Merge to master - PR number: 1070

.github/actions/tag-action/action.yaml

@@ -0,0 +1,37 @@
+name: 'Tag validator and retag'
+description: 'This action will check if the tag is rc and create a new tag for release'
+inputs:
+  ORIGINAL_TAG:  # id of input
+    description: 'Original tag'
+    required: true
+    default: ${{ github.ref_name }}
+  SUB_STRING: 
+    description: 'Sub string for rc tag'
+    required: true
+    default: "-rc"
+outputs:
+  NEW_TAG:
+    description: "The new tag for release"
+    value: ${{ steps.retag.outputs.NEW_TAG }}
+runs:
+  using: "composite"
+  steps:
+    - run: |
+        SUB='-rc'
+        if [[ "${{ inputs.ORIGINAL_TAG }}" == *"${{ inputs.SUB_STRING }}"* ]]; then
+            echo "Release candidate tag found."
+        else
+            echo "Release candidate tag not found."
+            exit 1
+        fi
+      shell: bash
+
+
+    - id: retag
+      run: | 
+          NEW_TAG=
+          echo "Original tag: ${{ inputs.ORIGINAL_TAG }}"
+          NEW_TAG=$(echo ${{ inputs.ORIGINAL_TAG }} | awk -F '-rc' '{print $1}')
+          echo "New tag: $NEW_TAG"
+          echo "NEW_TAG=$NEW_TAG" >> $GITHUB_OUTPUT
+      shell: bash

.github/workflows/00-pr-scanner.yaml

@@ -0,0 +1,33 @@
+name: 00-pr_scanner
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, ready_for_review]
+    branches: 
+      - 'master'
+      - 'main'
+      - 'dev'
+    paths-ignore:
+      - '**.yaml'
+      - '**.md'
+      - '**.sh'
+      - 'website/*'
+      - 'examples/*'
+      - 'docs/*'
+      - 'build/*'
+      - '.github/*'
+
+concurrency:
+  group: ${{ github.head_ref }}
+  cancel-in-progress: true
+
+  
+jobs:
+  pr-scanner:
+    permissions: 
+      pull-requests: write
+    uses: ./.github/workflows/a-pr-scanner.yaml
+    with:
+      RELEASE: ${{ github.ref_name}}
+      CLIENT: test
+    secrets: inherit

.github/workflows/01-code-review-approved.yaml

@@ -0,0 +1,57 @@
+name: 01-code_review_approved
+on:
+  pull_request_review:
+    types: [submitted]
+    branches:
+      - 'master'
+      - 'main'
+    paths-ignore:
+      - '**.yaml'
+      - '**.md'
+      - '**.sh'
+      - 'website/*'
+      - 'examples/*'
+      - 'docs/*'
+      - 'build/*'
+      - '.github/*'
+
+
+concurrency:
+  group: code-review-approved
+  cancel-in-progress: true
+
+jobs:
+
+  binary-build:
+    if: ${{ github.event.review.state == 'approved' && 
+            contains( github.event.pull_request.labels.*.name, 'trigger-integration-test') && 
+            github.event.pull_request.base.ref == 'master' }} ## run only if labeled as "trigger-integration-test" and base branch is master
+    uses: ./.github/workflows/b-binary-build-and-e2e-tests.yaml
+    with:
+      COMPONENT_NAME: kubescape
+      CGO_ENABLED: 1
+      GO111MODULE: ""
+      GO_VERSION: "1.19"
+      RELEASE: ${{ github.ref_name}}
+      CLIENT: test
+    secrets: inherit
+
+
+  merge-to-master:
+    needs: binary-build
+    env:
+      GH_PERSONAL_ACCESS_TOKEN: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
+    if: ${{ (github.event.review.state == 'approved' && github.event.pull_request.base.ref == 'master') && 
+            (always() && (contains(needs.*.result, 'success') || contains(needs.*.result, 'skipped')) && !(contains(needs.*.result, 'failure')) && !(contains(needs.*.result, 'cancelled'))) }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: merge-to-master
+        if: ${{ env.GH_PERSONAL_ACCESS_TOKEN }}
+        uses: pascalgn/automerge-action@v0.15.5
+        env:
+          GITHUB_TOKEN: "${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}"
+          MERGE_COMMIT_MESSAGE: "Merge to master - PR number: {pullRequest.number}"
+          MERGE_ERROR_FAIL: "true"
+          MERGE_METHOD: "merge"
+          MERGE_LABELS: ""
+          UPDATE_LABELS: ""

