scanner-offline-bundle-update.yaml | 133 --- .../scanner-versioned-definitions-update.yaml | 7 - .github/workflows/start-release.yml | 401 -------- .github/workflows/style.yaml | 291 ------ .github/workflows/tag-more-reviewers.yaml | 26 - .github/workflows/tagged-ci.yaml | 25 - .github/workflows/triage-report_periodic.yml | 17 - .github/workflows/unit-tests.yaml | 486 --------- .../workflows/update_collector_periodic.yaml | 50 - .github/workflows/update_fact_periodic.yaml | 50 - .../workflows/update_scanner_periodic.yaml | 49 - .github/workflows/upgrade-test.yml | 160 --- .github/workflows/variables.yml | 134 --- .github/workflows/verify-release.yml | 95 -- 41 files changed, 5556 deletions(-) delete mode 100644 .github/workflows/README.md delete mode 100644 .github/workflows/add-new-pr-to-oss-triaging.yml delete mode 100644 .github/workflows/auto-merge.yml delete mode 100644 .github/workflows/backport-pr.yaml delete mode 100644 .github/workflows/batch-load-test-metrics.yml delete mode 100644 .github/workflows/build.yaml delete mode 100644 .github/workflows/check-crd-compatibility.yaml delete mode 100644 .github/workflows/check-pr-title.yaml delete mode 100644 .github/workflows/ci-failures-report.yml delete mode 100644 .github/workflows/create-clusters.yml delete mode 100644 .github/workflows/cut-rc.yml delete mode 100644 .github/workflows/emailsender-central-compatibility.yaml delete mode 100644 .github/workflows/finish-release.yml delete mode 100644 .github/workflows/fixxxer.yaml delete mode 100644 .github/workflows/konflux-auto-retest.yml delete mode 100644 .github/workflows/labeler.yaml delete mode 100644 .github/workflows/nightly-tag.yml delete mode 100644 .github/workflows/notify-milestone-change.yml delete mode 100644 .github/workflows/performance-tests.yml delete mode 100644 .github/workflows/release-ci.yaml delete mode 100644 .github/workflows/retest_periodic.yml delete mode 100644 .github/workflows/scan-image-vulnerabilities.yaml delete mode 100644 .github/workflows/scanner-build.yaml delete mode 100644 .github/workflows/scanner-db-integration-tests.yaml delete mode 100644 .github/workflows/scanner-e2e-test.yaml delete mode 100644 .github/workflows/scanner-mapping-update.yaml delete mode 100644 .github/workflows/scanner-nvd-update.yaml delete mode 100644 .github/workflows/scanner-offline-bundle-update.yaml delete mode 100644 .github/workflows/start-release.yml delete mode 100644 .github/workflows/style.yaml delete mode 100644 .github/workflows/tag-more-reviewers.yaml delete mode 100644 .github/workflows/tagged-ci.yaml delete mode 100644 .github/workflows/triage-report_periodic.yml delete mode 100644 .github/workflows/unit-tests.yaml delete mode 100644 .github/workflows/update_collector_periodic.yaml delete mode 100644 .github/workflows/update_fact_periodic.yaml delete mode 100644 .github/workflows/update_scanner_periodic.yaml delete mode 100644 .github/workflows/upgrade-test.yml delete mode 100644 .github/workflows/variables.yml delete mode 100644 .github/workflows/verify-release.yml diff --git a/.github/workflows/README.md b/.github/workflows/README.md deleted file mode 100644 index b57b7d4619b51..0000000000000 --- a/.github/workflows/README.md +++ /dev/null @@ -1,16 +0,0 @@ -# GitHub Actions - -## Upstream Release Automation - -### General Rules - -* **Ensure reentrancy**: expect a workflow to be re-run from failed state; -* **Suggest the next step** if it is not automated: print `:arrow_right:` emoji - with the suggested action to `$GITHUB_STEP_SUMMARY` or post a message to Slack; -* **Highlight major things**: print to stdout with `::error::`, `::warning::` or - `::notice::` prefix to higlight important status. Markdown is not supported; -* **Log minor things**: print to `$GITHUB_STEP_SUMMARY` with markdown to describe - the executed actions and suggest the next step; -* **Support dry-run**: use the `DRY_RUN` environment variable to check for dry-run, - it holds `true` or `false` values; -* **Extract large scripts**: look in the `scripts` folder for examples; diff --git a/.github/workflows/add-new-pr-to-oss-triaging.yml b/.github/workflows/add-new-pr-to-oss-triaging.yml deleted file mode 100644 index dfb5b52a95100..0000000000000 --- a/.github/workflows/add-new-pr-to-oss-triaging.yml +++ /dev/null @@ -1,25 +0,0 @@ -name: Add any new Pull Request to OSS Triaging project -on: - pull_request_target: - types: [opened, reopened] - -env: - EXTERNAL_PR_LABEL: external-contributor - -jobs: - check-pr-if-external: - name: Add external label to pull request if outside StackRox - runs-on: ubuntu-latest - env: - GH_TOKEN: ${{ github.token }} - BASE_REPO: ${{ github.repository }} - HEAD_REPO: ${{ github.event.pull_request.head.user.login }}/${{ github.event.pull_request.head.repo.name }} - steps: - - id: check-external-pr - run: | - set -uo pipefail - if [[ "$BASE_REPO" != "$HEAD_REPO" ]]; then - gh pr edit \ - "${{ github.event.pull_request.number }}" \ - --add-label "${EXTERNAL_PR_LABEL}" - fi diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml deleted file mode 100644 index 9e2033cd97412..0000000000000 --- a/.github/workflows/auto-merge.yml +++ /dev/null @@ -1,30 +0,0 @@ -name: auto-merge - -on: - pull_request_target: - types: - - labeled - -jobs: - auto-merge-minor: - name: Auto-merge semver minor and patch bumps - runs-on: ubuntu-latest - if: github.actor == 'dependabot[bot]' && github.event.label.name == 'auto-merge' - steps: - - uses: ahmadnassri/action-dependabot-auto-merge@v2.6 - with: - github-token: '${{ secrets.RHACS_BOT_GITHUB_TOKEN }}' - command: "squash and merge" - approve: true - target: minor - - auto-merge-any: - name: Auto-merge any version bumps - runs-on: ubuntu-latest - if: github.actor == 'dependabot[bot]' && github.event.label.name == 'auto-merge-any' - steps: - - uses: ahmadnassri/action-dependabot-auto-merge@v2.6 - with: - github-token: '${{ secrets.RHACS_BOT_GITHUB_TOKEN }}' - command: "squash and merge" - approve: true diff --git a/.github/workflows/backport-pr.yaml b/.github/workflows/backport-pr.yaml deleted file mode 100644 index fd4f91621decb..0000000000000 --- a/.github/workflows/backport-pr.yaml +++ /dev/null @@ -1,27 +0,0 @@ -name: Backport PR to release branch -on: - pull_request_target: - types: - - closed - - labeled - -jobs: - backport: - name: Backport - runs-on: ubuntu-latest - # Only react to merged PRs for security reasons. - # See https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#pull_request_target. - if: > - github.event.pull_request.merged - && ( - github.event.action == 'closed' - || ( - github.event.action == 'labeled' - && contains(github.event.label.name, 'backport') - ) - ) - steps: - - uses: tibdex/backport@v2.0.4 - with: - github_token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - title_template: "<%= title %>" diff --git a/.github/workflows/batch-load-test-metrics.yml b/.github/workflows/batch-load-test-metrics.yml deleted file mode 100644 index de06ff50f3905..0000000000000 --- a/.github/workflows/batch-load-test-metrics.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: Batch load test metrics -on: - workflow_dispatch: - schedule: - - cron: 23 * * * * - -# Ensure that only a single batch loader is running -concurrency: Batch load test metrics - -jobs: - batch-load-test-metrics: - if: ${{ github.repository_owner == 'stackrox' }} - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - steps: - - name: Checkout - uses: actions/checkout@v6 - - name: Load - env: - GCP_SERVICE_ACCOUNT_STACKROX_CI: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - shell: bash - run: | - source scripts/ci/lib.sh - - setup_gcp - batch_load_test_metrics diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml deleted file mode 100644 index b83806c1e8957..0000000000000 --- a/.github/workflows/build.yaml +++ /dev/null @@ -1,950 +0,0 @@ -name: Build -on: - workflow_dispatch: - inputs: - commit: - description: 'Commit SHA to build' - required: true - type: string - workflow_call: - push: - tags: - - '*-nightly-*' - branches: - - master - pull_request: - types: - - opened - - reopened - - synchronize - -defaults: - run: - # This enables `-o pipefail` for all jobs as compared to when shell isn't set. - # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#defaultsrunshell - shell: bash - -jobs: - define-job-matrix: - outputs: - matrix: ${{ steps.define-job-matrix.outputs.matrix }} - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - name: Define the matrix for build jobs - id: define-job-matrix - run: | - source './scripts/ci/lib.sh' - - matrix='{ - "pre_build_go_binaries": { "name":[], "arch":[] }, - "build_and_push_main": { "name":[], "arch":[] }, - "push_main_multiarch_manifests": { "name":[] }, - "build_and_push_operator": { "name":[], "arch":[] }, - "push_operator_multiarch_manifests": { "name":[] }, - "scan_images_with_roxctl": { "name":[], "image":[], "exclude":[] } - }' - - # The base matrix - matrix="$(jq '.pre_build_go_binaries.name += ["default"]' <<< "$matrix")" - matrix="$(jq '.pre_build_go_binaries.arch += ["amd64", "arm64"]' <<< "$matrix")" - - matrix="$(jq '.build_and_push_main.name += ["RHACS_BRANDING", "STACKROX_BRANDING"]' <<< "$matrix")" - matrix="$(jq '.build_and_push_main.arch += ["amd64", "arm64"]' <<< "$matrix")" - - matrix="$(jq '.push_main_multiarch_manifests.name += ["RHACS_BRANDING", "STACKROX_BRANDING"]' <<< "$matrix")" - - matrix="$(jq '.build_and_push_operator.name += ["RHACS_BRANDING", "STACKROX_BRANDING"]' <<< "$matrix")" - matrix="$(jq '.build_and_push_operator.arch += ["amd64", "arm64"]' <<< "$matrix")" - - matrix="$(jq '.push_operator_multiarch_manifests.name += ["RHACS_BRANDING", "STACKROX_BRANDING"]' <<< "$matrix")" - matrix="$(jq '.push_operator_multiarch_manifests.archs = [.build_and_push_operator.arch | join(",")]' <<< "$matrix")" - - matrix="$(jq '.scan_images_with_roxctl.name += ["RHACS_BRANDING", "STACKROX_BRANDING"]' <<< "$matrix")" - matrix="$(jq '.scan_images_with_roxctl.image += ["central-db", "collector", "fact", "main", "roxctl", "scanner", "scanner-db", "scanner-db-slim", "scanner-slim", "stackrox-operator"]' <<< "$matrix")" - # TODO(ROX-27191): remove the exclusion once there's a community operator. - matrix="$(jq '.scan_images_with_roxctl.exclude += [{ "name": "STACKROX_BRANDING", "image": "stackrox-operator" }]' <<< "$matrix")" - - if ! is_in_PR_context || pr_has_label ci-build-all-arch; then - matrix="$(jq '.pre_build_go_binaries.arch += ["ppc64le", "s390x"]' <<< "$matrix")" - matrix="$(jq '.build_and_push_main.arch += ["ppc64le", "s390x"]' <<< "$matrix")" - fi; - - # Conditionally add a prerelease build (binaries built with GOTAGS=release) - if ! is_tagged; then - if ! is_in_PR_context || pr_has_label ci-build-prerelease; then - matrix="$(jq '.pre_build_go_binaries.name += ["prerelease"]' <<< "$matrix")" - matrix="$(jq '.build_and_push_main.name += ["prerelease"]' <<< "$matrix")" - matrix="$(jq '.push_main_multiarch_manifests.name += ["prerelease"]' <<< "$matrix")" - fi - fi - - # Conditionally add a -race debug build (binaries built with -race) - if ! is_in_PR_context || pr_has_label ci-build-race-condition-debug; then - matrix="$(jq '.pre_build_go_binaries.name += ["race-condition-debug"]' <<< "$matrix")" - matrix="$(jq '.build_and_push_main.name += ["race-condition-debug"]' <<< "$matrix")" - matrix="$(jq '.push_main_multiarch_manifests.name += ["race-condition-debug"]' <<< "$matrix")" - # Exclude "arm64", "ppc64le", "s390x" - matrix="$(jq '.pre_build_go_binaries.exclude = [{ "name": "race-condition-debug", "arch": "arm64" }]' <<< "$matrix")" - matrix="$(jq '.pre_build_go_binaries.exclude += [{ "name": "race-condition-debug", "arch": "ppc64le" }]' <<< "$matrix")" - matrix="$(jq '.pre_build_go_binaries.exclude += [{ "name": "race-condition-debug", "arch": "s390x" }]' <<< "$matrix")" - matrix="$(jq '.build_and_push_main.exclude = [{ "name": "race-condition-debug", "arch": "arm64" }]' <<< "$matrix")" - matrix="$(jq '.build_and_push_main.exclude += [{ "name": "race-condition-debug", "arch": "ppc64le" }]' <<< "$matrix")" - matrix="$(jq '.build_and_push_main.exclude += [{ "name": "race-condition-debug", "arch": "s390x" }]' <<< "$matrix")" - fi - - echo "Job matrix after conditionals:" - jq <<< "$matrix" - - condensed="$(jq -c <<< "$matrix")" - echo "matrix=$condensed" >> "$GITHUB_OUTPUT" - - pre-build-ui: - strategy: - fail-fast: false - matrix: - branding: [ RHACS_BRANDING, STACKROX_BRANDING ] - env: - ROX_PRODUCT_BRANDING: ${{ matrix.branding }} - # For consistency with `image/rhel/konflux.Dockerfile`, see comment there. - UI_PKG_INSTALL_EXTRA_ARGS: --ignore-scripts - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - uses: ./.github/actions/cache-ui-dependencies - - - uses: ./.github/actions/handle-tagged-build - - - name: Fetch UI deps - run: make -C ui deps - - - name: Build UI - run: make -C ui build - - - uses: ./.github/actions/upload-artifact-with-retry - with: - name: ui-${{env.ROX_PRODUCT_BRANDING}}-build - path: | - ui/build - ui/apps/platform/package-lock.json - - pre-build-cli: - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Cache Go dependencies - uses: ./.github/actions/cache-go-dependencies - - - uses: ./.github/actions/handle-tagged-build - - - name: Build CLI - run: make cli - - - name: Bundle build to preserve permissions - run: tar -cvzf cli-build.tgz bin - - - uses: ./.github/actions/upload-artifact-with-retry - with: - name: cli-build - path: cli-build.tgz - - pre-build-go-binaries: - strategy: - # Supports three go binary builds: - # default - built with environment defaults (see handle-tagged-build & env.mk) - # prerelease - built with GOTAGS=release - # race-condition-debug - built with -race - matrix: ${{ fromJson(needs.define-job-matrix.outputs.matrix).pre_build_go_binaries }} - needs: define-job-matrix - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Cache Go dependencies - env: - GOARCH: ${{ matrix.arch }} - uses: ./.github/actions/cache-go-dependencies - - - uses: ./.github/actions/handle-tagged-build - - - name: PR labels - uses: joerick/pr-labels-action@v1.0.9 - - - name: Setup build env for debugging support - run: | - if [[ "${GITHUB_HEAD_REF:-}" =~ -debug ]]; then - echo "DEBUG_BUILD=yes" >> "${GITHUB_ENV}" - fi - - - name: Setup Go build environment for release - if: | - contains(github.event.pull_request.labels.*.name, 'ci-release-build') - || - matrix.name == 'prerelease' - run: echo "GOTAGS=release" >> "$GITHUB_ENV" - - - name: Setup Go build environment for -race - if: | - matrix.arch == 'amd64' - && - ( - contains(github.event.pull_request.labels.*.name, 'ci-race-tests') - || - matrix.name == 'race-condition-debug' - ) - run: echo "RACE=true" >> "$GITHUB_ENV" - - - name: Build Go Binaries - run: | - if [[ "${{ matrix.arch }}" != "amd64" ]]; then - echo "Building non-amd binary" - GOOS=linux GOARCH=${{ matrix.arch }} CGO_ENABLED=0 make build-prep main-build-nodeps - else - echo "Building amd binary" - GOOS=linux GOARCH=${{ matrix.arch }} CGO_ENABLED=1 make build-prep main-build-nodeps - fi - - - name: Bundle the build to preserve permissions - run: tar -cvzf go-binaries-build.tgz bin/linux_${{ matrix.arch }} - - - uses: ./.github/actions/upload-artifact-with-retry - with: - name: go-binaries-build-${{ matrix.arch }}-${{ matrix.name }} - path: go-binaries-build.tgz - - pre-build-docs: - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Cache Go dependencies - uses: ./.github/actions/cache-go-dependencies - - - uses: ./.github/actions/handle-tagged-build - - - name: Resolve mods for protos - run: go mod tidy - - - name: Generate the swagger docs - run: | - make swagger-docs - # Workaround to handle https://github.com/actions/cache/issues/753 - rm -rf .proto - - - uses: ./.github/actions/upload-artifact-with-retry - with: - name: docs-build - path: | - image/rhel/docs - - build-and-push-main: - runs-on: ubuntu-latest - needs: - - define-job-matrix - - pre-build-ui - - pre-build-cli - - pre-build-go-binaries - - pre-build-docs - # This step will run even if required pre-* steps failed. By following this - # approach as much of the build matrix as possible is completed despite - # transient issues e.g. docker pull timeouts. In this way some e2e jobs that - # require some part of the build matrix can still proceed. - if: ${{ !cancelled() }} - strategy: - # Supports four image builds (see Setup build env): - # STACKROX_BRANDING - # RHACS_BRANDING - # prerelease - # race-condition-debug - fail-fast: false - matrix: ${{ fromJson(needs.define-job-matrix.outputs.matrix).build_and_push_main }} - env: - GO_BINARIES_BUILD_ARTIFACT: "" - ROX_PRODUCT_BRANDING: "" - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - env: - QUAY_RHACS_ENG_RO_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }} - QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }} - QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }} - QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }} - QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }} - QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }} - steps: - - name: Setup build env - run: | - case "${{ matrix.name }}" in - STACKROX_BRANDING) - go_binaries="default" - brand="STACKROX_BRANDING" - ;; - RHACS_BRANDING) - go_binaries="default" - brand="RHACS_BRANDING" - ;; - race-condition-debug) - go_binaries="race-condition-debug" - brand="RHACS_BRANDING" - ;; - prerelease) - go_binaries="prerelease" - brand="RHACS_BRANDING" - ;; - *) - echo "Unsupported build: ${{ matrix.name }}" - exit 1 - esac - - { - echo "GO_BINARIES_BUILD_ARTIFACT=go-binaries-build-${{ matrix.arch }}-${go_binaries}" - echo "ROX_PRODUCT_BRANDING=${brand}" - } >> "$GITHUB_ENV" - if [[ "${GITHUB_HEAD_REF:-}" =~ -debug ]]; then - echo "DEBUG_BUILD=yes" >> "${GITHUB_ENV}" - fi - - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Login to docker.io to mitigate rate limiting on downloading images - uses: docker/login-action@v3 - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - with: - username: ${{ secrets.DOCKERHUB_CI_ACCOUNT_USERNAME }} - password: ${{ secrets.DOCKERHUB_CI_ACCOUNT_PASSWORD }} - - - name: Set up QEMU - if: matrix.arch != 'amd64' - uses: docker/setup-qemu-action@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Checkout submodules - run: | - git submodule update --init - - - uses: ./.github/actions/handle-tagged-build - - - uses: ./.github/actions/download-artifact-with-retry - with: - name: ui-${{ env.ROX_PRODUCT_BRANDING }}-build - path: ui - - - uses: ./.github/actions/download-artifact-with-retry - with: - name: cli-build - - - name: Unpack cli build - run: | - tar xvzf cli-build.tgz - - - uses: ./.github/actions/download-artifact-with-retry - with: - name: ${{ env.GO_BINARIES_BUILD_ARTIFACT }} - - - name: Unpack Go binaries build - run: | - tar xvzf go-binaries-build.tgz - - - uses: ./.github/actions/download-artifact-with-retry - with: - name: docs-build - path: image/rhel/docs - - # needed to restore node_modules for ossls-nostice - - uses: ./.github/actions/cache-ui-dependencies - - # explicitly fetch deps just in case cache was not ready - - name: Fetch UI deps - run: make -C ui deps - - - name: Generate OSS notice - run: make ossls-notice - - - name: Set build tag for prerelease images - if: matrix.name == 'prerelease' - run: echo "BUILD_TAG=$(make --quiet --no-print-directory tag)-prerelease" >> "$GITHUB_ENV" - - - name: Set build tag for race condition images - if: matrix.name == 'race-condition-debug' - run: echo "BUILD_TAG=$(make --quiet --no-print-directory tag)-rcd" >> "$GITHUB_ENV" - - - name: Build main images - run: | - GOOS=linux GOARCH=${{ matrix.arch }} scripts/lib.sh retry 6 true make docker-build-main-image - - - name: Check debugger presence in the main image - run: make check-debugger - - - name: Build roxctl image - run: | - GOOS=linux GOARCH=${{ matrix.arch }} scripts/lib.sh retry 6 true make docker-build-roxctl-image - - # needed for docs ensure_image.sh initial pull with RHACS_BRANDING - - name: Docker login - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - run: | - ./scripts/ci/lib.sh registry_ro_login "quay.io/rhacs-eng" - - - name: Push images - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - run: | - source ./scripts/ci/lib.sh - echo "Will determine context from: ${{ github.event_name }} & ${{ github.ref_name }}" - push_context="" - if [[ "${{ github.event_name }}" == "push" && "${{ github.ref_name }}" == "master" ]]; then - push_context="merge-to-master" - fi - push_main_image_set "$push_context" "${{ env.ROX_PRODUCT_BRANDING }}" "${{ matrix.arch }}" - - - name: Push matching collector and scanner images - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - run: | - # Need to free up some space before push_matching_collector_scanner_images() does its pull. - docker system prune --all --force - source ./scripts/ci/lib.sh - push_matching_collector_scanner_images "${{ env.ROX_PRODUCT_BRANDING }}" "${{ matrix.arch }}" - - push-main-manifests: - runs-on: ubuntu-latest - needs: - - define-job-matrix - - build-and-push-main - # This step will run even if some of the build-and-push-matrix steps failed. - # By following this approach as much of the build matrix as possible is - # completed despite transient issues e.g. docker pull timeouts. In this way - # some e2e jobs that require some part of the build matrix can still - # proceed. - if: ${{ !cancelled() }} - strategy: - # Supports four image builds (see Setup build env): - # STACKROX_BRANDING - # RHACS_BRANDING - # prerelease - # race-condition-debug - fail-fast: false - matrix: ${{ fromJson(needs.define-job-matrix.outputs.matrix).push_main_multiarch_manifests }} - env: - ROX_PRODUCT_BRANDING: "" - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - env: - QUAY_RHACS_ENG_RO_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }} - QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }} - QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }} - QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }} - QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }} - QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }} - steps: - - name: Setup build env - run: | - case "${{ matrix.name }}" in - STACKROX_BRANDING) - brand="STACKROX_BRANDING" - ;; - RHACS_BRANDING) - brand="RHACS_BRANDING" - ;; - race-condition-debug) - brand="RHACS_BRANDING" - ;; - prerelease) - brand="RHACS_BRANDING" - ;; - *) - echo "Unsupported build: ${{ matrix.name }}" - exit 1 - esac - - { - echo "ROX_PRODUCT_BRANDING=${brand}" - } >> "$GITHUB_ENV" - - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Checkout submodules - run: | - git submodule update --init - - - uses: ./.github/actions/handle-tagged-build - - - name: Set build tag for prerelease images - if: matrix.name == 'prerelease' - run: echo "BUILD_TAG=$(make --quiet --no-print-directory tag)-prerelease" >> "$GITHUB_ENV" - - - name: Set build tag for race condition images - if: matrix.name == 'race-condition-debug' - run: echo "BUILD_TAG=$(make --quiet --no-print-directory tag)-rcd" >> "$GITHUB_ENV" - - - name: Build and push manifest lists - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - run: | - source ./scripts/ci/lib.sh - echo "Will determine context from: ${{ github.event_name }} & ${{ github.ref_name }}" - push_context="" - if [[ "${{ github.event_name }}" == "push" && "${{ github.ref_name }}" == "master" ]]; then - push_context="merge-to-master" - fi - architectures="amd64,arm64" - if ! is_in_PR_context || pr_has_label ci-build-all-arch; then - architectures="amd64,arm64,ppc64le,s390x" - fi - if [[ "${{ matrix.name }}" == "race-condition-debug" ]]; then - architectures="amd64" - fi - push_image_manifest_lists "$push_context" "${{ env.ROX_PRODUCT_BRANDING }}" "$architectures" - - - name: Comment on the PR - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - env: - GITHUB_TOKEN: "${{ secrets.RHACS_BOT_GITHUB_TOKEN }}" - run: | - source ./scripts/ci/lib.sh - add_build_comment_to_pr - - build-and-push-operator: - runs-on: ubuntu-latest - needs: - - define-job-matrix - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - env: - QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }} - QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }} - QUAY_RHACS_ENG_BEARER_TOKEN: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }} - QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }} - QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }} - strategy: - fail-fast: false - matrix: ${{ fromJson(needs.define-job-matrix.outputs.matrix).build_and_push_operator }} - env: - ROX_PRODUCT_BRANDING: ${{ matrix.name }} - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - free-disk-space: 30 - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - name: Cache Go dependencies - env: - GOARCH: ${{ matrix.arch }} - uses: ./.github/actions/cache-go-dependencies - - - uses: ./.github/actions/handle-tagged-build - - - name: Resolve mods for protos - run: go mod tidy - - - name: PR labels - uses: joerick/pr-labels-action@v1.0.9 - - - name: Setup Go release build environment - if: contains(github.event.pull_request.labels.