mirror of
https://github.com/kubereboot/kured.git
synced 2026-05-20 15:23:23 +00:00
ee13c5c40a
Since September 2025, dependabot does not update some actions anymore. Putting in a comment the _version tag_ (next to the sha) make it clear that the intent is not to pin and should allow further bumping by dependabot. This was not necessary in the past and seem required now. Signed-off-by: Jean-Philippe Evrard <open-source@a.spamming.party>
117 lines
4.1 KiB
YAML
117 lines
4.1 KiB
YAML
name: Daily jobs
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "30 1 * * 6"
|
|
|
|
jobs:
|
|
periodics-gotest:
|
|
name: Run go tests
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
|
|
with:
|
|
egress-policy: audit
|
|
|
|
|
|
- name: checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1
|
|
with:
|
|
version: 2025.10.5
|
|
|
|
- name: run tests
|
|
run: make test
|
|
|
|
- name: Annotate tests
|
|
if: always()
|
|
uses: guyarb/golang-test-annoations@2941118d7ef622b1b3771d1ff6eae9e90659eb26 # v0.8.0
|
|
with:
|
|
test-results: test.json
|
|
|
|
periodics-mark-stale:
|
|
name: Mark stale issues and PRs
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
# Stale, by default, waits for 60 days before marking PR/issues as stale and closes them after 21 days.
|
|
# Do not expire the first issues that would allow the community to grow.
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
|
|
with:
|
|
repo-token: ${{ secrets.GITHUB_TOKEN }}
|
|
stale-issue-message: 'This issue was automatically considered stale due to lack of activity. Please update it and/or join our slack channels to promote it, before it automatically closes (in 7 days).'
|
|
stale-pr-message: 'This PR was automatically considered stale due to lack of activity. Please refresh it and/or join our slack channels to highlight it, before it automatically closes (in 7 days).'
|
|
stale-issue-label: 'no-issue-activity'
|
|
stale-pr-label: 'no-pr-activity'
|
|
exempt-issue-labels: 'good first issue,keep'
|
|
exempt-pr-labels: 'keep'
|
|
days-before-close: 21
|
|
|
|
check-docs-links:
|
|
name: Check docs for incorrect links
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Link Checker
|
|
uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2.7.0
|
|
env:
|
|
GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
|
|
with:
|
|
args: --verbose --no-progress '*.md' '*.yaml' '*/*/*.go' --exclude-link-local
|
|
fail: true
|
|
|
|
vuln-scan:
|
|
name: Build image and scan it against known vulnerabilities
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@95d9a5deda9de15063e7595e9719c11c38c90ae2 # v2.13.2
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
|
|
- name: Ensure go version
|
|
uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
|
|
with:
|
|
go-version-file: 'go.mod'
|
|
check-latest: true
|
|
|
|
- uses: jdx/mise-action@6d1e696aa24c1aa1bcc1adea0212707c71ab78a8 # v3.6.1
|
|
with:
|
|
version: 2025.10.5
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
|
|
|
|
- name: Find current tag version
|
|
run: echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
|
|
id: tags
|
|
|
|
- name: Build artifacts
|
|
run: VERSION="${{ steps.tags.outputs.sha_short }}" DH_ORG="${{ github.repository_owner }}" make image
|
|
- name: Run Trivy vulnerability scanner
|
|
uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
|
|
with:
|
|
image-ref: 'ghcr.io/${{ github.repository }}:${{ steps.tags.outputs.sha_short }}'
|
|
format: 'table'
|
|
exit-code: '1'
|
|
ignore-unfixed: true
|
|
vuln-type: 'os,library'
|
|
severity: 'CRITICAL,HIGH'
|