diff --git a/.github/workflows/00-pr-scanner.yaml b/.github/workflows/00-pr-scanner.yaml index 0241f87b36..08894c1a55 100644 --- a/.github/workflows/00-pr-scanner.yaml +++ b/.github/workflows/00-pr-scanner.yaml @@ -2,10 +2,6 @@ name: 00-pr_scanner on: pull_request: types: [opened, reopened, synchronize, ready_for_review] - branches: - - 'master' - - 'main' - - 'dev' paths-ignore: - '**.yaml' - '**.md' @@ -29,3 +25,18 @@ jobs: RELEASE: "" CLIENT: test secrets: inherit + + binary-build: + if: ${{ contains( github.event.pull_request.labels.*.name, 'trigger-integration-test') }} ## run only if labeled as "trigger-integration-test" + uses: ./.github/workflows/b-binary-build-and-e2e-tests.yaml + needs: pr-scanner + with: + COMPONENT_NAME: kubescape + CGO_ENABLED: 1 + GO111MODULE: "" + GO_VERSION: "1.20" + RELEASE: "" + CLIENT: test + ARCH: "" + OS: "ubuntu-20.04" + secrets: inherit \ No newline at end of file diff --git a/.github/workflows/01-pr-merged.yaml b/.github/workflows/01-pr-merged.yaml deleted file mode 100644 index d0b2c1f3f7..0000000000 --- a/.github/workflows/01-pr-merged.yaml +++ /dev/null @@ -1,34 +0,0 @@ -name: 01-pr-merged - -on: - pull_request_target: - types: [closed] - branches: - - 'master' - - 'main' - paths-ignore: - - '**.yaml' - - '**.md' - - '**.sh' - - 'website/*' - - 'examples/*' - - 'docs/*' - - 'build/*' - - '.github/*' - -concurrency: - group: ${{ github.workflow }}-${{ github.ref }} - cancel-in-progress: true - -jobs: - binary-build: - if: ${{ github.event.pull_request.merged == true && contains( github.event.pull_request.labels.*.name, 'trigger-integration-test') && github.event.pull_request.base.ref == 'master' }} ## run only if labeled as "trigger-integration-test" and base branch is master - uses: ./.github/workflows/b-binary-build-and-e2e-tests.yaml - with: - COMPONENT_NAME: kubescape - CGO_ENABLED: 1 - GO111MODULE: "" - GO_VERSION: "1.20" - RELEASE: "" - CLIENT: test - secrets: inherit \ No newline at end of file diff --git a/.github/workflows/a-pr-scanner.yaml b/.github/workflows/a-pr-scanner.yaml index cdb21020d9..b1cd9e3bd1 100644 --- a/.github/workflows/a-pr-scanner.yaml +++ b/.github/workflows/a-pr-scanner.yaml @@ -87,15 +87,3 @@ jobs: - Credentials scan: ${{ steps.credentials-scan.outcome }} - Vulnerabilities scan: ${{ steps.vulnerabilities-scan.outcome }} reactions: 'eyes' - basic-tests: - needs: scanners - uses: ./.github/workflows/b-binary-build-and-e2e-tests.yaml - with: - COMPONENT_NAME: kubescape - CGO_ENABLED: 1 - GO111MODULE: "" - GO_VERSION: "1.20" - RELEASE: ${{ inputs.RELEASE }} - CLIENT: ${{ inputs.CLIENT }} - CHECKOUT_REPO: ${{ github.repository }} - secrets: inherit diff --git a/.github/workflows/b-binary-build-and-e2e-tests.yaml b/.github/workflows/b-binary-build-and-e2e-tests.yaml index 64aaf07665..cccc9220b5 100644 --- a/.github/workflows/b-binary-build-and-e2e-tests.yaml +++ b/.github/workflows/b-binary-build-and-e2e-tests.yaml @@ -1,5 +1,45 @@ name: b-binary-build-and-e2e-tests + on: + workflow_dispatch: + inputs: + COMPONENT_NAME: + required: false + type: string + default: "kubescape" + RELEASE: + required: false + type: string + default: "" + CLIENT: + required: false + type: string + default: "test" + GO_VERSION: + required: false + type: string + default: "1.20" + GO111MODULE: + required: false + type: string + default: "" + CGO_ENABLED: + type: number + default: 1 + required: false + OS_METRIX: + type: string + required: false + default: '[ "ubuntu-20.04", "macos-latest", "windows-latest"]' + ARCH_METRIX: + type: string + required: false + default: '[ "", "arm64"]' + BINARY_TESTS: + type: string + required: false + default: '[ "scan_nsa", "scan_mitre", "scan_with_exceptions", "scan_repository", "scan_local_file", "scan_local_glob_files", "scan_local_list_of_files", "scan_nsa_and_submit_to_backend", "scan_mitre_and_submit_to_backend", "scan_local_repository_and_submit_to_backend", "scan_repository_from_url_and_submit_to_backend", "scan_with_exception_to_backend", "scan_with_custom_framework", "scan_customer_configuration", "host_scanner", "scan_compliance_score" ]' + workflow_call: inputs: COMPONENT_NAME: @@ -23,18 +63,22 @@ on: BINARY_TESTS: type: string default: '[ "scan_nsa", "scan_mitre", "scan_with_exceptions", "scan_repository", "scan_local_file", "scan_local_glob_files", "scan_local_list_of_files", "scan_nsa_and_submit_to_backend", "scan_mitre_and_submit_to_backend", "scan_local_repository_and_submit_to_backend", "scan_repository_from_url_and_submit_to_backend", "scan_with_exception_to_backend", "scan_with_custom_framework", "scan_customer_configuration", "host_scanner", "scan_compliance_score" ]' - CHECKOUT_REPO: + OS_METRIX: + type: string required: false + default: '[ "ubuntu-20.04", "macos-latest", "windows-latest"]' + ARCH_METRIX: type: string - - - + required: false + default: '[ "", "arm64"]' jobs: wf-preparation: name: secret-validator runs-on: ubuntu-latest outputs: TEST_NAMES: ${{ steps.export_tests_to_env.outputs.TEST_NAMES }} + OS_METRIX: ${{ steps.export_os_to_env.outputs.OS_METRIX }} + ARCH_METRIX: ${{ steps.export_arch_to_env.outputs.ARCH_METRIX }} is-secret-set: ${{ steps.check-secret-set.outputs.is-secret-set }} steps: - name: check if the necessary secrets are set in github secrets @@ -49,24 +93,39 @@ jobs: REGISTRY_PASSWORD: ${{ secrets.REGISTRY_PASSWORD }} run: "echo \"is-secret-set=${{ env.CUSTOMER != '' && \n env.USERNAME != '' &&\n env.PASSWORD != '' &&\n env.CLIENT_ID != '' &&\n env.SECRET_KEY != '' &&\n env.REGISTRY_USERNAME != '' &&\n env.REGISTRY_PASSWORD != ''\n }}\" >> $GITHUB_OUTPUT\n" + - id: export_os_to_env + name: set test name + run: | + echo "OS_METRIX=$input" >> $GITHUB_OUTPUT + env: + input: ${{ inputs.OS_METRIX }} + - id: export_tests_to_env name: set test name run: | echo "TEST_NAMES=$input" >> $GITHUB_OUTPUT env: input: ${{ inputs.BINARY_TESTS }} - + + - id: export_arch_to_env + name: set test name + run: | + echo "ARCH_METRIX=$input" >> $GITHUB_OUTPUT + env: + input: ${{ inputs.ARCH_METRIX }} + binary-build: name: Create cross-platform build + needs: wf-preparation env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} GOARCH: ${{ matrix.arch }} runs-on: ${{ matrix.os }} strategy: matrix: - os: [ubuntu-20.04, macos-latest, windows-latest] - arch: ["", arm64] + os: ${{ fromJson(needs.wf-preparation.outputs.OS_METRIX) }} + arch: ${{ fromJson(needs.wf-preparation.outputs.ARCH_METRIX) }} exclude: - os: windows-latest arch: arm64 @@ -74,7 +133,6 @@ jobs: - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # ratchet:actions/checkout@v3 with: - repository: ${{inputs.CHECKOUT_REPO}} fetch-depth: 0 submodules: recursive diff --git a/.github/workflows/pr-agent.yaml b/.github/workflows/pr-agent.yaml new file mode 100644 index 0000000000..a99df756d3 --- /dev/null +++ b/.github/workflows/pr-agent.yaml @@ -0,0 +1,14 @@ +on: + pull_request: + issue_comment: +jobs: + pr_agent_job: + runs-on: ubuntu-latest + name: Run pr agent on every pull request, respond to user comments + steps: + - name: PR Agent action step + id: pragent + uses: Codium-ai/pr-agent@main + env: + OPENAI_KEY: ${{ secrets.OPENAI_KEY }} + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/build.py b/build.py index 6879001ef8..de43aa50e6 100644 --- a/build.py +++ b/build.py @@ -47,7 +47,7 @@ def main(): client_var = "github.com/kubescape/kubescape/v2/core/cautils.Client" client_name = os.getenv("CLIENT") - # Create build directory + # Create the build directory build_dir = get_build_dir() ks_file = os.path.join(build_dir, package_name)