Update module github.com/google/cel-go to v0.30.0 [SECURITY] (#1114) #409
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Run e2e upgrade test | |
| on: | |
| push: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| actions: read | |
| concurrency: | |
| group: e2e-upgrade-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| changes: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| # Expose matched filters as job 'src' output variable | |
| paths: ${{ steps.filter.outputs.changes }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| api.github.com:443 | |
| github.com:443 | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| id: filter | |
| with: | |
| filters: .github/filters.yml | |
| e2e-upgrade-test: | |
| needs: changes | |
| name: e2e-upgrade-test | |
| if: ${{contains(fromJSON(needs.changes.outputs.paths), 'src')}} | |
| runs-on: ubuntu-latest | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.github_token }} | |
| LINODE_TOKEN: ${{ secrets.LINODE_TOKEN }} | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1 | |
| with: | |
| disable-sudo: true | |
| egress-policy: block | |
| allowed-endpoints: > | |
| *:6443 | |
| api.linode.com:443 | |
| api.github.com:443 | |
| github.com:443 | |
| gcr.io:443 | |
| ghcr.io:443 | |
| golang.org:443 | |
| proxy.golang.org:443 | |
| sum.golang.org:443 | |
| *.githubusercontent.com:443 | |
| docker.io:443 | |
| registry-1.docker.io:443 | |
| auth.docker.io:443 | |
| production.cloudflare.docker.com:443 | |
| production.cloudfront.docker.com:443 | |
| storage.googleapis.com:443 | |
| registry.k8s.io:443 | |
| *.pkg.dev:443 | |
| *.amazonaws.com:443 | |
| *.blob.core.windows.net:443 | |
| quay.io:443 | |
| *.quay.io:443 | |
| api.snapcraft.io:443 | |
| cloud.tilt.dev:443 | |
| kubernetes-sigs.github.io:443 | |
| charts.jetstack.io:443 | |
| helm.cilium.io:443 | |
| linode.github.io:443 | |
| *.linodeobjects.com:443 | |
| dl.k8s.io:443 | |
| cdn.dl.k8s.io:443 | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set up Mise | |
| uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0 | |
| with: | |
| install_args: go | |
| - name: Create IPv4-only kind network | |
| run: | | |
| # Pre-create the shared kind network as IPv4-only because | |
| # harden-runner block mode trips over Docker/kind's local IPv6 | |
| # address advertisement during cluster setup. | |
| docker network inspect kind >/dev/null 2>&1 || \ | |
| docker network create -d=bridge \ | |
| -o com.docker.network.bridge.enable_ip_masquerade=true \ | |
| -o com.docker.network.driver.mtu=1500 \ | |
| kind | |
| - name: Run Upgrade Test | |
| env: | |
| LINODE_REGION: us-sea | |
| LINODE_CONTROL_PLANE_MACHINE_TYPE: g6-standard-2 | |
| LINODE_MACHINE_TYPE: g6-standard-2 | |
| CLUSTERCTL_CONFIG: /home/runner/work/cluster-api-provider-linode/cluster-api-provider-linode/e2e/gha-clusterctl-config.yaml | |
| E2E_FLAGS: --assert-timeout 20m0s | |
| run: mise run test-upgrade | |
| - name: cleanup stale clusters | |
| if: ${{ always() }} | |
| run: mise run clean-child-clusters | |
| - name: cleanup kind mgmt cluster | |
| if: ${{ always() }} | |
| run: mise run clean-kind-cluster |