Skip to content

Commit 56e500f

Browse files
brianLoomisbrianLoomis
committed
pilot for v2 main CI and CD actions
1 parent 26a9e7a commit 56e500f

27 files changed

Lines changed: 1263 additions & 314 deletions

‎.github/workflows/DEV README.md‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#TODO: items
2+
3+
1. identify affected repos (needing common GH action)
4+
- list of repos finalized for limited GA
5+
2. prototype each GH action on https://github.com/chef/chef-vault
6+
- sonar - public repos - the Jason way (new runner)
7+
- API tokens created - done...
8+
- correct project_name in properties?
9+
- blackduck
10+
- request all repos to Jason
11+
- polaris
12+
- truffle hog - done...?
13+
- scc and any othertools from previous GA's
14+
- dependabot scanning (manual)
15+
- ad hoc CD - intel cve-bin tool
16+
- add OSSF scorecard? https://github.com/actions/starter-workflows/blob/main/code-scanning/scorecard.yml
17+
18+
3. first 10 repos
19+
4. have teams do next round
20+
21+
## copy PR-v2.yml & stub to other 3 common-github-actions repos
22+
1. https://github.com/habitat-sh/common-github-actions
23+
1. https://github.com/inspec/common-github-actions
24+
25+
## set up secrets like
26+
- https://github.com/chef/chef/settings/secrets/actions
27+
28+
## set up sonar.properties from references
29+
- https://github.com/progress-platform-services/chef-node-management-cli/blob/main/sonar-project.properties
30+
- https://github.com/progress-platform-services/chef-node-management-cli
31+
- go-based one (Sonar Cloud) - https://github.com/chef/automate/blob/main/sonar-project.properties (goes to https://sonar.progress.com/dashboard?id=Chef_Automate&codeScope=overall, convert project name to Chef_Automate instead of automate_automate)
32+
- https://github.com/progress-platform-services/chef-node-management-cli/blob/main/.github/workflows/sonarqube.yml
33+
- https://github.com/chef/chef-server/blob/0ae871a00deb405ed068f2b8b1854b0660413a77/sonar-project.properties#L7
34+
35+
needs work
36+
- https://github.com/chef/ohai/blob/main/sonar-project.properties
37+
- https://github.com/chef/chef/blob/main/sonar-project.properties
38+
39+
ref- https://docs.sonarsource.com/sonarqube-server/latest/analyzing-source-code/languages/ruby/
40+
41+
## Blackduck
42+
SCA needs BLACKDUCK_URL and secrets.BLACKDUCK_TOKEN
43+
can upload SARIF to GitHub Adv Security in advanced example
44+
45+
Polaris needs POLARIS_SERVER_URL, secrets.POLARIS_ACCESS_TOKEN
46+
47+
Coverity needs COVERITY_URL, COVERITY_USER, secrets.COVERITY_PASSPHRASE
48+
49+
## copy to test repos
50+
### chef
51+
- https://github.com/chef/mixlib-cli
52+
53+
- https://github.com/inspec/train-habitat
54+
- https://github.com/inspec/k8s-ruby
55+
56+
## upgrade all common stubs to progress-platform-sevices
57+
- look at all the junk in https://github.com/progress-platform-services/chef-state-api workflows
58+
59+
## generate Sonar reports for limited GA
60+
https://www.bitegarden.com/how-to-create-sonarqube-report
61+
62+
## add container stuff
63+
https://github.com/actions/starter-workflows/blob/main/code-scanning/kubesec.yml
64+
https://github.com/actions/starter-workflows/blob/main/code-scanning/snyk-container.yml
65+
66+
Evaluate other tools:
67+
https://github.com/actions/starter-workflows/blob/main/code-scanning/sysdig-scan.yml
68+
https://github.com/actions/starter-workflows/blob/main/code-scanning/trivy.yml

.github/workflows/ci-cli-go-main-ALLACTIONS.yml renamed to .github/workflows/archived/ci-cli-go-main-ALLACTIONS.yml

