Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
80 changes: 40 additions & 40 deletions .github/dependabot.yaml
Original file line number Diff line number Diff line change
@@ -1,40 +1,40 @@
version: 2

updates:
- package-ecosystem: "gomod"
directory: "/"
labels: ["dependencies"]
schedule:
interval: "monthly"
groups:
go-deps:
patterns:
- "*"
allow:
- dependency-type: "direct"
ignore:
# Cloud SDK are updated manually
- dependency-name: "cloud.google.com/*"
- dependency-name: "github.com/Azure/azure-sdk-for-go/*"
# Kubernetes deps are updated by fluxcd/pkg/runtime
- dependency-name: "k8s.io/*"
- dependency-name: "sigs.k8s.io/*"
- dependency-name: "github.com/go-logr/*"
# OCI deps are updated by fluxcd/pkg/oci
- dependency-name: "github.com/docker/*"
- dependency-name: "github.com/distribution/*"
- dependency-name: "github.com/google/go-containerregistry*"
- dependency-name: "github.com/opencontainers/*"
# Helm deps are updated by fluxcd/pkg/helmtestserver
- dependency-name: "helm.sh/helm/*"
# Flux APIs are updated at release time
- dependency-name: "github.com/fluxcd/source-controller/api"
- package-ecosystem: "github-actions"
directory: "/"
labels: ["area/ci", "dependencies"]
groups:
ci:
patterns:
- "*"
schedule:
interval: "monthly"
#version: 2
#
#updates:
# - package-ecosystem: "gomod"
# directory: "/"
# labels: ["dependencies"]
# schedule:
# interval: "monthly"
# groups:
# go-deps:
# patterns:
# - "*"
# allow:
# - dependency-type: "direct"
# ignore:
# # Cloud SDK are updated manually
# - dependency-name: "cloud.google.com/*"
# - dependency-name: "github.com/Azure/azure-sdk-for-go/*"
# # Kubernetes deps are updated by fluxcd/pkg/runtime
# - dependency-name: "k8s.io/*"
# - dependency-name: "sigs.k8s.io/*"
# - dependency-name: "github.com/go-logr/*"
# # OCI deps are updated by fluxcd/pkg/oci
# - dependency-name: "github.com/docker/*"
# - dependency-name: "github.com/distribution/*"
# - dependency-name: "github.com/google/go-containerregistry*"
# - dependency-name: "github.com/opencontainers/*"
# # Helm deps are updated by fluxcd/pkg/helmtestserver
# - dependency-name: "helm.sh/helm/*"
# # Flux APIs are updated at release time
# - dependency-name: "github.com/fluxcd/source-controller/api"
# - package-ecosystem: "github-actions"
# directory: "/"
# labels: ["area/ci", "dependencies"]
# groups:
# ci:
# patterns:
# - "*"
# schedule:
# interval: "monthly"
24 changes: 12 additions & 12 deletions .github/workflows/backport.yaml
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
name: backport
on:
pull_request_target:
types: [closed, labeled]
jobs:
backport:
permissions:
contents: write # for reading and creating branches.
pull-requests: write # for creating pull requests against release branches.
uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.4.0
secrets:
github-token: ${{ secrets.BOT_GITHUB_TOKEN }}
#name: backport
#on:
# pull_request_target:
# types: [closed, labeled]
#jobs:
# backport:
# permissions:
# contents: write # for reading and creating branches.
# pull-requests: write # for creating pull requests against release branches.
# uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.4.0
# secrets:
# github-token: ${{ secrets.BOT_GITHUB_TOKEN }}
40 changes: 20 additions & 20 deletions .github/workflows/cifuzz.yaml
Original file line number Diff line number Diff line change
@@ -1,20 +1,20 @@
name: fuzz
on:
pull_request:
branches:
- 'main'
- 'release/**'
jobs:
smoketest:
runs-on: ubuntu-latest
permissions:
contents: read # for reading the repository code.