*.name, 'ci-release-build') - run: echo "GOTAGS=release" >> "$GITHUB_ENV" - - - name: Setup Go RHACS build environment - if: matrix.name == 'RHACS_BRANDING' - run: echo "QUAY_ORG=rhacs-eng" >> "$GITHUB_ENV" - - - name: Setup Go StackRox build environment - if: matrix.name == 'STACKROX_BRANDING' - run: echo "QUAY_ORG=stackrox-io" >> "$GITHUB_ENV" - - - name: Docker login - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - run: | - ./scripts/ci/lib.sh registry_rw_login "quay.io/${QUAY_ORG}" - - - name: Build Operator Bundle image - if: | - matrix.name != 'STACKROX_BRANDING' - run: | - make -C operator/ bundle bundle-build - - - name: Operator unit tests - if: matrix.arch == 'amd64' - run: | - scripts/lib.sh retry 2 true make -C operator/ test - - - name: Build Operator image - run: | - # The first invocation builds native architecture dependencies, which helps avoid the following error, - # which otherwise happens when cross-building. It also needlessly builds the operator binary for the - # native architecture, but this is quick and more robust than trying to repeat the dependencies here - # or in a separate intermediate target. - # + protoc-gen-go - # go: cannot install cross-compiled binaries when GOBIN is set - CGO_ENABLED=0 scripts/lib.sh retry 6 true make -C operator/ build - # Once the native architecture dependencies are installed by the above command, the following one - # simply builds the actual operator binary for the correct target architecture. - CGO_ENABLED=0 GOARCH=${{ matrix.arch }} scripts/lib.sh retry 6 true make -C operator/ build docker-build - - - name: Login to docker.io to mitigate rate limiting on downloading images - uses: docker/login-action@v3 - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - with: - username: ${{ secrets.DOCKERHUB_CI_ACCOUNT_USERNAME }} - password: ${{ secrets.DOCKERHUB_CI_ACCOUNT_PASSWORD }} - - - name: Set up QEMU - if: matrix.arch != 'amd64' - uses: docker/setup-qemu-action@v3 - - - name: Check that Operator image is runnable - run: docker run --rm --platform linux/${{ matrix.arch }} "quay.io/${QUAY_ORG}/stackrox-operator:$(make --quiet --no-print-directory -C operator tag)" --help - - - name: Push image - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - run: | - source ./scripts/ci/lib.sh - echo "Will determine context from: ${{ github.event_name }} & ${{ github.ref_name }}" - push_context="" - if [[ "${{ github.event_name }}" == "push" && "${{ github.ref_name }}" == "master" ]]; then - push_context="merge-to-master" - fi - echo "Starting operator image push for context: \"$push_context\", branding: \"${{ env.ROX_PRODUCT_BRANDING }}\", arch: \"${{ matrix.arch }}\"" - if ! push_operator_image "$push_context" "${{ env.ROX_PRODUCT_BRANDING }}" "${{ matrix.arch }}"; then - echo "ERROR: push_operator_image failed" >&2 - exit 1 - fi - echo "Operator image push completed successfully" - - - name: Push bundle image - # Skip for external contributions, and for upstream. - if: | - matrix.name != 'STACKROX_BRANDING' && (github.event_name == 'push' || !github.event.pull_request.head.repo.fork) - run: | - make -C operator/ docker-push-bundle | cat - - # Index image can only be built once bundle was pushed - - name: Build index - # Skip for external contributions and for upstream, as the build relies on the previous image to be pushed. - if: | - matrix.name != 'STACKROX_BRANDING' && (github.event_name == 'push' || !github.event.pull_request.head.repo.fork) - run: | - make -C operator/ index-build - - - name: Push index image - # Skip for external contributions, and for upstream. - if: | - matrix.name != 'STACKROX_BRANDING' && (github.event_name == 'push' || !github.event.pull_request.head.repo.fork) - run: | - make -C operator/ docker-push-index | cat - - push-operator-manifests: - runs-on: ubuntu-latest - needs: - - define-job-matrix - - build-and-push-operator - # This step will run even if some of the build-and-push-matrix steps failed. - # By following this approach as much of the build matrix as possible is - # completed despite transient issues e.g. docker pull timeouts. In this way - # some e2e jobs that require some part of the build matrix can still - # proceed. - if: ${{ !cancelled() }} - strategy: - # Supports image builds (see Setup build env): - # RHACS_BRANDING - # STACKROX_BRANDING - fail-fast: false - matrix: ${{ fromJson(needs.define-job-matrix.outputs.matrix).push_operator_multiarch_manifests }} - env: - ROX_PRODUCT_BRANDING: ${{ matrix.name }} - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - env: - QUAY_RHACS_ENG_RO_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }} - QUAY_RHACS_ENG_RO_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }} - QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }} - QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }} - QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }} - QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }} - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - uses: ./.github/actions/handle-tagged-build - - - name: Push operator manifest lists - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - run: | - source ./scripts/ci/lib.sh - echo "Will determine context from: ${{ github.event_name }} & ${{ github.ref_name }}" - push_context="" - if [[ "${{ github.event_name }}" == "push" && "${{ github.ref_name }}" == "master" ]]; then - push_context="merge-to-master" - fi - push_operator_manifest_lists "$push_context" "${{ env.ROX_PRODUCT_BRANDING }}" ${{ matrix.archs }} - - scan-go-binaries: - if: | - contains(github.event.pull_request.labels.*.name, 'scan-go-binaries') - env: - ARTIFACT_DIR: junit-reports/ - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - needs: - - pre-build-cli - - pre-build-go-binaries - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 1 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - uses: ./.github/actions/download-artifact-with-retry - with: - name: cli-build - - - name: Unpack cli build - run: | - tar xvzf cli-build.tgz - - - uses: ./.github/actions/download-artifact-with-retry - with: - name: go-binaries-build-amd64-default - - - name: Unpack Go binaries build - run: | - tar xvzf go-binaries-build.tgz - - - name: Scan - run: | - ./scripts/ci/govulncheck.sh - - - name: Publish Test Report - uses: test-summary/action@v2 - if: always() - with: - paths: 'junit-reports/**/*.xml' - - - name: Report junit failures in jira - uses: ./.github/actions/junit2jira - if: always() - with: - jira-token: ${{ secrets.JIRA_TOKEN }} - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - directory: 'junit-reports' - - scan-images-with-roxctl: - if: github.event_name == 'push' || - contains(github.event.pull_request.labels.*.name, 'scan-images-with-roxctl') - needs: - - define-job-matrix - - build-and-push-main - - build-and-push-operator - - push-main-manifests - name: Check images for vulnerabilities - runs-on: ubuntu-latest - permissions: - # Needed for stackrox/central-login to create the JWT token. - id-token: write - security-events: write - strategy: - fail-fast: false - matrix: ${{ fromJson(needs.define-job-matrix.outputs.matrix).scan_images_with_roxctl }} - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - uses: ./.github/actions/handle-tagged-build - - - name: Central login - uses: stackrox/central-login@v1 - with: - endpoint: ${{ vars.ACS_DOGFOODING_CENTRAL_URL }} - - - name: Install roxctl - uses: stackrox/roxctl-installer-action@v1 - with: - central-endpoint: ${{ vars.ACS_DOGFOODING_CENTRAL_URL }} - central-token: ${{ env.ROX_API_TOKEN }} - - - name: Scan images for vulnerabilities - run: | - release_tag="$(make --quiet --no-print-directory tag)" - if [[ "${{ matrix.image }}" =~ "operator" ]]; then - release_tag="$(make -C operator --quiet --no-print-directory tag)" - fi - - registry="$(./scripts/ci/lib.sh registry_from_branding "${{ matrix.name }}")" - - roxctl image scan --retries=10 --retry-delay=15 --force --severity=CRITICAL,IMPORTANT --output=sarif \ - --image="${registry}/${{ matrix.image }}:${release_tag}" \ - | tee results.sarif - - # TODO: re-enable roxctl scan results upload once quota issue has been resolved - # - name: Upload roxctl scan results to GitHub Security tab - # uses: github/codeql-action/upload-sarif@v3 - # with: - # category: ${{ matrix.image }} - # sarif_file: results.sarif - - slack-on-build-failure: - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - SLACK_CI_INTEGRATION_TESTING_WEBHOOK: ${{ secrets.SLACK_CI_INTEGRATION_TESTING_WEBHOOK }} - TEST_FAILURES_NOTIFY_WEBHOOK: ${{ secrets.TEST_FAILURES_NOTIFY_WEBHOOK }} - if: | - failure() && ( - github.event_name == 'push' || - contains(github.event.pull_request.labels.*.name, 'ci-test-github-action-slack-messages') - ) - name: Post failure message to Slack - runs-on: ubuntu-latest - needs: - - pre-build-ui - - pre-build-cli - - pre-build-go-binaries - - pre-build-docs - - build-and-push-main - - build-and-push-operator - - scan-images-with-roxctl - - scan-go-binaries - permissions: - actions: read - steps: - - name: Checkout - uses: actions/checkout@v6 - - - name: Slack message - env: - GITHUB_CONTEXT: ${{ toJSON(github) }} - run: | - source scripts/ci/lib.sh - slack_workflow_failure diff --git a/.github/workflows/check-crd-compatibility.yaml b/.github/workflows/check-crd-compatibility.yaml deleted file mode 100644 index 2e32fdb61d995..0000000000000 --- a/.github/workflows/check-crd-compatibility.yaml +++ /dev/null @@ -1,82 +0,0 @@ -name: Check CRD Compatibility -on: - push: - tags: - - '*' - branches: - - master - - release-* - pull_request: - types: - - opened - - reopened - - synchronize - -concurrency: - group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} - cancel-in-progress: true - -jobs: - check-crd-compatibility: - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - outputs: - released_version: ${{ steps.get_previous_released_version.outputs.released_version }} - steps: - - name: Checkout stackrox/stackrox - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Checkout crd-schema-checker - uses: actions/checkout@v6 - with: - repository: openshift/crd-schema-checker - path: .crd-schema-checker - ref: c313b6407231f6d1aabfb602f0823708f8c6b9fb # 2025-09-05 - - - name: Build crd-schema-checker - run: | - make -C .crd-schema-checker - - - name: Get previous released version - id: get_previous_released_version - run: | - make -C operator bundle-post-process - released_version="$(make --no-print-directory -C operator replaced-version)" - echo "released_version=$released_version" >> "$GITHUB_OUTPUT" - - - name: Checkout previous released version - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ steps.get_previous_released_version.outputs.released_version }} - path: .old-stackrox - - - name: Run crd-schema-checker for platform operator - run: | - set -e - old_path=.old-stackrox/operator/config/crd/bases - new_path=operator/config/crd/bases - sc_file=platform.stackrox.io_securedclusters.yaml - central_file=platform.stackrox.io_centrals.yaml - args="--disabled-validators=ConditionsMustHaveProperSSATags,ListsMustHaveSSATags,NoBools,NoMaps" - set -x - .crd-schema-checker/crd-schema-checker check-manifests $args --existing-crd-filename=$old_path/$sc_file --new-crd-filename=$new_path/$sc_file - .crd-schema-checker/crd-schema-checker check-manifests $args --existing-crd-filename=$old_path/$central_file --new-crd-filename=$new_path/$central_file - - - name: Run crd-schema-checker for config operator - run: | - set -e - old_path=.old-stackrox/config-controller/config/crd/bases - new_path=config-controller/config/crd/bases - policy_file=config.stackrox.io_securitypolicies.yaml - args="--disabled-validators=ConditionsMustHaveProperSSATags,ListsMustHaveSSATags,NoBools,NoMaps" - set -x - .crd-schema-checker/crd-schema-checker check-manifests $args --existing-crd-filename=$old_path/$policy_file --new-crd-filename=$new_path/$policy_file diff --git a/.github/workflows/check-pr-title.yaml b/.github/workflows/check-pr-title.yaml deleted file mode 100644 index 5212dfd3ac09b..0000000000000 --- a/.github/workflows/check-pr-title.yaml +++ /dev/null @@ -1,46 +0,0 @@ -name: "Check PR title" - -on: - pull_request: - types: [opened, edited, synchronize] - -jobs: - check-title: - runs-on: ubuntu-latest - env: - PR_TITLE: ${{ github.event.pull_request.title }} - steps: - - name: Check if the PR title is well dressed - env: - CONV: '(build|chore|ci|docs?|feat|fix|perf|refactor|revert|style|tests?)(\([\w\-\.]+\))?!?' - JIRA: '([A-Z]+-[0-9]+, ?)*[A-Z]+-[0-9]+' - TEXT: ': .+' - run: | - # Either conventional or JIRA-nnn prefix followed by ': ' and random text: - REGEX="(($CONV)|($JIRA))($TEXT)" - test_regex() { echo -nE "$1" | grep --perl-regexp --line-regexp "$REGEX" ; } - - echo "Examples:" - test_regex 'ROX-123: text' - test_regex 'ROX-123, RS-45: text' - test_regex 'refactor: text' - test_regex 'fix(ui): text' - test_regex 'feat(api)!: text' - - if ! test_regex "$PR_TITLE" - then - echo "::error::Please update the PR title so that it follows the convention." - exit 1 - fi - - - name: Check PR title length - if: github.event.pull_request.user.login != 'dependabot[bot]' - env: - LENGTH: '70' - run: | - TITLE_LENGTH="$(echo -nE "$PR_TITLE" | wc --chars)" - if [ "$TITLE_LENGTH" -gt "$LENGTH" ] - then - echo "::error::Please shorten the PR title from $TITLE_LENGTH to at most $LENGTH characters." - exit 1 - fi diff --git a/.github/workflows/ci-failures-report.yml b/.github/workflows/ci-failures-report.yml deleted file mode 100644 index 369a09976720b..0000000000000 --- a/.github/workflows/ci-failures-report.yml +++ /dev/null @@ -1,40 +0,0 @@ -name: CI Failures Report -on: - workflow_dispatch: - inputs: - test: - description: "Slack to #acs-slack-ci-integration-testing" - required: true - default: true - type: boolean - schedule: - - cron: 0 12 * * 1 - -jobs: - report-e2e-failures-to-slack: - if: ${{ github.repository_owner == 'stackrox' }} - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - steps: - - name: Checkout - uses: actions/checkout@v6 - - name: Report - env: - GCP_SERVICE_ACCOUNT_STACKROX_CI: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - SLACK_CI_INTEGRATION_TESTING_WEBHOOK: ${{ secrets.SLACK_CI_INTEGRATION_TESTING_WEBHOOK }} - SLACK_ENG_DISCUSS_WEBHOOK: ${{ secrets.SLACK_ENG_DISCUSS_WEBHOOK }} - shell: bash - run: | - source scripts/ci/lib.sh - - setup_gcp - - # Avoid BQ init message in first report - bq --quiet --format=pretty query --use_legacy_sql=false 'select 1' - n=10 - slack_top_n_failures ${n} "qa-e2e" ":testgrid: Top ${n} QA E2E Test failures in this and previous week" "${{github.event.inputs.test}}" - slack_top_n_failures ${n} "operator-e2e" ":operator: Top ${n} Operator E2E Test failures in this and previous week" "${{github.event.inputs.test}}" - slack_top_n_failures ${n} "ui-e2e" ":computer: Top ${n} UI E2E Test failures in this and previous week" "${{github.event.inputs.test}}" - slack_top_n_failures ${n} "nongroovy-e2e" ":go: Top ${n} NonGroovy E2E Test failures in this and previous week" "${{github.event.inputs.test}}" - slack_top_n_failures ${n} "go" ":github: Top ${n} unit test failures in this and previous week" "${{github.event.inputs.test}}" diff --git a/.github/workflows/create-clusters.yml b/.github/workflows/create-clusters.yml deleted file mode 100644 index ace80e23e87e4..0000000000000 --- a/.github/workflows/create-clusters.yml +++ /dev/null @@ -1,79 +0,0 @@ -name: "RELEASE: Create Clusters" -on: - workflow_dispatch: - inputs: - version: - description: Version of the images - required: true - default: "4.1.1" - type: string - create-k8s-cluster: - description: Create a GKE demo cluster - default: false - type: boolean - create-os4-cluster: - description: Create an Openshift 4 demo cluster - default: false - type: boolean - create-long-cluster: - description: Create a long-running cluster - default: false - type: boolean - dry-run: - description: Dry-run - default: false - type: boolean - -env: - main_branch: ${{github.event.repository.default_branch}} - script_url: /repos/${{github.repository}}/contents/.github/workflows/scripts/common.sh?ref=${{ github.ref_name }} - ACCEPT_RAW: "Accept: application/vnd.github.v3.raw" - GH_TOKEN: ${{ github.token }} - GH_NO_UPDATE_NOTIFIER: 1 - TIMEOUT_WAIT_FOR_IMAGES_SECONDS: 3600 - -run-name: >- - ${{ - format('Create clusters for {0}', inputs.version) - }} - -# Ensure that only a single automation workflow can run at a time for each release. -concurrency: Release automation ${{ inputs.version }} - -jobs: - trim-cluster-names: - runs-on: ubuntu-latest - outputs: - cluster-with-fake-load-name-cleaned: ${{ steps.cluster-names.outputs.cluster-with-fake-load-name-cleaned }} - cluster-with-real-load-name-cleaned: ${{ steps.cluster-names.outputs.cluster-with-real-load-name-cleaned }} - env: - CLUSTER_WITH_FAKE_LOAD_NAME: lfl-${{ github.event.inputs.version }} - CLUSTER_WITH_REAL_LOAD_NAME: lrl-${{ github.event.inputs.version }} - steps: - - name: Trim and clean cluster names - id: cluster-names - run: | - # Cluster names are cropped to infra's max length and dots replaced with dashes. - # Latter is to avoid informing release engineers of incorrect cluster names. - CLEANED_CLUSTER_WITH_FAKE_LOAD_NAME="$(echo "${CLUSTER_WITH_FAKE_LOAD_NAME:0:28}" | tr '.' '-')" - echo "cluster-with-fake-load-name-cleaned=${CLEANED_CLUSTER_WITH_FAKE_LOAD_NAME}" >> "${GITHUB_OUTPUT}" - - CLEANED_CLUSTER_WITH_REAL_LOAD_NAME="$(echo "${CLUSTER_WITH_REAL_LOAD_NAME:0:28}" | tr '.' '-')" - echo "cluster-with-real-load-name-cleaned=${CLEANED_CLUSTER_WITH_REAL_LOAD_NAME}" >> "${GITHUB_OUTPUT}" - - clusters: - name: Setup demo clusters - needs: trim-cluster-names - uses: stackrox/actions/.github/workflows/create-demo-clusters.yml@v1 - secrets: inherit - with: - version: ${{github.event.inputs.version}} - create-k8s-cluster: ${{github.event.inputs.create-k8s-cluster == 'true'}} - create-os4-cluster: ${{github.event.inputs.create-os4-cluster == 'true'}} - create-long-cluster: ${{github.event.inputs.create-long-cluster == 'true'}} - dry-run: ${{github.event.inputs.dry-run == 'true'}} - workflow-ref: v1 - kube-burner-config-ref: ${{ github.event.inputs.version }} - kube-burner-config-repo: stackrox - cluster-with-fake-load-name: ${{ needs.trim-cluster-names.outputs.cluster-with-fake-load-name-cleaned }} - cluster-with-real-load-name: ${{ needs.trim-cluster-names.outputs.cluster-with-real-load-name-cleaned }} diff --git a/.github/workflows/cut-rc.yml b/.github/workflows/cut-rc.yml deleted file mode 100644 index 24f1d3784ef91..0000000000000 --- a/.github/workflows/cut-rc.yml +++ /dev/null @@ -1,341 +0,0 @@ -name: "RELEASE: Cut RC" -on: - milestone: - types: - - closed - - workflow_dispatch: - inputs: - version: - description: Full RC version (A.B.C[-N]-rc.D) - required: true - default: 0.0.0-test-rc.1 - type: string - dry-run: - description: Dry-run - required: false - default: true - type: boolean - create-k8s-cluster: - description: Create a GKE demo cluster - required: true - default: true - type: boolean - create-os4-cluster: - description: Create an Openshift 4 demo cluster - required: true - default: true - type: boolean - create-long-cluster: - description: Create a long-running cluster on RC1 - required: true - default: true - type: boolean - check-jira-issues: - description: Check Jira issues for current release - required: true - default: true - type: boolean - -env: - main_branch: ${{github.event.repository.default_branch}} - script_url: /repos/${{github.repository}}/contents/.github/workflows/scripts/common.sh?ref=${{ github.ref_name }} - DRY_RUN: ${{ fromJSON('["true", "false"]')[github.event.inputs.dry-run != 'true'] }} - ACCEPT_RAW: "Accept: application/vnd.github.v3.raw" - GH_TOKEN: ${{ github.token }} - GH_NO_UPDATE_NOTIFIER: 1 - TIMEOUT_WAIT_FOR_IMAGES_SECONDS: 3600 - -run-name: >- - ${{ - format('Cut {0}{1}{2}', - github.event.milestone.title, - inputs.version, - fromJSON('[" (dry-run)", ""]')[github.event.inputs.dry-run != 'true'] - ) - }} - -# Ensure that only a single automation workflow can run at a time for each release. -concurrency: Release automation ${{ inputs.version }} - -jobs: - properties: - runs-on: ubuntu-latest - outputs: - slack-channel: ${{ fromJSON(format('["{0}","{1}"]', steps.fetch.outputs.dry-slack-channel, steps.fetch.outputs.slack-channel))[github.event.inputs.dry-run != 'true'] }} - jira-projects: ${{ steps.fetch.outputs.jira-projects }} - steps: - - name: Read workflow properties file - id: fetch - env: - PROPERTIES_URL: /repos/${{ github.repository }}/contents/.github/properties?ref=${{ github.ref_name }} - run: gh api -H "$ACCEPT_RAW" "$PROPERTIES_URL" >> "$GITHUB_OUTPUT" - - run-parameters: - name: Run parameters - runs-on: ubuntu-latest - steps: - - run: | - [ "$DRY_RUN" = "true" ] && echo "::warning::This is a dry run" - echo "Event: ${{github.event_name}}" >>"$GITHUB_STEP_SUMMARY" - if [ "${{github.event_name}}" = "workflow_dispatch" ]; then - cat <>"$GITHUB_STEP_SUMMARY" - \`\`\` - ${{toJSON(inputs)}} - \`\`\` - EOF - fi - - variables: - name: Setup variables - uses: ./.github/workflows/variables.yml - with: - version: ${{format('{0}{1}', github.event.milestone.title, github.event.inputs.version)}} - assert-format: A.B.C[-N]-rc.D - - check-jira: - name: Check Jira tickets for release - needs: [variables, properties] - runs-on: ubuntu-latest - steps: - - name: Query JIRA - # Checking unequal with "false" because closed milestones have unset input values. - if: github.event.inputs.check-jira-issues != 'false' - env: - JIRA_TOKEN: ${{ secrets.JIRA_TOKEN }} - run: | - set -uo pipefail - gh api -H "$ACCEPT_RAW" "${{env.script_url}}" | bash -s -- \ - check-jira-issues \ - "${{needs.properties.outputs.jira-projects}}" \ - "${{needs.variables.outputs.release}}" \ - "${{needs.variables.outputs.patch}}" \ - "${{needs.variables.outputs.named-release-patch}}" - - postpone-prs: - name: Postpone open PRs - needs: variables - runs-on: ubuntu-latest - steps: - - name: Check open PRs - id: check - run: | - set -u - PRs=$(gh pr list -s open \ - --repo "${{github.repository}}" \ - --search "milestone:${{needs.variables.outputs.milestone}}" \ - --json number \ - --jq length) - if [ "$PRs" -gt 0 ]; then - echo "open-issues=$PRs" >> "$GITHUB_OUTPUT" - fi - - - name: Create next milestone - if: env.DRY_RUN == 'false' && steps.check.outputs.open-issues != '' - run: | - set -u - if ! RESPONSE=$(gh api -X POST \ - "repos/${{github.repository}}/milestones" \ - -f title="${{needs.variables.outputs.next-milestone}}" \ - 2>&1); then - if grep "HTTP 422" <<< "$RESPONSE"; then - echo "Milestone ${{needs.variables.outputs.next-milestone}} already exists." >> "$GITHUB_STEP_SUMMARY" - else - echo "::error::Couldn't create milestone ${{needs.variables.outputs.next-milestone}}: $RESPONSE" - exit 1 - fi - else - NEXT_MILESTONE_URL=$(echo "${RESPONSE}" | jq -r '.html_url') - echo ":arrow_right: Close the newly created [milestone ${{ needs.variables.outputs.next-milestone }}](${NEXT_MILESTONE_URL}) when ready, or delete it when finishing the release." >> "$GITHUB_STEP_SUMMARY" - fi - - - name: Move open PRs - run: | - set -u - PRS=$(gh pr list -s open \ - --repo "${{github.repository}}" \ - --search "milestone:${{needs.variables.outputs.milestone}}" \ - --json number \ - --jq ".