-
Notifications
You must be signed in to change notification settings - Fork 1
118 lines (100 loc) · 3.98 KB
/
release.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
name: Release Charts
on:
push:
branches:
- master
paths:
- "charts/**"
# Declare default permissions as read only.
permissions:
contents: read
jobs:
release:
runs-on: ubuntu-24.04
container: ghcr.io/chgl/kube-powertools:v2.3.35@sha256:c9335d63cd73e01456b56f2593ab67228b5a880f2e5d7c0114e2715f96bd692a
permissions:
contents: write
packages: write
id-token: write
steps:
- name: Add workspace as safe directory
run: |
git config --global --add safe.directory /__w/charts/charts
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
fetch-depth: 0
- name: Configure Git
run: |
git config user.name "$GITHUB_ACTOR"
git config user.email "[email protected]"
- name: Add Helm chart dependency repos
run: |
helm repo add codecentric https://codecentric.github.io/helm-charts
helm repo add hapifhir https://hapifhir.github.io/hapi-fhir-jpaserver-starter
- name: Update dependencies
run: find charts/ ! -path charts/ -maxdepth 1 -type d -exec helm dependency update {} \;
- name: Generate changelogs
run: generate-chart-changelog.sh
- name: Run chart-releaser
uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
with:
config: .github/ct/ct.yaml
env:
CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
- name: Login to GitHub Container Registry
run: |
# used by helm
echo "${GHCR_REGISTRY_PASSWORD}" | helm registry login ghcr.io --username ${{ github.actor }} --password-stdin
# used by cosign
echo "${GHCR_REGISTRY_PASSWORD}" | crane auth login ghcr.io --username ${{ github.actor }} --password-stdin
env:
GHCR_REGISTRY_PASSWORD: "${{ secrets.GITHUB_TOKEN }}"
- name: Push Charts to ghcr.io
run: |
for pkg in .cr-release-packages/*; do
if [ -z "${pkg:-}" ]; then
break
fi
helm push "${pkg}" oci://ghcr.io/${{ github.repository }} 2> .digest
OCI_ARTIFACT_PATH="$(awk -F "[, ]+" '/Pushed/{print $NF}' < .digest)"
OCI_ARTIFACT_DIGEST="$(awk -F "[, ]+" '/Digest/{print $NF}' < .digest)"
cosign sign --yes "${OCI_ARTIFACT_PATH}@${OCI_ARTIFACT_DIGEST}"
done
- name: Generate kubescape reports
run: |
kubescape scan framework cis-v1.23-t1.0.1 --format=html --output=kubescape-reports/cis-v1.23-t1.0.1.html charts/
kubescape scan framework nsa --format=html --output=kubescape-reports/nsa.html charts/
kubescape scan framework mitre --format=html --output=kubescape-reports/mitre.html charts/
- name: "Upload kubescape reports"
uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
with:
name: kubescape-reports
path: kubescape-reports/
retention-days: 5
update-kubescape-reports:
runs-on: ubuntu-24.04
container: ghcr.io/chgl/kube-powertools:v2.3.35@sha256:c9335d63cd73e01456b56f2593ab67228b5a880f2e5d7c0114e2715f96bd692a
permissions:
contents: write
needs:
- release
steps:
- name: Add workspace as safe directory
run: |
git config --global --add safe.directory /__w/charts/charts
- name: Checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
ref: gh-pages
- name: Download reports
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
with:
name: kubescape-reports
path: "kubescape-reports/"
- run: |
ls -lsa ./
- uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
with:
add: "kubescape-reports/"
message: "docs: updated kubescape reports"