steps:
- name: Test suite setup
uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.4.0
with:
go-version: 1.25.x
- name: Smoke test Fuzzers
run: make fuzz-smoketest
env:
SKIP_COSIGN_VERIFICATION: true
#name: fuzz
#on:
# pull_request:
# branches:
# - 'main'
# - 'release/**'
#jobs:
# smoketest:
# runs-on: ubuntu-latest
# permissions:
# contents: read # for reading the repository code.
# steps:
# - name: Test suite setup
# uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.4.0
# with:
# go-version: 1.25.x
# - name: Smoke test Fuzzers
# run: make fuzz-smoketest
# env:
# SKIP_COSIGN_VERIFICATION: true
70 changes: 35 additions & 35 deletions .github/workflows/e2e.yaml
Original file line number Diff line number Diff line change
@@ -1,35 +1,35 @@
name: e2e
on:
workflow_dispatch:
pull_request:
push:
branches:
- 'main'
- 'release/**'
jobs:
kind-linux-amd64:
runs-on: ubuntu-latest
permissions:
contents: read # for reading the repository code.
steps:
- name: Test suite setup
uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.4.0
with:
go-version: 1.25.x
- name: Verify
run: make verify
- name: Enable integration tests
# Only run integration tests for main and release branches
if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')
run: |
echo 'GO_TAGS=integration' >> $GITHUB_ENV
- name: Run E2E tests
env:
SKIP_COSIGN_VERIFICATION: true
CREATE_CLUSTER: false
run: make e2e
- name: Print controller logs
if: always()
continue-on-error: true
run: |
kubectl -n source-system logs -l app=source-controller
#name: e2e
#on:
# workflow_dispatch:
# pull_request:
# push:
# branches:
# - 'main'
# - 'release/**'
#jobs:
# kind-linux-amd64:
# runs-on: ubuntu-latest
# permissions:
# contents: read # for reading the repository code.
# steps:
# - name: Test suite setup
# uses: fluxcd/gha-workflows/.github/actions/setup-kubernetes@v0.4.0
# with:
# go-version: 1.25.x
# - name: Verify
# run: make verify
# - name: Enable integration tests
# # Only run integration tests for main and release branches
# if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')
# run: |
# echo 'GO_TAGS=integration' >> $GITHUB_ENV
# - name: Run E2E tests
# env:
# SKIP_COSIGN_VERIFICATION: true
# CREATE_CLUSTER: false
# run: make e2e
# - name: Print controller logs
# if: always()
# continue-on-error: true
# run: |
# kubectl -n source-system logs -l app=source-controller
132 changes: 66 additions & 66 deletions .github/workflows/release.yaml
Original file line number Diff line number Diff line change
@@ -1,66 +1,66 @@
name: release
on:
push:
tags:
- 'v*'
workflow_dispatch:
inputs:
tag:
description: 'image tag prefix'
default: 'rc'
required: true
jobs:
release:
permissions:
contents: write # for creating the GitHub release.
id-token: write # for creating OIDC tokens for signing.
packages: write # for pushing and signing container images.
uses: fluxcd/gha-workflows/.github/workflows/controller-release.yaml@v0.4.0
with:
controller: ${{ github.event.repository.name }}
release-candidate-prefix: ${{ github.event.inputs.tag }}
secrets:
github-token: ${{ secrets.GITHUB_TOKEN }}
dockerhub-token: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
release-provenance:
needs: [release]
permissions:
actions: read # for detecting the Github Actions environment.
id-token: write # for creating OIDC tokens for signing.
contents: write # for uploading attestations to GitHub releases.
if: startsWith(github.ref, 'refs/tags/v')
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
with:
provenance-name: "provenance.intoto.jsonl"
base64-subjects: "${{ needs.release.outputs.release-digests }}"
upload-assets: true
dockerhub-provenance:
needs: [release]
permissions:
contents: read # for reading the repository code.
actions: read # for detecting the Github Actions environment.
id-token: write # for creating OIDC tokens for signing.
packages: write # for uploading attestations.
if: startsWith(github.ref, 'refs/tags/v')
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
with:
image: ${{ needs.release.outputs.image-name }}
digest: ${{ needs.release.outputs.image-digest }}
registry-username: ${{ github.repository_owner == 'fluxcd' && 'fluxcdbot' || github.repository_owner }}
secrets:
registry-password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
ghcr-provenance:
needs: [release]
permissions:
contents: read # for reading the repository code.