[] | .number") - - echo "The following PRs are still open: $PRS" - - for PR in $PRS; do - [ "$DRY_RUN" = "false" ] && \ - gh pr edit "$PR" \ - --milestone "${{needs.variables.outputs.next-milestone}}" \ - --repo "${{github.repository}}" - - echo "PR $PR has been moved to milestone ${{needs.variables.outputs.next-milestone}}." >> "$GITHUB_STEP_SUMMARY" - done - - cut-rc: - name: Tag RC for milestone ${{needs.variables.outputs.milestone}} - runs-on: ubuntu-latest - needs: [variables, properties, postpone-prs, check-jira] - steps: - - name: Check out code - uses: actions/checkout@v6 - with: - ref: ${{needs.variables.outputs.branch}} - token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - - name: Initialize mandatory git config - run: | - git config user.name "${{github.event.sender.login}}" - git config user.email noreply@github.com - - run: | - # Could be optimized: done only if there are closed PRs to cherry-pick - git fetch origin ${{env.main_branch}}:${{env.main_branch}} --unshallow - - name: Cherry-pick commits from the main branch - id: cherry-pick - run: | - set -uo pipefail - gh api -H "$ACCEPT_RAW" "${{env.script_url}}" | bash -s -- \ - cherry-pick \ - "${{needs.variables.outputs.milestone}}" \ - "${{needs.variables.outputs.branch}}" \ - "${{needs.variables.outputs.named-release-patch}}" - - - name: Post to Slack about picked cherries - if: failure() && steps.cherry-pick.outputs.bad-cherries != '' - uses: slackapi/slack-github-action@v2.1.1 - with: - method: chat.postMessage - token: ${{ secrets.SLACK_BOT_TOKEN }} - payload: | - channel: "${{ needs.properties.outputs.slack-channel }}" - text: "Couldn't close upstream milestone ${{needs.variables.outputs.milestone}} on <${{github.server_url}}/${{github.repository}}|${{github.repository}}>. See workflow run <${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|${{github.workflow}}> for details." - blocks: - - type: "section" - text: - type: "mrkdwn" - text: | - :${{ fromJSON('["desert", "red_circle"]')[github.event.inputs.dry-run != 'true'] }}: - *Couldn't close upstream milestone ${{needs.variables.outputs.milestone}} on <${{github.server_url}}/${{github.repository}}|${{github.repository}}>.* - - type: "section" - text: - type: "mrkdwn" - text: | - *Couldn't cherry-pick the following PRs to the release branch:* - ${{steps.cherry-pick.outputs.bad-cherries}} - - type: "divider" - - type: "section" - text: - type: "mrkdwn" - text: | - :arrow_right: *Please assist the PR assignees in merging their changes to `${{needs.variables.outputs.branch}}` branch - and then re-run failed jobs of the <${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|workflow run>.* - - type: "section" - text: - type: "mrkdwn" - text: | - > Repository: <${{github.server_url}}/${{github.repository}}|${{github.repository}}> - > Milestone: <${{github.event.milestone.html_url}}|${{needs.variables.outputs.milestone}}> - > Workflow: <${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|${{github.workflow}}> - - - name: Tag release branch with "${{needs.variables.outputs.milestone}}" - id: tag - env: - GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - run: | - set -uo pipefail - gh api -H "$ACCEPT_RAW" "${{env.script_url}}" | bash -s -- \ - tag-rc \ - "${{needs.variables.outputs.milestone}}" - - - name: Create next milestone - if: env.DRY_RUN == 'false' - env: - GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - run: | - set -u - if ! http_code=$(gh api --silent -X POST \ - "repos/${{github.repository}}/milestones" \ - -f title="${{needs.variables.outputs.next-milestone}}" \ - 2>&1); then - - if grep "HTTP 422" <<< "$http_code"; then - echo "Milestone ${{needs.variables.outputs.next-milestone}} already exists." >> "$GITHUB_STEP_SUMMARY" - else - echo "::error::Couldn't create milestone ${{needs.variables.outputs.next-milestone}}: $http_code" - exit 1 - fi - else - echo ":arrow_right: Close the newly created milestone [${{needs.variables.outputs.next-milestone}}](${{github.event.milestone.html_url}}) when ready." >> "$GITHUB_STEP_SUMMARY" - fi - - - name: Create GitHub Pre-release - id: pre-release - if: env.DRY_RUN == 'false' - env: - GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - run: | - set -uo pipefail - gh api -H "$ACCEPT_RAW" "${{env.script_url}}" | bash -s -- \ - create-release \ - "${{ needs.variables.outputs.milestone }}" \ - "${{ needs.variables.outputs.branch }}" \ - "true" - - - name: Post to Slack - uses: slackapi/slack-github-action@v2.1.1 - with: - method: chat.postMessage - token: ${{ secrets.SLACK_BOT_TOKEN }} - payload: | - channel: "${{ needs.properties.outputs.slack-channel }}" - text: "Upstream release candidate <${{steps.pre-release.outputs.url}}|${{needs.variables.outputs.milestone}}> of <${{github.server_url}}/${{github.repository}}|${{github.repository}}> has been published on GitHub" - blocks: - - type: "section" - text: - type: "mrkdwn" - text: | - :${{ fromJSON('["desert", "white_check_mark"]')[github.event.inputs.dry-run != 'true'] }}: *Upstream release candidate <${{steps.pre-release.outputs.url}}|${{needs.variables.outputs.milestone}}> of <${{github.server_url}}/${{github.repository}}|${{github.repository}}> has been published on GitHub* - - type: "divider" - - type: "section" - text: - type: "mrkdwn" - text: | - :arrow_right: Once all checks pass and you're ready for release, run the <${{ github.server_url }}/${{ github.repository }}/actions/workflows/finish-release.yml|Finish Release> workflow and delete the `${{ needs.variables.outputs.next-milestone }}` milestone to avoid confusion. - - trim-cluster-names: - runs-on: ubuntu-latest - outputs: - cluster-with-fake-load-name-cleaned: ${{ steps.cluster-names.outputs.cluster-with-fake-load-name-cleaned }} - cluster-with-real-load-name-cleaned: ${{ steps.cluster-names.outputs.cluster-with-real-load-name-cleaned }} - env: - CLUSTER_WITH_FAKE_LOAD_NAME: lfl-${{format('{0}{1}', github.event.milestone.title, github.event.inputs.version)}} - CLUSTER_WITH_REAL_LOAD_NAME: lrl-${{format('{0}{1}', github.event.milestone.title, github.event.inputs.version)}} - steps: - - name: Trim and clean cluster names - id: cluster-names - run: | - # Cluster names are cropped to infra's max length and dots replaced with dashes. - # Latter is to avoid informing release engineers of incorrect cluster names. - CLEANED_CLUSTER_WITH_FAKE_LOAD_NAME="$(echo "${CLUSTER_WITH_FAKE_LOAD_NAME:0:28}" | tr '.' '-')" - echo "cluster-with-fake-load-name-cleaned=${CLEANED_CLUSTER_WITH_FAKE_LOAD_NAME}" >> "${GITHUB_OUTPUT}" - - CLEANED_CLUSTER_WITH_REAL_LOAD_NAME="$(echo "${CLUSTER_WITH_REAL_LOAD_NAME:0:28}" | tr '.' '-')" - echo "cluster-with-real-load-name-cleaned=${CLEANED_CLUSTER_WITH_REAL_LOAD_NAME}" >> "${GITHUB_OUTPUT}" - - clusters: - name: Setup demo clusters - secrets: inherit - needs: [variables, cut-rc, trim-cluster-names] - uses: stackrox/actions/.github/workflows/create-demo-clusters.yml@v1 - if: >- # Skip if no clusters are going to be created. Checking unequal with "false" because closed milestones have unset input values. - github.event.inputs.create-k8s-cluster != 'false' || - github.event.inputs.create-os4-cluster != 'false' || - needs.variables.outputs.rc == '1' && - github.event.inputs.create-long-cluster != 'false' - with: - version: ${{needs.variables.outputs.milestone}} - create-k8s-cluster: ${{github.event.inputs.create-k8s-cluster != 'false'}} - create-os4-cluster: ${{github.event.inputs.create-os4-cluster != 'false'}} - create-long-cluster: ${{needs.variables.outputs.rc == '1' && github.event.inputs.create-long-cluster != 'false'}} - dry-run: ${{github.event.inputs.dry-run == 'true'}} - workflow-ref: v1 - kube-burner-config-ref: ${{needs.variables.outputs.milestone}} - kube-burner-config-repo: stackrox - cluster-with-fake-load-name: ${{ needs.trim-cluster-names.outputs.cluster-with-fake-load-name-cleaned }} - cluster-with-real-load-name: ${{ needs.trim-cluster-names.outputs.cluster-with-real-load-name-cleaned }} diff --git a/.github/workflows/emailsender-central-compatibility.yaml b/.github/workflows/emailsender-central-compatibility.yaml deleted file mode 100644 index 9de49411e5612..0000000000000 --- a/.github/workflows/emailsender-central-compatibility.yaml +++ /dev/null @@ -1,84 +0,0 @@ - -name: emailsender-central-compatibility - -on: - push: - branches: - - master - paths: - - 'central/notifiers/email/**' - - 'central/notifiers/acscsemail/**' - - 'central/auth/m2m/**' - - '.github/workflows/emailsender-central-compatibility.yaml' - - pull_request: - types: [opened, synchronize, reopened, ready_for_review] - paths: - - 'central/notifiers/email/**' - - 'central/notifiers/acscsemail/**' - - 'central/auth/m2m/**' - - '.github/workflows/emailsender-central-compatibility.yaml' - -jobs: - e2e-test-on-kind: - timeout-minutes: 60 - name: "Test on kind cluster" - runs-on: ubuntu-latest - if: ${{ !github.event.pull_request.head.repo.fork }} # do not run for PRs from forks - permissions: - id-token: write - contents: read - steps: - - name: Cancel Previous Runs - uses: n1hility/cancel-previous-runs@v3 - with: - token: ${{ secrets.GITHUB_TOKEN }} - - name: Login to Quay.io - uses: docker/login-action@v3 - with: - registry: quay.io - username: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }} - password: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }} - - name: Checkout stackrox/acs-fleet-manager repository - uses: actions/checkout@v6 - with: - repository: stackrox/acs-fleet-manager - path: acs-fleet-manager - ref: main - fetch-depth: 0 - - name: Checkout stackrox/stackrox repository - uses: actions/checkout@v6 - with: - repository: stackrox/stackrox - ref: ${{ github.event.pull_request.head.sha }} - path: stackrox - fetch-depth: 0 - - name: Set up Go - uses: actions/setup-go@v6 - with: - go-version-file: stackrox/go.mod - - name: Cache go module - uses: actions/cache@v5 - with: - path: ~/go/pkg/mod - key: ${{ runner.os }}-go-${{ hashFiles('stackrox/go.sum') }} - restore-keys: | - ${{ runner.os }}-go- - - uses: ./stackrox/.github/actions/job-preamble - with: - free-disk-space: 40 - - name: Create Kind cluster" - uses: helm/kind-action@v1 - with: - cluster_name: kind - - name: Run Test - env: - IMG_WAIT_TIMEOUT_SECONDS: 2100 - run: acs-fleet-manager/scripts/ci/central_compatibility/entrypoint.sh - - name: Upload logs - uses: actions/upload-artifact@v6 - if: failure() - with: - name: logs-directory-${{ github.sha }} - path: logs/ - retention-days: 3 diff --git a/.github/workflows/finish-release.yml b/.github/workflows/finish-release.yml deleted file mode 100644 index 54dc553dcf474..0000000000000 --- a/.github/workflows/finish-release.yml +++ /dev/null @@ -1,240 +0,0 @@ -name: "RELEASE: Finish Release" -on: - workflow_dispatch: - inputs: - version: - description: Release version (A.B.C[-N]) - required: true - default: 0.0.0-test - type: string - dry-run: - description: Dry-run - required: false - default: true - type: boolean - -env: - main_branch: ${{ github.event.repository.default_branch }} - script_url: /repos/${{ github.repository }}/contents/.github/workflows/scripts/common.sh?ref=${{ github.ref_name }} - DRY_RUN: ${{ fromJSON('["true", "false"]')[github.event.inputs.dry-run != 'true'] }} - ACCEPT_RAW: "Accept: application/vnd.github.v3.raw" - GH_TOKEN: ${{ github.token }} - GH_NO_UPDATE_NOTIFIER: 1 - -run-name: >- - ${{ - format('Finish release {0}{1}', - inputs.version, - fromJSON('[" (dry-run)", ""]')[inputs.dry-run != true] - ) - }} - -# Ensure that only a single automation workflow can run at a time for each release. -concurrency: Release automation ${{ inputs.version }} - -jobs: - properties: - runs-on: ubuntu-latest - outputs: - slack-channel: ${{ fromJSON(format('["{0}","{1}"]', steps.fetch.outputs.dry-slack-channel, steps.fetch.outputs.slack-channel))[github.event.inputs.dry-run != 'true'] }} - steps: - - name: Read workflow properties file - id: fetch - env: - PROPERTIES_URL: /repos/${{ github.repository }}/contents/.github/properties?ref=${{ github.ref_name }} - run: gh api -H "$ACCEPT_RAW" "$PROPERTIES_URL" >> "$GITHUB_OUTPUT" - - run-parameters: - if: github.event_name == 'workflow_dispatch' - name: Run parameters - runs-on: ubuntu-latest - steps: - - run: | - [ "$DRY_RUN" = "true" ] && echo "::warning::This is a dry run" - { - echo "Event: ${{ github.event_name }}" - if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then - echo '```' - echo "${{ toJSON(inputs) }}" - echo '```' - fi - } >> "$GITHUB_STEP_SUMMARY" - - variables: - if: github.event_name == 'workflow_dispatch' - name: Setup variables - uses: ./.github/workflows/variables.yml - with: - version: ${{ inputs.version }} - assert-format: A.B.C[-N] - - publish-release: - name: Tag Release ${{ needs.variables.outputs.named-release-patch }} - runs-on: ubuntu-latest - needs: [variables, properties] - steps: - - name: Check out code - uses: actions/checkout@v6 - with: - ref: ${{ needs.variables.outputs.branch }} - token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - fetch-depth: 0 - - name: Initialize mandatory git config - run: | - git config user.name "${{ github.event.sender.login }}" - git config user.email noreply@github.com - - - name: Check CHANGELOG entry exists for release "${{ needs.variables.outputs.named-release-patch }}" - run: | - set -uo pipefail - gh api -H "$ACCEPT_RAW" "${{ env.script_url }}" | bash -s -- \ - check-changelog \ - "${{ needs.variables.outputs.branch }}" \ - "${{ needs.variables.outputs.named-release-patch }}" - - - name: Tag release branch with "${{ needs.variables.outputs.named-release-patch }}" - id: tag - env: - GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - run: | - set -uo pipefail - gh api -H "$ACCEPT_RAW" "${{ env.script_url }}" | bash -s -- \ - tag-rc \ - "${{ needs.variables.outputs.named-release-patch }}" - - - name: Create GitHub Release - id: release - if: env.DRY_RUN == 'false' - env: - GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - run: | - set -uo pipefail - gh api -H "$ACCEPT_RAW" "${{env.script_url}}" | bash -s -- \ - create-release \ - "${{ needs.variables.outputs.named-release-patch }}" \ - "${{ needs.variables.outputs.branch }}" \ - "false" - - - name: Delete open milestone for release - if: env.DRY_RUN == 'false' - run: | - set -uo pipefail - gh api \ - repos/${{ github.repository }}/milestones \ - --jq '.[] | select((.title | startswith("${{ needs.variables.outputs.named-release-patch }}-rc.")) and (.state == "open")) | .number' \ - | xargs -I % gh api -X DELETE repos/${{ github.repository }}/milestones/% - - - name: Create first milestone for the next patch release - if: env.DRY_RUN == 'false' - env: - GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - run: | - set -uo pipefail - NEXT_RELEASE_FIRST_MILESTONE="${{ needs.variables.outputs.next-named-patch-release }}-rc.1" - if ! http_code=$(gh api --silent -X POST \ - "repos/${{github.repository}}/milestones" \ - -f title="${NEXT_RELEASE_FIRST_MILESTONE}" \ - 2>&1); then - - if grep "HTTP 422" <<< "$http_code"; then - echo "Milestone ${NEXT_RELEASE_FIRST_MILESTONE} already exists." >> "$GITHUB_STEP_SUMMARY" - else - echo "::error::Couldn't create milestone ${NEXT_RELEASE_FIRST_MILESTONE}: $http_code" - exit 1 - fi - fi - - - name: Post to Slack - uses: slackapi/slack-github-action@v2.1.1 - with: - method: chat.postMessage - token: ${{ secrets.SLACK_BOT_TOKEN }} - payload: | - channel: "${{ needs.properties.outputs.slack-channel }}" - text: "Release <${{ steps.release.outputs.url }} | ${{ inputs.version }}> has been published. Consult the tracker for next steps." - blocks: - - type: "section" - text: - type: "mrkdwn" - text: | - :${{ fromJSON('["desert", "white_check_mark"]')[github.event.inputs.dry-run != 'true'] }}: *Release <${{ steps.release.outputs.url }} | ${{ inputs.version }}> of <${{github.server_url}}/${{github.repository}}|${{github.repository}}> has been published on GitHub.* - - type: "section" - text: - type: "mrkdwn" - text: | - :arrow_right: Tell the downstream release engineer to trigger the downstream release. - Once the downstream release is complete, merge the PR created by CI in repository. - - type: "section" - text: - type: "mrkdwn" - text: | - :arrow_right: Check the status of the upstream CI for the tag in and follow up on any failures." - - update-infra-demo-version: - name: Update infra demo default versions - runs-on: ubuntu-latest - needs: [publish-release] - env: - BRANCH: "bump-demo-versions-${{ inputs.version }}" - steps: - - name: Checkout stackrox/infra repository - uses: actions/checkout@v6 - with: - repository: stackrox/infra - token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - ref: master - - name: Initialize git and check remote branch exists - id: check-existing - run: | - git config user.name "${{github.event.sender.login}}" - git config user.email noreply@github.com - if git ls-remote --quiet --exit-code origin "$BRANCH"; then - echo "branch-exists=true" >> "$GITHUB_OUTPUT" - else - echo "branch-exists=false" >> "$GITHUB_OUTPUT" - fi - - name: Create new branch - if: steps.check-existing.outputs.branch-exists == 'false' - run: | - git switch --create "$BRANCH" - - name: Switch to branch - if: steps.check-existing.outputs.branch-exists == 'true' - run: | - git fetch origin - git switch "$BRANCH" - - name: Update the demo version in the infra chart definition - id: update-infra-demo-version - run: | - CURRENT_VERSION="$(yq '.annotations.acsDemoVersion' < chart/infra-server/Chart.yaml)" - if printf '%s\n%s\n' "${CURRENT_VERSION}" "${{ inputs.version }}" | sort --check=quiet --version-sort; then - yq eval -i '.annotations.acsDemoVersion = "${{ inputs.version }}"' chart/infra-server/Chart.yaml - git add chart/infra-server/Chart.yaml - if ! git diff-index --quiet HEAD; then - git commit --message "Bump demo versions for ${{ inputs.version }}" - echo "Demo versions were bumped in infra." >> "$GITHUB_STEP_SUMMARY" - echo "update-required=true" >> "$GITHUB_OUTPUT" - else - echo "Demo versions were not updated in infra, because there is no diff." >> "$GITHUB_STEP_SUMMARY" - echo "update-required=false" >> "$GITHUB_OUTPUT" - fi - else - echo "Demo versions were not updated in infra, because the current version is newer." >> "$GITHUB_STEP_SUMMARY" - echo "update-required=false" >> "$GITHUB_OUTPUT" - fi - - - name: Push changes & open PR - if: env.DRY_RUN == 'false' && steps.update-infra-demo-version.outputs.update-required == 'true' - env: - GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - run: | - git push --force --set-upstream origin "$BRANCH" - if ! gh pr ready; then - PR_URL=$(gh pr create --repo stackrox/infra \ - --title "Bump demo versions to ${{ inputs.version }}" \ - --base "master" \ - --body "Bumping demo versions for ACS release ${{ inputs.version }}") - - echo ":arrow_right: Let the infra team review and roll out the changes from the [PR]($PR_URL) that has been created." >> "$GITHUB_STEP_SUMMARY" - else - echo ":arrow_right: Let the infra team review and rollout the changes from the update PR." >> "$GITHUB_STEP_SUMMARY" - fi diff --git a/.github/workflows/fixxxer.yaml b/.github/workflows/fixxxer.yaml deleted file mode 100644 index f562e9ebe7eba..0000000000000 --- a/.github/workflows/fixxxer.yaml +++ /dev/null @@ -1,79 +0,0 @@ -name: PR Fixxxer - -on: - issue_comment: - types: [created] - -permissions: - contents: write - -env: - ROX_PRODUCT_BRANDING: RHACS_BRANDING - -jobs: - pr_commented: - name: Run PR Fixxxer - # TODO: support leading and trailing whitespace too - if: ${{ github.event.issue.pull_request && github.event.comment.body == '/fixxx' }} - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - steps: - - - name: Fetch PR metadata - id: pr-metadata - run: | - curl --silent --retry 7 "$PR_URL" > pr.json - pr_head_repo="$(jq --raw-output .head.repo.full_name pr.json)" - - if [ "$pr_head_repo" != "${THIS_REPO}" ]; then - echo "This comment was issued on a PR from branch in repo $pr_head_repo. Currently only PRs from branches in repo $THIS_REPO are supported." - # TODO: we could still run commands and point at results in a PR comment, even if we do not have permissions to push there. - exit 1 - fi - - branch="$(jq --raw-output .head.ref pr.json)" - # If branch name is empty, push action defaults to pushing to main, which we do not want to do. - if [ -z "${branch}" ]; then - echo "Failed to detect source branch." - # TODO: more checks for safe branch names - exit 1 - fi - echo "branch=$branch" >> "$GITHUB_OUTPUT" - rm pr.json - env: - PR_URL: ${{ github.event.issue.pull_request.url }} - THIS_REPO: ${{ github.repository }} - - - name: Dump GitHub context - env: - GITHUB_CONTEXT: ${{ toJson(github) }} - run: echo "$GITHUB_CONTEXT" | jq . - - name: Dump job context - env: - JOB_CONTEXT: ${{ toJson(job) }} - run: echo "$JOB_CONTEXT" | jq . - - name: Dump steps context - env: - STEPS_CONTEXT: ${{ toJson(steps) }} - run: echo "$STEPS_CONTEXT" | jq . - - - uses: actions/checkout@v6 - with: - ref: ${{ steps.pr-metadata.outputs.branch }} - fetch-depth: 0 - token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - - - name: Configure Git - run: | - set -ex - git config --global --add safe.directory "$(pwd)" - git config --global user.email "rhacs-bot@redhat.com" - git config --global user.name "StackRox PR Fixxxer" - - - run: ./scripts/fixxxer.sh - - - uses: ad-m/github-push-action@v1.0.0 - with: - branch: ${{ steps.pr-metadata.outputs.branch }} - github_token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} diff --git a/.github/workflows/konflux-auto-retest.yml b/.github/workflows/konflux-auto-retest.yml deleted file mode 100644 index f0ecb4cfc89ea..0000000000000 --- a/.github/workflows/konflux-auto-retest.yml +++ /dev/null @@ -1,17 +0,0 @@ -name: Retest Konflux Builds - -on: - check_run: - types: [completed] - pull_request: - types: [synchronize] - -jobs: - retest-failed-builds: - uses: stackrox/actions/.github/workflows/retest-konflux-builds.yml@v1 - permissions: - pull-requests: write - issues: write - with: - max_retries: 3 - check_name_suffix: '-on-push' diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml deleted file mode 100644 index a2b40b7d73bc6..0000000000000 --- a/.github/workflows/labeler.yaml +++ /dev/null @@ -1,17 +0,0 @@ -name: Label pull requests based on changed files -on: - pull_request: - types: - - ready_for_review - - opened - - synchronize - -jobs: - label-pr: - runs-on: ubuntu-latest - if: ${{ github.actor != 'dependabot[bot]' && !github.event.pull_request.head.repo.fork }} - steps: - - uses: actions/labeler@v6 - with: - repo-token: "${{ github.token }}" - sync-labels: False diff --git a/.github/workflows/nightly-tag.yml b/.github/workflows/nightly-tag.yml deleted file mode 100644 index fef2d6783d405..0000000000000 --- a/.github/workflows/nightly-tag.yml +++ /dev/null @@ -1,37 +0,0 @@ -name: Create nightly tag -on: - workflow_dispatch: - schedule: - - cron: 0 0 * * 1-5 -jobs: - create-nightly-tag: - if: ${{ github.repository_owner == 'stackrox' }} - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - ref: nightlies - - name: Rebase branch and create new tag - env: - GITHUB_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - run: .openshift-ci/nightlies.sh - - slack-on-failure: - needs: create-nightly-tag - if: failure() - runs-on: ubuntu-latest - steps: - - name: Slack on failure - uses: slackapi/slack-github-action@v2.1.1 - with: - method: chat.postMessage - token: ${{ secrets.SLACK_BOT_TOKEN }} - payload: | - channel: "C010PEADMFA" # acs-nightly-ci-runs - text: "Updating nightly tag has failed. Please check the workflow run: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}." - blocks: - - type: "section" - text: - type: "mrkdwn" - text: " Updating nightly tag has failed. Please check the ." diff --git a/.github/workflows/notify-milestone-change.yml b/.github/workflows/notify-milestone-change.yml deleted file mode 100644 index e08e5f29b09f8..0000000000000 --- a/.github/workflows/notify-milestone-change.yml +++ /dev/null @@ -1,123 +0,0 @@ -name: "Release: Notify when PR is added or removed from milestone" -on: - pull_request: - types: [milestoned, demilestoned] - workflow_dispatch: - inputs: - test-pr-title: - description: 'Test PR title with quotes (for testing only)' - required: false - default: 'ROX-12345: Fix the "authentication" bug in login system' - type: string - -env: - ACCEPT_RAW: "Accept: application/vnd.github.v3.raw" - GH_TOKEN: ${{ github.token }} - GH_NO_UPDATE_NOTIFIER: 1 - -jobs: - properties: - name: Read repository properties - runs-on: ubuntu-latest - outputs: - docs-repository: ${{ steps.properties.outputs.docs-repository }} - slack-channel: ${{ fromJSON(format('["{0}","{1}"]', steps.properties.outputs.dry-slack-channel, steps.properties.outputs.slack-channel))[github.repository == 'stackrox/stackrox'] }} - jira-project: ${{ steps.properties.outputs.jira-project }} - steps: - - name: Read workflow properties file - id: properties - env: - PROPERTIES_URL: /repos/${{ github.repository }}/contents/.github/properties?ref=${{ github.event.repository.default_branch }} - run: gh api -H "$ACCEPT_RAW" "$PROPERTIES_URL" >> "$GITHUB_OUTPUT" - - notify: - runs-on: ubuntu-latest - needs: [properties] - steps: - - name: Determine Jira context for PR - id: context - env: - PR_TITLE: ${{ github.event_name == 'workflow_dispatch' && inputs.test-pr-title || github.event.pull_request.title }} - run: | - # For manual testing, simulate a milestoned event - if [ "${{ github.event_name }}" = "workflow_dispatch" ] || [ "${{ github.event.action}}" = "milestoned" ]; then - EVENT_ACTION="added to" - EVENT_ICON=":white_check_mark:" - echo "call-to-action=:arrow_right: Release Engineers : Review whether this PR meets the criteria for being included in the release." >> "${GITHUB_OUTPUT}" - else - EVENT_ACTION="removed from" - EVENT_ICON=":x:" - echo "call-to-action=:arrow_right: FYI, No action required" >> "${GITHUB_OUTPUT}" - fi - - # Escape quotes in PR_TITLE for YAML compatibility - ESCAPED_TITLE="${PR_TITLE//\"/\\\"}" - - if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then - # Manual testing mode - printf 'pr-info=%s (Author: test-user) was %s milestone .