Skip to content

Commit c954809

Browse files
awownysz-splunkawownysz-splunk
authored
feat: introduce a lightweight workflow which utilizes composite actions (#199)
This PR introduces a lightweight workflow to get faster feedback on PRs. The new approach utilizes composite actions to allow for separate definition of each job. Based on the following MSCS TA Jira story: [https://splunk.atlassian.net/browse/ADDON-66448?atlOrigin=eyJpIjoiYjc1NzdkNzc4MTlkNDM0ODg2M2EzZDY0YzgyNGZmMjMiLCJwIjoiaiJ9](url) Sample run of the reused workflow in the MSCS TA repo: [https://github.com/splunk/splunk-add-on-for-microsoft-cloud-services/actions/workflows/lightweight-check-pr.yml](https://github.com/splunk/splunk-add-on-for-microsoft-cloud-services/actions/workflows/lightweight-check-pr.yml)
1 parent a6824b5 commit c954809

File tree

18 files changed

+1193
-535
lines changed

18 files changed

+1193
-535
lines changed

‎.github/actions/appinspect-api/action.yml

+40
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: AppInspect
2+
3+
description: >
4+
Performs validation checks on your Splunk app package against a set of standardized criteria to evaluate
5+
the app structure, features, security, and adherence to Splunk Cloud Platform requirements.
6+
Uses AppInspect API.
7+
8+
inputs:
9+
matrix_tags:
10+
required: true
11+
SPL_COM_USER:
12+
required: true
13+
SPL_COM_PASSWORD:
14+
required: true
15+
16+
runs:
17+
using: composite
18+
steps:
19+
- name: Checkout repository
20+
uses: actions/checkout@v3
21+
22+
- name: Download artifact
23+
uses: actions/download-artifact@v3
24+
with:
25+
name: package-splunkbase
26+
path: build/package/
27+
28+
- name: AppInspect API
29+
uses: splunk/[email protected]
30+
with:
31+
username: ${{ inputs.SPL_COM_USER }}
32+
password: ${{ inputs.SPL_COM_PASSWORD }}
33+
app_path: build/package/
34+
included_tags: ${{ inputs.matrix_tags }}
35+
36+
- uses: actions/upload-artifact@v3
37+
if: always()
38+
with:
39+
name: appinspect-api-html-report-${{ inputs.matrix_tags }}
40+
path: AppInspect_response.html

‎.github/actions/appinspect-cli/action.yml

+44
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: AppInspect
2+
3+
description: >
4+
Performs validation checks on your Splunk app package against a set of standardized criteria to evaluate
5+
the app structure, features, security, and adherence to Splunk Cloud Platform requirements.
6+
Uses AppInspect CLI.
7+
8+
inputs:
9+
matrix_tags:
10+
required: true
11+
12+
runs:
13+
using: composite
14+
steps:
15+
- name: Checkout repository
16+
uses: actions/checkout@v3
17+
18+
- name: Download artifact
19+
uses: actions/download-artifact@v3
20+
with:
21+
name: package-splunkbase
22+
path: build/package/
23+
24+
- name: Scan
25+
uses: splunk/[email protected]
26+
with:
27+
app_path: build/package/
28+
included_tags: ${{ inputs.matrix_tags }}
29+
result_file: appinspect_result_${{ inputs.matrix_tags }}.json
30+
31+
- name: Upload AppInspect report
32+
if: ${{ !cancelled() }}
33+
uses: actions/upload-artifact@v3
34+
with:
35+
name: appinspect_${{ inputs.matrix_tags }}_checks.json
36+
path: appinspect_result_${{ inputs.matrix_tags }}.json
37+
38+
- name: Upload Markdown
39+
if: inputs.matrix_tags == 'manual'
40+
uses: actions/upload-artifact@v3
41+
with:
42+
name: check_markdown
43+
path: |
44+
*_markdown.txt