.github/workflows/01-create-release.yaml

@@ -1,41 +0,0 @@
-name: 01-create-release
-
-on:
-  workflow_call:
-    inputs:
-      release_name:
-        description: 'release'
-        required: true
-        type: string
-      tag:
-        description: 'tag'
-        required: true
-        type: string
-      draft:
-        description: 'create draft release'
-        required: false
-        type: boolean
-        default: false
-    outputs:
-      upload_url:
-        description: "The first output string"
-        value: ${{ jobs.release.outputs.upload_url }}
-
-jobs:
-  release:
-    name: Create release
-    runs-on: ubuntu-latest
-    outputs:
-      upload_url: ${{ steps.create_release.outputs.upload_url }}
-    steps:
-      - name: Create a release
-        id: create_release
-        uses: actions/create-release@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          release_name: ${{ inputs.release_name }}
-          tag_name: ${{ inputs.tag }}
-          draft: ${{ inputs.draft }}
-          prerelease: false
-   

.github/workflows/02-publish-artifacts.yaml

@@ -1,80 +0,0 @@
-name: publish-artifacts
-
-on:
-  workflow_call:
-    inputs:
-      upload_url:
-        description: 'upload url'
-        required: true
-        type: string
-      release:
-        description: 'release tag'
-        required: true
-        type: string
-
-jobs:
-  publish-artifacts:
-    name: Build and publish artifacts
-    runs-on: ${{ matrix.os }}
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    strategy:
-      matrix:
-        os: [ubuntu-20.04, macos-latest, windows-latest]
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          submodules: recursive
-
-      - name: Set up Go
-        uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
-
-      - name: Install MSYS2 & libgit2 (Windows)
-        shell: cmd
-        run: .\build.bat all
-        if: matrix.os == 'windows-latest'
-
-      - name: Install libgit2 (Linux/macOS)
-        run: make libgit2
-        if: matrix.os != 'windows-latest'
-
-      - name: Build
-        env:
-          RELEASE: ${{ inputs.release }}
-          CLIENT: release
-          CGO_ENABLED: 1
-        run: python3 --version && python3 build.py
-
-      - name: Upload release assets (Windows / MacOS)
-        id: upload-release-asset-win-macos
-        uses: shogo82148/actions-upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ inputs.upload_url }}
-          asset_path: build/${{ matrix.os }}/*
-        if: matrix.os != 'ubuntu-20.04'
-
-      - name: Upload release assets (Linux)
-        id: upload-release-asset-linux
-        uses: shogo82148/actions-upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          upload_url: ${{ inputs.upload_url }}
-          asset_path: build/ubuntu-latest/*
-        if: matrix.os == 'ubuntu-20.04'
-
-  publish-krew-plugin:
-    name: Publish Krew plugin
-    runs-on: ubuntu-latest
-    if: "${{ github.repository_owner }} == kubescape"
-    needs: publish-artifacts
-    steps:
-      - uses: actions/checkout@v3
-        with:
-          submodules: recursive
-      - name: Update new version in krew-index
-        uses: rajatjindal/krew-release-bot@v0.0.43