Lines changed: 1 addition & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -165,72 +165,4 @@ jobs:
165165
# - name: Copy file
166166
# run: cp coverage.out test/unittest/coverage.out
167167
# # - name: cat the file
168-
# # run: cat test/unittest/coverage.out
169-
170-
# - name: SonarQube Scan
171-
# uses: sonarsource/sonarqube-scan-action@master
172-
# # https://github.com/marketplace/actions/official-sonarqube-scan
173-
# env:
174-
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
175-
# SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
176-
177-
# - name: Upload test coverage artifact
178-
# uses: actions/upload-artifact@v4
179-
# with:
180-
# # Name of the artifact to upload.
181-
# name: test-coverage.out
182-
# # A file, directory or wildcard pattern that describes what to upload
183-
# path: test/unittest/coverage.out
184-
185-
# Language vulnerability checks (SCA) - OWASP depcheck, gosec
186-
# depcheck - https://jeremylong.github.io/DependencyCheck/dependency-check-cli/index.html, https://jeremylong.github.io/DependencyCheck/ (plugin to SQ)
187-
# https://github.com/marketplace/actions/gosec-security-checker
188-
# https://go.googlesource.com/vuln - govulncheck
189-
# language-vuln-checks:
190-
# runs-on: ubuntu-latest
191-
# needs: veracode-sast
192-
# name: 'OWASP depcheck and gosec'
193-
# steps:
194-
# - name: 'OWASP depcheck and gosec'
195-
# run: echo 'hello world'
196-
197-
# srcclr
198-
# srcclr scan . --recursive --quick
199-
# srcclr scan .\automate\ --recursive --quick
200-
# needs SRCCLR_API_TOKEN env var...
201-
# srcclr scan --url https://github.com/progress-platform-services/chef-node-management-cli --json=veracode_output --no-upload --recursive --ref=main --scan-analyzers="go mod"
202-
203-
# go install github.com/securego/gosec/v2/cmd/gosec@latest
204-
# GHA at https://github.com/securego/gosec
205-
# gosec ./... >> ./bin/gosec.out
206-
207-
# go install golang.org/x/vuln/cmd/govulncheck@latest
208-
# govulncheck ./... >> ./bin/security/govuln.out
209-
210-
# go mod graph >> ./bin/go-dep-graph.out
211-
212-
# go install honnef.co/go/tools/cmd/staticcheck@latest
213-
# staticcheck ./... >> ./bin/staticcheck.out
214-
215-
# go install github.com/golangci/golangci-lint/cmd/golangci-lint@v1.57.1
216-
# GHA at ?
217-
# golangci-lint run ./...
218-
219-
# go get github.com/manifest-cyber/cli
220-
# use the GHA
221-
222-
# Code signing (can generate MD5 SHA, but also need signature - not GPG but provisioned by Progress EVCode)
223-
# https://github.com/mtrojnar/osslsigncode?tab=readme-ov-file
224-
# code-signing:
225-
# runs-on: ubuntu-latest
226-
# needs: language-vuln-checks
227-
# name: 'Code signing'
228-
# steps:
229-
# - name: 'Code signing'
230-
# run: echo 'hello world'
231-
232-
233-
234-
235-
# msftsbom.exe generate -b ./bin -bc . -pn chef-api -pv 0.1.0 -ps "Progress Chef" -nsb "https://chef.io" -V Verbose
236-
# license_scout
168+
# # run: cat test/unittest/coverage.out