‎.github/actions/artifact-registry/action.yml

+94
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
name: Artifact registry
2+
3+
description: Uploads the generated addon build to ghcr.io
4+
5+
inputs:
6+
sc4s:
7+
required: true
8+
9+
outputs:
10+
artifact:
11+
value: ${{ steps.artifactid.outputs.result }}
12+
13+
runs:
14+
using: composite
15+
steps:
16+
- name: Checkout repository
17+
uses: actions/checkout@v3
18+
19+
- name: Download artifact
20+
uses: actions/download-artifact@v3
21+
with:
22+
name: package-splunkbase
23+
path: build/package/splunkbase
24+
25+
- name: Get app ID
26+
id: getappid
27+
shell: bash
28+
run: |
29+
appid=$(jq -r '.info.id.name' package/app.manifest)
30+
echo appid="$appid"
31+
echo "result=$appid" >> "$GITHUB_OUTPUT"
32+
33+
- name: Download ORAS
34+
shell: bash
35+
run: |
36+
curl -LO https://github.com/oras-project/oras/releases/download/v0.12.0/oras_0.12.0_linux_amd64.tar.gz
37+
mkdir -p oras-install/
38+
tar -zxf oras_0.12.0_*.tar.gz -C oras-install/
39+
mv oras-install/oras /usr/local/bin/
40+
rm -rf oras_0.12.0_*.tar.gz oras-install/
41+
42+
- name: Set up Docker Buildx
43+
uses: docker/setup-buildx-action@v2
44+
45+
- name: Login to GitHub Packages Docker Registry
46+
uses: docker/[email protected]
47+
with:
48+
registry: ghcr.io
49+
username: ${{ github.actor }}
50+
password: ${{ github.token }}
51+
52+
- name: Docker meta
53+
id: meta
54+
uses: docker/[email protected]
55+
with:
56+
images: ghcr.io/${{ github.repository }}
57+
tags: |
58+
type=semver,pattern=v{{major}}.{{minor}},prefix=${{ steps.getappid.outputs.result }}-
59+
type=semver,pattern=v{{major}},prefix=${{ steps.getappid.outputs.result }}-
60+
type=semver,pattern=v{{version}},prefix=${{ steps.getappid.outputs.result }}-
61+
type=semver,pattern={{major}}.{{minor}},prefix=${{ steps.getappid.outputs.result }}-
62+
type=semver,pattern={{major}},prefix=${{ steps.getappid.outputs.result }}-
63+
type=semver,pattern={{version}},prefix=${{ steps.getappid.outputs.result }}-
64+
type=ref,event=branch,prefix=${{ steps.getappid.outputs.result }}-
65+
type=ref,event=pr,prefix=${{ steps.getappid.outputs.result }}-
66+
type=sha,prefix=${{ steps.getappid.outputs.result }}-
67+
type=sha,format=long,prefix=${{ steps.getappid.outputs.result }}-
68+
69+
- name: Upload artifacts
70+
shell: bash
71+
run: |
72+
tee /tmp/tags &>/dev/null <<EOF
73+
${{ steps.meta.outputs.tags }}
74+
EOF
75+
pushd build/package/splunkbase/
76+
PACKAGE=$(ls ./*)
77+
echo "$PACKAGE"
78+
mv "$PACKAGE" "${{ steps.getappid.outputs.result }}".spl
79+
while IFS= read -r line
80+
do
81+
echo ">>$line<<"
82+
oras push \
83+
--manifest-config /dev/null:application/vnd.splunk.ent.package.v1.tar+gzip \
84+
"$line" \
85+
"${{ steps.getappid.outputs.result }}".spl
86+
echo " complete"
87+
done < /tmp/tags
88+
popd
89+
90+
- name: Output artifact locator
91+
id: artifactid
92+
shell: bash
93+
run: |
94+
echo "result= ${{ inputs.sc4s }}" >> "$GITHUB_OUTPUT"