.github/workflows/02-release.yaml

@@ -0,0 +1,69 @@
+name: 02-create_release
+
+on:
+  push:
+    tags:
+    - 'v*.*.*-rc.*'
+
+jobs:
+  retag:
+    outputs:
+      NEW_TAG: ${{ steps.tag-calculator.outputs.NEW_TAG }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - id: tag-calculator
+        uses: ./.github/actions/tag-action
+        with:
+          SUB_STRING: "-rc"
+
+  binary-build:
+    needs: [retag]
+    uses: ./.github/workflows/b-binary-build-and-e2e-tests.yaml
+    with:
+      COMPONENT_NAME: kubescape
+      CGO_ENABLED: 1
+      GO111MODULE: ""
+      GO_VERSION: "1.19"
+      RELEASE: ${{ github.ref_name}}
+      CLIENT: release
+    secrets: inherit
+
+  create-release:
+    permissions:
+      contents: write    
+    needs: [retag, binary-build]
+    uses: ./.github/workflows/c-create-release.yaml
+    with:
+      RELEASE_NAME: "Release ${{ needs.retag.outputs.NEW_TAG }}"
+      TAG: ${{ needs.retag.outputs.NEW_TAG }}
+      DRAFT: false
+    secrets: inherit    
+
+  publish-krew-plugin:
+    name: Publish Krew plugin
+    runs-on: ubuntu-latest
+    if: "${{ github.repository_owner }} == kubescape"
+    needs: create-release
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          submodules: recursive
+      - name: Update new version in krew-index
+        uses: rajatjindal/krew-release-bot@v0.0.43
+
+  publish-image:
+    permissions:
+      id-token: write
+      packages: write
+      contents: read    
+    uses: ./.github/workflows/d-publish-image.yaml
+    needs: [ create-release, retag ]
+    with:
+      client: "image-release"
+      image_name: "quay.io/${{ github.repository_owner }}/kubescape"
+      image_tag: ${{ needs.retag.outputs.NEW_TAG }}
+      support_platforms: true
+      cosign: true
+    secrets: inherit

.github/workflows/03-post-release.yaml

@@ -1,14 +1,14 @@
-name: create release digests
+name: 03-create_release_digests
 
 on:
   release:
-    types: [ published]
+    types: [ published ]
     branches:
     - 'master'
     - 'main'
   
 jobs:
-  once:
+  create_release_digests:
     name: Creating digests
     runs-on: ubuntu-latest
     steps:

.github/workflows/a-pr-check.yaml

@@ -1,24 +0,0 @@
-name: pr-checks
-
-on:
-  pull_request:
-    types: [ edited, opened, synchronize, reopened ]
-    branches: 
-      - 'master'
-      - 'main'
-      - 'dev'
-    paths-ignore:
-      - '**.yaml'
-      - '**.md'
-      - '**.sh'
-      - 'website/*'
-      - 'examples/*'
-      - 'docs/*'
-      - 'build/*'
-      - '.github/*'
-jobs:
-  test:
-    uses: ./.github/workflows/00-test.yaml
-    with:
-      release: ${{ github.ref_name}}
-      client: test

.github/workflows/a-pr-scanner.yaml

@@ -1,22 +1,90 @@
-name: 00-test
+name: a-pr-scanner
 
 on:
   workflow_call:
     inputs:
-      release:
+      RELEASE:
         description: 'release'
         required: true
         type: string
-      client:
+      CLIENT:
         description: 'Client name'
         required: true
         type: string
+
+
 jobs:
+  scanners:
+    env:
+       GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
+       SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+    name: PR Scanner
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - uses: actions/setup-go@v3 # Install go because go-licenses use it
+        name: Installing go
+        with:
+          go-version: '1.19'
+          cache: true
+
+      - name: Scanning - Forbidden Licenses (go-licenses)
+        id: licenses-scan
+        continue-on-error: true
+        run: |
+          echo "## Installing go-licenses tool"
+          go install github.com/google/go-licenses@latest
+          echo "## Scanning for forbiden licenses ##"
+          go-licenses check .
+
+      - name: Scanning - Credentials (GitGuardian)
+        if: ${{ env.GITGUARDIAN_API_KEY }}
+        continue-on-error: true      
+        id: credentials-scan
+        uses: GitGuardian/ggshield-action@master
+        with:
+          args: -v --all-policies        
+        env:
+          GITHUB_PUSH_BEFORE_SHA: ${{ github.event.before }}
+          GITHUB_PUSH_BASE_SHA: ${{ github.event.base }}
+          GITHUB_PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          GITGUARDIAN_API_KEY: ${{ secrets.GITGUARDIAN_API_KEY }}
+
+      - name: Scanning - Vulnerabilities (Snyk)
+        if: ${{ env.SNYK_TOKEN }}
+        id: vulnerabilities-scan
+        continue-on-error: true
+        uses: snyk/actions/golang@master
+        with:
+          command: test --all-projects
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+
+      - name: Comment results to PR
+        continue-on-error: true # Warninig: This might break opening PRs from forks
+        uses: peter-evans/create-or-update-comment@v2.1.0
+        with:
+          issue-number:  ${{ github.event.pull_request.number }}
+          body: |
+            Scan results:
+            - License scan: ${{ steps.licenses-scan.outcome }}
+            - Credentials scan: ${{ steps.credentials-scan.outcome }}
+            - Vulnerabilities scan: ${{ steps.vulnerabilities-scan.outcome }}
+          reactions: 'eyes'
+
   basic-tests:
+    needs: scanners
     name: Create cross-platform build
     runs-on: ${{ matrix.os }}
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      RELEASE: ${{ inputs.RELEASE }}
+      CLIENT: ${{ inputs.CLIENT }}
     strategy:
       matrix:
         os: [ubuntu-20.04, macos-latest, windows-latest]
@@ -26,7 +94,7 @@ jobs:
           submodules: recursive
 
