mirror of
https://github.com/kubescape/kubescape.git
synced 2026-04-15 06:58:11 +00:00
272 lines
10 KiB
YAML
272 lines
10 KiB
YAML
name: b-binary-build-and-e2e-tests
|
|
permissions: read-all
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
COMPONENT_NAME:
|
|
required: false
|
|
type: string
|
|
default: "kubescape"
|
|
RELEASE:
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
CLIENT:
|
|
required: false
|
|
type: string
|
|
default: "test"
|
|
GO_VERSION:
|
|
required: false
|
|
type: string
|
|
default: "1.21"
|
|
GO111MODULE:
|
|
required: false
|
|
type: string
|
|
default: ""
|
|
CGO_ENABLED:
|
|
type: number
|
|
default: 1
|
|
required: false
|
|
BINARY_TESTS:
|
|
type: string
|
|
required: false
|
|
default: '[ "scan_nsa", "scan_mitre", "scan_with_exceptions", "scan_repository", "scan_local_file", "scan_local_glob_files", "scan_local_list_of_files", "scan_nsa_and_submit_to_backend", "scan_mitre_and_submit_to_backend", "scan_local_repository_and_submit_to_backend", "scan_repository_from_url_and_submit_to_backend", "scan_with_exception_to_backend", "scan_with_custom_framework", "scan_customer_configuration", "host_scanner", "scan_compliance_score", "control_cluster_from_CLI_config_scan_exclude_namespaces", "control_cluster_from_CLI_config_scan_include_namespaces", "control_cluster_from_CLI_config_scan_host_scanner_enabled", "control_cluster_from_CLI_config_scan_MITRE_framework", "control_cluster_from_CLI_vulnerabilities_scan_default", "control_cluster_from_CLI_vulnerabilities_scan_include_namespaces" ]'
|
|
|
|
workflow_call:
|
|
inputs:
|
|
COMPONENT_NAME:
|
|
required: true
|
|
type: string
|
|
RELEASE:
|
|
required: true
|
|
type: string
|
|
CLIENT:
|
|
required: true
|
|
type: string
|
|
GO_VERSION:
|
|
type: string
|
|
default: "1.21"
|
|
GO111MODULE:
|
|
required: true
|
|
type: string
|
|
CGO_ENABLED:
|
|
type: number
|
|
default: 1
|
|
BINARY_TESTS:
|
|
type: string
|
|
default: '[ "scan_nsa", "scan_mitre", "scan_with_exceptions", "scan_repository", "scan_local_file", "scan_local_glob_files", "scan_local_list_of_files", "scan_nsa_and_submit_to_backend", "scan_mitre_and_submit_to_backend", "scan_local_repository_and_submit_to_backend", "scan_repository_from_url_and_submit_to_backend", "scan_with_exception_to_backend", "scan_with_custom_framework", "scan_customer_configuration", "host_scanner", "scan_compliance_score", "scan_custom_framework_scanning_file_scope_testing", "scan_custom_framework_scanning_cluster_scope_testing", "scan_custom_framework_scanning_cluster_and_file_scope_testing" ]'
|
|
|
|
jobs:
|
|
wf-preparation:
|
|
name: secret-validator
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
TEST_NAMES: ${{ steps.export_tests_to_env.outputs.TEST_NAMES }}
|
|
is-secret-set: ${{ steps.check-secret-set.outputs.is-secret-set }}
|
|
|
|
steps:
|
|
- name: check if the necessary secrets are set in github secrets
|
|
id: check-secret-set
|
|
env:
|
|
CUSTOMER: ${{ secrets.CUSTOMER }}
|
|
USERNAME: ${{ secrets.USERNAME }}
|
|
PASSWORD: ${{ secrets.PASSWORD }}
|
|
CLIENT_ID: ${{ secrets.CLIENT_ID_PROD }}
|
|
SECRET_KEY: ${{ secrets.SECRET_KEY_PROD }}
|
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
