Skip to content

Commit 972a740

Browse files
alexlovelltroyalexlovelltroy
authored
Merge pull request #7 from OpenCHAMI/feature/upgrade-fabrica
Feature/upgrade fabrica
2 parents dd247bc + abcf688 commit 972a740

73 files changed

Lines changed: 4032 additions & 1037 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.fabrica.yaml‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# SPDX-FileCopyrightText: 2026 OpenCHAMI Contributors
2+
#
3+
# SPDX-License-Identifier: MIT
4+
5+
project:
6+
name: boot-service
7+
module: github.com/openchami/boot-service
8+
description: OpenCHAMI boot service with Fabrica-generated REST APIs and legacy BSS compatibility
9+
created: 2025-01-01T00:00:00Z
10+
features:
11+
validation:
12+
enabled: true
13+
mode: strict
14+
events:
15+
enabled: false
16+
bus_type: memory
17+
conditional:
18+
enabled: true
19+
etag_algorithm: sha256
20+
auth:
21+
enabled: true
22+
security:
23+
authn:
24+
enabled: true
25+
authz:
26+
enabled: false
27+
mode: enforce
28+
storage:
29+
enabled: true
30+
type: file
31+
metrics:
32+
enabled: false
33+
generation:
34+
handlers: true
35+
storage: true
36+
client: true
37+
openapi: true
38+
events: false
39+
middleware: true
40+
reconciliation: false

‎.github/copilot-instructions.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,14 +33,15 @@ Client → Chi Router → [Auth Middleware] → Generated Handlers → Storage B
3333
**NEVER manually edit `*_generated.go` files.** All handlers, storage, and client code is generated from resource definitions.
3434

3535
```bash
36-
# After modifying resources in pkg/resources/*/
36+
# After modifying resources in apis/boot.openchami.io/v1/
3737
fabrica generate --handlers --storage --openapi --client
3838

3939
# Or use the Makefile
4040
make dev # clean + generate + build
4141
```
4242

43-
Resources are defined in `pkg/resources/{node,bootconfiguration,bmc}/` with `Spec` (desired state) and `Status` (observed state) structs.
43+
Resources are defined in `apis/boot.openchami.io/v1/` with `Spec` (desired state) and `Status` (observed state) structs.
44+
The `pkg/resources/*` tree is deprecated and should not be used for new code.
4445

4546
### Building
4647

@@ -271,7 +272,7 @@ GoReleaser config: `.goreleaser.yaml` (v2.4.4 compatible, no sboms).
271272
## Key Files Reference
272273

273274
- `cmd/server/main.go` - Server entrypoint with Cobra CLI and config loading
274-
- `pkg/resources/*/` - Resource definitions (edit these, not generated files)
275+
- `apis/boot.openchami.io/v1/` - Resource definitions (edit these, not generated files)
275276
- `pkg/controllers/bootscript/` - Boot logic, config matching, iPXE generation
276277
- `pkg/handlers/legacy/` - BSS compatibility layer
277278
- `pkg/auth/` - TokenSmith integration and testing utilities

