diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..33dc6d2 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,12 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + open-pull-requests-limit: 10 + groups: + actions: + update-types: + - "minor" + - "patch" diff --git a/.github/workflows/ansible-lint.yml b/.github/workflows/ansible-lint.yml index a2d9cc6..d165a93 100644 --- a/.github/workflows/ansible-lint.yml +++ b/.github/workflows/ansible-lint.yml @@ -8,11 +8,12 @@ jobs: name: Ansible Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 - name: Run ansible-lint - uses: ansible/ansible-lint-action@v6.3.0 # the latest version has a bug that does not run in online mode + uses: ansible/ansible-lint@44be233dbd6a8a6d8f3c5297c318ed4ed4644c32 # v24.10.0 with: - path: "ansible-playbooks/" + working_directory: "${{ github.workspace }}/ansible-playbooks" + requirements_file: "${{ github.workspace }}/requirements.yml" diff --git a/.github/workflows/reusable_build_images.yml b/.github/workflows/reusable_build_images.yml index be27cd3..ae66ad1 100644 --- a/.github/workflows/reusable_build_images.yml +++ b/.github/workflows/reusable_build_images.yml @@ -25,14 +25,14 @@ jobs: fail-fast: false matrix: arch: [amd64, arm64] - runs-on: ${{ (matrix.arch == 'arm64' && 'actuated-arm64-8cpu-16gb') || 'ubuntu-22.04' }} + runs-on: ${{ (matrix.arch == 'arm64' && 'oracle-aarch64-4cpu-16gb') || 'ubuntu-22.04' }} steps: - name: Checkout repo - uses: actions/checkout@v3 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - name: Login to Github Packages if: inputs.push - uses: docker/login-action@v1 + uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 with: registry: ghcr.io username: ${{ github.actor }} diff --git a/ansible-playbooks/roles/scap_open/tasks/main.yml b/ansible-playbooks/roles/scap_open/tasks/main.yml index 17280e4..df9e9e5 100644 --- a/ansible-playbooks/roles/scap_open/tasks/main.yml +++ b/ansible-playbooks/roles/scap_open/tasks/main.yml @@ -24,15 +24,15 @@ rescue: - name: Disable Modern Bpf support ansible.builtin.set_fact: - modern_bpf_supported: false + scap_open_modern_bpf_supported: false when: result.rc == 95 - name: Check Old Bpf Support block: - name: Enable old Bpf support ansible.builtin.set_fact: - bpf_supported: true - when: ansible_kernel is version(bpf_minimum_kver[ansible_architecture],'>=') + scap_open_bpf_supported: true + when: ansible_kernel is version(scap_open_bpf_minimum_kver[ansible_architecture],'>=') - name: Prepare the build directory block: @@ -50,7 +50,7 @@ -DUSE_BUNDLED_DEPS=ON -DBUILD_LIBSCAP_MODERN_BPF=OFF -DBUILD_LIBSCAP_GVISOR=OFF - -DBUILD_BPF={{ bpf_supported }} + -DBUILD_BPF={{ scap_open_bpf_supported }} -DCREATE_TEST_TARGETS=OFF .. chdir: "{{ remote_repos_folder }}/repos/{{ repos['libs'].name }}/build" @@ -139,7 +139,7 @@ cmd: make bpf -j {{ cpus }} chdir: "{{ remote_repos_folder }}/repos/{{ repos['libs'].name }}/build" register: bpf_probe_result - when: bpf_supported + when: scap_open_bpf_supported changed_when: false rescue: - name: Print error message to stdout --- build bpf probe @@ -161,7 +161,7 @@ cmd: /tmp/scap-open --num_events 50 --bpf driver/bpf/probe.o chdir: "{{ remote_repos_folder }}/repos/{{ repos['libs'].name }}/build" register: result - when: bpf_supported + when: scap_open_bpf_supported changed_when: false rescue: - name: Print error message to stdout --- scap-open + bpf probe @@ -183,7 +183,7 @@ cmd: /tmp/scap-open --num_events 50 --modern_bpf chdir: "{{ remote_repos_folder }}/repos/{{ repos['libs'].name }}/build" register: result - when: modern_bpf_supported + when: scap_open_modern_bpf_supported changed_when: false rescue: - name: Print error message to stdout --- scap-open + modern probe diff --git a/ansible-playbooks/roles/scap_open/vars/main.yml b/ansible-playbooks/roles/scap_open/vars/main.yml index c1d3acd..6ff5681 100644 --- a/ansible-playbooks/roles/scap_open/vars/main.yml +++ b/ansible-playbooks/roles/scap_open/vars/main.yml @@ -1,6 +1,6 @@ --- -modern_bpf_supported: true -bpf_supported: false -bpf_minimum_kver: +scap_open_modern_bpf_supported: true +scap_open_bpf_supported: false +scap_open_bpf_minimum_kver: aarch64: '4.17' x86_64: '4.14' diff --git a/requirements.yml b/requirements.yml index 559cece..e69af9e 100644 --- a/requirements.yml +++ b/requirements.yml @@ -2,3 +2,4 @@ collections: - name: community.docker - name: community.crypto + - name: ansible.posix