\n' \ - "${EVENT_ICON}" \ - "${{ github.repository }}" \ - "${ESCAPED_TITLE}" \ - "${EVENT_ACTION}" \ - "${{ github.repository }}" >> "${GITHUB_OUTPUT}" - else - # Real PR event - printf 'pr-info=%s <%s|%s> (Author: %s) was %s milestone <%s|%s>.\n' \ - "${EVENT_ICON}" \ - "${{ github.event.pull_request.html_url }}" \ - "${ESCAPED_TITLE}" \ - "${{ github.event.pull_request.user.login }}" \ - "${EVENT_ACTION}" \ - "${{ github.event.milestone.html_url }}" \ - "${{ github.event.milestone.title }}" >> "${GITHUB_OUTPUT}" - fi - - ISSUE_ID="$(echo "${PR_TITLE}" | grep --only-matching 'ROX-[0-9]\+' || true)" - if [ -n "${ISSUE_ID}" ]; then - JIRA_INFO="$(curl \ - -sSL \ - --retry 5 --retry-all-errors \ - --location "https://issues.redhat.com/rest/api/2/issue/${ISSUE_ID}" \ - --header "Authorization: Bearer ${{ secrets.JIRA_TOKEN }}" \ - | jq -r '{ key: .key, summary: .fields.summary, priority: .fields.priority.name, assignee: .fields.assignee.displayName, status: .fields.status.name, type: .fields.issuetype.name }')" - - KEY="$(echo "${JIRA_INFO}" | jq -r .key)" - SUMMARY="$(echo "${JIRA_INFO}" | jq -r .summary)" - PRIORITY="$(echo "${JIRA_INFO}" | jq -r .priority)" - ASSIGNEE="$(echo "${JIRA_INFO}" | jq -r .assignee)" - STATUS="$(echo "${JIRA_INFO}" | jq -r .status)" - TYPE="$(echo "${JIRA_INFO}" | jq -r .type)" - - # Escape quotes in SUMMARY for YAML compatibility - ESCAPED_SUMMARY="${SUMMARY//\"/\\\"}" - - # Need to use echo to preserve newlines in the output (GH action limitation) - # shellcheck disable=SC2028 - echo "jira-info=\n> Type: \`${TYPE}\`\n> Assignee: \`${ASSIGNEE}\`\n> Status: \`${STATUS}\`\n> Priority: \`${PRIORITY}\`" >> "${GITHUB_OUTPUT}" - else - echo "jira-info=:exclamation: We could not find a Jira issue for this PR." >> "${GITHUB_OUTPUT}" - fi - - - name: Send Slack notification - uses: slackapi/slack-github-action@v2.1.1 - with: - method: chat.postMessage - token: ${{ secrets.SLACK_BOT_TOKEN }} - payload: | - channel: "${{ needs.properties.outputs.slack-channel }}" - text: "${{ steps.context.outputs.pr-info }}" - blocks: - - type: "section" - text: - type: "mrkdwn" - text: "${{ steps.context.outputs.pr-info }}" - - type: "section" - text: - type: "mrkdwn" - text: "${{ steps.context.outputs.call-to-action }}" - - type: "divider" - - type: "section" - text: - type: "mrkdwn" - text: "${{ steps.context.outputs.jira-info}}" diff --git a/.github/workflows/performance-tests.yml b/.github/workflows/performance-tests.yml deleted file mode 100644 index b71360dff760a..0000000000000 --- a/.github/workflows/performance-tests.yml +++ /dev/null @@ -1,205 +0,0 @@ -name: Performance tests -on: - pull_request: - branches: - - master - types: - - labeled - - synchronize -concurrency: performance-tests-${{ github.ref }} -jobs: - wait-for-images: - name: Wait for images - runs-on: ubuntu-latest - if: ${{ contains(github.event.pull_request.labels.*.name, 'ci-performance-tests') }} - strategy: - matrix: - image: [main, roxctl] - steps: - - name: Checkout repo - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} - - name: Get PR image tag - run: | - MAIN_IMAGE_TAG="$(make tag)" - echo "MAIN_IMAGE_TAG=${MAIN_IMAGE_TAG}" >> "$GITHUB_ENV" - - name: Wait for the ${{ matrix.image }} - uses: stackrox/actions/release/wait-for-image@v1 - with: - token: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }} - image: rhacs-eng/${{ matrix.image }}:${{ env.MAIN_IMAGE_TAG }} - - run-k6-performance-tests: - needs: [wait-for-images] - name: Run k6 performance tests - runs-on: ubuntu-latest - if: ${{ contains(github.event.pull_request.labels.*.name, 'ci-performance-tests') }} - env: - USE_GKE_GCLOUD_AUTH_PLUGIN: "True" - INFRA_TOKEN: ${{ secrets.INFRA_TOKEN }} - KUBECONFIG: artifacts/kubeconfig - TERM: xterm - DEFAULT_IMAGE_REGISTRY: "quay.io/rhacs-eng" - SCALE_CLUSTER_NAME: k6-test-${{ github.event.pull_request.number }} - SCALE_WORKLOAD_TYPE: default - SCALE_WORKLOAD_CLUSTERS: 10 - steps: - - name: Checkout repo - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} - - - name: Checkout workflow scripts - uses: actions/checkout@v6 - with: - repository: "stackrox/workflow" - path: workflow - - # Create scale cluster with larger nodes. - - name: Create testing cluster - uses: stackrox/actions/infra/create-cluster@v1 - with: - token: ${{ secrets.INFRA_TOKEN }} - flavor: gke-default - name: ${{ env.SCALE_CLUSTER_NAME }} - lifespan: 12h - args: nodes=3,machine-type=e2-standard-32 - wait: true - - # Fetch infractl artifacts - - uses: stackrox/actions/infra/install-infractl@v1 - - uses: "google-github-actions/auth@v3" - with: - credentials_json: "${{ secrets.GCP_PERFORMANCE_TESTER_CI_SA }}" - - name: "Set up Cloud SDK" - uses: "google-github-actions/setup-gcloud@v3" - with: - install_components: "gke-gcloud-auth-plugin" - - name: Test cluster readiness - run: | - STATUS=$(infractl get "${SCALE_CLUSTER_NAME//./-}" --json | jq -r .Status) - if [ "$STATUS" != "READY" ]; then - exit 1 - fi - - name: Fetch infra artifacts - run: | - infractl artifacts "${SCALE_CLUSTER_NAME//./-}" --download-dir artifacts > /dev/null - - - name: Add Docker login for Quay.io - env: - REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }} - REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }} - run: | - docker login -u "${REGISTRY_USERNAME}" --password-stdin quay.io <<<"${REGISTRY_PASSWORD}" - - - name: Clean previous installation - run: | - source ./workflow/env.sh - ./scripts/k8s/cleanup.sh stackrox - - # Delete all namespaces created by scale script. - for i in $(seq 1 "${SCALE_WORKLOAD_CLUSTERS}"); do - ./scripts/k8s/cleanup.sh "stackrox${i}" - done - - - name: Get PR image tag - run: | - MAIN_IMAGE_TAG="$(make tag)" - echo "MAIN_IMAGE_TAG=${MAIN_IMAGE_TAG}" >> "$GITHUB_ENV" - - # Install Central + CentralDB - - name: Launch central services - env: - LOAD_BALANCER: lb - ROX_POSTGRES_DATASTORE: "true" - MONITORING_SUPPORT: "false" - REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }} - REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }} - run: | - source ./workflow/env.sh - - # ROX-29641: We are facing issues with workload generation on GKE when Scanner v4 is enabled. - export ROX_SCANNER_V4=false - ./scale/dev/launch_central.sh - - # Required for k6 tests to run. - echo "ROX_ADMIN_PASSWORD=$(cat ./deploy/k8s/central-deploy/password)" >> "$GITHUB_ENV" - echo "ROX_PASSWORD=$(cat ./deploy/k8s/central-deploy/password)" >> "$GITHUB_ENV" - echo "::add-mask::$(cat ./deploy/k8s/central-deploy/password)" - - LB_IP="$(kubectl -n stackrox get svc/central-loadbalancer -o json | jq -r '.status.loadBalancer.ingress[0] | .ip // .hostname')" - echo "HOST=https://${LB_IP}:443" >> "$GITHUB_ENV" - echo "API_ENDPOINT=${LB_IP}:443" >> "$GITHUB_ENV" - echo "::add-mask::${LB_IP}" - - - name: Generate workload - env: - LOAD_BALANCER: lb - ROX_POSTGRES_DATASTORE: "true" - MONITORING_SUPPORT: "false" - REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }} - REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }} - run: | - source ./workflow/env.sh - ./scale/dev/run-many.sh "${SCALE_WORKLOAD_TYPE}" "${SCALE_WORKLOAD_CLUSTERS}" - - num_deployments=$(yq '.deploymentWorkload[] | select(.deploymentType == "Deployment") | .numDeployments' "./scale/workloads/${SCALE_WORKLOAD_TYPE}.yaml") - max_deployments=$(( num_deployments * SCALE_WORKLOAD_CLUSTERS - 20 )) # num_deployments * SCALE_WORKLOAD_CLUSTERS is never quite reached so stop before than - - ./scale/dev/wait-for-deployments.sh "${max_deployments}" - - - name: Stop workload generation - run: | - source ./workflow/env.sh - ./scale/dev/kill-sensors.sh - - - name: Create result directory - run: | - mkdir -p performance-results - - - name: Run local k6 test - uses: grafana/k6-action@v0.3.1 - with: - filename: ./tests/performance/tests/testK6Integration.js - flags: --out json=performance-results/raw.json --out csv=performance-results/raw.csv --iterations 50 --duration 20m --tag github_run_id=${{ github.run_id }} --tag github_ref=${{ github.ref }} --tag github_sha=${{ github.sha }} - - - name: Publish JUnit test report in job summary - uses: test-summary/action@v2 - with: - paths: performance-results/report.xml - - - name: Upload results to GCS - uses: google-github-actions/upload-cloud-storage@v3 - with: - path: performance-results - destination: acs-performance-test-results/${{ github.ref }}/${{ github.sha }}/${{ github.run_id }}/${{ github.run_attempt }} - gzip: false - process_gcloudignore: false - - - name: Render PR comment from text report and links - run: | - report_txt=$(cat performance-results/report.txt) - cat < pr-comment.md - # Performance test results - - ## Summary - - $report_txt - - ## Sources - - - Summary: [HTML Report](https://storage.cloud.google.com/acs-performance-test-results/${{ github.ref }}/${{ github.sha }}/${{ github.run_id }}/${{ github.run_attempt }}/performance-results/report.html) | [JSON](https://storage.cloud.google.com/acs-performance-test-results/${{ github.ref }}/${{ github.sha }}/${{ github.run_id }}/${{ github.run_attempt }}/performance-results/report.json) - - Raw Data: [CSV](https://storage.cloud.google.com/acs-performance-test-results/${{ github.ref }}/${{ github.sha }}/${{ github.run_id }}/${{ github.run_attempt }}/performance-results/raw.csv) | [JSON](https://storage.cloud.google.com/acs-performance-test-results/${{ github.ref }}/${{ github.sha }}/${{ github.run_id }}/${{ github.run_attempt }}/performance-results/raw.json) - EOF - - cat pr-comment.md >> "$GITHUB_STEP_SUMMARY" - - - name: Add text report and links as PR comment - uses: mshick/add-pr-comment@v2 - with: - message-id: performance-evaluation - message-path: | - pr-comment.md diff --git a/.github/workflows/release-ci.yaml b/.github/workflows/release-ci.yaml deleted file mode 100644 index f28143aa12eaf..0000000000000 --- a/.github/workflows/release-ci.yaml +++ /dev/null @@ -1,161 +0,0 @@ -name: Release CI -on: - push: - branches: - - 'release-*' - tags-ignore: - - '*-nightly-*' - -jobs: - run-parameters: - name: Run parameters - runs-on: ubuntu-latest - steps: - - run: | - echo "Event: ${{ github.event_name }}" >> "$GITHUB_STEP_SUMMARY" - echo "Ref: ${{ github.ref_name }}" >> "$GITHUB_STEP_SUMMARY" - - build: - name: Build - uses: ./.github/workflows/build.yaml - secrets: inherit - - build-scanner-v4: - name: Build Scanner v4 - uses: ./.github/workflows/scanner-build.yaml - secrets: inherit - - check-is-release: - runs-on: ubuntu-latest - outputs: - is_release: ${{ steps.is_release_check.outputs.is_release }} - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.ref_name }} - - id: is_release_check - run: | - source scripts/ci/lib.sh - if is_release_version "${{ github.ref_name }}"; then - echo "is_release=true" | tee -a "$GITHUB_OUTPUT" - else - echo "is_release=false" | tee -a "$GITHUB_OUTPUT" - fi - - check-scanner-version: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.ref_name }} - - name: Check scanner version - run: | - scripts/ci/lib.sh \ - check_scanner_version - - check-collector-version: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.ref_name }} - - name: Check collector version - run: | - scripts/ci/lib.sh \ - check_collector_version - - check-fact-version: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.ref_name }} - - name: Check fact version - run: | - scripts/ci/lib.sh \ - check_fact_version - - publish-helm-charts: - needs: [build, check-scanner-version, check-collector-version, check-fact-version, check-is-release] - if: needs.check-is-release.outputs.is_release == 'true' - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.ref_name }} - - uses: ./.github/actions/download-artifact-with-retry - with: - name: cli-build - - name: Publish Helm charts to stackrox/release-artifacts - env: - STACKROX_TAG: ${{ github.ref_name }} - GITHUB_USERNAME: ${{ secrets.RHACS_BOT_GITHUB_USERNAME }} - GITHUB_EMAIL: ${{ secrets.RHACS_BOT_GITHUB_EMAIL }} - GITHUB_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - SLACK_MAIN_WEBHOOK: ${{ secrets.SLACK_MAIN_WEBHOOK }} - RELEASE_WORKFLOW_NOTIFY_WEBHOOK: ${{ secrets.RELEASE_WORKFLOW_NOTIFY_WEBHOOK }} - run: | - tar xzf cli-build.tgz - mkdir -p "${HOME}/.local/bin" - mv bin/linux_amd64/roxctl "${HOME}/.local/bin/roxctl" - scripts/ci/lib.sh \ - push_helm_charts "${STACKROX_TAG}" - - # Publish `roxagent` and `roxctl`. - publish-cli: - needs: [build, check-scanner-version, check-collector-version, check-fact-version, check-is-release] - if: needs.check-is-release.outputs.is_release == 'true' - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.ref_name }} - - uses: 'google-github-actions/auth@v3' - with: - credentials_json: '${{ secrets.GCLOUD_SERVICE_ACCOUNT_CI_ROX }}' - - name: 'Set up Cloud SDK' - uses: 'google-github-actions/setup-gcloud@v3' - - uses: ./.github/actions/download-artifact-with-retry - with: - name: cli-build - - name: Publish cli artifacts to Google Cloud storage - env: - STACKROX_TAG: ${{ github.ref_name }} - run: | - tar xzf cli-build.tgz - scripts/ci/lib.sh \ - publish_cli "${STACKROX_TAG}" - - publish-openapispec: - needs: [build, check-scanner-version, check-collector-version, check-fact-version, check-is-release] - if: needs.check-is-release.outputs.is_release == 'true' - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.ref_name }} - - uses: 'google-github-actions/auth@v3' - with: - credentials_json: '${{ secrets.GCLOUD_SERVICE_ACCOUNT_CI_ROX }}' - - name: 'Set up Cloud SDK' - uses: 'google-github-actions/setup-gcloud@v3' - - name: Publish OpenAPI spec to Google Cloud storage - env: - STACKROX_TAG: ${{ github.ref_name }} - run: | - scripts/ci/lib.sh \ - publish_openapispec "${STACKROX_TAG}" diff --git a/.github/workflows/retest_periodic.yml b/.github/workflows/retest_periodic.yml deleted file mode 100644 index ae15f50e59843..0000000000000 --- a/.github/workflows/retest_periodic.yml +++ /dev/null @@ -1,30 +0,0 @@ -name: Auto /retest -on: - workflow_dispatch: - schedule: - - cron: 5,15,25,35,45,55 * * * * -concurrency: - group: Auto /retest - cancel-in-progress: false -jobs: - retest: - if: ${{ github.repository_owner == 'stackrox' }} - timeout-minutes: 10 - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - sparse-checkout: | - .github - tools/retest - - - name: Setup Go environment - uses: actions/setup-go@v6 - with: - go-version-file: go.mod - - - name: Retest - env: - GITHUB_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - run: cd tools/retest && go run ./... diff --git a/.github/workflows/scan-image-vulnerabilities.yaml b/.github/workflows/scan-image-vulnerabilities.yaml deleted file mode 100644 index 7fd100e9b11c1..0000000000000 --- a/.github/workflows/scan-image-vulnerabilities.yaml +++ /dev/null @@ -1,160 +0,0 @@ -name: "RELEASE: Scan images for vulnerabilities" -on: - workflow_dispatch: - inputs: - version: - description: Full version tag - required: true - default: 0.0.0-test-rc.1 - type: string - wait-for-images-limit: - description: Duration to wait for images to be available (as Go duration string or a number of seconds, set 0 to skip waiting) - required: true - # When changing the default here, also update the default in run-parameters. - default: 3h10m - type: string - push: - tags: ['*'] - -run-name: ${{ format('Scan images for vulnerabilities ({0})', inputs.version || github.ref_name) }} - -jobs: - run-parameters: - name: Run parameters - runs-on: ubuntu-latest - outputs: - wait-for-images-limit: ${{ steps.run-parameters.outputs.wait-for-images-limit }} - version: ${{ steps.run-parameters.outputs.version }} - steps: - - name: Run parameters - id: run-parameters - run: | - wait_for_images_limit="${{ inputs.wait-for-images-limit || '3h10m' }}" - wait_for_images_limit="$(sed 's/h/*3600 +/g; s/m/*60 +/g; s/s/\+/g; s/+[ ]*$//g' <<< "${wait_for_images_limit}" | bc)" - version="${{ inputs.version || github.ref_name }}" - - echo "wait-for-images-limit=${wait_for_images_limit}" >> "${GITHUB_OUTPUT}" - echo "version=${version}" >> "${GITHUB_OUTPUT}" - { - echo "Event: ${{ github.event_name }}" - echo "Version: ${version}" - echo "Wait for images limit: ${wait_for_images_limit}" - echo "Inputs:" - echo '```' - echo "${{ toJSON(inputs) }}" - echo '```' - } >> "$GITHUB_STEP_SUMMARY" - - scan-image-vulnerabilities-upstream: - name: "Upstream: ${{ matrix.image }}:${{ needs.run-parameters.outputs.version }}" - runs-on: ubuntu-latest - needs: [run-parameters] - permissions: - # Needed for stackrox/central-login to create the JWT token. - id-token: write - strategy: - fail-fast: false - matrix: - image: - [ - "central-db", - "collector", - "fact", - "main", - "roxctl", - "scanner", - "scanner-db", - "scanner-db-slim", - "scanner-slim", - "scanner-v4", - "scanner-v4-db", - "stackrox-operator", - ] - steps: - - name: Sanitize nightly tag - id: sanitize-nightly-tag - run: | - set -euo pipefail - tag="${{ needs.run-parameters.outputs.version }}" - if [[ "${{ matrix.image }}" = "stackrox-operator" && "${tag}" == *-nightly-* ]]; then - # Replace '.x' in patch version with '.0'. Example: 0.1.x-nightly-20260114 -> 0.1.0-nightly-20260114 - tag="$(echo "${tag}" | sed -E 's@^(([[:digit:]]+\.)+)x(-)?@\10\3@g')" - fi - echo "tag=${tag}" >> "${GITHUB_OUTPUT}" - - - name: Scan image vulnerabilities - uses: stackrox/actions/release/scan-image-vulnerabilities@v1 - id: scan-image - with: - image: rhacs-eng/${{ matrix.image }} - version: ${{ steps.sanitize-nightly-tag.outputs.tag }} - wait-limit: ${{ needs.run-parameters.outputs.wait-for-images-limit }} - summary-prefix: "Upstream:" - quay-bearer-token: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }} - central-url: ${{ vars.ACS_DOGFOODING_CENTRAL_URL }} - - - name: Upload scan result artifact - if: always() - uses: actions/upload-artifact@v6 - with: - name: upstream_quay_io_rhacs-eng_${{ matrix.image }}_${{ needs.run-parameters.outputs.version }}.json - path: ${{ steps.scan-image.outputs.result-path }} - retention-days: 30 - - scan-image-vulnerabilities-konflux: - name: "Konflux: ${{ matrix.image }}:${{ needs.run-parameters.outputs.version }}" - runs-on: ubuntu-latest - needs: [run-parameters] - permissions: - # Needed for stackrox/central-login to create the JWT token. - id-token: write - strategy: - fail-fast: false - matrix: - image: - [ - "release-central-db", - "release-collector", - "release-fact", - "release-main", - "release-roxctl", - "release-scanner", - "release-scanner-db", - "release-scanner-db-slim", - "release-scanner-slim", - "release-scanner-v4", - "release-scanner-v4-db", - "release-operator", - ] - steps: - - name: Sanitize nightly tag - id: sanitize-nightly-tag - run: | - set -euo pipefail - tag="${{ needs.run-parameters.outputs.version }}" - if [[ "${tag}" == *-nightly-* ]]; then - # Replace '.x' in patch version with '.0' and append '-fast' suffix. - # Example: 0.1.x-nightly-20260114 -> 0.1.0-nightly-20260114-fast - suffix="fast" - tag="$(echo "${tag}" | sed -E 's@^(([[:digit:]]+\.)+)x(-)?