‎.github/workflows/PRBuild.yaml‎

Lines changed: 107 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,107 @@
1+
# Copyright © 2025 OpenCHAMI a Series of LF Projects, LLC
2+
#
3+
# SPDX-License-Identifier: MIT
4+
5+
name: Build each PR for testing and validation
6+
7+
on:
8+
pull_request:
9+
branches:
10+
- main
11+
types: [opened, synchronize, reopened, edited]
12+
workflow_dispatch:
13+
inputs:
14+
pr_number:
15+
description: 'PR Number to build (optional, for manual PR builds)'
16+
required: false
17+
type: string
18+
19+
permissions: write-all # Necessary for the generate-build-provenance action with containers
20+
21+
jobs:
22+
23+
build:
24+
25+
26+
runs-on: ubuntu-latest
27+
28+
steps:
29+
- name: Set up latest stable Go
30+
uses: actions/setup-go@v5
31+
with:
32+
go-version: stable
33+
- name: Set up QEMU
34+
uses: docker/setup-qemu-action@v3
35+
- name: Set up Docker Buildx
36+
uses: docker/setup-buildx-action@v3
37+
with:
38+
driver-opts: |
39+
image=moby/buildkit:master
40+
network=host
41+
- name: Docker Login
42+
uses: docker/login-action@v3
43+
with:
44+
registry: ghcr.io
45+
username: ${{ github.actor }}
46+
password: ${{ secrets.GITHUB_TOKEN }}
47+
- name: Checkout
48+
uses: actions/checkout@v4
49+
with:
50+
fetch-tags: 1
51+
fetch-depth: 0
52+
# Set environment variables required by GoReleaser
53+
- name: Set build environment variables
54+
run: |
55+
echo "GIT_STATE=$(if git diff-index --quiet HEAD --; then echo 'clean'; else echo 'dirty'; fi)" >> $GITHUB_ENV
56+
echo "BUILD_HOST=$(hostname)" >> $GITHUB_ENV
57+
echo "GO_VERSION=$(go version | awk '{print $3}')" >> $GITHUB_ENV
58+
echo "BUILD_USER=$(whoami)" >> $GITHUB_ENV
59+
echo "CGO_ENABLED=0" >> $GITHUB_ENV
60+
echo "IS_PR_BUILD=true" >> $GITHUB_ENV
61+
62+
- name: Docker Login
63+
uses: docker/login-action@v3
64+
with:
65+
registry: ghcr.io
66+
username: ${{ github.actor }}
67+
password: ${{ secrets.GITHUB_TOKEN }}
68+
69+
- name: Create Tag for PR
70+
if: github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && inputs.pr_number != '')
71+
run: |
72+
git config --global user.name "github-actions[bot]"
73+
git config --global user.email "github-actions[bot]@users.noreply.github.com"
74+
PR_NUM="${{ github.event.number }}"
75+
if [[ "${{ inputs.pr_number }}" != "" ]]; then
76+
PR_NUM="${{ inputs.pr_number }}"
77+
fi
78+
git tag -f -a pr-${PR_NUM} -m "PR Release"
79+
80+
- name: Build/Push container with goreleaser
81+
uses: goreleaser/goreleaser-action@v6
82+
env:
83+
GITHUB_TOKEN: ${{ github.token }}
84+
with:
85+
version: '~> 2'
86+
args: release --clean --skip=announce,validate,archive
87+
id: goreleaser
88+
- name: Process goreleaser output
89+
id: process_goreleaser_output
90+
run: |
91+
echo "const fs = require('fs');" > process.js
92+
echo 'const artifacts = ${{ steps.goreleaser.outputs.artifacts }}' >> process.js
93+
echo "const firstNonNullDigest = artifacts.find(artifact => artifact.extra && artifact.extra.Digest != null)?.extra.Digest;" >> process.js
94+
echo "console.log(firstNonNullDigest);" >> process.js
95+
echo "fs.writeFileSync('digest.txt', firstNonNullDigest);" >> process.js
96+
node process.js
97+
echo "digest=$(cat digest.txt)" >> $GITHUB_OUTPUT
98+
- name: Attest Binaries
99+
uses: actions/attest-build-provenance@v4.1.0
100+
with:
101+
subject-path: dist/**/boot-*
102+
- name: generate build provenance
103+
uses: actions/attest-build-provenance@v4.1.0
104+
with:
105+
subject-name: ghcr.io/openchami/boot-service
106+
subject-digest: ${{ steps.process_goreleaser_output.outputs.digest }}
107+
push-to-registry: true

‎.github/workflows/REUSE.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
# Copyright © 2025 OpenCHAMI a Series of LF Projects, LLC
2+
# SPDX-FileCopyrightText: 2020 Free Software Foundation Europe e.V.
3+
#
4+
# SPDX-License-Identifier: CC0-1.0
5+
# SPDX-License-Identifier: MIT
6+
name: REUSE Compliance Check
7+
8+
on: [push, pull_request]
9+
10+
jobs:
11+
test:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- uses: actions/checkout@v6.0.2
15+
- name: REUSE Compliance Check
16+
uses: fsfe/reuse-action@v6