       - name: Cache Go modules (Linux)
-        if: matrix.os == 'ubuntu-20.04'
+        if: matrix.os == 'ubuntu-latest'
         uses: actions/cache@v3
         with:
           path: |
@@ -80,21 +148,21 @@ jobs:
 
       - name: Build
         env:
-          RELEASE: ${{ inputs.release }}
-          CLIENT: test
+          RELEASE: ${{ inputs.RELEASE }}
+          CLIENT: ${{ inputs.CLIENT }}
           CGO_ENABLED: 1
         run: python3 --version && python3 build.py
 
       - name: Smoke Testing (Windows / MacOS)
         env:
-          RELEASE: ${{ inputs.release }} 
+          RELEASE: ${{ inputs.RELEASE }} 
           KUBESCAPE_SKIP_UPDATE_CHECK: "true"
         run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape-${{ matrix.os }}
         if: matrix.os != 'ubuntu-20.04'
 
       - name: Smoke Testing (Linux)
         env:
-          RELEASE: ${{ inputs.release }} 
+          RELEASE: ${{ inputs.RELEASE }} 
           KUBESCAPE_SKIP_UPDATE_CHECK: "true"
         run: python3 smoke_testing/init.py ${PWD}/build/ubuntu-latest/kubescape-ubuntu-latest
         if: matrix.os == 'ubuntu-20.04'      
@@ -104,26 +172,6 @@ jobs:
         continue-on-error: true
         uses: golangci/golangci-lint-action@v3
         with:
-          # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
           version: latest
-
-          # Optional: working directory, useful for monorepos
-          # working-directory: somedir
-
-          # Optional: golangci-lint command line arguments.
-          # args: --issues-exit-code=0
           args: --timeout 10m --build-tags=static
-          #--new-from-rev dev
-
-          # Optional: show only new issues if it's a pull request. The default value is `false`.
-          only-new-issues: true
-
-          # Optional: if set to true then the all caching functionality will be complete disabled,
-          #           takes precedence over all other caching options.
-          # skip-cache: true
-
-          # Optional: if set to true then the action don't cache or restore ~/go/pkg.
-          # skip-pkg-cache: true
-
-          # Optional: if set to true then the action don't cache or restore ~/.cache/go-build.
-          # skip-build-cache: true
+          only-new-issues: true

