Skip to content

Commit 405d033

Browse files
seagynseagyn
authored
Merge pull request #4 from lsdopen/feat/add-ci
ci: add new build process
2 parents 7f3d5f6 + fcdbe88 commit 405d033

9 files changed

Lines changed: 198 additions & 6 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
name: CI
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- 'main'
7+
8+
permissions:
9+
contents: read
10+
pull-requests: write # Required for posting comments (if using a commenting action) or checks
11+
security-events: write # Required for uploading SARIF results
12+
13+
jobs:
14+
lint:
15+
name: Lint
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v4
20+
21+
- name: Setup Go
22+
uses: actions/setup-go@v5
23+
with:
24+
go-version-file: 'go.mod'
25+
26+
- name: Run golangci-lint
27+
uses: golangci/golangci-lint-action@v8
28+
with:
29+
version: v2.7.2
30+
31+
sast:
32+
name: SAST (Gosec)
33+
runs-on: ubuntu-latest
34+
steps:
35+
- name: Checkout code
36+
uses: actions/checkout@v4
37+
38+
- name: Run Gosec Security Scanner
39+
uses: securego/gosec@v2.22.0
40+
with:
41+
args: '-no-fail -fmt sarif -out results.sarif ./...'
42+
43+
- name: Upload SARIF file
44+
uses: github/codeql-action/upload-sarif@v3
45+
with:
46+
sarif_file: results.sarif
47+
48+
test:
49+
name: Test
50+
runs-on: ubuntu-latest
51+
steps:
52+
- name: Checkout code
53+
uses: actions/checkout@v4
54+
55+
- name: Setup Go
56+
uses: actions/setup-go@v5
57+
with:
58+
go-version-file: 'go.mod'
59+
60+
- name: Run tests
61+
run: go test ./...
62+
63+
build-image:
64+
name: Build Image
65+
runs-on: ubuntu-latest
66+
steps:
67+
- name: Checkout code
68+
uses: actions/checkout@v4
69+
70+
- name: Build Docker image
71+
run: docker build -f Containerfile .
72+
73+
container-scan:
74+
name: Container Scan
75+
runs-on: ubuntu-latest
76+
steps:
77+
- name: Checkout code
78+
uses: actions/checkout@v4
79+
80+
- name: Build Docker image
81+
run: docker build -f Containerfile -t local/app:latest .
82+
83+
- name: Run Trivy vulnerability scanner
84+
uses: aquasecurity/trivy-action@0.28.0
85+
with:
86+
image-ref: 'local/app:latest'
87+
format: 'sarif'
88+
output: 'trivy-results.sarif'
89+
ignore-unfixed: true
90+
vuln-type: 'os,library'
91+
severity: 'CRITICAL,HIGH'
92+
93+
- name: Upload Trivy scan results to GitHub Security tab
94+
uses: github/codeql-action/upload-sarif@v3
95+
with:
96+
sarif_file: 'trivy-results.sarif'

‎.github/workflows/publish.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: Publish
2+
3+
on:
4+
release:
5+
types: [published]
6+
7+
permissions:
8+
packages: write
9+
contents: read
10+
11+
jobs:
12+
push-image:
13+
name: Build & Push Image
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout code
17+
uses: actions/checkout@v4
18+
19+
- name: Log in to the Container registry
20+
uses: docker/login-action@v3
21+
with:
22+
registry: ghcr.io
23+
username: ${{ github.actor }}
24+
password: ${{ secrets.GITHUB_TOKEN }}
25+
26+
- name: Extract metadata (tags, labels) for Docker
27+
id: meta
28+
uses: docker/metadata-action@v5
29+
with:
30+
images: ghcr.io/${{ github.repository }}
31+
tags: |
32+
type=semver,pattern={{version}}
33+
type=semver,pattern={{major}}.{{minor}}
34+
type=semver,pattern={{major}}
35+
36+
- name: Build and push Docker image
37+
uses: docker/build-push-action@v5
38+
with:
39+
context: .
40+
file: Containerfile
41+
push: true
42+
tags: ${{ steps.meta.outputs.tags }}
43+
labels: ${{ steps.meta.outputs.labels }}

‎.github/workflows/release.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
branches:
6+
- 'main'
7+
8+
permissions:
9+
contents: write
10+
issues: write
11+
pull-requests: write
12+
13+
jobs:
14+
release:
15+
name: Release
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v4
20+
with:
21+
fetch-depth: 0 # Required for commit history
22+
23+
- name: Setup Node.js
24+
uses: actions/setup-node@v4
25+
with:
26+
node-version: 'lts/*'
27+
28+
- name: Install dependencies
29+
run: npm install --no-save semantic-release@^24.2.0 @semantic-release/commit-analyzer@^13.0.0 @semantic-release/release-notes-generator@^14.0.1 @semantic-release/github@^11.0.1
30+
31+
- name: Semantic Release
32+
env:
33+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
34+
run: npx semantic-release@^24.2.0

‎.releaserc.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
{
2+
"branches": [
3+
"main"
4+
],
5+
"plugins": [
6+
"@semantic-release/commit-analyzer",
7+
"@semantic-release/release-notes-generator",
8+
"@semantic-release/github"
9+
]
10+
}

Dockerfile renamed to Containerfile

File renamed without changes.

Dockerfile.dev renamed to Containerfile.dev

File renamed without changes.

‎Tiltfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,9 @@ k8s_yaml(secret_yaml_tls(
1414

1515
# 3. Build and Deploy Webhook
1616
docker_build_with_restart(
17-
'archy-webhook',
17+
'webhook',
1818
'.',
19-
dockerfile='Dockerfile.dev',
19+
dockerfile='Containerfile.dev',
2020
# Live update for fast iteration
2121
live_update=[
2222
sync('.', '/app'),

‎cmd/webhook/main.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,9 @@ func main() {
4646
mux.Handle("/mutate", handler)
4747
mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
4848
w.WriteHeader(http.StatusOK)
49-
w.Write([]byte("ok"))
49+
if _, err := w.Write([]byte("ok")); err != nil {
50+
log.Printf("Failed to write health check response: %v", err)
51+
}
5052
})
5153

5254
server := &http.Server{

‎pkg/webhook/handler.go‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"encoding/json"
66
"fmt"
77
"io"
8+
"log"
89
"net/http"
910

1011
"github.com/google/go-containerregistry/pkg/v1/remote"
@@ -23,8 +24,12 @@ var (
2324
)
2425

2526
func init() {
26-
admissionv1.AddToScheme(scheme)
27-
corev1.AddToScheme(scheme)
27+
if err := admissionv1.AddToScheme(scheme); err != nil {
28+
panic(err)
29+
}
30+
if err := corev1.AddToScheme(scheme); err != nil {
31+
panic(err)
32+
}
2833
}
2934

3035
type Handler struct {
@@ -84,7 +89,9 @@ func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
8489
}
8590

8691
w.Header().Set("Content-Type", "application/json")
87-
w.Write(respBytes)
92+
if _, err := w.Write(respBytes); err != nil {
93+
log.Printf("Failed to write response: %v", err)
94+
}
8895
}
8996

9097
func (h *Handler) mutate(ctx context.Context, ar *admissionv1.AdmissionReview) *admissionv1.AdmissionResponse {

0 commit comments

Comments
 (0)