run: "echo \"is-secret-set=${{ env.CUSTOMER != '' && \n env.USERNAME != '' &&\n env.PASSWORD != '' &&\n env.CLIENT_ID != '' &&\n env.SECRET_KEY != '' &&\n env.REGISTRY_USERNAME != '' &&\n env.REGISTRY_PASSWORD != ''\n }}\" >> $GITHUB_OUTPUT\n"
|
|
|
|
- id: export_tests_to_env
|
|
name: set test name
|
|
run: |
|
|
echo "TEST_NAMES=$input" >> $GITHUB_OUTPUT
|
|
env:
|
|
input: ${{ inputs.BINARY_TESTS }}
|
|
|
|
check-secret:
|
|
name: check if QUAYIO_REGISTRY_USERNAME & QUAYIO_REGISTRY_PASSWORD is set in github secrets
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
is-secret-set: ${{ steps.check-secret-set.outputs.is-secret-set }}
|
|
steps:
|
|
- name: check if QUAYIO_REGISTRY_USERNAME & QUAYIO_REGISTRY_PASSWORD is set in github secrets
|
|
id: check-secret-set
|
|
env:
|
|
QUAYIO_REGISTRY_USERNAME: ${{ secrets.QUAYIO_REGISTRY_USERNAME }}
|
|
QUAYIO_REGISTRY_PASSWORD: ${{ secrets.QUAYIO_REGISTRY_PASSWORD }}
|
|
run: |
|
|
echo "is-secret-set=${{ env.QUAYIO_REGISTRY_USERNAME != '' && env.QUAYIO_REGISTRY_PASSWORD != '' }}" >> $GITHUB_OUTPUT
|
|
|
|
binary-build:
|
|
name: Create cross-platform build
|
|
needs: wf-preparation
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
|
|
- uses: actions/checkout@v3
|
|
with:
|
|
fetch-depth: 0
|
|
submodules: recursive
|
|
|
|
- uses: actions/setup-go@v4
|
|
name: Installing go
|
|
with:
|
|
go-version: ${{ inputs.GO_VERSION }}
|
|
cache: true
|
|
|
|
- name: Test core pkg
|
|
run: ${{ env.DOCKER_CMD }} go test -v ./...
|
|
if: startsWith(github.ref, 'refs/tags')
|
|
|
|
- name: Test httphandler pkg
|
|
run: ${{ env.DOCKER_CMD }} sh -c 'cd httphandler && go test -v ./...'
|
|
if: startsWith(github.ref, 'refs/tags')
|
|
|
|
- uses: anchore/sbom-action/download-syft@v0.15.2
|
|
name: Setup Syft
|
|
|
|
- uses: goreleaser/goreleaser-action@v5
|
|
name: Build
|
|
with:
|
|
distribution: goreleaser
|
|
version: latest
|
|
args: release --clean --snapshot
|
|
env:
|
|
RELEASE: ${{ inputs.RELEASE }}
|
|
CLIENT: ${{ inputs.CLIENT }}
|
|
CGO_ENABLED: ${{ inputs.CGO_ENABLED }}
|
|
|
|
- name: Smoke Testing
|
|
env:
|
|
RELEASE: ${{ inputs.RELEASE }}
|
|
KUBESCAPE_SKIP_UPDATE_CHECK: "true"
|
|
run: ${{ env.DOCKER_CMD }} python3 smoke_testing/init.py ${PWD}/dist/kubescape-ubuntu-latest
|
|
|
|
- name: golangci-lint
|
|
continue-on-error: true
|
|
uses: golangci/golangci-lint-action@08e2f20817b15149a52b5b3ebe7de50aff2ba8c5 # ratchet:golangci/golangci-lint-action@v3
|
|
with:
|
|
version: latest
|
|
args: --timeout 10m --build-tags=static
|
|
only-new-issues: true
|
|
|
|
- uses: actions/upload-artifact@83fd05a356d7e2593de66fc9913b3002723633cb # ratchet:actions/upload-artifact@v3.1.1
|
|
name: Upload artifacts
|
|
with:
|
|
name: kubescape
|
|
path: dist/kubescape*
|
|
if-no-files-found: error
|
|
|
|
build-http-image:
|
|
permissions:
|
|
contents: read
|
|
id-token: write
|
|
packages: write
|
|
pull-requests: read
|
|
needs: [check-secret]
|
|
uses: kubescape/workflows/.github/workflows/incluster-comp-pr-merged.yaml@main
|
|
with:
|
|
IMAGE_NAME: quay.io/${{ github.repository_owner }}/kubescape
|
|
IMAGE_TAG: ${{ inputs.RELEASE }}
|
|
COMPONENT_NAME: kubescape
|
|
CGO_ENABLED: 0
|
|
GO111MODULE: "on"
|
|
BUILD_PLATFORM: linux/amd64,linux/arm64
|
|
GO_VERSION: "1.21"
|
|