.github/workflows/b-binary-build-and-e2e-tests.yaml

@@ -0,0 +1,276 @@
+name: b-binary-build-and-e2e-tests
+on:
+  workflow_call:
+    inputs:
+      COMPONENT_NAME:
+        required: true
+        type: string
+      RELEASE:
+        required: true
+        type: string
+      CLIENT:
+        required: true
+        type: string
+      GO_VERSION:
+        type: string
+        default: "1.19"
+      GO111MODULE:
+        required: true
+        type: string
+      CGO_ENABLED:
+        type: number
+        default: 1
+      BINARY_TESTS:
+        type: string
+        default: '[
+                    "scan_nsa",                                                                                            
+                    "scan_mitre",                                                                                          
+                    "scan_with_exceptions",                                                                                
+                    "scan_repository",                                                                                     
+                    "scan_local_file",                                                                                     
+                    "scan_local_glob_files",                                                                               
+                    "scan_local_list_of_files",                                                                            
+                    "scan_nsa_and_submit_to_backend",                                                                      
+                    "scan_mitre_and_submit_to_backend",                                                                    
+                    "scan_local_repository_and_submit_to_backend",                                                         
+                    "scan_repository_from_url_and_submit_to_backend",                                                      
+                    "scan_with_exception_to_backend",                                                                      
+                    "scan_with_custom_framework",                                                                                                                                                                
+                    "scan_customer_configuration",                                                                         
+                    "host_scanner"
+                  ]'
+
+jobs:
+
+  check-secret:
+    name: secret-validator
+    runs-on: ubuntu-latest
+    outputs:
+      is-secret-set: ${{ steps.check-secret-set.outputs.is-secret-set }}
+    steps:
+      - name: check if the necessary secrets are set in github secrets
+        id: check-secret-set
+        env:
+            CUSTOMER: ${{ secrets.CUSTOMER }}
+            USERNAME: ${{ secrets.USERNAME }}
+            PASSWORD: ${{ secrets.PASSWORD }}
+            CLIENT_ID: ${{ secrets.CLIENT_ID_PROD }}
+            SECRET_KEY: ${{ secrets.SECRET_KEY_PROD }}
+            REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+            REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+        run: |
+            echo "is-secret-set=${{ env.CUSTOMER != '' && 
+                                    env.USERNAME != '' &&
+                                    env.PASSWORD != '' &&
+                                    env.CLIENT_ID != '' &&
+                                    env.SECRET_KEY != '' &&
+                                    env.REGISTRY_USERNAME != '' &&
+                                    env.REGISTRY_PASSWORD != ''
+                                  }}" >> $GITHUB_OUTPUT
+
+
+  binary-build:
+    needs: [check-secret]
+    if: needs.check-secret.outputs.is-secret-set == 'true'
+    name: Create cross-platform build
+    outputs:
+      TEST_NAMES: ${{ steps.export_tests_to_env.outputs.TEST_NAMES }}    
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-20.04, macos-latest, windows-latest]
+    steps:
+
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Cache Go modules (Linux)
+        if: matrix.os == 'ubuntu-20.04' 
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Cache Go modules (macOS)
+        if: matrix.os == 'macos-latest' 
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/Library/Caches/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Cache Go modules (Windows)
+        if: matrix.os == 'windows-latest'
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~\AppData\Local\go-build
+            ~\go\pkg\mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - uses: actions/setup-go@v3
+        name: Installing go
+        with:
+          go-version: ${{ inputs.GO_VERSION }}