@\10\3@g')-${suffix}" - fi - echo "tag=${tag}" >> "${GITHUB_OUTPUT}" - - - name: Scan image vulnerabilities - uses: stackrox/actions/release/scan-image-vulnerabilities@v1 - id: scan-image - with: - image: rhacs-eng/${{ matrix.image }} - version: ${{ steps.sanitize-nightly-tag.outputs.tag }} - wait-limit: ${{ needs.run-parameters.outputs.wait-for-images-limit }} - summary-prefix: "Konflux:" - quay-bearer-token: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }} - central-url: ${{ vars.ACS_DOGFOODING_CENTRAL_URL }} - - - name: Upload scan result artifact - if: always() - uses: actions/upload-artifact@v6 - with: - name: konflux_quay_io_rhacs-eng_${{ matrix.image }}_${{ needs.run-parameters.outputs.version }}.json - path: ${{ steps.scan-image.outputs.result-path }} - retention-days: 30 diff --git a/.github/workflows/scanner-build.yaml b/.github/workflows/scanner-build.yaml deleted file mode 100644 index 1493f701f16ae..0000000000000 --- a/.github/workflows/scanner-build.yaml +++ /dev/null @@ -1,379 +0,0 @@ -name: Scanner build and push images - -on: - workflow_dispatch: - inputs: - commit: - description: 'Commit SHA to build' - required: true - type: string - workflow_call: - push: - tags: - - '*-nightly-*' - branches: - - master - pull_request: - types: - - opened - - reopened - - synchronize - -defaults: - run: - # This enables `-o pipefail` for all jobs as compared to when shell isn't set. - # See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#defaultsrunshell - shell: bash - -jobs: - define-scanner-job-matrix: - outputs: - matrix: ${{ steps.define-scanner-job-matrix.outputs.matrix }} - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - name: Define the matrix for build jobs - id: define-scanner-job-matrix - run: | - source './scripts/ci/lib.sh' - - # If goarch is updated, be sure to update architectures in "push-scanner-manifests" below. - matrix='{ - "pre_build_scanner_go_binary": { "name":["default"], "goos":["linux"], "goarch":["amd64", "arm64"] }, - "build_and_push_scanner": { }, - "push_scanner_manifests": { "name":["default"], "registry":["quay.io/stackrox-io", "quay.io/rhacs-eng"] }, - "scan_images_with_roxctl": { "image":["scanner-v4", "scanner-v4-db"], "registry":["quay.io/stackrox-io", "quay.io/rhacs-eng"] } - }' - - if ! is_in_PR_context || pr_has_label ci-build-all-arch; then - matrix="$(jq '.pre_build_scanner_go_binary.goarch += ["ppc64le", "s390x"]' <<< "$matrix")" - fi; - - # Conditionally add a prerelease build (binaries built with GOTAGS=release) - if ! is_tagged; then - if ! is_in_PR_context || pr_has_label ci-build-prerelease; then - matrix="$(jq '.pre_build_scanner_go_binary.name += ["prerelease"]' <<< "$matrix")" - matrix="$(jq '.push_scanner_manifests.name += ["prerelease"]' <<< "$matrix")" - fi - fi - - # Conditionally add a -race debug build (binaries built with -race) - if ! is_in_PR_context || pr_has_label ci-build-race-condition-debug; then - matrix="$(jq '.pre_build_scanner_go_binary.name += ["race-condition-debug"]' <<< "$matrix")" - matrix="$(jq '.push_scanner_manifests.name += ["race-condition-debug"]' <<< "$matrix")" - fi - - matrix="$(jq '.build_and_push_scanner = .pre_build_scanner_go_binary' <<< "$matrix")" - matrix="$(jq '.build_and_push_scanner.registry = .push_scanner_manifests.registry' <<< "$matrix")" - - echo "Job matrix after conditionals:" - jq <<< "$matrix" - - condensed="$(jq -c <<< "$matrix")" - echo "matrix=$condensed" >> "$GITHUB_OUTPUT" - - pre-build-scanner-go-binary: - needs: define-scanner-job-matrix - runs-on: ubuntu-latest - strategy: - # Supports three go binary builds: - # default - built with environment defaults (see handle-tagged-build & env.mk) - # prerelease - built with GOTAGS=release - # race-condition-debug - built with -race - matrix: ${{ fromJson(needs.define-scanner-job-matrix.outputs.matrix).pre_build_scanner_go_binary }} - container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Cache Go dependencies - uses: ./.github/actions/cache-go-dependencies - - - uses: ./.github/actions/handle-tagged-build - - - name: Setup Go build environment for release - if: | - contains(github.event.pull_request.labels.*.name, 'ci-release-build') - || - matrix.name == 'prerelease' - run: echo "GOTAGS=release" >> "$GITHUB_ENV" - - - name: Setup Go build environment for -race - if: | - matrix.arch == 'amd64' - && - ( - contains(github.event.pull_request.labels.*.name, 'ci-race-tests') - || - matrix.name == 'race-condition-debug' - ) - run: echo "RACE=true" >> "$GITHUB_ENV" - - - name: Build Go binary - run: | - if [[ "${{ matrix.goarch }}" != "amd64" ]]; then - echo "Building non-amd binary (CGO_ENABLED=0)" - make -C scanner CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} image/scanner/bin/scanner - else - echo "Building amd binary (CGO_ENABLED=1)" - make -C scanner CGO_ENABLED=1 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} image/scanner/bin/scanner - fi - - - name: Archive Go binary to preserve permissions - run: tar -cvzf go-binary.tgz scanner/image/scanner/bin/scanner - - - uses: ./.github/actions/upload-artifact-with-retry - with: - name: go-binary-${{ matrix.name }}-${{ matrix.goos }}-${{ matrix.goarch }} - path: go-binary.tgz - - scan-scanner-go-binary: - needs: pre-build-scanner-go-binary - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.5.1 - if: contains(github.event.pull_request.labels.*.name, 'scan-go-binaries') - env: - ARTIFACT_DIR: junit-reports/ - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 1 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - uses: ./.github/actions/download-artifact-with-retry - with: - name: go-binary-default-linux-amd64 - - - name: Unpack Go binary - run: | - tar xvzf go-binary.tgz - - - name: Scan - run: | - ./scripts/ci/govulncheck.sh scanner/image/scanner/bin/scanner - - - name: Publish Test Report - uses: test-summary/action@v2 - if: always() - with: - paths: 'junit-reports/**/*.xml' - - - name: Report junit failures in jira - uses: ./.github/actions/junit2jira - if: always() - with: - jira-token: ${{ secrets.JIRA_TOKEN }} - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - directory: 'junit-reports' - - build-and-push-scanner: - needs: - - define-scanner-job-matrix - - pre-build-scanner-go-binary - runs-on: ubuntu-latest - strategy: - fail-fast: false - # Supports three go binary and image builds: - # default - built with environment defaults (see handle-tagged-build & env.mk) - # prerelease - built with GOTAGS=release - # race-condition-debug - built with -race - matrix: ${{ fromJson(needs.define-scanner-job-matrix.outputs.matrix).build_and_push_scanner }} - container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - env: - QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }} - QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }} - QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }} - QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }} - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - - name: Login to docker.io to mitigate rate limiting on downloading images - uses: docker/login-action@v3 - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - with: - username: ${{ secrets.DOCKERHUB_CI_ACCOUNT_USERNAME }} - password: ${{ secrets.DOCKERHUB_CI_ACCOUNT_PASSWORD }} - - - name: Set up QEMU - if: matrix.goarch != 'amd64' - uses: docker/setup-qemu-action@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - - - uses: ./.github/actions/handle-tagged-build - - - uses: ./.github/actions/download-artifact-with-retry - with: - name: go-binary-${{ matrix.name }}-${{ matrix.goos }}-${{ matrix.goarch }} - - - name: Unpack Go binary - run: tar xvzf go-binary.tgz - - - name: Set build tag for prerelease images - if: matrix.name == 'prerelease' - run: echo "BUILD_TAG=$(make -C scanner --quiet --no-print-directory tag)-prerelease" >> "$GITHUB_ENV" - - - name: Set build tag for race condition images - if: matrix.name == 'race-condition-debug' - run: echo "BUILD_TAG=$(make -C scanner --quiet --no-print-directory tag)-rcd" >> "$GITHUB_ENV" - - - name: Build Scanner and ScannerDB images - run: scripts/lib.sh retry 6 true make -C scanner GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} images - - - name: Push Scanner and ScannerDB images - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - run: | - source ./scripts/ci/lib.sh - push_scanner_image_set "${{ matrix.registry }}" "${{ matrix.goarch }}" - - push-scanner-manifests: - needs: - - define-scanner-job-matrix - - build-and-push-scanner - runs-on: ubuntu-latest - strategy: - fail-fast: false - # Supports three image builds: - # default - # prerelease - # race-condition-debug - matrix: ${{ fromJson(needs.define-scanner-job-matrix.outputs.matrix).push_scanner_manifests }} - container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.5.1 - env: - QUAY_RHACS_ENG_RW_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RW_USERNAME }} - QUAY_RHACS_ENG_RW_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RW_PASSWORD }} - QUAY_STACKROX_IO_RW_USERNAME: ${{ secrets.QUAY_STACKROX_IO_RW_USERNAME }} - QUAY_STACKROX_IO_RW_PASSWORD: ${{ secrets.QUAY_STACKROX_IO_RW_PASSWORD }} - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - name: Ignore dubious repository ownership - run: | - # Prevent fatal error "detected dubious ownership in repository" from recent git. - git config --global --add safe.directory "$(pwd)" - - - uses: ./.github/actions/handle-tagged-build - - - name: Set build tag for prerelease images - if: matrix.name == 'prerelease' - run: echo "BUILD_TAG=$(make -C scanner --quiet --no-print-directory tag)-prerelease" >> "$GITHUB_ENV" - - - name: Set build tag for race condition images - if: matrix.name == 'race-condition-debug' - run: echo "BUILD_TAG=$(make -C scanner --quiet --no-print-directory tag)-rcd" >> "$GITHUB_ENV" - - - name: Push Scanner and ScannerDB image manifests - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - run: | - source ./scripts/ci/lib.sh - - # If this is updated, be sure to update goarch in define-scanner-job-matrix above. - architectures="amd64,arm64" - if ! is_in_PR_context || pr_has_label ci-build-all-arch; then - architectures="amd64,arm64,ppc64le,s390x" - fi - if [[ "${{ matrix.name }}" == "race-condition-debug" ]]; then - architectures="amd64" - fi - - push_scanner_image_manifest_lists "${{ matrix.registry }}" "$architectures" - - scan-images-with-roxctl: - if: github.event_name == 'push' || - contains(github.event.pull_request.labels.*.name, 'scan-images-with-roxctl') - needs: - - define-scanner-job-matrix - - build-and-push-scanner - - push-scanner-manifests - name: Check images for vulnerabilities - runs-on: ubuntu-latest - permissions: - # Needed for stackrox/central-login to create the JWT token. - id-token: write - security-events: write - strategy: - fail-fast: false - matrix: ${{ fromJson(needs.define-scanner-job-matrix.outputs.matrix).scan_images_with_roxctl }} - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ inputs.commit || github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - uses: ./.github/actions/handle-tagged-build - - - name: Central login - uses: stackrox/central-login@v1 - with: - endpoint: ${{ vars.ACS_DOGFOODING_CENTRAL_URL }} - - - name: Install roxctl - uses: stackrox/roxctl-installer-action@v1 - with: - central-endpoint: ${{ vars.ACS_DOGFOODING_CENTRAL_URL }} - central-token: ${{ env.ROX_API_TOKEN }} - - - name: Scan images for vulnerabilities - run: | - release_tag="$(make --quiet --no-print-directory tag)" - roxctl image scan --retries=10 --retry-delay=15 --force --severity=IMPORTANT,CRITICAL --output=sarif \ - --image="${{ matrix.registry }}/${{ matrix.image }}:${release_tag}" \ - | tee results.sarif - - # TODO: re-enable roxctl scan results upload once quota issue has been resolved - # - name: Upload roxctl scan results to GitHub Security tab - # uses: github/codeql-action/upload-sarif@v3 - # with: - # category: ${{ matrix.image }} - # sarif_file: results.sarif diff --git a/.github/workflows/scanner-db-integration-tests.yaml b/.github/workflows/scanner-db-integration-tests.yaml deleted file mode 100644 index a17a3c2766522..0000000000000 --- a/.github/workflows/scanner-db-integration-tests.yaml +++ /dev/null @@ -1,43 +0,0 @@ -name: Scanner DB integration tests - -on: - push: - tags: - - '*' - branches: - - master - - release-* - pull_request: - types: - - opened - - reopened - - synchronize - -jobs: - db-integration-tests: - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.5.1 - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Run Postgres - run: | - su postgres -c 'initdb -D /tmp/data' - su postgres -c 'pg_ctl -D /tmp/data start' - - - name: Cache Go dependencies - uses: ./.github/actions/cache-go-dependencies - - - name: Is Postgres ready - run: pg_isready -h 127.0.0.1 - - - name: DB Integration tests - run: make -C scanner db-integration-test diff --git a/.github/workflows/scanner-e2e-test.yaml b/.github/workflows/scanner-e2e-test.yaml deleted file mode 100644 index 1157dfe233ef6..0000000000000 --- a/.github/workflows/scanner-e2e-test.yaml +++ /dev/null @@ -1,134 +0,0 @@ -name: Scanner functional tests - -on: - workflow_dispatch: - pull_request: - types: - - opened - - reopened - - synchronize - -jobs: - scanner-ft-images: - name: Wait for images - if: > - github.event_name != 'pull_request' - || contains(github.event.pull_request.labels.*.name, 'scanner-functional-tests') - runs-on: ubuntu-latest - strategy: - matrix: - image: - - scanner-v4 - - scanner-v4-db - steps: - - name: Checkout repo - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: "${{ github.event.pull_request.head.sha }}" - - name: Get tag - run: | - echo "tag=$(make tag)" >> "$GITHUB_ENV" - - name: Wait for image ${{ matrix.image }} - uses: stackrox/actions/release/wait-for-image@v1 - with: - token: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }} - image: rhacs-eng/${{ matrix.image }}:${{ env.tag }} - - scanner-ft-run: - name: Deploy and run - needs: - - scanner-ft-images - runs-on: ubuntu-latest - env: - SCANNER_E2E_QUAY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }} - SCANNER_E2E_QUAY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }} - # TODO Add registry.redhat.io secrets. - SCANNER_E2E_REDHAT_USERNAME: ${{ secrets.REDHAT_USERNAME }} - SCANNER_E2E_REDHAT_PASSWORD: ${{ secrets.REDHAT_PASSWORD }} - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: "${{ github.event.pull_request.head.sha }}" - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Create cluster (minikube) - uses: medyagh/setup-minikube@latest - with: - driver: docker - cpus: max - memory: max - mount-path: ${{ runner.temp }}:/runner - container-runtime: cri-o - - - name: Deploy scanner - run: | - mkdir -m 777 "${{ runner.temp }}"/pgdata - # TODO(ROX-28174) Rename the targets and charts to "scanner functional - # tests". - make -C scanner e2e-deploy db-host-path="/runner/pgdata" - - - name: Wait for deployments - run: | - info() { echo >&2 ">>> INFO (Wait for deployments): $*"; } - timeout=1m - while : ; do - info "Waiting for deployments to become ready (in $timeout)..." - kubectl -n stackrox wait pod --for=condition=Ready --all --timeout="$timeout" && break - info "Deployments are not ready yet" - info "Describing all pods:" - kubectl -n stackrox describe pods - for app in scanner-v4-db scanner-v4; do - info "Showing deployment logs ($app):" - kubectl -n stackrox logs -l app="$app" --all-containers=true - done - info "Abort if any pod has failed:" - kubectl \ - -n stackrox get pods \ - -o jsonpath='{range .items[*]}{.metadata.name} status={.status.phase}{range .status.containerStatuses[*]} restart={.restartCount}/{.name}{end}{"\n"}{end}' \ - | grep -E 'status=Failed' && exit 1 - done - - - name: Run tests - run: | - kubectl -n stackrox expose deployment scanner-v4 - kubectl -n stackrox get svc - while true; do - kubectl -n stackrox port-forward \ - "$(kubectl -n stackrox get pods \ - -l app=scanner-v4 \ - -o jsonpath="{.items[*].metadata.name}")" \ - 8443:8443 || continue - done & - PID1=$! - while true; do - kubectl -n stackrox port-forward \ - "$(kubectl -n stackrox get pods \ - -l app=scanner-v4-db \ - -o jsonpath="{.items[*].metadata.name}")" \ - 5432:5432 || continue - done & - PID2=$! - trap 'kill $PID1 $PID2' EXIT - - PGPASSWORD=$(kubectl get secret "scanner-v4-db-password" -o json -n stackrox | jq .data.password -r | base64 -d) - - # TODO(ROX-28174) Rename the targets and charts to "scanner functional - # tests". - PGPASSWORD="$PGPASSWORD" make -C scanner e2e-run NODEPS=1 - - - name: Describe and show logs - if: failure() || success() - run: | - info() { echo >&2 ">>> INFO (Describe and show logs): $*"; } - info "Describing all pods:" - kubectl -n stackrox describe pods - for app in scanner-v4-db scanner-v4; do - info "Showing deployment logs ($app):" - kubectl -n stackrox logs -l app="$app" --all-containers=true - done diff --git a/.github/workflows/scanner-mapping-update.yaml b/.github/workflows/scanner-mapping-update.yaml deleted file mode 100644 index 82b440dbcf09f..0000000000000 --- a/.github/workflows/scanner-mapping-update.yaml +++ /dev/null @@ -1,40 +0,0 @@ -name: Scanner mappings update - -on: - schedule: - - cron: "0 0 * * *" - -jobs: - update-scanner-mappings: - if: ${{ github.repository_owner == 'stackrox' }} - runs-on: ubuntu-latest - env: - REPOMAPPING_DIR: repomapping - steps: - - name: Checkout repository - uses: actions/checkout@v6 - - - name: Authenticate with Google Cloud - uses: google-github-actions/auth@v3 - with: - credentials_json: ${{ secrets.GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER }} - - - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@v3 - - - name: Download repository mappings - run: scanner/image/scanner/download-mappings.sh "${{env.REPOMAPPING_DIR}}" - - - name: Upload repository mappings to Google Cloud Storage - run: | - # Zip the files into mapping.zip - zip mapping.zip ${{env.REPOMAPPING_DIR}}/* - - mkdir -p redhat-repository-mappings && mv mapping.zip redhat-repository-mappings/ - # Upload mapping.zip to Google Cloud Storage - gsutil cp -r "redhat-repository-mappings" "gs://definitions.stackrox.io/v4" - - - name: Send Slack notification on workflow failure - if: failure() - run: | - curl -X POST -H 'Content-type: application/json' --data '{"text":" Failure in Scanner V4 Updater Workflow: Update Repository Mappings"}' ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }} diff --git a/.github/workflows/scanner-nvd-update.yaml b/.github/workflows/scanner-nvd-update.yaml deleted file mode 100644 index 902dd4f6c03bb..0000000000000 --- a/.github/workflows/scanner-nvd-update.yaml +++ /dev/null @@ -1,220 +0,0 @@ -name: Scanner NVD update - -on: - pull_request: - types: - - opened - - reopened - - synchronize - schedule: - - cron: '0 */6 * * *' - workflow_dispatch: - -jobs: - fetch-nvd-feeds: - runs-on: ubuntu-latest - if: > - github.repository_owner == 'stackrox' && - github.event_name == 'schedule' || - github.event_name == 'workflow_dispatch' || - (github.event_name == 'pull_request' && - contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-nvd')) - - steps: - - name: Checkout repository - uses: actions/checkout@v6 - - - name: Set up Python - uses: actions/setup-python@v6 - with: - python-version: '3.10' - - - name: Fetch NVD Feeds - run: | - set -eu - dir=$(mktemp -d) - python3 .github/workflows/scripts/scanner-update-nvd-feeds.py "$dir" - for f in "$dir"/*.nvd.json; do - if jq . "$f" >/dev/null 2>&1; then - echo "Validating and adding '$f' to nvd-feeds.zip" - zip -j nvd-feeds.zip "$f" - else - echo "Error: Invalid JSON file '$f'" - exit 1 - fi - done - - - uses: ./.github/actions/upload-artifact-with-retry - with: - name: nvd-feeds - path: nvd-feeds.zip - if-no-files-found: error - - fetch-nvd-api: - runs-on: ubuntu-latest - if: > - github.event_name == 'schedule' || - github.event_name == 'workflow_dispatch' || - (github.event_name == 'pull_request' && - contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-nvd')) - - steps: - - name: Checkout repository - uses: actions/checkout@v6 - - - name: Set up Python - uses: actions/setup-python@v6 - with: - python-version: '3.10' - - - name: Fetch NVD API - env: - SCANNER_NVD_API_KEY: ${{ secrets.NVD_API_KEY }} - SCANNER_NVD_URL: https://services.nvd.nist.gov/rest/json/cves/2.0 - run: | - set -eu - dir=$(mktemp -d) - python3 .github/workflows/scripts/scanner-update-nvd-api.py "$dir" - for f in "$dir"/*.nvd.json; do - if jq . "$f" >/dev/null 2>&1; then - echo "Validating and adding '$f' to nvd-api.zip" - zip -j nvd-api.zip "$f" - else - echo "Error: Invalid JSON file '$f'" - exit 1 - fi - done - - - uses: ./.github/actions/upload-artifact-with-retry - with: - name: nvd-api - path: nvd-api.zip - if-no-files-found: error - - upload-pr-nvd-feeds: - needs: - - fetch-nvd-feeds - runs-on: ubuntu-latest - if: github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-nvd') - steps: - # Checkout master to get the latest local actions - - name: Checkout repository - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - uses: ./.github/actions/job-preamble - with: - free-disk-space: 50 - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Checkout specific reference - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} - - - name: Authenticate with test GCS bucket - uses: google-github-actions/auth@v3 - with: - credentials_json: ${{ secrets.GOOGLE_SA_CIRCLECI_SCANNER }} - - - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@v3 - - - name: Download NVD - uses: ./.github/actions/download-artifact-with-retry - with: - name: nvd-feeds - path: . - - # PR owner is responsible for verifying NVD bundle is generated - - name: Upload NVD Feeds to Google Cloud Storage - run: | - branch=${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}} - # Replace / with -, so the branch name isn't truncated when pushed to GCS. - dir=${branch////-} - case "$dir" in - dev|1.0.0) - echo "Error: branch $dir is protected. Choose a different branch name." - exit 1 - esac - mkdir -p "$dir" - cp nvd-feeds.zip "$dir/" - gsutil -m cp -r "$dir" "gs://scanner-v4-test/nvd/" - - # Checkout again to get the latest local actions for cleanup phase - - name: Checkout repository - uses: actions/checkout@v6 - if: always() - with: - fetch-depth: 0 - - upload-nvd-feeds: - needs: - - fetch-nvd-feeds - runs-on: ubuntu-latest - if: github.event_name != 'pull_request' - steps: - - name: Checkout repository - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.ref }} - - - uses: ./.github/actions/download-artifact-with-retry - with: - name: nvd-feeds - path: . - - - name: Authenticate with Google Cloud - uses: google-github-actions/auth@v3 - with: - credentials_json: ${{ secrets.GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER }} - - - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@v3 - - - name: Upload NVD Feeds to Google Cloud Storage - run: | - gsutil cp nvd-feeds.zip "gs://definitions.stackrox.io/v4/nvd/nvd-feeds.zip" - - upload-nvd-api: - needs: - - fetch-nvd-api - runs-on: ubuntu-latest - if: github.event_name != 'pull_request' - steps: - - name: Checkout repository - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.ref }} - - - uses: ./.github/actions/download-artifact-with-retry - with: - name: nvd-api - path: . - - - name: Authenticate with Google Cloud - uses: google-github-actions/auth@v3 - with: - credentials_json: ${{ secrets.GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER }} - - - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@v3 - - - name: Upload NVD API to Google Cloud Storage - run: - gsutil cp nvd-api.zip "gs://definitions.stackrox.io/v4/nvd/nvd-api.zip" - - send-notification: - needs: - - upload-nvd-feeds - - upload-nvd-api - runs-on: ubuntu-latest - if: ${{ failure() && github.ref_name == 'master' }} - steps: - - name: Send Slack notification on workflow failure - run: | - curl -X POST -H 'Content-type: application/json' --data '{"text":"<${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|Workflow ${{ github.workflow }}> failed in repository ${{ github.repository }}: Failed to update NVD CVEs"}' ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }} diff --git a/.github/workflows/scanner-offline-bundle-update.yaml b/.github/workflows/scanner-offline-bundle-update.yaml deleted file mode 100644 index cdba51a879ede..0000000000000 --- a/.github/workflows/scanner-offline-bundle-update.yaml +++ /dev/null @@ -1,133 +0,0 @@ -name: Scanner release offline vulnerability bundle update - -on: - schedule: - - cron: '0 */3 * * *' - pull_request: - types: - - opened - - reopened - - synchronize - -jobs: - offline-bundle-matrix: - runs-on: ubuntu-latest - if: > - github.repository_owner == 'stackrox' && - github.event_name == 'schedule' || - (github.event_name == 'pull_request' && - contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-vulns')) - outputs: - matrix: ${{ steps.output-matrix.outputs.matrix }} - steps: - - name: Checkout code - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - name: Create matrix - id: output-matrix - run: | - set -o pipefail - EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64) - echo "matrix<<$EOF" >> "$GITHUB_OUTPUT" - SCANNER_RELEASE_ALLOW_RC=true .github/workflows/scripts/scanner-offline-bundle-matrix.sh | tee -a "$GITHUB_OUTPUT" - echo "$EOF" >> "$GITHUB_OUTPUT" - - offline-bundle-generate: - needs: offline-bundle-matrix - runs-on: ubuntu-latest - strategy: - fail-fast: false - matrix: - versions: ${{ fromJson(needs.offline-bundle-matrix.outputs.matrix).versions }} - env: - VULNERABILITY_VERSION: ${{ matrix.versions.vulnerability_version }} - SUPPORTED_RELEASES: ${{ matrix.versions.supported_releases }} - steps: - - name: Checkout code - uses: actions/checkout@v6 - - - name: Set up Google Cloud SDK - uses: google-github-actions/setup-gcloud@v3 - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Generate offline bundle - run: | - .github/workflows/scripts/scanner-offline-bundle-generate.sh \ - bundle \ - "$VULNERABILITY_VERSION" \ - "$SUPPORTED_RELEASES" - - - uses: ./.github/actions/upload-artifact-with-retry - with: - name: offline-bundle-${{ matrix.versions.vulnerability_version }} - path: bundle - if-no-files-found: error - - offline-bundle-upload: - runs-on: ubuntu-latest - needs: - - offline-bundle-generate - steps: - - uses: actions/download-artifact@v7 - with: - path: bundles - pattern: offline-bundle-* - merge-multiple: true - - - name: Authenticate with Google Cloud (release) - if: github.event_name == 'schedule' - uses: google-github-actions/auth@v3 - with: - credentials_json: ${{ secrets.GOOGLE_SA_STACKROX_HUB_VULN_DUMP_UPLOADER }} - - - name: Authenticate with Google Cloud (pull request) - if: github.event_name == 'pull_request' - uses: google-github-actions/auth@v3 - with: - credentials_json: ${{ secrets.GOOGLE_SA_CIRCLECI_SCANNER }} - - - name: Set up Cloud SDK - uses: google-github-actions/setup-gcloud@v3 - - - name: Set GCS bucket (release) - if: github.event_name == 'schedule' - run: | - bucket="gs://definitions.stackrox.io/v4/offline-bundles/" - echo "BUCKET=$bucket" >> "$GITHUB_ENV" - - - name: Set GCS bucket (pull request) - if: github.event_name == 'pull_request' - run: | - branch="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}" - dir="${branch////-}" - case $dir in - dev|1.0.0) - echo "Branch $dir is disallowed" - exit 1 - esac - bucket="gs://scanner-v4-test/offline-bundles/$dir" - echo "BUCKET=$bucket" >> "$GITHUB_ENV" - - - name: Upload bundles - run: | - cd bundles - echo "uploading files to $BUCKET" - ls -lh . - gsutil cp -r . "$BUCKET" - - offline-bundle-notification: - needs: - - offline-bundle-matrix - - offline-bundle-generate - - offline-bundle-upload - runs-on: ubuntu-latest - if: github.event_name == 'schedule' && failure() - steps: - - name: Send Slack notification on workflow failure - run: | - curl -X POST -H 'Content-type: application/json' --data '{"text":"<${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|Workflow ${{ github.workflow }}> failed in repository ${{ github.repository }}: Failed to update offline vulnerabilities bundle"}' ${{ secrets.SLACK_ONCALL_SCANNER_WEBHOOK }} diff --git a/.github/workflows/scanner-versioned-definitions-update.yaml b/.github/workflows/scanner-versioned-definitions-update.yaml index 567672bcb5ff7..97537571c99e9 100644 --- a/.github/workflows/scanner-versioned-definitions-update.yaml +++ b/.github/workflows/scanner-versioned-definitions-update.yaml @@ -1,13 +1,6 @@ name: Scanner versioned vulnerabilities update on: - schedule: - - cron: "30 */4 * * *" - pull_request: - types: - - opened - - reopened - - synchronize workflow_dispatch: inputs: stream: diff --git a/.github/workflows/start-release.yml b/.github/workflows/start-release.yml deleted file mode 100644 index 4521e3f6bc438..0000000000000 --- a/.github/workflows/start-release.yml +++ /dev/null @@ -1,401 +0,0 @@ -name: "RELEASE: Start Release" -on: - workflow_dispatch: - inputs: - version: - description: Release version (A.B.C[-N]) - required: true - default: 0.0.0 - type: string - ref: - description: Override release branch starting ref - required: false - default: "" - type: string - dry-run: - description: Dry-run - required: false - default: false - type: boolean - -env: - USER_REF: ${{ inputs.ref }} - main_branch: ${{github.event.repository.default_branch}} - script_url: /repos/${{ github.repository }}/contents/.github/workflows/scripts/common.sh?ref=${{ github.ref_name }} - DRY_RUN: ${{ fromJSON('["true", "false"]')[github.event.inputs.dry-run != 'true'] }} - ACCEPT_RAW: "Accept: application/vnd.github.v3.raw" - GH_TOKEN: ${{ github.token }} - GH_NO_UPDATE_NOTIFIER: 1 - -run-name: >- - ${{ - format('Start release {0} from {1}{2}', - inputs.version, - fromJSON(format('["{0}","{1}"]', inputs.ref, 'the last nightly branching point'))[inputs.ref == ''], - fromJSON('[" (dry-run)", ""]')[inputs.dry-run != true] - ) - }} - -# Ensure that only a single automation workflow can run at a time for each release. -concurrency: Release automation ${{ inputs.version }} - -jobs: - start-sha: - name: Find commit for release branch - runs-on: ubuntu-latest - outputs: - start-sha: ${{ fromJSON(format('["{0}","{1}"]', env.USER_REF, steps.find.outputs.merge_base))[env.USER_REF == ''] }} - steps: - - name: Check out code - uses: actions/checkout@v6 - with: - ref: ${{ github.event.repository.default_branch }} - fetch-depth: 0 - - name: Print user-provided input - run: | - if [ "${{ env.USER_REF }}" != '' ]; then - echo "User provided the following override for the git-sha: \`${{ env.USER_REF }}\`" >> "$GITHUB_STEP_SUMMARY" - else - echo "User did not provide override for the git-sha" >> "$GITHUB_STEP_SUMMARY" - fi - - name: Find merge-base for ${{ github.event.repository.default_branch }} and 'origin/nightlies' - id: find - run: | - MERGEBASE="$(git merge-base origin/nightlies ${{ github.event.repository.default_branch }})" - echo "merge_base=${MERGEBASE}" >> "$GITHUB_OUTPUT" - echo "Found the following git-sha as a branching point for the release branch: [\`${MERGEBASE}\`](${{github.server_url}}/${{github.repository}}/commits/${MERGEBASE})" >> "$GITHUB_STEP_SUMMARY" - - properties: - name: Read repository properties - runs-on: ubuntu-latest - outputs: - docs-repository: ${{ steps.properties.outputs.docs-repository }} - slack-channel: ${{ fromJSON(format('["{0}","{1}"]', steps.properties.outputs.dry-slack-channel, steps.properties.outputs.slack-channel))[github.event.inputs.dry-run != 'true'] }} - jira-project: ${{ steps.properties.outputs.jira-project }} - steps: - - name: Read workflow properties file - id: properties - env: - PROPERTIES_URL: /repos/${{ github.repository }}/contents/.github/properties?ref=${{ github.ref_name }} - run: gh api -H "$ACCEPT_RAW" "$PROPERTIES_URL" >> "$GITHUB_OUTPUT" - - run-parameters: - name: Run parameters - runs-on: ubuntu-latest - steps: - - run: | - [ "$DRY_RUN" = "true" ] && echo "::warning::This is a dry run" - echo "Event: ${{github.event_name}}" >>"$GITHUB_STEP_SUMMARY" - cat <>"$GITHUB_STEP_SUMMARY" - \`\`\` - ${{toJSON(inputs)}} - \`\`\` - EOF - - variables: - name: Setup variables - uses: ./.github/workflows/variables.yml - with: - version: ${{github.event.inputs.version}} - assert-format: A.B.C[-N] - - check-jira: - name: Check Jira release - needs: [variables, properties] - runs-on: ubuntu-latest - outputs: - release-date: ${{steps.check-jira-release.outputs.date}} - steps: - - name: Check that Jira release ${{needs.variables.outputs.release}}.${{needs.variables.outputs.patch}} is not released - id: check-jira-release - env: - JIRA_TOKEN: ${{ secrets.JIRA_TOKEN }} - run: | - set -uo pipefail - gh api -H "$ACCEPT_RAW" "${{env.script_url}}" | bash -s -- \ - check-jira-release \ - "${{needs.variables.outputs.release}}.${{needs.variables.outputs.patch}}" \ - "${{needs.properties.outputs.jira-project}}" - - branch: - name: Prepare release branch - needs: [variables, start-sha] - runs-on: ubuntu-latest - steps: - - name: Check out code (normal release) - if: needs.variables.outputs.patch == 0 - uses: actions/checkout@v6 - with: - ref: ${{ needs.start-sha.outputs.start-sha }} - fetch-depth: 0 - token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - - name: Check out code (patch release) - if: needs.variables.outputs.patch != 0 - uses: actions/checkout@v6 - with: - ref: ${{ needs.variables.outputs.branch }} - submodules: true - token: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - - name: Check remote branch exists - id: check-existing - run: | - if git ls-remote --quiet --exit-code origin "${{needs.variables.outputs.branch}}"; then - echo "branch-exists=true" >> "$GITHUB_OUTPUT" - else - echo "branch-exists=false" >> "$GITHUB_OUTPUT" - fi - - name: Fail if there is no branch for patch release - if: steps.check-existing.outputs.branch-exists == 'false' && needs.variables.outputs.patch != 0 - run: exit 1 - - name: Initialize mandatory git config - run: | - git config user.name "${{github.event.sender.login}}" - git config user.email noreply@github.com - - name: Create release branch ${{needs.variables.outputs.branch}} - if: steps.check-existing.outputs.branch-exists == 'false' - run: | - git switch --create "${{needs.variables.outputs.branch}}" - git commit --allow-empty --message \ - "Empty commit to diverge ${{needs.variables.outputs.release}} from ${{env.main_branch}}" - - name: Tag release branch with rc.0 ${{needs.variables.outputs.branch}} - run: | - git tag --annotate --message "Upstream automation" \ - "${{needs.variables.outputs.release}}.${{needs.variables.outputs.patch}}-rc.0" HEAD - - name: Update the changelog on the release branch - run: | - set -uo pipefail - gh api -H "$ACCEPT_RAW" "${{env.script_url}}" | bash -s -- \ - patch-release-changelog \ - "${{inputs.version}}" - - name: Tag ${{env.main_branch}} for next release - if: steps.check-existing.outputs.branch-exists == 'false' - run: | - # There could be several commits between the starting point of the release branch and the HEAD - # on main/master tagged with the next release. While this leaves those intermediate - # commits tagged with the previous release, this is better than changing the build tag for - # those commits after all their artifacts have already been built and tested. - git switch ${{env.main_branch}} - git pull origin --rebase ${{env.main_branch}} - git tag --annotate --message "Upstream automation" \ - "${{needs.variables.outputs.next-minor-release}}.x" HEAD - - name: Push changes - if: env.DRY_RUN == 'false' - env: - GH_TOKEN: "${{ secrets.RHACS_BOT_GITHUB_TOKEN }}" - run: | - git switch "${{needs.variables.outputs.branch}}" - # This command pushes all new tags, not just the ones on the current branch. Therefore, it will push the tag we put on ${{env.main_branch}}. - git push --follow-tags --set-upstream origin "${{needs.variables.outputs.branch}}" - - ci: - name: Configure OpenShift CI jobs - needs: [variables, branch] - if: needs.variables.outputs.patch == 0 - runs-on: ubuntu-latest - env: - RELEASE: "${{needs.variables.outputs.release}}" - BRANCH: "stackrox-release-${{needs.variables.outputs.release}}" - steps: - - name: Check remote branch exists - id: check-existing - run: | - if gh api --silent -H "$ACCEPT_RAW" "/repos/stackrox/openshift-release/branches/${BRANCH}"; then - echo "branch-exists=true" >> "$GITHUB_OUTPUT" - echo "::notice::OpenShift CI configuration branch exists. Assuming CI is ready." - else - echo "branch-exists=false" >> "$GITHUB_OUTPUT" - fi - - name: Synchronize fork from openshift/release - if: env.DRY_RUN == 'false' && steps.check-existing.outputs.branch-exists == 'false' - env: - GH_TOKEN: "${{ secrets.RHACS_BOT_GITHUB_TOKEN }}" - run: | - gh repo sync stackrox/openshift-release --source openshift/release - - name: Check out stackrox/openshift-release - uses: actions/checkout@v6 - with: - repository: stackrox/openshift-release - token: "${{ secrets.RHACS_BOT_GITHUB_TOKEN }}" - - name: Initialize git config and create new branch - if: steps.check-existing.outputs.branch-exists == 'false' - run: | - git config user.name "${{github.event.sender.login}}" - git config user.email noreply@github.com - git switch --create "$BRANCH" - - name: Make configuration - if: steps.check-existing.outputs.branch-exists == 'false' - env: - CFG_DIR: "ci-operator/config/stackrox/stackrox" - run: | - # Duplicate the template configurations - for yaml in "$CFG_DIR"/stackrox-stackrox-release-x.y*.yaml ; do - yq eval ".zz_generated_metadata.branch=\"release-$RELEASE\"" "$yaml" > "${yaml//stackrox-release-x.y/$BRANCH}" - done - - - name: Make update - if: steps.check-existing.outputs.branch-exists == 'false' - run: | - make update - - git add ci-operator - git commit -m "Release $RELEASE files" >> "$GITHUB_STEP_SUMMARY" - - name: Push and create PR - if: env.DRY_RUN == 'false' && steps.check-existing.outputs.branch-exists == 'false' - env: - GH_TOKEN: "${{ secrets.RHACS_BOT_GITHUB_TOKEN }}" - run: | - git push --set-upstream origin "$BRANCH" - - PR_URL=$(gh pr create --repo openshift/release \ - --title "Stackrox release $RELEASE" \ - --base "master" \ - --body "CI configuration files to support Stackrox release \`$RELEASE\`.") - - PR_NUMBER="$(echo "${PR_URL}" | rev | cut -d '/' -f1 | rev)" - gh pr comment "${PR_NUMBER}" --repo openshift/release --body "/assign ${GITHUB_ACTOR}" - - echo ":arrow_right: Review and merge the [PR]($PR_URL) that has been created for the \`openshift/release\` repository." >> "$GITHUB_STEP_SUMMARY" - - patch-main-changelog: - name: Patch CHANGELOG.md on the default branch - needs: [variables, branch, start-sha] - if: needs.variables.outputs.patch == 0 - runs-on: ubuntu-latest - steps: - - name: Check out code - uses: actions/checkout@v6 - with: - # Working on `start-sha` instead of `env.main_branch` may help - # to spot changes happened to CHANGELOG.md after `start-sha`. - ref: ${{ needs.start-sha.outputs.start-sha }} - - name: Initialize mandatory git config - run: | - git config user.name "${{github.event.sender.login}}" - git config user.email noreply@github.com - - name: Patch CHANGELOG.md on ${{ needs.start-sha.outputs.start-sha }} - env: - GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - run: | - set -uo pipefail - gh api -H "$ACCEPT_RAW" "${{env.script_url}}" | bash -s -- \ - patch-main-changelog \ - "${{needs.variables.outputs.release}}.${{needs.variables.outputs.patch}}" \ - "${{ needs.start-sha.outputs.start-sha }}" \ - "${{needs.variables.outputs.branch}}" - - patch-scanner-versions: - name: Patch Scanner updater configuration - needs: [variables, branch] - runs-on: ubuntu-latest - steps: - - name: Check out code - uses: actions/checkout@v6 - with: - ref: ${{ env.main_branch }} - - name: Initialize mandatory git config - run: | - git config user.name "${{github.event.sender.login}}" - git config user.email noreply@github.com - - name: Patch scanner/updater/version/RELEASE_VERSION for ${{needs.variables.outputs.release}}.${{needs.variables.outputs.patch}} - env: - GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - run: | - set -uo pipefail - gh api -H "$ACCEPT_RAW" "${{env.script_url}}" | bash -s -- \ - patch-scanner-updater-configuration \ - "${{needs.variables.outputs.release}}.${{needs.variables.outputs.patch}}" - - milestone: - name: Create milestone - needs: [variables] - runs-on: ubuntu-latest - steps: - - name: Create ${{needs.variables.outputs.next-milestone}} milestone - if: env.DRY_RUN == 'false' - run: | - set -u - if ! http_code=$(gh api --silent -X POST \ - "repos/${{github.repository}}/milestones" \ - -f title="${{needs.variables.outputs.next-milestone}}" \ - 2>&1); then - - if grep "HTTP 422" <<< "$http_code"; then - echo ":arrow_right: Milestone ${{needs.variables.outputs.next-milestone}} already exists." \ - "**Close it once it's finished.**" >> "$GITHUB_STEP_SUMMARY" - else - echo "::error::Couldn't create milestone ${{needs.variables.outputs.next-milestone}}: $http_code" - exit 1 - fi - else - echo ":arrow_right: Milestone ${{needs.variables.outputs.next-milestone}} has been created." \ - "**Close it once it's finished.**" >> "$GITHUB_STEP_SUMMARY" - fi - - notify: - name: Notify everybody - needs: [variables, properties, branch, milestone] - runs-on: ubuntu-latest - steps: - - name: Post to Slack (normal release) - if: needs.variables.outputs.patch == 0 - uses: slackapi/slack-github-action@v2.1.1 - with: - method: chat.postMessage - token: ${{ secrets.SLACK_BOT_TOKEN }} - payload: | - channel: "${{ needs.properties.outputs.slack-channel }}" - text: "Upstream release ${{needs.variables.outputs.named-release-patch}} has been triggered. Consult the tracker for next steps." - blocks: - - type: "section" - text: - type: "mrkdwn" - text: | - :${{ fromJSON('["desert", "white_check_mark"]')[github.event.inputs.dry-run != 'true'] }}: *Upstream release ${{needs.variables.outputs.named-release-patch}} has been triggered on <${{github.server_url}}/${{github.repository}}|${{github.repository}}> by ${{ github.event.sender.login }}.* - - type: "section" - text: - type: "mrkdwn" - text: | - Branch `${{needs.variables.outputs.branch}}` and milestone `${{needs.variables.outputs.next-milestone}}` have been created. - - PRs merged to the ${{env.main_branch}} branch and assigned to RC milestones will be cherry-picked when closing the respective milestones. - For the urgent fixes that must go exclusively to this release open PRs to the `${{needs.variables.outputs.branch}}` branch. - - type: "divider" - - type: "section" - text: - type: "mrkdwn" - text: | - > Repository: <${{github.server_url}}/${{github.repository}}|${{github.repository}}> - > Release: ${{needs.variables.outputs.named-release-patch}} - > Workflow: <${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|${{github.workflow}}> - - - name: Post to Slack (patch release) - if: needs.variables.outputs.patch != 0 - uses: slackapi/slack-github-action@v2.1.1 - with: - method: chat.postMessage - token: ${{ secrets.SLACK_BOT_TOKEN }} - payload: | - channel: "${{ needs.properties.outputs.slack-channel }}" - text: "Upstream patch release ${{needs.variables.outputs.named-release-patch}} has been triggered. Consult the tracker for next steps." - blocks: - - type: "section" - text: - type: "mrkdwn" - text: | - :${{ fromJSON('["desert", "white_check_mark"]')[github.event.inputs.dry-run != 'true'] }}: *Upstream patch release ${{needs.variables.outputs.named-release-patch}} has been triggered on <${{github.server_url}}/${{github.repository}}|${{github.repository}}> by ${{ github.event.sender.login }}.* - - type: "section" - text: - type: "mrkdwn" - text: | - Milestone `${{needs.variables.outputs.next-milestone}}` has been created. - - PRs merged to the ${{env.main_branch}} branch and assigned to RC milestones will be cherry-picked when closing the respective milestones. - For the urgent fixes that must go exclusively to this release open PRs to the `${{needs.variables.outputs.branch}}` branch. - - type: "divider" - - type: "section" - text: - type: "mrkdwn" - text: | - > Repository: <${{github.server_url}}/${{github.repository}}|${{github.repository}}> - > Release: ${{needs.variables.outputs.named-release-patch}} - > Workflow: <${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|${{github.workflow}}> diff --git a/.github/workflows/style.yaml b/.github/workflows/style.yaml deleted file mode 100644 index 4991ff69d19d0..0000000000000 --- a/.github/workflows/style.yaml +++ /dev/null @@ -1,291 +0,0 @@ -name: Style -on: - push: - tags: - - '*' - branches: - - master - - release-* - pull_request: - types: - - opened - - reopened - - synchronize -env: - ROX_PRODUCT_BRANDING: RHACS_BRANDING - -concurrency: - group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} - cancel-in-progress: true - -jobs: - check-generated-files: - env: - ARTIFACT_DIR: junit-reports/ - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Create artifacts dir - run: mkdir -p "$ARTIFACT_DIR" - - - name: Cache Go dependencies - uses: ./.github/actions/cache-go-dependencies - - - name: Check Generated - run: scripts/ci/jobs/check-generated.sh - - misc-checks: - env: - ARTIFACT_DIR: junit-reports/ - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Create artifacts dir - run: mkdir -p "$ARTIFACT_DIR" - - - name: Ensure no trailing whitespaces - if: github.event_name == 'pull_request' - # Markdown files aren't checked for trailing whitespaces because it's a valid linebreak there. - run: git diff --check "${{ github.event.pull_request.base.sha }}"...HEAD ':(exclude)*.md' - - - name: Check PR fixes - run: scripts/ci/jobs/check-pr-fixes.sh - - - name: Check TODOs - run: scripts/ci/jobs/check-todos.sh - - - name: Check Policies - run: scripts/ci/jobs/policy-checks.sh - - - name: Check Konflux setup - run: scripts/ci/jobs/check-konflux-setup.sh - - - name: Check build & test image versions - run: scripts/ci/jobs/check-image-version.sh - - - name: Check dependabot knows about pinned prefetched images - run: scripts/ci/jobs/check-dependabot-pinned-image.sh - - style-check: - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - free-disk-space: '30' - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Cache Go dependencies - uses: ./.github/actions/cache-go-dependencies - - - name: Cache UI dependencies - uses: ./.github/actions/cache-ui-dependencies - - - name: Cache QA Test dependencies - uses: ./.github/actions/cache-gradle-dependencies - - - name: Fetch UI deps - run: make -C ui deps - - - name: make style-slim - run: make style-slim - - golangci-lint: - timeout-minutes: 240 - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - uses: actions/setup-go@v6 - with: - go-version-file: 'tools/linters/go.mod' - - - name: Check Cache golangci-lint - run: make golangci-lint-cache-status - - - name: Cache golangci-lint - uses: actions/cache@v5 - with: - path: /github/home/.cache/golangci-lint - key: go-lint-v2-${{ hashFiles('**/go.sum') }} - restore-keys: | - go-lint-v2-${{ hashFiles('**/go.sum') }} - go-lint-v2- - - - name: Check cache golangci-lint - run: make golangci-lint-cache-status - - - name: Check Go version is in sync in .golangci.yml and go.mod - run: | - [ "$(awk '/^go /{print $2}' go.mod | cut -d. -f 1-2)" = "$(yq e .run.go .golangci.yml)" ] - - - name: make golangci-lint - run: make golangci-lint - - - name: Check Cache golangci-lint - run: make golangci-lint-cache-status - - check-dependent-images-exist: - # This job ensures that COLLECTOR_VERSION, FACT_VERSION or SCANNER_VERSION files cannot be updated to a version - # for which the image was not successfully built on Konflux (suffix "-fast"). It also verifies that GHA-built image - # is there (no suffix) so that the failure also happens in this job. - runs-on: ubuntu-latest - strategy: - matrix: - image: ["collector", "fact", "scanner", "scanner-slim", "scanner-db", "scanner-db-slim"] - steps: - - name: Checkout repo - uses: actions/checkout@v6 - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Get image tag from COLLECTOR|FACT|SCANNER_VERSION file - id: image-tag - run: | - if [[ "${{ matrix.image }}" == "collector" ]]; then - makefile_target="collector-tag" - elif [[ "${{ matrix.image }}" == "fact" ]]; then - makefile_target="fact-tag" - else - makefile_target="scanner-tag" - fi - echo "image-tag=$(make --quiet --no-print-directory "${makefile_target}")" >> "${GITHUB_OUTPUT}" - - - name: Check GHA-built image exists - uses: stackrox/actions/release/wait-for-image@v1 - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - with: - token: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }} - image: rhacs-eng/${{ matrix.image }}:${{ steps.image-tag.outputs.image-tag }} - limit: 300 - - - name: Check Konflux-built image exists - uses: stackrox/actions/release/wait-for-image@v1 - # Skip for external contributions. - if: | - github.event_name == 'push' || !github.event.pull_request.head.repo.fork - with: - token: ${{ secrets.QUAY_RHACS_ENG_BEARER_TOKEN }} - image: rhacs-eng/release-${{ matrix.image }}:${{ steps.image-tag.outputs.image-tag }}-fast - limit: 300 - - github-actions-lint: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - name: Download actionlint - id: get_actionlint - run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/2ab3a12c7848f6c15faca9a92612ef4261d0e370/scripts/download-actionlint.bash) 1.6.27 - shell: bash - - name: Check workflow files - run: ${{ steps.get_actionlint.outputs.executable }} -color - shell: bash - - github-actions-shellcheck: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - name: Check scripts with shellcheck - run: shellcheck -P SCRIPTDIR -x ./.github/workflows/scripts/*.sh - - openshift-ci-lint: - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: pycodestyle - run: make -C .openshift-ci style - - - name: Pylint - run: make -C .openshift-ci lint - - slack-on-style-failure: - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - SLACK_CI_INTEGRATION_TESTING_WEBHOOK: ${{ secrets.SLACK_CI_INTEGRATION_TESTING_WEBHOOK }} - TEST_FAILURES_NOTIFY_WEBHOOK: ${{ secrets.TEST_FAILURES_NOTIFY_WEBHOOK }} - if: | - failure() && ( - github.event_name == 'push' || - contains(github.event.pull_request.labels.