Skip to content

Commit

Permalink
[Backport] Add global.podSecurityStandards.enforced value for PSS mig…
Browse files Browse the repository at this point in the history
…ration.
  • Loading branch information
whites11 committed May 6, 2024
1 parent 94b2b1b commit bd5cc02
Show file tree
Hide file tree
Showing 9 changed files with 128 additions and 70 deletions.
53 changes: 18 additions & 35 deletions .circleci/config.yml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
version: 2.1
orbs:
architect: giantswarm/architect@4.31.0
architect: giantswarm/architect@5.0.1

workflows:
build:
Expand All @@ -13,42 +13,12 @@ workflows:
tags:
only: /^v.*/

- architect/push-to-docker:
context: "architect"
name: push-app-operator-to-docker
image: "docker.io/giantswarm/app-operator"
username_envar: "DOCKER_USERNAME"
password_envar: "DOCKER_PASSWORD"
requires:
- go-build
# Needed to trigger job also on git tag.
filters:
tags:
only: /^v.*/

- architect/push-to-docker:
context: architect
name: push-app-operator-to-quay
image: "quay.io/giantswarm/app-operator"
username_envar: "QUAY_USERNAME"
password_envar: "QUAY_PASSWORD"
requires:
- go-build
filters:
# Trigger the job also on git tag.
tags:
only: /^v.*/

- architect/push-to-docker:
- architect/push-to-registries:
context: architect
name: push-app-operator-to-aliyun
image: "giantswarm-registry.cn-shanghai.cr.aliyuncs.com/giantswarm/app-operator"
username_envar: "ALIYUN_USERNAME"
password_envar: "ALIYUN_PASSWORD"
name: push-to-registries
requires:
- go-build
filters:
# Trigger the job also on git tag.
tags:
only: /^v.*/

Expand All @@ -59,7 +29,7 @@ workflows:
app_catalog_test: "control-plane-test-catalog"
chart: "app-operator"
requires:
- push-app-operator-to-quay
- push-to-registries
filters:
tags:
only: /^v.*/
Expand Down Expand Up @@ -107,8 +77,8 @@ workflows:
app_name: "app-operator"
app_collection_repo: "aws-app-collection"
requires:
- push-app-operator-to-aliyun
- push-app-operator-to-control-plane-app-catalog
- push-to-registries
filters:
branches:
ignore: /.*/
Expand Down Expand Up @@ -168,6 +138,19 @@ workflows:
tags:
only: /^v.*/

- architect/push-to-app-collection:
context: architect
name: push-to-capz-app-collection
app_name: "app-operator"
app_collection_repo: "capz-app-collection"
requires:
- push-app-operator-to-control-plane-app-catalog
filters:
branches:
ignore: /.*/
tags:
only: /^v.*/

- architect/push-to-app-collection:
context: architect
name: push-to-gcp-app-collection
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/pre_commit_go.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ name: pre-commit
on:
pull_request:
push:
branches: [master]
branches: [main]

jobs:
pre-commit:
Expand All @@ -13,13 +13,13 @@ jobs:
- uses: actions/setup-python@v4
- uses: actions/setup-go@v3
with:
go-version: "1.18.4"
go-version: "1.21"
- name: Install goimports
run: |
go install golang.org/x/tools/cmd/goimports@latest
- name: Install golangci-lint
env:
GOLANGCI_LINT_VERSION: "v1.47.2"
GOLANGCI_LINT_VERSION: "v1.54.2"
run: |
curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | \
sudo sh -s -- -b $GOPATH/bin ${GOLANGCI_LINT_VERSION}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/zz_generated.add-team-labels.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ jobs:
-O artifacts/users.yaml \
https://raw.githubusercontent.com/giantswarm/github/main/tools/issue-automation/user-mapping.yaml
- name: Upload Artifact
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: users
path: artifacts/users.yaml
Expand All @@ -27,7 +27,7 @@ jobs:
runs-on: ubuntu-latest
needs: build_user_list
steps:
- uses: actions/download-artifact@v3
- uses: actions/download-artifact@v4
id: download-users
with:
name: users
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/zz_generated.add-to-project-board.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ jobs:
-O artifacts/users.yaml \
https://raw.githubusercontent.com/giantswarm/github/main/tools/issue-automation/user-mapping.yaml
- name: Upload Artifact
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: users
path: artifacts/users.yaml
Expand All @@ -30,7 +30,7 @@ jobs:
-O artifacts/labels.yaml \
https://raw.githubusercontent.com/giantswarm/github/main/tools/issue-automation/label-mapping.yaml
- name: Upload Artifact
uses: actions/upload-artifact@v3
uses: actions/upload-artifact@v4
with:
name: labels
path: artifacts/labels.yaml
Expand All @@ -42,7 +42,7 @@ jobs:
needs: build_user_list
if: github.event.action == 'assigned'
steps:
- uses: actions/download-artifact@v3
- uses: actions/download-artifact@v4
id: download-users
with:
name: users
Expand All @@ -68,7 +68,7 @@ jobs:
needs: build_user_list
if: github.event.action == 'labeled'
steps:
- uses: actions/download-artifact@v3
- uses: actions/download-artifact@v4
id: download-labels
with:
name: labels
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/zz_generated.check_values_schema.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# DO NOT EDIT. Generated with:
#
# devctl@6.9.0
# devctl@6.18.2
#
name: 'Values and schema'
on:
Expand All @@ -21,7 +21,7 @@ jobs:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v3
uses: actions/checkout@v4
with:
fetch-depth: 0