actions: read # for detecting the Github Actions environment.
id-token: write # for creating OIDC tokens for signing.
packages: write # for uploading attestations.
if: startsWith(github.ref, 'refs/tags/v')
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
with:
image: ghcr.io/${{ needs.release.outputs.image-name }}
digest: ${{ needs.release.outputs.image-digest }}
registry-username: fluxcdbot # not necessary for ghcr.io
secrets:
registry-password: ${{ secrets.GITHUB_TOKEN }}
#name: release
#on:
# push:
# tags:
# - 'v*'
# workflow_dispatch:
# inputs:
# tag:
# description: 'image tag prefix'
# default: 'rc'
# required: true
#jobs:
# release:
# permissions:
# contents: write # for creating the GitHub release.
# id-token: write # for creating OIDC tokens for signing.
# packages: write # for pushing and signing container images.
# uses: fluxcd/gha-workflows/.github/workflows/controller-release.yaml@v0.4.0
# with:
# controller: ${{ github.event.repository.name }}
# release-candidate-prefix: ${{ github.event.inputs.tag }}
# secrets:
# github-token: ${{ secrets.GITHUB_TOKEN }}
# dockerhub-token: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
# release-provenance:
# needs: [release]
# permissions:
# actions: read # for detecting the Github Actions environment.
# id-token: write # for creating OIDC tokens for signing.
# contents: write # for uploading attestations to GitHub releases.
# if: startsWith(github.ref, 'refs/tags/v')
# uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
# with:
# provenance-name: "provenance.intoto.jsonl"
# base64-subjects: "${{ needs.release.outputs.release-digests }}"
# upload-assets: true
# dockerhub-provenance:
# needs: [release]
# permissions:
# contents: read # for reading the repository code.
# actions: read # for detecting the Github Actions environment.
# id-token: write # for creating OIDC tokens for signing.
# packages: write # for uploading attestations.
# if: startsWith(github.ref, 'refs/tags/v')
# uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
# with:
# image: ${{ needs.release.outputs.image-name }}
# digest: ${{ needs.release.outputs.image-digest }}
# registry-username: ${{ github.repository_owner == 'fluxcd' && 'fluxcdbot' || github.repository_owner }}
# secrets:
# registry-password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
# ghcr-provenance:
# needs: [release]
# permissions:
# contents: read # for reading the repository code.
# actions: read # for detecting the Github Actions environment.
# id-token: write # for creating OIDC tokens for signing.
# packages: write # for uploading attestations.
# if: startsWith(github.ref, 'refs/tags/v')
# uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
# with:
# image: ghcr.io/${{ needs.release.outputs.image-name }}
# digest: ${{ needs.release.outputs.image-digest }}
# registry-username: fluxcdbot # not necessary for ghcr.io
# secrets:
# registry-password: ${{ secrets.GITHUB_TOKEN }}
34 changes: 17 additions & 17 deletions .github/workflows/scan.yaml
Original file line number Diff line number Diff line change
@@ -1,17 +1,17 @@
name: scan
on:
push:
branches: [ main ]
pull_request:
branches: [ main ]
schedule:
- cron: '18 10 * * 3'
jobs:
analyze:
permissions:
contents: read # for reading the repository code.
security-events: write # for uploading the CodeQL analysis results.
uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.4.0
secrets:
github-token: ${{ secrets.GITHUB_TOKEN }}
fossa-token: ${{ secrets.FOSSA_TOKEN }}
#name: scan
#on:
# push:
# branches: [ main ]
# pull_request:
# branches: [ main ]
# schedule:
# - cron: '18 10 * * 3'
#jobs:
# analyze:
# permissions:
# contents: read # for reading the repository code.
# security-events: write # for uploading the CodeQL analysis results.
# uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.4.0
# secrets:
# github-token: ${{ secrets.GITHUB_TOKEN }}
# fossa-token: ${{ secrets.FOSSA_TOKEN }}
Loading