*.name, 'ci-test-github-action-slack-messages') - ) - name: Post failure message to Slack - runs-on: ubuntu-latest - needs: - - check-generated-files - - misc-checks - - style-check - - golangci-lint - - check-dependent-images-exist - - github-actions-lint - - github-actions-shellcheck - - openshift-ci-lint - permissions: - actions: read - steps: - - name: Checkout - uses: actions/checkout@v6 - - - name: Slack message - env: - GITHUB_CONTEXT: ${{ toJSON(github) }} - run: | - source scripts/ci/lib.sh - slack_workflow_failure diff --git a/.github/workflows/tag-more-reviewers.yaml b/.github/workflows/tag-more-reviewers.yaml deleted file mode 100644 index f6ce74aac7c50..0000000000000 --- a/.github/workflows/tag-more-reviewers.yaml +++ /dev/null @@ -1,26 +0,0 @@ -name: Tag more reviewers - -on: - pull_request: - types: - - review_requested - -jobs: - tag-konflux-maintainers: - # We have lots of PR traffic from MintMaker (acting as `red-hat-konflux[bot]`), and so it's unsustainable to go - # through these emails every day. Therefore, the notifications are disabled for `konflux-maintainers-no-email` - # team that's set as owner in CODEOWNERS for the Konflux stuff. - # At the same time, we want to be notified when humans, not the bot, request reviews (which happens automatically - # again through CODEOWNERS) for the Konflux-related files. This job invites `konflux-maintainers` team for review - # for such cases. - if: | - github.event.requested_team.name == 'konflux-maintainers-no-email' && - github.event.pull_request.user.login != 'red-hat-konflux[bot]' - env: - GH_TOKEN: ${{ secrets.RHACS_BOT_GITHUB_TOKEN }} - runs-on: ubuntu-latest - steps: - - name: Tag Konflux Maintainers for review - run: | - gh pr --repo "${{ github.repository }}" edit "${{ github.event.pull_request.number }}" \ - --add-reviewer stackrox/konflux-maintainers diff --git a/.github/workflows/tagged-ci.yaml b/.github/workflows/tagged-ci.yaml deleted file mode 100644 index ca55fe959f008..0000000000000 --- a/.github/workflows/tagged-ci.yaml +++ /dev/null @@ -1,25 +0,0 @@ -name: Tagged CI -on: - push: - tags: - - '*' - - '!*-nightly-*' - -jobs: - slack-tagged-notice: - name: Slack Tagged Notice - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.ref_name }} - - name: Slack - env: - RELEASE_WORKFLOW_NOTIFY_WEBHOOK: ${{ secrets.RELEASE_WORKFLOW_NOTIFY_WEBHOOK }} - SLACK_MAIN_WEBHOOK: ${{ secrets.SLACK_MAIN_WEBHOOK }} - run: | - set -euo pipefail - source scripts/ci/lib.sh - slack_prow_notice "${{ github.ref_name }}" diff --git a/.github/workflows/triage-report_periodic.yml b/.github/workflows/triage-report_periodic.yml deleted file mode 100644 index 7910423e2a329..0000000000000 --- a/.github/workflows/triage-report_periodic.yml +++ /dev/null @@ -1,17 +0,0 @@ -name: Triage Report -on: - workflow_dispatch: - schedule: - - cron: 0 15 * * 3,5 -jobs: - triage-report: - if: ${{ github.repository_owner == 'stackrox' }} - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v6 - - name: Report to Slack - env: - JIRA_TOKEN: ${{ secrets.JIRA_TOKEN }} - SLACK_WEBHOOK: ${{ secrets.SLACK_ACS_SUPPORT_TRIAGE_WEBHOOK }} - run: ./scripts/run-support-triage-report.sh diff --git a/.github/workflows/unit-tests.yaml b/.github/workflows/unit-tests.yaml deleted file mode 100644 index f048282df2838..0000000000000 --- a/.github/workflows/unit-tests.yaml +++ /dev/null @@ -1,486 +0,0 @@ -name: Unit Tests -on: - push: - tags: - - '*' - branches: - - master - - release-* - pull_request: - types: - - opened - - reopened - - synchronize - -concurrency: - group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} - cancel-in-progress: true - -jobs: - go: - strategy: - fail-fast: false - matrix: - gotags: [ 'GOTAGS=""', 'GOTAGS=release' ] - runs-on: ubuntu-latest - outputs: - new-jiras: ${{ steps.junit2jira.outputs.new-jiras }} - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Cache Go dependencies - uses: ./.github/actions/cache-go-dependencies - - - name: Go Unit Tests - run: ${{ matrix.gotags }} make go-unit-tests - - - uses: codecov/codecov-action@v3 - with: - token: ${{ secrets.CODECOV_TOKEN }} - flags: go-unit-tests - - - name: Generate junit report - if: always() - run: make generate-junit-reports - - - name: Publish Test Report - uses: test-summary/action@v2 - if: always() - with: - paths: 'junit-reports/report.xml' - - - name: Go Integration Unit Tests - run: ${{ matrix.gotags }} make integration-unit-tests - - - name: Go Operator Integration Tests - run: ${{ matrix.gotags }} make -C operator/ test-integration - - - name: Generate junit report - if: always() - run: make generate-junit-reports - - - name: Publish Test Report - uses: test-summary/action@v2 - if: always() - with: - paths: 'junit-reports/report.xml' - - - name: Report test failures to Jira - if: (!cancelled()) - id: junit2jira - uses: ./.github/actions/junit2jira - with: - create-jiras: ${{ github.event_name == 'push' }} - jira-token: ${{ secrets.JIRA_TOKEN }} - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - directory: 'junit-reports' - - go-postgres: - strategy: - fail-fast: false - matrix: - gotags: [ 'GOTAGS=""', 'GOTAGS=release' ] - pg: [ '15' ] - runs-on: ubuntu-latest - outputs: - new-jiras: ${{ steps.junit2jira.outputs.new-jiras }} - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - steps: - - name: Set Postgres version - run: | - echo "/usr/pgsql-${{ matrix.pg }}/bin" >> "${GITHUB_PATH}" - - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Run Postgres - run: | - su postgres -c 'initdb -D /tmp/data' - su postgres -c 'pg_ctl -D /tmp/data start' - - - name: Cache Go dependencies - uses: ./.github/actions/cache-go-dependencies - - - name: Is Postgres ready - run: pg_isready -h 127.0.0.1 - - - name: Go Unit Tests - run: ${{ matrix.gotags }} make go-postgres-unit-tests - - - uses: codecov/codecov-action@v3 - with: - token: ${{ secrets.CODECOV_TOKEN }} - flags: go-unit-tests - - - name: Generate junit report - if: always() - run: make generate-junit-reports - - - name: Publish Test Report - uses: test-summary/action@v2 - if: always() - with: - paths: 'junit-reports/report.xml' - - - name: Report junit failures in jira - if: (!cancelled()) - id: junit2jira - uses: ./.github/actions/junit2jira - with: - create-jiras: ${{ github.event_name == 'push' }} - jira-token: ${{ secrets.JIRA_TOKEN }} - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - directory: 'junit-reports' - - go-bench: - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - steps: - - name: Set Postgres version - run: | - echo "/usr/pgsql-15/bin" >> "${GITHUB_PATH}" - - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Run Postgres - run: | - su postgres -c 'initdb -D /tmp/data' - su postgres -c 'pg_ctl -D /tmp/data start' - - - name: Cache Go dependencies - uses: ./.github/actions/cache-go-dependencies - - - name: Is Postgres ready - run: pg_isready -h 127.0.0.1 - - - name: Go Bench Tests - run: make go-postgres-bench-tests - - - name: Generate junit report - if: always() - run: make generate-junit-reports - - - name: Publish Test Report - uses: test-summary/action@v2 - if: always() - with: - paths: 'junit-reports/report.xml' - - # Do not create junit report for bench tests: - # https://github.com/jstemmer/go-junit-report/issues/174 - - ui: - runs-on: ubuntu-latest - outputs: - new-jiras: ${{ steps.junit2jira.outputs.new-jiras }} - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - steps: - - name: Checkout - uses: actions/checkout@v6 - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Cache UI dependencies - uses: ./.github/actions/cache-ui-dependencies - - - name: UI Unit Tests - run: make ui-test - - - name: Publish Test Report - uses: test-summary/action@v2 - if: always() - with: - paths: 'ui/apps/platform/test-results/reports/*.xml' - - - name: Report junit failures in jira - if: (!cancelled()) - id: junit2jira - uses: ./.github/actions/junit2jira - with: - create-jiras: ${{ github.event_name == 'push' }} - jira-token: ${{ secrets.JIRA_TOKEN }} - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - directory: 'ui/apps/platform/test-results/reports' - - ui-component: - runs-on: ubuntu-latest - outputs: - new-jiras: ${{ steps.junit2jira.outputs.new-jiras }} - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-ui-test-0.5.1 - steps: - - name: Checkout - uses: actions/checkout@v6 - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Cache UI dependencies - uses: ./.github/actions/cache-ui-dependencies - - - name: UI Component Tests - run: make ui-component-tests - - - name: Upload Cypress test result artifacts - uses: ./.github/actions/upload-artifact-with-retry - if: always() - with: - name: Cypress test results - path: ui/apps/platform/cypress/test-results/ - - - name: Publish Test Report - uses: test-summary/action@v2 - if: always() - with: - paths: 'ui/apps/platform/cypress/test-results/reports/**/*.xml' - - - name: Report junit failures in jira - if: (!cancelled()) - id: junit2jira - uses: ./.github/actions/junit2jira - with: - create-jiras: ${{ github.event_name == 'push' }} - jira-token: ${{ secrets.JIRA_TOKEN }} - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - directory: 'ui/apps/platform/cypress/test-results/reports' - - local-roxctl-tests: - runs-on: ubuntu-latest - outputs: - new-jiras: ${{ steps.junit2jira.outputs.new-jiras }} - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - volumes: - - /usr:/mnt/usr - - /opt:/mnt/opt - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Cache Go dependencies - uses: ./.github/actions/cache-go-dependencies - - - uses: ./.github/actions/handle-tagged-build - - - name: Local roxctl tests - run: ./scripts/ci/jobs/local-roxctl-tests.sh - - - name: Publish Test Report - uses: test-summary/action@v2 - if: always() - with: - paths: 'roxctl-test-output/*.xml' - - - name: Report junit failures in jira - if: (!cancelled()) - id: junit2jira - uses: ./.github/actions/junit2jira - with: - create-jiras: ${{ github.event_name == 'push' }} - jira-token: ${{ secrets.JIRA_TOKEN }} - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - directory: 'roxctl-test-output' - - shell-unit-tests: - runs-on: ubuntu-latest - outputs: - new-jiras: ${{ steps.junit2jira.outputs.new-jiras }} - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Shell Unit Tests - run: make shell-unit-tests - - - name: Publish Test Report - uses: test-summary/action@v2 - if: always() - with: - paths: 'shell-test-output/*.xml' - - - name: Report junit failures in jira - if: (!cancelled()) - id: junit2jira - uses: ./.github/actions/junit2jira - with: - create-jiras: ${{ github.event_name == 'push' }} - jira-token: ${{ secrets.JIRA_TOKEN }} - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - directory: 'shell-test-output' - - openshift-ci-unit-tests: - runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:stackrox-test-0.5.1 - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - ref: ${{ github.event.pull_request.head.sha }} - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: OpenShift CI Wrapper Unit Tests - run: make -C .openshift-ci test - - sensor-integration-tests: - env: - KUBECONFIG: "/tmp/kubeconfig" - runs-on: ubuntu-latest - outputs: - new-jiras: ${{ steps.junit2jira.outputs.new-jiras }} - steps: - - name: Checkout - uses: actions/checkout@v6 - with: - fetch-depth: 0 - - - name: Set up Go - uses: actions/setup-go@v6 - with: - go-version-file: go.mod - - - uses: ./.github/actions/job-preamble - with: - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - - name: Cache Go dependencies - uses: ./.github/actions/cache-go-dependencies - - - name: Login to Quay.io - uses: docker/login-action@v3 - with: - registry: quay.io - username: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }} - password: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }} - - - name: Create k8s Kind Cluster - uses: helm/kind-action@v1 - with: - kubeconfig: "${{ env.KUBECONFIG }}" - - - name: Load test images into Kind - run: | - # Read images from prefetch list (single source of truth) - while IFS= read -r image; do - # Skip empty lines and comments - [[ -z "$image" || "$image" =~ ^# ]] && continue - echo "Loading $image into Kind..." - docker pull "$image" - kind load docker-image "$image" --name chart-testing - done < sensor/tests/images-to-prefetch.txt - - - name: Run sensor integration tests - run: make sensor-integration-test - - - name: Generate junit report - if: always() - run: make generate-junit-reports - - - name: Publish Test Report - uses: test-summary/action@v2 - if: always() - with: - paths: 'junit-reports/report.xml' - - - name: Report junit failures in jira - if: (!cancelled()) - id: junit2jira - uses: ./.github/actions/junit2jira - with: - create-jiras: ${{ github.event_name == 'push' }} - jira-token: ${{ secrets.JIRA_TOKEN }} - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - directory: 'junit-reports' - - slack-on-unit-tests-failure: - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - SLACK_CI_INTEGRATION_TESTING_WEBHOOK: ${{ secrets.SLACK_CI_INTEGRATION_TESTING_WEBHOOK }} - TEST_FAILURES_NOTIFY_WEBHOOK: ${{ secrets.TEST_FAILURES_NOTIFY_WEBHOOK }} - if: | - failure() && ( - github.event_name == 'push' || - contains(github.event.pull_request.labels.*.name, 'ci-test-github-action-slack-messages') - ) - name: Post failure message to Slack - runs-on: ubuntu-latest - needs: - - go - - go-bench - - go-postgres - - local-roxctl-tests - - openshift-ci-unit-tests - - sensor-integration-tests - - shell-unit-tests - - ui - - ui-component - permissions: - actions: read - steps: - - name: Checkout - uses: actions/checkout@v6 - - - name: Slack message - env: - GITHUB_CONTEXT: ${{ toJSON(github) }} - mention_author: ${{ needs.go.outputs.new-jiras || needs.go-postgres.outputs.new-jiras || needs.local-roxctl-tests.outputs.new-jiras || needs.ui.outputs.new-jiras || needs.go.outputs.new-jiras || needs.shell-unit-tests.outputs.new-jiras || needs.sensor-integration-tests.outputs.new-jiras }} - run: | - source scripts/ci/lib.sh - slack_workflow_failure diff --git a/.github/workflows/update_collector_periodic.yaml b/.github/workflows/update_collector_periodic.yaml deleted file mode 100644 index 69d0fd61cb0ad..0000000000000 --- a/.github/workflows/update_collector_periodic.yaml +++ /dev/null @@ -1,50 +0,0 @@ -name: Update collector version -on: - workflow_dispatch: - schedule: - - cron: 0 5 * * 1 -jobs: - update-collector: - if: ${{ github.repository_owner == 'stackrox' }} - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - with: - ref: master # this is our target branch - fetch-depth: 0 # we need to fetch all branches - - name: Checkout collector repo - uses: actions/checkout@v6 - with: - repository: stackrox/collector - path: deps/collector - fetch-depth: 0 # we need to fetch tags - - name: Update version - run: make -sC deps/collector tag | tee COLLECTOR_VERSION - - name: Create Pull Request - id: cpr - uses: peter-evans/create-pull-request@v8 - with: - token: '${{ secrets.RHACS_BOT_GITHUB_TOKEN }}' - commit-message: Update COLLECTOR_VERSION - committer: '${{ secrets.RHACS_BOT_GITHUB_USERNAME }} <${{ secrets.RHACS_BOT_GITHUB_EMAIL }}>' - author: '${{ secrets.RHACS_BOT_GITHUB_USERNAME }} <${{ secrets.RHACS_BOT_GITHUB_EMAIL }}>' - branch: update_collector_version - signoff: false - delete-branch: true - title: 'chore(collector): Update COLLECTOR_VERSION' - body: | - Daily update of COLLECTOR_VERSION to latest master version - labels: | - ci-all-qa-tests - dependencies - konflux-build - team-reviewers: | - collector-team - draft: false - - name: Enable Pull Request Automerge - if: steps.cpr.outputs.pull-request-operation == 'created' - uses: peter-evans/enable-pull-request-automerge@v3 - with: - token: '${{ secrets.RHACS_BOT_GITHUB_TOKEN }}' - pull-request-number: '${{ steps.cpr.outputs.pull-request-number }}' - merge-method: squash diff --git a/.github/workflows/update_fact_periodic.yaml b/.github/workflows/update_fact_periodic.yaml deleted file mode 100644 index 160203926f04a..0000000000000 --- a/.github/workflows/update_fact_periodic.yaml +++ /dev/null @@ -1,50 +0,0 @@ -name: Update fact version -on: - workflow_dispatch: - schedule: - - cron: 0 5 * * 1 -jobs: - update-fact: - if: ${{ github.repository_owner == 'stackrox' }} - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - with: - ref: master # this is our target branch - fetch-depth: 0 # we need to fetch all branches - - name: Checkout fact repo - uses: actions/checkout@v6 - with: - repository: stackrox/fact - path: deps/fact - fetch-depth: 0 # we need to fetch tags - - name: Update version - run: make -sC deps/fact tag | tee FACT_VERSION - - name: Create Pull Request - id: cpr - uses: peter-evans/create-pull-request@v8 - with: - token: '${{ secrets.RHACS_BOT_GITHUB_TOKEN }}' - commit-message: Update FACT_VERSION - committer: '${{ secrets.RHACS_BOT_GITHUB_USERNAME }} <${{ secrets.RHACS_BOT_GITHUB_EMAIL }}>' - author: '${{ secrets.RHACS_BOT_GITHUB_USERNAME }} <${{ secrets.RHACS_BOT_GITHUB_EMAIL }}>' - branch: update_fact_version - signoff: false - delete-branch: true - title: 'chore(fact): Update FACT_VERSION' - body: | - Daily update of FACT_VERSION to latest master version - labels: | - ci-all-qa-tests - dependencies - konflux-build - team-reviewers: | - collector-team - draft: false - - name: Enable Pull Request Automerge - if: steps.cpr.outputs.pull-request-operation == 'created' - uses: peter-evans/enable-pull-request-automerge@v3 - with: - token: '${{ secrets.RHACS_BOT_GITHUB_TOKEN }}' - pull-request-number: '${{ steps.cpr.outputs.pull-request-number }}' - merge-method: squash diff --git a/.github/workflows/update_scanner_periodic.yaml b/.github/workflows/update_scanner_periodic.yaml deleted file mode 100644 index c00ed436f96e3..0000000000000 --- a/.github/workflows/update_scanner_periodic.yaml +++ /dev/null @@ -1,49 +0,0 @@ -name: Update scanner version -on: - workflow_dispatch: - schedule: - - cron: 0 5 * * 1 -jobs: - update-scanner: - if: ${{ github.repository_owner == 'stackrox' }} - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - with: - ref: master # this is our target branch - fetch-depth: 0 # we need to fetch all branches - - name: Checkout scanner repo - uses: actions/checkout@v6 - with: - repository: stackrox/scanner - path: deps/scanner - fetch-depth: 0 # we need to fetch tags - - name: Update version - run: make -sC deps/scanner tag | tee SCANNER_VERSION - - name: Create Pull Request - id: cpr - uses: peter-evans/create-pull-request@v8 - with: - token: '${{ secrets.RHACS_BOT_GITHUB_TOKEN }}' - commit-message: Update SCANNER_VERSION - committer: '${{ secrets.RHACS_BOT_GITHUB_USERNAME }} <${{ secrets.RHACS_BOT_GITHUB_EMAIL }}>' - author: '${{ secrets.RHACS_BOT_GITHUB_USERNAME }} <${{ secrets.RHACS_BOT_GITHUB_EMAIL }}>' - branch: update_scanner_version - signoff: false - delete-branch: true - title: 'chore(scanner): Update SCANNER_VERSION' - body: | - Weekly update of SCANNER_VERSION to latest master version - labels: | - ci-all-qa-tests - dependencies - konflux-build - team-reviewers: scanner - draft: false - - name: Enable Pull Request Automerge - if: steps.cpr.outputs.pull-request-operation == 'created' - uses: peter-evans/enable-pull-request-automerge@v3 - with: - token: '${{ secrets.RHACS_BOT_GITHUB_TOKEN }}' - pull-request-number: '${{ steps.cpr.outputs.pull-request-number }}' - merge-method: squash diff --git a/.github/workflows/upgrade-test.yml b/.github/workflows/upgrade-test.yml deleted file mode 100644 index 82eb2190d4369..0000000000000 --- a/.github/workflows/upgrade-test.yml +++ /dev/null @@ -1,160 +0,0 @@ -name: "RELEASE: Prepare manual upgrade test" -on: - workflow_dispatch: - inputs: - previous-version: - description: Previous release version (A.B.C) - required: true - default: 0.0.0 - type: string - milestone: - description: Stable release candidate milestone (A.B.C[-N]) - required: true - default: 0.0.0 - type: string - dry-run: - description: Dry-run - required: false - default: false - type: boolean - -env: - script_url: /repos/${{ github.repository }}/contents/.github/workflows/scripts/common.sh?ref=${{ github.ref_name }} - DRY_RUN: ${{ fromJSON('["true", "false"]')[github.event.inputs.dry-run != 'true'] }} - ACCEPT_RAW: "Accept: application/vnd.github.v3.raw" - GH_TOKEN: ${{ github.token }} - GH_NO_UPDATE_NOTIFIER: 1 - -run-name: >- - ${{ - format('Prepare clusters for manual upgrade test from {0} to {1}{2}', - inputs.previous-version, - inputs.milestone, - fromJSON('[" (dry-run)", ""]')[inputs.dry-run != true] - ) - }} - -# Ensure that only a single automation workflow can run at a time for each release. -concurrency: Release automation ${{ inputs.milestone }} - -jobs: - properties: - name: Read repository properties - runs-on: ubuntu-latest - outputs: - slack-channel: ${{ fromJSON(format('["{0}","{1}"]', steps.properties.outputs.dry-slack-channel, steps.properties.outputs.slack-channel))[inputs.dry-run != 'true'] }} - steps: - - name: Read workflow properties file - id: properties - env: - PROPERTIES_URL: /repos/${{ github.repository }}/contents/.github/properties?ref=${{ github.ref_name }} - run: gh api -H "$ACCEPT_RAW" "$PROPERTIES_URL" >> "$GITHUB_OUTPUT" - - run-parameters: - name: Run parameters - runs-on: ubuntu-latest - steps: - - run: | - [ "$DRY_RUN" = "true" ] && echo "::warning::This is a dry run" - echo "Event: ${{github.event_name}}" >>"$GITHUB_STEP_SUMMARY" - cat <>"$GITHUB_STEP_SUMMARY" - \`\`\` - ${{toJSON(inputs)}} - \`\`\` - EOF - - create-clusters: - needs: [properties] - if: github.event.inputs.dry-run != 'true' - runs-on: ubuntu-latest - strategy: - matrix: - name: [test1, test2] - steps: - - name: Create the ${{ matrix.name }} cluster - uses: stackrox/actions/infra/create-cluster@v1 - with: - token: ${{ secrets.INFRA_TOKEN }} - flavor: gke-default - name: upgrade-${{ matrix.name }}-${{ inputs.milestone }} - lifespan: 48h - args: nodes=5,machine-type=e2-standard-8 - wait: true - - prepare-clusters: - needs: [properties, create-clusters] - runs-on: ubuntu-latest - steps: - - name: Check out code - uses: actions/checkout@v6 - with: - ref: ${{ github.ref_name }} - - uses: stackrox/actions/infra/install-infractl@v1 - - uses: "google-github-actions/auth@v3" - with: - credentials_json: "${{ secrets.GCP_RELEASE_AUTOMATION_SA }}" - - name: "Set up Cloud SDK" - uses: "google-github-actions/setup-gcloud@v3" - with: - install_components: "gke-gcloud-auth-plugin" - - name: Prepare clusters for upgrade test - if: env.DRY_RUN == 'false' - env: - INFRA_TOKEN: ${{ secrets.INFRA_TOKEN }} - REGISTRY_USERNAME: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }} - REGISTRY_PASSWORD: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }} - USE_GKE_GCLOUD_AUTH_PLUGIN: "True" - run: | - set -uo pipefail - gh api -H "$ACCEPT_RAW" "${{env.script_url}}" | bash -s -- \ - prepare-upgrade-test \ - "${{inputs.previous-version}}" \ - "${{inputs.milestone}}" - - name: Post to Slack about cluster creation - uses: slackapi/slack-github-action@v2.1.1 - with: - method: chat.postMessage - token: ${{ secrets.SLACK_BOT_TOKEN }} - payload: | - channel: "${{ needs.properties.outputs.slack-channel }}" - text: "Upgrade clusters have been prepared for ${{ inputs.milestone }} milestone. Consult the upgrade test documentation for next steps." - blocks: - - type: "section" - text: - type: "mrkdwn" - text: | - :${{ fromJSON('["desert", "tada"]')[github.event.inputs.dry-run != 'true'] }}: *Upgrade clusters have been prepared for ${{ inputs.milestone }} milestone of <${{ github.server_url }}/${{ github.repository }}|${{ github.repository }}> by ${{ github.event.sender.login }}.