‎.github/workflows/Release.yaml‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# Copyright © 2025 OpenCHAMI a Series of LF Projects, LLC
2+
#
3+
# SPDX-License-Identifier: MIT
4+
5+
name: Release with goreleaser
6+
7+
on:
8+
workflow_dispatch:
9+
push:
10+
tags:
11+
- v*
12+
13+
permissions: write-all # Necessary for the generate-build-provenance action with containers
14+
15+
jobs:
16+
17+
build:
18+
19+
20+
runs-on: ubuntu-latest
21+
22+
steps:
23+
- name: Set up latest stable Go
24+
uses: actions/setup-go@v5
25+
with:
26+
go-version: stable
27+
- name: Set up QEMU
28+
uses: docker/setup-qemu-action@v3
29+
- name: Docker Login
30+
uses: docker/login-action@v3
31+
with:
32+
registry: ghcr.io
33+
username: ${{ github.actor }}
34+
password: ${{ secrets.GITHUB_TOKEN }}
35+
- name: Checkout
36+
uses: actions/checkout@v4
37+
with:
38+
fetch-tags: 1
39+
fetch-depth: 0
40+
# Set environment variables required by GoReleaser
41+
- name: Set build environment variables
42+
run: |
43+
echo "GIT_STATE=$(if git diff-index --quiet HEAD --; then echo 'clean'; else echo 'dirty'; fi)" >> $GITHUB_ENV
44+
echo "BUILD_HOST=$(hostname)" >> $GITHUB_ENV
45+
echo "GO_VERSION=$(go version | awk '{print $3}')" >> $GITHUB_ENV
46+
echo "BUILD_USER=$(whoami)" >> $GITHUB_ENV
47+
echo "CGO_ENABLED=0" >> $GITHUB_ENV
48+
echo "IS_PR_BUILD=false" >> $GITHUB_ENV
49+
50+
- name: Release with goreleaser
51+
uses: goreleaser/goreleaser-action@v6
52+
env:
53+
GITHUB_TOKEN: ${{ github.token }}
54+
with:
55+
version: latest
56+
args: release --clean
57+
id: goreleaser
58+
- name: Process goreleaser output
59+
id: process_goreleaser_output
60+
run: |
61+
echo "const fs = require('fs');" > process.js
62+
echo 'const artifacts = ${{ steps.goreleaser.outputs.artifacts }}' >> process.js
63+
echo "const firstNonNullDigest = artifacts.find(artifact => artifact.extra && artifact.extra.Digest != null)?.extra.Digest;" >> process.js
64+
echo "console.log(firstNonNullDigest);" >> process.js
65+
echo "fs.writeFileSync('digest.txt', firstNonNullDigest);" >> process.js
66+
node process.js
67+
echo "digest=$(cat digest.txt)" >> $GITHUB_OUTPUT
68+
- name: Attest Binaries
69+
uses: actions/attest-build-provenance@v1
70+
with:
71+
subject-path: dist/boot-service*
72+
- name: generate build provenance
73+
uses: actions/attest-build-provenance@v1
74+
with:
75+
subject-name: ghcr.io/openchami/boot-service
76+
subject-digest: ${{ steps.process_goreleaser_output.outputs.digest }}
77+
push-to-registry: true

‎.github/workflows/golangci-lint.yaml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Copyright © 2025 OpenCHAMI a Series of LF Projects, LLC
2+
#
3+
# SPDX-License-Identifier: MIT
4+
name: golangci-lint
5+
6+
on:
7+
push:
8+
branches: [ main ]
9+
pull_request:
10+
workflow_dispatch:
11+
12+
jobs:
13+
lint:
14+
runs-on: ubuntu-latest
15+
steps:
16+
- uses: actions/checkout@v6
17+
- name: Run golangci-lint
18+
uses: golangci/golangci-lint-action@v6
19+
with:
20+
version: latest

‎.github/workflows/scorecard.yml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Copyright © 2025 OpenCHAMI a Series of LF Projects, LLC
2+
#
3+
# SPDX-License-Identifier: MIT
4+
5+
# This workflow uses actions that are not certified by GitHub. They are provided
6+
# by a third-party and are governed by separate terms of service, privacy
7+
# policy, and support documentation.
8+
9+
name: Scorecard supply-chain security
10+
on:
11+
# For Branch-Protection check. Only the default branch is supported. See
12+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
13+
branch_protection_rule:
14+
# To guarantee Maintained check is occasionally updated. See
15+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
16+
schedule:
17+
- cron: '39 5 * * 1'
18+
push:
19+
branches: [ "main" ]
20+
21+
# Declare default permissions as read only.
22+
permissions: read-all
23+
24+
jobs:
25+
analysis:
26+
name: Scorecard analysis
27+
runs-on: ubuntu-latest
28+
# `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
29+
if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request'
30+
permissions:
31+
# Needed to upload the results to code-scanning dashboard.
32+
security-events: write
33+
# Needed to publish results and get a badge (see publish_results below).
34+
id-token: write
35+
# Uncomment the permissions below if installing in a private repository.
36+
# contents: read
37+
# actions: read
38+
39+
steps:
40+
- name: "Checkout code"
41+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
42+
with:
43+
persist-credentials: false
44+
45+
- name: "Run analysis"
46+
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
47+
with:
48+
results_file: results.sarif
49+
results_format: sarif
50+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
51+
# - you want to enable the Branch-Protection check on a *public* repository, or
52+
# - you are installing Scorecard on a *private* repository
53+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
54+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
55+
56+
# Public repositories:
57+
# - Publish results to OpenSSF REST API for easy access by consumers
58+
# - Allows the repository to include the Scorecard badge.
59+
# - See https://github.com/ossf/scorecard-action#publishing-results.
60+
# For private repositories:
61+
# - `publish_results` will always be set to `false`, regardless
62+
# of the value entered here.
63+
publish_results: true
64+
65+
# (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore
66+
# file_mode: git
67+
68+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
69+
# format to the repository Actions tab.
70+
- name: "Upload artifact"
71+
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
72+
with:
73+
name: SARIF file
74+
path: results.sarif
75+
retention-days: 5
76+
77+
# Upload the results to GitHub's code scanning dashboard (optional).
78+
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
79+
- name: "Upload to code-scanning"
80+
uses: github/codeql-action/upload-sarif@v3
81+
with:
82+
sarif_file: results.sarif

0 commit comments

Comments
 (0)