+          cache: true
+
+      - name: Install MSYS2 & libgit2 (Windows)
+        shell: cmd
+        run: .\build.bat all
+        if: matrix.os == 'windows-latest'
+
+      - name: Install libgit2 (Linux/macOS)
+        run: make libgit2
+        if: matrix.os != 'windows-latest'
+ 
+      - name: Test core pkg
+        run: go test "-tags=static,gitenabled" -v ./...
+
+      - name: Test httphandler pkg
+        run: cd httphandler && go test "-tags=static,gitenabled" -v ./...
+
+      - name: Build
+        env:
+          RELEASE: ${{ inputs.RELEASE }}
+          CLIENT: ${{ inputs.CLIENT }}
+          CGO_ENABLED: ${{ inputs.CGO_ENABLED }}
+        run: python3 --version && python3 build.py
+
+      - name: Smoke Testing (Windows / MacOS)
+        env:
+          RELEASE: ${{ inputs.RELEASE }} 
+          KUBESCAPE_SKIP_UPDATE_CHECK: "true"
+        run: python3 smoke_testing/init.py ${PWD}/build/${{ matrix.os }}/kubescape-${{ matrix.os }}
+        if: matrix.os != 'ubuntu-20.04'
+
+      - name: Smoke Testing (Linux)
+        env:
+          RELEASE: ${{ inputs.RELEASE }} 
+          KUBESCAPE_SKIP_UPDATE_CHECK: "true"
+        run: python3 smoke_testing/init.py ${PWD}/build/ubuntu-latest/kubescape-ubuntu-latest
+        if: matrix.os == 'ubuntu-20.04'      
+
+      - name: golangci-lint
+        if: matrix.os == 'ubuntu-20.04'      
+        continue-on-error: true
+        uses: golangci/golangci-lint-action@v3
+        with:
+          version: latest
+          args: --timeout 10m --build-tags=static
+          only-new-issues: true
+
+      - id: export_tests_to_env
+        name: set test name
+        run: |
+          echo "TEST_NAMES=$input" >> $GITHUB_OUTPUT
+        env:
+          input: ${{ inputs.BINARY_TESTS }}
+
+      - uses: actions/upload-artifact@v3.1.1
+        name: Upload artifact (Linux)
+        if: matrix.os == 'ubuntu-20.04'
+        with:
+          name: kubescape-ubuntu-latest
+          path: build/ubuntu-latest/
+          if-no-files-found: error
+
+      - uses: actions/upload-artifact@v3.1.1
+        name: Upload artifact (MacOS, Win)
+        if: matrix.os != 'ubuntu-20.04'
+        with:
+          name: kubescape-${{ matrix.os }}
+          path: build/${{ matrix.os }}/
+          if-no-files-found: error
+
+  run-tests:
+    strategy:
+      fail-fast: false    
+      matrix:
+        TEST: ${{ fromJson(needs.binary-build.outputs.TEST_NAMES) }}
+    needs: binary-build
+    runs-on: ubuntu-20.04 # This cannot change
+    steps:
+
+      - uses: actions/download-artifact@v3.0.2
+        id: download-artifact
+        with:
+          name: kubescape-ubuntu-latest
+          path: "~"
+
+      - run: ls -laR
+
+      - name: chmod +x
+        run: chmod +x ${{steps.download-artifact.outputs.download-path}}/kubescape-ubuntu-latest
+
+      - name: Checkout systests repo
+        uses: actions/checkout@v3
+        with:
+          repository: armosec/system-tests
+          path: .
+          
+      - uses: actions/setup-python@v4
+        with:
+          python-version: '3.8.13'
+          cache: 'pip'
+
+      - name: create env
+        run: ./create_env.sh
+
+      - name: Generate uuid
+        id: uuid
+        run: | 
+          echo "RANDOM_UUID=$(uuidgen)" >> $GITHUB_OUTPUT
+
+      - name: Create k8s Kind Cluster
+        id: kind-cluster-install
+        uses: helm/kind-action@v1.3.0
+        with:
+          cluster_name: ${{ steps.uuid.outputs.RANDOM_UUID }}
+
+      - name: run-tests
+        env:
+          CUSTOMER: ${{ secrets.CUSTOMER }}
+          USERNAME: ${{ secrets.USERNAME }}
+          PASSWORD: ${{ secrets.PASSWORD }}
+          CLIENT_ID: ${{ secrets.CLIENT_ID_PROD }}
+          SECRET_KEY: ${{ secrets.SECRET_KEY_PROD }}
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
+
+        run: |
+          echo "Test history:"
+          echo " ${{ matrix.TEST }} " >/tmp/testhistory
+          cat /tmp/testhistory
+          source systests_python_env/bin/activate
+
+          python3 systest-cli.py             \
+            -t ${{ matrix.TEST }}            \
+            -b production                    \
+            -c CyberArmorTests               \
+            --duration 3                     \
+            --logger DEBUG                   \
+            --kwargs kubescape=${{steps.download-artifact.outputs.download-path}}/kubescape-ubuntu-latest
+          
+          deactivate
+          
+      - name: Test Report
+        uses: mikepenz/action-junit-report@v3.6.1
+        if: always() # always run even if the previous step fails
+        with:
+          report_paths: '**/results_xml_format/**.xml'
+          commit: ${{github.event.workflow_run.head_sha}}
+
+          