REQUIRED_TESTS: '[
|
|
"ks_microservice_create_2_cronjob_mitre_and_nsa_proxy",
|
|
"ks_microservice_triggering_with_cron_job",
|
|
"ks_microservice_update_cronjob_schedule",
|
|
"ks_microservice_delete_cronjob",
|
|
"ks_microservice_create_2_cronjob_mitre_and_nsa",
|
|
"ks_microservice_ns_creation",
|
|
"ks_microservice_on_demand",
|
|
"ks_microservice_mitre_framework_on_demand",
|
|
"ks_microservice_nsa_and_mitre_framework_demand",
|
|
"scan_compliance_score"
|
|
]'
|
|
COSIGN: true
|
|
HELM_E2E_TEST: true
|
|
FORCE: true
|
|
secrets: inherit
|
|
|
|
run-tests:
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
TEST: ${{ fromJson(needs.wf-preparation.outputs.TEST_NAMES) }}
|
|
needs: [wf-preparation, binary-build]
|
|
if: ${{ (needs.wf-preparation.outputs.is-secret-set == 'true') && (always() && (contains(needs.*.result, 'success') || contains(needs.*.result, 'skipped')) && !(contains(needs.*.result, 'failure')) && !(contains(needs.*.result, 'cancelled'))) }}
|
|
runs-on: ubuntu-latest # This cannot change
|
|
steps:
|
|
- uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # ratchet:actions/download-artifact@v3.0.2
|
|
id: download-artifact
|
|
with:
|
|
name: kubescape
|
|
path: "~"
|
|
|
|
- run: ls -laR
|
|
|
|
- name: chmod +x
|
|
run: chmod +x -R ${{steps.download-artifact.outputs.download-path}}/kubescape-ubuntu-latest
|
|
|
|
- name: Checkout systests repo
|
|
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # ratchet:actions/checkout@v3
|
|
with:
|
|
repository: armosec/system-tests
|
|
path: .
|
|
|
|
- uses: actions/setup-python@d27e3f3d7c64b4bbf8e4abfb9b63b83e846e0435 # ratchet:actions/setup-python@v4
|
|
with:
|
|
python-version: '3.8.13'
|
|
cache: 'pip'
|
|
|
|
- name: create env
|
|
run: ./create_env.sh
|
|
|
|
- name: Generate uuid
|
|
id: uuid
|
|
run: |
|
|
echo "RANDOM_UUID=$(uuidgen)" >> $GITHUB_OUTPUT
|
|
|
|
- name: Create k8s Kind Cluster
|
|
id: kind-cluster-install
|
|
uses: helm/kind-action@d08cf6ff1575077dee99962540d77ce91c62387d # ratchet:helm/kind-action@v1.3.0
|
|
with:
|
|
cluster_name: ${{ steps.uuid.outputs.RANDOM_UUID }}
|
|
|
|
- name: run-tests-on-local-built-kubescape
|
|
env:
|
|
CUSTOMER: ${{ secrets.CUSTOMER }}
|
|
USERNAME: ${{ secrets.USERNAME }}
|
|
PASSWORD: ${{ secrets.PASSWORD }}
|
|
CLIENT_ID: ${{ secrets.CLIENT_ID_PROD }}
|
|
SECRET_KEY: ${{ secrets.SECRET_KEY_PROD }}
|
|
REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
|
|
REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }}
|
|
run: |
|
|
echo "Test history:"
|
|
echo " ${{ matrix.TEST }} " >/tmp/testhistory
|
|
cat /tmp/testhistory
|
|
source systests_python_env/bin/activate
|
|
|
|
python3 systest-cli.py \
|
|
-t ${{ matrix.TEST }} \
|
|
-b production \
|
|
-c CyberArmorTests \
|
|
--duration 3 \
|
|
--logger DEBUG \
|
|
--kwargs kubescape=${{steps.download-artifact.outputs.download-path}}/kubescape-ubuntu-latest
|
|
|
|
deactivate
|
|
|
|
- name: Test Report
|
|
uses: mikepenz/action-junit-report@6e9933f4a97f4d2b99acef4d7b97924466037882 # ratchet:mikepenz/action-junit-report@v3.6.1
|
|
if: always() # always run even if the previous step fails
|
|
with:
|
|
report_paths: '**/results_xml_format/**.xml'
|
|
commit: ${{github.event.workflow_run.head_sha}}
|