‎.github/actions/build/action.yml

+179
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,179 @@
1+
name: Build
2+
3+
description: >
4+
Creates the UCC build for the addon, generates the SPL file using slim
5+
and uploads it to the Github registry
6+
7+
inputs:
8+
python_version:
9+
required: true
10+
SA_GH_USER_NAME:
11+
required: true
12+
SA_GH_USER_EMAIL:
13+
required: true
14+
SA_GPG_PRIVATE_KEY:
15+
required: true
16+
SA_GPG_PASSPHRASE:
17+
required: true
18+
AWS_ACCESS_KEY_ID:
19+
required: true
20+
AWS_DEFAULT_REGION:
21+
required: true
22+
AWS_SECRET_ACCESS_KEY:
23+
required: true
24+
ucc_modinput_functional:
25+
required: true
26+
modinput_functional:
27+
required: true
28+
29+
outputs:
30+
buildname:
31+
value: ${{ steps.buildupload.outputs.name }}
32+
33+
runs:
34+
using: composite
35+
steps:
36+
- name: Checkout repository
37+
uses: actions/checkout@v3
38+
with:
39+
# Very Important: semantic-release won't trigger a tagged
40+
# build if this is not set to false
41+
persist-credentials: false
42+
43+
- name: Setup python
44+
uses: actions/setup-python@v4
45+
with:
46+
python-version: 3.7
47+
48+
- name: Create requirements file for pip
49+
shell: bash
50+
run: |
51+
if [ -f "poetry.lock" ]
52+
then
53+
echo " poetry.lock found "
54+
sudo pip3 install poetry==1.5.1 poetry-plugin-export==1.4.0
55+
poetry lock --check
56+
poetry export --without-hashes -o requirements.txt
57+
if [ "$(grep -cve '^\s*$' requirements.txt)" -ne 0 ]
58+
then
59+
echo "Prod dependencies were found, creating package/lib folder"
60+
mkdir -p package/lib || true
61+
mv requirements.txt package/lib
62+
else
63+
echo "No prod dependencies were found"
64+
rm requirements.txt
65+
fi
66+
poetry export --without-hashes --dev -o requirements_dev.txt
67+
cat requirements_dev.txt
68+
fi
69+
70+
- name: Get pip cache dir
71+
id: pip-cache
72+
shell: bash
73+
run: |
74+
echo "dir=$(pip cache dir)" >> "$GITHUB_OUTPUT"
75+
76+
- name: Run Check there are libraries to scan
77+
id: checklibs
78+
shell: bash
79+
run: if [ -f requirements_dev.txt ]; then echo "ENABLED=true" >> "$GITHUB_OUTPUT"; fi
80+
81+
- name: Run pip cache
82+
if: ${{ steps.checklibs.outputs.ENABLED == 'true' }}
83+
uses: actions/cache@v3
84+
with:
85+
path: ${{ steps.pip-cache.outputs.dir }}
86+
key: ${{ runner.os }}-pip-${{ hashFiles('requirements_dev.txt') }}
87+
restore-keys: |
88+
${{ runner.os }}-pip-
89+
90+
- name: Install deps
91+
if: ${{ steps.checklibs.outputs.ENABLED == 'true' }}
92+
shell: bash
93+
run: pip install -r requirements_dev.txt
94+
95+
- name: Semantic Release Get Next
96+
id: semantic
97+
if: github.event_name != 'pull_request'
98+
uses: splunk/[email protected]
99+
with:
100+
dry_run: true
101+
git_committer_name: ${{ inputs.SA_GH_USER_NAME }}
102+
git_committer_email: ${{ inputs.SA_GH_USER_EMAIL }}
103+
gpg_private_key: ${{ inputs.SA_GPG_PRIVATE_KEY }}
104+
passphrase: ${{ inputs.SA_GPG_PASSPHRASE }}
105+
env:
106+
GITHUB_TOKEN: ${{ github.token }}
107+
108+
- name: Determine the version to build
109+
id: BuildVersion
110+
uses: splunk/addonfactory-get-splunk-package-version-action@v1
111+