.github/workflows/c-create-release.yaml

@@ -0,0 +1,64 @@
+name: c-create_release
+on:
+  workflow_call:
+    inputs:
+      RELEASE_NAME:
+        description: 'Release name'
+        required: true
+        type: string
+      TAG:
+        description: 'Tag name'
+        required: true
+        type: string
+      DRAFT:
+        description: 'Create draft release'
+        required: false
+        type: boolean
+        default: false
+
+jobs:
+
+  create-release:
+    name: create-release
+    runs-on: ubuntu-latest
+    # permissions:
+    #   contents: write    
+    steps:
+      - uses: actions/download-artifact@v3.0.2
+        id: download-artifact
+        with:
+          path: .
+
+      - run: ls -laR
+
+      - name: artifacts rename
+        run: |
+
+          MAC_OS=macos-latest
+          UBUNTU_OS=ubuntu-latest
+          WINDOWS_OS=windows-latest
+
+          mv ./kubescape-$MAC_OS/kubescape-$MAC_OS ./kubescape-$MAC_OS/kubescape-$MAC_OS-${{ inputs.TAG }}
+          mv ./kubescape-$MAC_OS/kubescape-$MAC_OS.sha256 ./kubescape-$MAC_OS/kubescape-$MAC_OS-${{ inputs.TAG }}.sha256
+
+          mv ./kubescape-$UBUNTU_OS/kubescape-$UBUNTU_OS ./kubescape-$UBUNTU_OS/kubescape-$UBUNTU_OS-${{ inputs.TAG }}
+          mv ./kubescape-$UBUNTU_OS/kubescape-$UBUNTU_OS.sha256 ./kubescape-$UBUNTU_OS/kubescape-$UBUNTU_OS-${{ inputs.TAG }}.sha256
+
+          mv ./kubescape-$WINDOWS_OS/kubescape-$WINDOWS_OS ./kubescape-$WINDOWS_OS/kubescape-$WINDOWS_OS-${{ inputs.TAG }}
+          mv ./kubescape-$WINDOWS_OS/kubescape-$WINDOWS_OS.sha256 ./kubescape-$WINDOWS_OS/kubescape-$WINDOWS_OS-${{ inputs.TAG }}.sha256
+
+      - name: Release
+        uses: softprops/action-gh-release@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          name: ${{ inputs.RELEASE_NAME }}
+          tag_name: ${{ inputs.TAG }}
+          body: ${{ github.event.pull_request.body }}
+          draft: ${{ inputs.DRAFT }}
+          fail_on_unmatched_files: true
+          prerelease: false
+          files: |
+            ./kubescape-ubuntu-latest/*
+            ./kubescape-macos-latest/*
+            ./kubescape-windows-latest/*
+            

.github/workflows/c-release.yaml

@@ -1,47 +0,0 @@
-name: release
-
-on:
-  push:
-    tags:
-    # - 'v*.*.*-rc.*' # Comment out since the re-tagging process is not yet implemented
-    - 'v*.*.*'
-jobs:
-  test:
-    uses: ./.github/workflows/00-test.yaml
-    with:
-      release: ${{ github.ref_name}}
-      client: test
-  
-  # integration-test:
-  #   if: ${{ label == e2e-tests }}
-
-  # re-tag:
-  #   # if tests passed, create new tag without `rc`
-    
-  create-release:
-    uses: ./.github/workflows/01-create-release.yaml
-    needs: test
-    with:
-      release_name: "Release ${{ github.ref_name}}"
-      tag: ${{ github.ref_name}}
-    secrets: inherit
-
-  publish-artifacts:
-    uses: ./.github/workflows/02-publish-artifacts.yaml
-    needs: create-release
-    with:
-      upload_url: ${{ needs.create-release.outputs.upload_url }}
-      release: "${{ github.ref_name}}"
-    secrets: inherit
-       
-
-  publish-image:
-    uses: ./.github/workflows/03-publish-image.yaml
-    needs: create-release
-    with:
-      client: "image-release"
-      image_name: "quay.io/${{ github.repository_owner }}/kubescape"
-      image_tag: "${{ github.ref_name}}"
-      support_platforms: true
-      cosign: true
-    secrets: inherit

.github/workflows/d-publish-image.yaml

@@ -1,4 +1,4 @@
-name: 03-publish-image
+name: d-publish-image
 
 on:
   workflow_call:
@@ -33,7 +33,7 @@ jobs:
     outputs:
       is-secret-set: ${{ steps.check-secret-set.outputs.is-secret-set }}
     steps:
-      - name: Check whether unity activation requests should be done
+      - name: check if QUAYIO_REGISTRY_USERNAME & QUAYIO_REGISTRY_PASSWORD is set in github secrets
         id: check-secret-set
         env:
             QUAYIO_REGISTRY_USERNAME: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
@@ -46,10 +46,6 @@ jobs:
     if: needs.check-secret.outputs.is-secret-set == 'true'
     name: Build image and upload to registry
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-      packages: write
-      contents: read
 
     steps:
       - uses: actions/checkout@v3