Expand Down
33 changes: 15 additions & 18 deletions .github/workflows/zz_generated.create_release.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# DO NOT EDIT. Generated with:
#
# devctl@6.9.0
# devctl@6.18.2
#
name: Create Release
on:
Expand Down Expand Up @@ -32,11 +32,10 @@ jobs:
steps:
- name: Get version
id: get_version
env:
COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
run: |
title="$(cat <<- 'COMMIT_MESSAGE_END' | head -n 1 -
${{ github.event.head_commit.message }}
COMMIT_MESSAGE_END
)"
title=$(echo -n "${COMMIT_MESSAGE}" | head -1)
# Matches strings like:
#
# - "Release v1.2.3"
Expand All @@ -53,7 +52,7 @@ jobs:
echo "version=${version}" >> $GITHUB_OUTPUT
- name: Checkout code
if: ${{ steps.get_version.outputs.version != '' }}
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Get project.go path
id: get_project_go_path
if: ${{ steps.get_version.outputs.version != '' }}
Expand All @@ -66,11 +65,10 @@ jobs:
echo "path=${path}" >> $GITHUB_OUTPUT
- name: Check if reference version
id: ref_version
env:
COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
run: |
title="$(cat <<- 'COMMIT_MESSAGE_END' | head -n 1 -
${{ github.event.head_commit.message }}
COMMIT_MESSAGE_END
)"
title=$(echo -n "${COMMIT_MESSAGE}" | head -1)
if echo "${title}" | grep -qE '^release v[0-9]+\.[0-9]+\.[0-9]+([.-][^ .-][^ ]*)?( \(#[0-9]+\))?$' ; then
version=$(echo "${title}" | cut -d ' ' -f 2)
fi
Expand All @@ -93,7 +91,7 @@ jobs:
uses: giantswarm/[email protected]
with:
binary: "architect"
version: "6.11.0"
version: "6.14.1"
- name: Install semver
uses: giantswarm/[email protected]
with:
Expand All @@ -103,7 +101,7 @@ jobs:
tarball_binary_path: "*/src/${binary}"
smoke_test: "${binary} --version"
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@v4
- name: Update project.go
id: update_project_go
env:
Expand Down Expand Up @@ -143,7 +141,7 @@ jobs:
version: "${{ needs.gather_facts.outputs.version }}"
title: "Bump version to ${{ steps.update_project_go.outputs.new_version }}"
run: |
hub pull-request -f -m "${{ env.title }}" -b ${{ env.base }} -h ${{ env.branch }} -r ${{ github.actor }}
gh pr create --title "${{ env.title }}" --body "" --base ${{ env.base }} --head ${{ env.branch }} --reviewer ${{ github.actor }}
create_release:
name: Create release
runs-on: ubuntu-22.04
Expand All @@ -154,7 +152,7 @@ jobs:
upload_url: ${{ steps.create_gh_release.outputs.upload_url }}
steps:
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@v4
with:
ref: ${{ github.sha }}
- name: Ensure correct version in project.go
Expand Down Expand Up @@ -184,13 +182,12 @@ jobs:
git push "${REMOTE_REPO}" --tags
- name: Create release
id: create_gh_release
uses: actions/create-release@v1
uses: ncipollo/release-action@v1
env:
GITHUB_TOKEN: "${{ secrets.TAYLORBOT_GITHUB_ACTION }}"
with:
body: ${{ steps.changelog_reader.outputs.changes }}
tag_name: "v${{ needs.gather_facts.outputs.version }}"
release_name: "v${{ needs.gather_facts.outputs.version }}"
tag: "v${{ needs.gather_facts.outputs.version }}"

create-release-branch:
name: Create release branch
Expand All @@ -208,7 +205,7 @@ jobs:
tarball_binary_path: "*/src/${binary}"
smoke_test: "${binary} --version"
- name: Check out the repository
uses: actions/checkout@v3
uses: actions/checkout@v4
with:
fetch-depth: 0 # Clone the whole history, not just the most recent commit.
- name: Fetch all tags and branches
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/zz_generated.create_release_pr.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# DO NOT EDIT. Generated with:
#
# devctl@6.9.0
# devctl@6.18.2
#
name: Create Release PR
on:
Expand Down Expand Up @@ -152,7 +152,7 @@ jobs:
binary: "architect"
version: "6.11.0"
- name: Checkout code
uses: actions/checkout@v3
uses: actions/checkout@v4
with:
ref: ${{ needs.gather_facts.outputs.branch }}
- name: Prepare release changes
Expand Down Expand Up @@ -227,4 +227,4 @@ jobs:
base: "${{ needs.gather_facts.outputs.base }}"
version: "${{ needs.gather_facts.outputs.version }}"
run: |
hub pull-request -f -m "Release v${{ env.version }}" -a ${{ github.actor }} -b ${{ env.base }} -h ${{ needs.gather_facts.outputs.branch }}
gh pr create --assignee ${{ github.actor }} --title "Release v${{ env.version }}" --body "" --base ${{ env.base }} --head "${{ needs.gather_facts.outputs.branch }}"
6 changes: 3 additions & 3 deletions .github/workflows/zz_generated.gitleaks.yaml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# DO NOT EDIT. Generated with:
#
# devctl@6.9.0
# devctl@6.18.2
#
name: gitleaks

Expand All @@ -10,8 +10,8 @@ jobs:
gitleaks:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v4
with:
fetch-depth: '0'
- name: gitleaks-action
uses: zricethezav/gitleaks-action@v1.6.0
uses: giantswarm/gitleaks-action@main
Loading

0 comments on commit bd5cc02

Please sign in to comment.