with:
112+
SemVer: ${{ steps.semantic.outputs.new_release_version }}
113+
PrNumber: ${{ github.event.number }}
114+
115+
- name: Download THIRDPARTY
116+
if: ${{ inputs.python_version }} == '3.7' && github.event_name != 'pull_request' && github.event_name != 'schedule'
117+
uses: actions/download-artifact@v3
118+
with:
119+
name: THIRDPARTY
120+
121+
- name: Download THIRDPARTY (Optional for PR and schedule)
122+
if: ${{ inputs.python_version }} == '3.7' && github.event_name == 'pull_request' || github.event_name == 'schedule'
123+
continue-on-error: true
124+
uses: actions/download-artifact@v3
125+
with:
126+
name: THIRDPARTY
127+
128+
- name: Update Notices
129+
if: ${{ inputs.python_version }} == '3.7'
130+
shell: bash
131+
run: |
132+
cp -f THIRDPARTY package/THIRDPARTY || echo "THIRDPARTY file not found (allowed for PR and schedule)"
133+
134+
- name: Build Package
135+
id: uccgen
136+
uses: splunk/addonfactory-ucc-generator-action@v2
137+
with:
138+
version: ${{ steps.BuildVersion.outputs.VERSION }}
139+
140+
- name: Slim Package
141+
if: always() && ${{ inputs.python_version }} == '3.7'
142+
id: slim
143+
uses: splunk/addonfactory-packaging-toolkit-action@v1
144+
with:
145+
source: ${{ steps.uccgen.outputs.OUTPUT }}
146+
147+
- name: Artifact OpenAPI
148+
if: ${{ inputs.python_version }} == '3.7' && ${{ !cancelled() && inputs.ucc_modinput_functional == 'true' && inputs.modinput_functional == 'true' }}
149+
uses: actions/upload-artifact@v3
150+
with:
151+
name: artifact-openapi
152+
path: ${{ github.workspace }}/${{ steps.uccgen.outputs.OUTPUT }}/static/openapi.json
153+
154+
- name: Artifact Splunkbase
155+
if: ${{ !cancelled() }} && ${{ inputs.python_version }} == '3.7'
156+
uses: actions/upload-artifact@v3
157+
with:
158+
name: package-splunkbase
159+
path: ${{ steps.slim.outputs.OUTPUT }}
160+
161+
- name: Upload build to S3
162+
if: ${{ inputs.python_version }} == '3.7'
163+
id: buildupload
164+
shell: bash
165+
env:
166+
AWS_ACCESS_KEY_ID: ${{ inputs.AWS_ACCESS_KEY_ID }}
167+
AWS_DEFAULT_REGION: ${{ inputs.AWS_DEFAULT_REGION }}
168+
AWS_SECRET_ACCESS_KEY: ${{ inputs.AWS_SECRET_ACCESS_KEY }}
169+
run: |
170+
echo "name=$(basename "${{ steps.slim.outputs.OUTPUT }}")" >> "$GITHUB_OUTPUT"
171+
basename "${{ steps.slim.outputs.OUTPUT }}"
172+
aws s3 cp "${{ steps.slim.outputs.OUTPUT }}" s3://ta-production-artifacts/ta-apps/
173+
174+
- name: Artifact Splunk parts
175+
if: ${{ !cancelled() }} && ${{ inputs.python_version }} == '3.7'
176+
uses: actions/upload-artifact@v3
177+
with:
178+
name: package-deployment
179+
path: build/package/deployment**

‎.github/actions/compliance-copyrights/action.yml

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
name: Compliance copyrights
2+
3+
description: >
4+
Reuse compliance check. Analyze third-party dependencies, generate a report,
5+
and upload the report as an artifact for further inspection or use.
6+
7+
runs:
8+
using: composite
9+
steps:
10+
- name: Checkout repository
11+
uses: actions/checkout@v3
12+
13+
- name: REUSE Compliance Check
14+
uses: fsfe/[email protected]

0 commit comments

Comments
 (0)