* - - type: "divider" - - type: "section" - text: - type: "mrkdwn" - text: | - :arrow_right: Setup your local access to Central by running in your clone of `${{ github.repository }}`: - ```./scripts/release-tools/upgrade-cluster-client.sh ${{ inputs.milestone }}``` - - notify-failed-clusters: - name: Notify about failed cluster creation - needs: [properties, prepare-clusters] - if: always() && needs.prepare-clusters.result == 'failure' - runs-on: ubuntu-latest - steps: - - name: Post to Slack - uses: slackapi/slack-github-action@v2.1.1 - with: - method: chat.postMessage - token: ${{ secrets.SLACK_BOT_TOKEN }} - payload: | - channel: "${{ needs.properties.outputs.slack-channel }}" - text: "Couldn't create upgrade clusters for ${{ inputs.milestone }} milestone. Investigate the output of the <${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|${{github.workflow}}> workflow run." - blocks: - - type: "section" - text: - type: "mrkdwn" - text: | - :${{ fromJSON('["desert", "red_circle"]')[github.event.inputs.dry-run != 'true'] }}: *Couldn't create upgrade clusters for ${{ inputs.milestone }} milestone of <${{ github.server_url }}/${{ github.repository }}|${{ github.repository }}> by ${{ github.event.sender.login }}.* - - type: "divider" - - type: "section" - text: - type: "mrkdwn" - text: | - :arrow_right: Please investigate the output of the <${{github.server_url}}/${{github.repository}}/actions/runs/${{github.run_id}}|${{github.workflow}}> workflow run and then restart the script from where it failed. diff --git a/.github/workflows/variables.yml b/.github/workflows/variables.yml deleted file mode 100644 index f574eec48faa4..0000000000000 --- a/.github/workflows/variables.yml +++ /dev/null @@ -1,134 +0,0 @@ -name: "RELEASE: Parse Version" -on: - workflow_call: - inputs: - version: - description: Version (A.B.C[-N][-rc.D]) - type: string - required: true - assert-format: - description: Check for presence of the given version parts - type: string - default: A.B.C[-N][-rc.D] - required: false - - outputs: - release: - description: Release number (A.B) - value: ${{jobs.parse.outputs.release}} - patch: - description: Patch number (C) - value: ${{jobs.parse.outputs.patch}} - rc: - description: RC number (D) - value: ${{jobs.parse.outputs.rc}} - name: - description: Release name (N) - value: ${{jobs.parse.outputs.name}} - named-release: - description: Release name and minor version (A.B[-N]) - value: ${{format('{0}{1}', jobs.parse.outputs.release, jobs.parse.outputs.dash-name)}} - named-release-patch: - description: Release.patch-name (A.B.C[-N]) - value: ${{format('{0}.{1}{2}', jobs.parse.outputs.release, jobs.parse.outputs.patch, jobs.parse.outputs.dash-name)}} - branch: - description: Release branch name (release-A.B[-N]) - value: ${{format('release-{0}{1}', jobs.parse.outputs.release, jobs.parse.outputs.dash-name)}} - docs-branch: - description: Documentation branch name - value: ${{format('rhacs-docs-{0}.{1}', jobs.parse.outputs.release, jobs.parse.outputs.patch)}} - milestone: - description: Milestone (A.B.C[-N]-rc.D) - value: ${{format('{0}.{1}{2}-rc.{3}', jobs.parse.outputs.release, jobs.parse.outputs.patch, jobs.parse.outputs.dash-name, jobs.parse.outputs.rc)}} - next-milestone: - description: Next milestone (A.B.C[-N]-rc.`D+1`) - value: ${{format('{0}.{1}{2}-rc.{3}', jobs.parse.outputs.release, jobs.parse.outputs.patch, jobs.parse.outputs.dash-name, jobs.parse.outputs.next-rc)}} - next-minor-release: - description: Next Release (A.`B+1`) - value: ${{format('{0}.{1}', jobs.parse.outputs.major, jobs.parse.outputs.next-minor)}} - next-patch-release: - description: Next Release.patch (A.B.`C+1`) - value: ${{format('{0}.{1}', jobs.parse.outputs.release, jobs.parse.outputs.next-patch)}} - next-named-patch-release: - description: Next Release.patch-name (A.B.`C+1`[-N]) - value: ${{format('{0}.{1}{2}', jobs.parse.outputs.release, jobs.parse.outputs.next-patch, jobs.parse.outputs.dash-name)}} - -jobs: - parse: - name: Parse ${{inputs.version}} - runs-on: ubuntu-latest - outputs: - release: ${{steps.parse.outputs.release}} - major: ${{steps.parse.outputs.major}} - minor: ${{steps.parse.outputs.minor}} - patch: ${{steps.parse.outputs.patch}} - rc: ${{steps.parse.outputs.rc}} - name: ${{steps.parse.outputs.name}} - dash-name: ${{steps.parse.outputs.dash-name}} - next-patch: ${{steps.parse.outputs.next-patch}} - next-minor: ${{steps.parse.outputs.next-minor}} - next-rc: ${{steps.parse.outputs.next-rc}} - steps: - - name: Parse version - id: parse - shell: python - # Allowed versions examples: - # 1.2.3 - # 1.2.3-rc.4 - # 1.2.3-alnum - # 1.2.3-alnum-alnum - # 1.2.3-alnum-rc.4 - run: | - import os - import re - import sys - - RELEASE=r'(?P(?P\d+)\.(?P\d+))' - PATCH=r'(?P\d+)' - NAME=r'(-(?P\w+(-\w+)*))' - RC=r'(-rc\.(?P\d+))' - - f = '${{ inputs.assert-format }}' - - EXPR = { - 'A.B.C': rf'{RELEASE}\.{PATCH}$', - 'A.B.C-N': rf'{RELEASE}\.{PATCH}{NAME}$', - 'A.B.C[-N]': rf'{RELEASE}\.{PATCH}{NAME}?$', - 'A.B.C-N-rc.D': rf'{RELEASE}\.{PATCH}{NAME}{RC}$', - 'A.B.C-N[-rc.D]': rf'{RELEASE}\.{PATCH}{NAME}{RC}?$', - 'A.B.C[-N]-rc.D': rf'{RELEASE}\.{PATCH}{NAME}?{RC}$', - 'A.B.C[-N][-rc.D]': rf'{RELEASE}\.{PATCH}{NAME}?{RC}?$', - 'A.B.0': rf'{RELEASE}\.0$', - 'A.B.0-N': rf'{RELEASE}\.0{NAME}$', - 'A.B.0[-N]': rf'{RELEASE}\.0{NAME}?$', - 'A.B.0-N-rc.D': rf'{RELEASE}\.0{NAME}{RC}$', - 'A.B.0-N[-rc.D]': rf'{RELEASE}\.0{NAME}{RC}?$', - 'A.B.0[-N]-rc.D': rf'{RELEASE}\.0{NAME}?{RC}$', - 'A.B.0[-N][-rc.D]': rf'{RELEASE}\.0{NAME}?{RC}?$', - }[f] - - version = '${{ inputs.version }}' - m = re.match(EXPR, version) - if not m: - print(f'::error::Cannot parse "{version}": should be in a form of `{f}`.') - exit(1) - - patch = m.group('patch') if '.C' in f else 0 - name = (m.group('name') if '-N' in f else '') or '' - rc = int(m.group('rc') or 1) if '-rc.D' in f else 0 - - data = { - 'release': m.group('release'), - 'major': m.group('major'), - 'minor': m.group('minor'), - 'patch': patch, - 'rc': rc, - 'name': name, - 'dash-name': f'-{name}' if name else '', - 'next-minor': int(m.group('minor'))+1, - 'next-patch': int(patch)+1, - 'next-rc': rc+1, - } - - with open(os.environ.get('GITHUB_OUTPUT'), mode='a') as f: - print('\n'.join(f'{k}={v}' for k,v in data.items()), file=f) diff --git a/.github/workflows/verify-release.yml b/.github/workflows/verify-release.yml deleted file mode 100644 index f04d9379a4145..0000000000000 --- a/.github/workflows/verify-release.yml +++ /dev/null @@ -1,95 +0,0 @@ -name: "RELEASE: Verify release" -on: - workflow_dispatch: - inputs: - version: - description: Release version (A.B.C[-N]) - required: true - default: 0.0.0-test - type: string - errata: - description: Name of the related Errata advisory - required: true - default: "RHSA-1970:0000" - type: string - latest-version: - description: Is this latest published version? (enables additional checks) - required: true - default: false - type: boolean - -env: - script_url: /repos/${{ github.repository }}/contents/.github/workflows/scripts/common.sh?ref=${{ github.ref_name }} - ACCEPT_RAW: "Accept: application/vnd.github.v3.raw" - GH_TOKEN: ${{ github.token }} - GH_NO_UPDATE_NOTIFIER: 1 - -run-name: ${{ format('Verify release {0}', inputs.version) }} - -# Ensure that only a single automation workflow can run at a time for each release. -concurrency: Release automation ${{ inputs.version }} - -jobs: - run-parameters: - name: Run parameters - runs-on: ubuntu-latest - steps: - - run: | - { - echo "Event: ${{ github.event_name }}" - if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then - echo '```' - echo "${{ toJSON(inputs) }}" - echo '```' - fi - } >> "$GITHUB_STEP_SUMMARY" - - variables: - name: Setup variables - uses: ./.github/workflows/variables.yml - with: - version: ${{ inputs.version }} - - properties: - name: Read repository properties - runs-on: ubuntu-latest - outputs: - jira-project: ${{ steps.properties.outputs.jira-project }} - steps: - - name: Read workflow properties file - id: properties - env: - PROPERTIES_URL: /repos/${{ github.repository }}/contents/.github/properties?ref=${{ github.ref_name }} - run: gh api -H "$ACCEPT_RAW" "$PROPERTIES_URL" >> "$GITHUB_OUTPUT" - - verify-release: - name: Verify all artifacts for release ${{ needs.variables.outputs.named-release-patch }} are published - runs-on: ubuntu-latest - needs: [variables, properties] - env: - JIRA_TOKEN: ${{ secrets.JIRA_TOKEN }} - steps: - - name: Login to Quay.io - uses: docker/login-action@v3 - with: - registry: quay.io - username: ${{ secrets.QUAY_RHACS_ENG_RO_USERNAME }} - password: ${{ secrets.QUAY_RHACS_ENG_RO_PASSWORD }} - - - name: Login to registry.redhat.io - uses: docker/login-action@v3 - with: - registry: registry.redhat.io - username: ${{ secrets.RH_REGISTRY_USERNAME_RO }} - password: ${{ secrets.RH_REGISTRY_PASSWORD_RO }} - - - name: Verify all artifacts are published - run: | - set -uo pipefail - gh api -H "$ACCEPT_RAW" "${{ env.script_url }}" | bash -s -- \ - verify-release \ - "${{ needs.variables.outputs.named-release-patch }}" \ - "${{ github.event.inputs.latest-version }}" \ - "${{ needs.variables.outputs.named-release }}" \ - "${{ needs.properties.outputs.jira-project }}" \ - "${{ github.event.inputs.errata }}" From dea33970e54d731d38e7c591b07907b6c2ace412 Mon Sep 17 00:00:00 2001 From: David Caravello <119438707+dcaravel@users.noreply.github.com> Date: Wed, 11 Feb 2026 22:04:23 -0600 Subject: [PATCH 03/11] init --- .../scanner-versioned-definitions-update.yaml | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/.github/workflows/scanner-versioned-definitions-update.yaml b/.github/workflows/scanner-versioned-definitions-update.yaml index 97537571c99e9..1f6bc140d3a67 100644 --- a/.github/workflows/scanner-versioned-definitions-update.yaml +++ b/.github/workflows/scanner-versioned-definitions-update.yaml @@ -28,7 +28,6 @@ on: jobs: parse-versions: - if: github.repository_owner == 'stackrox' && github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-vulns') runs-on: ubuntu-latest outputs: versions: ${{ steps.set-versions.outputs.versions }} @@ -82,22 +81,9 @@ jobs: ./.github/workflows/scripts/scanner-get-released-tags.sh | tee -a "$GITHUB_OUTPUT" echo "$EOF" >> "$GITHUB_OUTPUT" - prepare-environment: - if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'pr-update-scanner-vulns') - runs-on: ubuntu-latest - outputs: - manual_url: ${{ steps.set-manual-url.outputs.manual_url }} - steps: - - name: Checkout repository - uses: actions/checkout@v6 - with: - fetch-depth: 0 - build-and-run: - if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' needs: - parse-versions - - prepare-environment runs-on: ubuntu-latest container: image: quay.io/stackrox-io/apollo-ci:scanner-test-0.5.1 From b9b3749e024d34257787328270ea109f179e6a3b Mon Sep 17 00:00:00 2001 From: David Caravello <119438707+dcaravel@users.noreply.github.com> Date: Wed, 11 Feb 2026 22:12:30 -0600 Subject: [PATCH 04/11] updates --- .../scanner-versioned-definitions-update.yaml | 28 +++++++++++++------ 1 file changed, 20 insertions(+), 8 deletions(-) diff --git a/.github/workflows/scanner-versioned-definitions-update.yaml b/.github/workflows/scanner-versioned-definitions-update.yaml index 1f6bc140d3a67..4b697b331b827 100644 --- a/.github/workflows/scanner-versioned-definitions-update.yaml +++ b/.github/workflows/scanner-versioned-definitions-update.yaml @@ -25,6 +25,11 @@ on: - nvd-feeds required: true default: nvd-feeds + dry_run: + description: "Dry run mode - do not abort or set env vars if reference cannot be determined" + type: boolean + required: false + default: false jobs: parse-versions: @@ -42,6 +47,7 @@ jobs: INPUT_GA_REF: ${{ github.event.inputs.ga_ref || '' }} INPUT_RC_REF: ${{ github.event.inputs.rc_ref || '' }} INPUT_STREAM: ${{ github.event.inputs.stream || '' }} + INPUT_DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }} run: | set -o pipefail @@ -64,16 +70,22 @@ jobs: ref="$INPUT_RC_REF" allow_rc=true fi + if [ -z "$ref" ]; then - echo >&2 "abort: invalid input: could not determine the reference" - exit 1 + if [ "$INPUT_DRY_RUN" = "true" ]; then + echo "dry run: reference could not be determined, skipping env var configuration" + # Skip setting env vars in dry run mode + else + echo >&2 "abort: invalid input: could not determine the reference" + exit 1 + fi + else + # Configure environment to generate the matrix with versions and + # references. + export SCANNER_BUNDLE_STREAM="$INPUT_STREAM" + export SCANNER_BUNDLE_REFERENCE="$ref" + export SCANNER_RELEASE_ALLOW_RC="$allow_rc" fi - - # Configure environment to generate the matrix with versions and - # references. - export SCANNER_BUNDLE_STREAM="$INPUT_STREAM" - export SCANNER_BUNDLE_REFERENCE="$ref" - export SCANNER_RELEASE_ALLOW_RC="$allow_rc" fi EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64) From 848625aa327d90022d6c78b07961d8675fc20737 Mon Sep 17 00:00:00 2001 From: David Caravello <119438707+dcaravel@users.noreply.github.com> Date: Wed, 11 Feb 2026 22:15:20 -0600 Subject: [PATCH 05/11] updates --- .github/workflows/checkout-test.yaml | 38 ++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .github/workflows/checkout-test.yaml diff --git a/.github/workflows/checkout-test.yaml b/.github/workflows/checkout-test.yaml new file mode 100644 index 0000000000000..1bacf2ec9f12d --- /dev/null +++ b/.github/workflows/checkout-test.yaml @@ -0,0 +1,38 @@ +name: check-test + +on: + workflow_dispatch: + inputs: + ref: + description: > + Sets the git reference to build a bundle that will be uploaded to the + release candidate version stream, appending `-rc` to the version + stream vN (eg. v2-rc). + required: false + +jobs: + build-and-run: + runs-on: ubuntu-latest + container: + image: quay.io/stackrox-io/apollo-ci:scanner-test-0.5.1 + volumes: + # The updater makes heavy use of /tmp files. + - /tmp:/tmp + - /usr:/mnt/usr + - /opt:/mnt/opt + env: + ROX_GIT_REF: ${{ github.event.inputs.ref || '' }} + steps: + # Checkout master to get the latest local actions + - name: Checkout repository + uses: actions/checkout@v6 + with: + fetch-depth: 0 + + - name: Checkout specific reference + uses: actions/checkout@v6 + with: + fetch-depth: 0 + ref: ${{ env.ROX_GIT_REF }} + + \ No newline at end of file From 7d26b039b540a53ec81499cc1968cded818b68a0 Mon Sep 17 00:00:00 2001 From: David Caravello <119438707+dcaravel@users.noreply.github.com> Date: Wed, 11 Feb 2026 22:23:23 -0600 Subject: [PATCH 06/11] updates --- .github/workflows/checkout-test.yaml | 5 -- .../scanner-versioned-definitions-update.yaml | 75 ------------------- 2 files changed, 80 deletions(-) diff --git a/.github/workflows/checkout-test.yaml b/.github/workflows/checkout-test.yaml index 1bacf2ec9f12d..7a5270f8dc49c 100644 --- a/.github/workflows/checkout-test.yaml +++ b/.github/workflows/checkout-test.yaml @@ -23,11 +23,6 @@ jobs: env: ROX_GIT_REF: ${{ github.event.inputs.ref || '' }} steps: - # Checkout master to get the latest local actions - - name: Checkout repository - uses: actions/checkout@v6 - with: - fetch-depth: 0 - name: Checkout specific reference uses: actions/checkout@v6 diff --git a/.github/workflows/scanner-versioned-definitions-update.yaml b/.github/workflows/scanner-versioned-definitions-update.yaml index 4b697b331b827..9fa15dbeefddf 100644 --- a/.github/workflows/scanner-versioned-definitions-update.yaml +++ b/.github/workflows/scanner-versioned-definitions-update.yaml @@ -2,34 +2,6 @@ name: Scanner versioned vulnerabilities update on: workflow_dispatch: - inputs: - stream: - description: "Vulnerability bundle version stream to build (typically vN, eg. v2)." - required: false - ga_ref: - description: > - WARNING - THIS WLL UPDATE A GA BUNDLE STREAM: Sets the git reference - to build a bundle that will be uploaded to the GA version stream. - required: false - rc_ref: - description: > - Sets the git reference to build a bundle that will be uploaded to the - release candidate version stream, appending `-rc` to the version - stream vN (eg. v2-rc). - required: false - job: - type: choice - description: "Choose the NVD source" - options: - - nvd-api - - nvd-feeds - required: true - default: nvd-feeds - dry_run: - description: "Dry run mode - do not abort or set env vars if reference cannot be determined" - type: boolean - required: false - default: false jobs: parse-versions: @@ -43,51 +15,9 @@ jobs: fetch-depth: 0 - name: Parse VULNERABILITY_BUNDLE_VERSION id: set-versions - env: - INPUT_GA_REF: ${{ github.event.inputs.ga_ref || '' }} - INPUT_RC_REF: ${{ github.event.inputs.rc_ref || '' }} - INPUT_STREAM: ${{ github.event.inputs.stream || '' }} - INPUT_DRY_RUN: ${{ github.event.inputs.dry_run || 'false' }} run: | set -o pipefail - if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then - # Validate input. - if [ -n "$INPUT_GA_REF" ] && [ -n "$INPUT_RC_REF" ]; then - echo >&2 "abort: invalid input: you cannot provide both 'ga_ref' and 'rc_ref'" - exit 1 - fi - if [ -z "$INPUT_GA_REF" ] && [ -z "$INPUT_RC_REF" ] && [ -n "$INPUT_STREAM" ]; then - echo >&2 "abort: invalid input: when specifying 'stream', you must set 'ga_ref' or 'rc_ref'" - exit 1 - fi - - # Determine the reference. - if [ -n "$INPUT_GA_REF" ]; then - ref="$INPUT_GA_REF" - fi - if [ -n "$INPUT_RC_REF" ]; then - ref="$INPUT_RC_REF" - allow_rc=true - fi - - if [ -z "$ref" ]; then - if [ "$INPUT_DRY_RUN" = "true" ]; then - echo "dry run: reference could not be determined, skipping env var configuration" - # Skip setting env vars in dry run mode - else - echo >&2 "abort: invalid input: could not determine the reference" - exit 1 - fi - else - # Configure environment to generate the matrix with versions and - # references. - export SCANNER_BUNDLE_STREAM="$INPUT_STREAM" - export SCANNER_BUNDLE_REFERENCE="$ref" - export SCANNER_RELEASE_ALLOW_RC="$allow_rc" - fi - fi - EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64) echo "versions<<$EOF" >> "$GITHUB_OUTPUT" ./.github/workflows/scripts/scanner-get-released-tags.sh | tee -a "$GITHUB_OUTPUT" @@ -120,11 +50,6 @@ jobs: with: fetch-depth: 0 - - uses: ./.github/actions/job-preamble - with: - free-disk-space: 50 - gcp-account: ${{ secrets.GCP_SERVICE_ACCOUNT_STACKROX_CI }} - - name: Checkout specific reference uses: actions/checkout@v6 with: From d654d6a7844cf14a91f5022582218177ba777d0a Mon Sep 17 00:00:00 2001 From: David Caravello <119438707+dcaravel@users.noreply.github.com> Date: Wed, 11 Feb 2026 22:25:38 -0600 Subject: [PATCH 07/11] try commit --- scanner/updater/version/VULNERABILITY_BUNDLE_VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION b/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION index 885ecd967a23b..6039352b691cd 100644 --- a/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION +++ b/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION @@ -6,4 +6,4 @@ # This process ensures that each version's vulnerability data is accurately captured and maintained in accordance with its respective version. dev heads/master v1 4.5.2 -v2 tags/4.9.4-rc.0-6-g2bcc59d86d +v2 heads/2bcc59d86d479a560c8675e75b166aaa0cf3babc From 8d07ed6f221cf7f556895be20f4ddd795473e879 Mon Sep 17 00:00:00 2001 From: David Caravello <119438707+dcaravel@users.noreply.github.com> Date: Wed, 11 Feb 2026 22:26:12 -0600 Subject: [PATCH 08/11] remove full checkout --- .github/workflows/scanner-versioned-definitions-update.yaml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/scanner-versioned-definitions-update.yaml b/.github/workflows/scanner-versioned-definitions-update.yaml index 9fa15dbeefddf..57fc3a024943f 100644 --- a/.github/workflows/scanner-versioned-definitions-update.yaml +++ b/.github/workflows/scanner-versioned-definitions-update.yaml @@ -44,11 +44,6 @@ jobs: ROX_GIT_REF: ${{ matrix.ref }} STACKROX_RHEL_VEX_COMPRESSED_FILE_TIMEOUT: "10m" steps: - # Checkout master to get the latest local actions - - name: Checkout repository - uses: actions/checkout@v6 - with: - fetch-depth: 0 - name: Checkout specific reference uses: actions/checkout@v6 From 763b75e1441de571ae603db327dbe09ca52765e7 Mon Sep 17 00:00:00 2001 From: David Caravello <119438707+dcaravel@users.noreply.github.com> Date: Wed, 11 Feb 2026 22:27:10 -0600 Subject: [PATCH 09/11] back --- scanner/updater/version/VULNERABILITY_BUNDLE_VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION b/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION index 6039352b691cd..885ecd967a23b 100644 --- a/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION +++ b/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION @@ -6,4 +6,4 @@ # This process ensures that each version's vulnerability data is accurately captured and maintained in accordance with its respective version. dev heads/master v1 4.5.2 -v2 heads/2bcc59d86d479a560c8675e75b166aaa0cf3babc +v2 tags/4.9.4-rc.0-6-g2bcc59d86d From 79a26227c28221533ea1f24f173e52573861d599 Mon Sep 17 00:00:00 2001 From: David Caravello <119438707+dcaravel@users.noreply.github.com> Date: Wed, 11 Feb 2026 22:29:11 -0600 Subject: [PATCH 10/11] remove container --- .../workflows/scanner-versioned-definitions-update.yaml | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.github/workflows/scanner-versioned-definitions-update.yaml b/.github/workflows/scanner-versioned-definitions-update.yaml index 57fc3a024943f..0b58084835f9c 100644 --- a/.github/workflows/scanner-versioned-definitions-update.yaml +++ b/.github/workflows/scanner-versioned-definitions-update.yaml @@ -27,13 +27,6 @@ jobs: needs: - parse-versions runs-on: ubuntu-latest - container: - image: quay.io/stackrox-io/apollo-ci:scanner-test-0.5.1 - volumes: - # The updater makes heavy use of /tmp files. - - /tmp:/tmp - - /usr:/mnt/usr - - /opt:/mnt/opt strategy: fail-fast: false max-parallel: 1 From f06a1b70b63d6f99e99ed6531de0297e0fdbe583 Mon Sep 17 00:00:00 2001 From: David Caravello <119438707+dcaravel@users.noreply.github.com> Date: Wed, 11 Feb 2026 22:34:50 -0600 Subject: [PATCH 11/11] updates --- scanner/updater/version/VULNERABILITY_BUNDLE_VERSION | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION b/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION index 885ecd967a23b..6039352b691cd 100644 --- a/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION +++ b/scanner/updater/version/VULNERABILITY_BUNDLE_VERSION @@ -6,4 +6,4 @@ # This process ensures that each version's vulnerability data is accurately captured and maintained in accordance with its respective version. dev heads/master v1 4.5.2 -v2 tags/4.9.4-rc.0-6-g2bcc59d86d +v2 heads/2bcc59d86d479a560c8675e75b166aaa0cf3babc