‎.github/workflows/archived/ci-release-go-cli.yml‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
name: Build, Generate Metrics and Test Go CLIs with go-releaser
2+
on:
3+
workflow_call:
4+
inputs:
5+
application-name:
6+
required: true
7+
type: string
8+
9+
permissions:
10+
contents: write
11+
12+
env:
13+
APPLICATION_NAME: ${{ inputs.application-name }}
14+
API_VERSION: ${{ github.ref_name }}
15+
BUILDTYPE: 'CLI'
16+
SCCOUTPUTFILE: 'scc.out'
17+
BUILDLANGUAGE: 'GoLang'
18+
DOCKERFILE_PATH: './Dockerfile'
19+
20+
jobs:
21+
# Build GoLang binaries per .goreleaser.yaml with go-releaser makes these artifacts in GitHub
22+
goreleaser:
23+
runs-on: ubuntu-latest
24+
steps:
25+
-
26+
name: Checkout
27+
uses: actions/checkout@v4
28+
with:
29+
fetch-depth: 0
30+
-
31+
name: Set up Go
32+
uses: actions/setup-go@v4
33+
with:
34+
go-version: '>=1.21'
35+
- run: go version
36+
# - name: Configure git for private modules linux
37+
# if: ${{ matrix.os == 'ubuntu-latest' }}
38+
# env:
39+
# GOPRIVATE: github.com/progress-platform-services/*
40+
# run: git config --global url."https://${{ secrets.GH_TOKEN }}@github.com/".insteadOf "https://github.com/"
41+
-
42+
name: Run GoReleaser
43+
uses: goreleaser/goreleaser-action@v5
44+
with:
45+
distribution: goreleaser
46+
version: latest
47+
args: release --clean
48+
env:
49+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
50+
51+
# Unit Test and Sonar (SCA and unit test coverage)
52+
unit-test:
53+
name: 'Unit test and run Sonar scan'
54+
runs-on: ubuntu-latest-4-cores
55+
needs: goreleaser
56+
steps:
57+
- uses: actions/checkout@v4
58+
with:
59+
fetch-depth: 0
60+
61+
- name: 'Unit Test: Generate coverage.out and covreport.xml file'
62+
run: go test -v -coverprofile="coverage.out" ./...
63+
- name: Copy file
64+
run: cp coverage.out test/unittest/coverage.out
65+
# - name: cat the file
66+
# run: cat test/unittest/coverage.out
67+
68+
# - name: SonarQube Scan
69+
# uses: sonarsource/sonarqube-scan-action@master
70+
# # https://github.com/marketplace/actions/official-sonarqube-scan
71+
# env:
72+
# SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
73+
# SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
74+
75+
- name: Upload test coverage artifact
76+
uses: actions/upload-artifact@v4
77+
with:
78+
# Name of the artifact to upload.
79+
name: test-coverage.out
80+
# A file, directory or wildcard pattern that describes what to upload
81+
path: test/unittest/coverage.out
82+
83+

‎.github/workflows/cd-main-ruby-package-deploy-integration-test.yml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# ad hoc continuous delivery/deployment workflow for ruby package
2+
name: main and release branch CD workflow for ruby package
3+
4+
on:
5+
workflow_call:
6+
inputs:
7+
language:
8+
description: 'Primary language in the repository, for language-specific checks'
9+
required: false
10+
type: string
11+
default: 'Go'
12+
visibility:
13+
description: 'Visibility of the repository'
14+
required: false
15+
type: string
16+
default: 'public' # (private, public, or internal)
17+
skip-unit-tests:
18+
description: 'Skip unit tests'
19+
required: false
20+
type: boolean
21+
default: false
22+
23+
env:
24+
REPO_VISIBILITY: ${{ github.event.repository.visibility }}
25+
PIPELINE_VERSION: '1.0.0'
26+
27+
jobs:
28+
echo_inputs:
29+
name: 'Echo version of pipeline and inputs'
30+
runs-on: ubuntu-latest
31+
steps:
32+
- name: echo version of pipeline and inputs
33+
run: |
34+
echo "pipeline version $PIPELINE_VERSION"
35+
echo "Language set to ${{ inputs.language }} "
36+
echo "SCC output filename set to ${{ inputs.outputfilename }} "
37+
echo "Visibility set to $REPO_VISIBILITY [ ${{ inputs.visibility }} ]"
38+
echo "Skip trufflehog set to ${{ inputs.skip-trufflehog }}"
39+
echo "Skip SonarQube set to ${{ inputs.skip-sonarqube }}"
40+
echo "Skip unit tests set to ${{ inputs.skip-unit-tests }}"
41+
42+
# build binaries and executables
43+
44+
# package the binaries and executables
45+
46+
# Code signing (can generate MD5 SHA, but also need signature - not GPG but provisioned by Progress EVCode)
47+
# https://github.com/mtrojnar/osslsigncode?tab=readme-ov-file
48+
49+
# scan the binaries for vulnerabilities using intel CVE bin tool
50+
intel-cve-scan:
51+
if: ${{ inputs.skip-intel-cve-scan == false }}
52+
uses: chef/common-github-actions/.github/workflows/tools/intel-cve-bin.yml@main
53+
needs: echo_inputs
54+
secrets: inherit
55+
56+
57+
# deploy to integration test environment
58+
59+
# run integration tests
60+
61+
# Documentation generation
62+
# # Publish OpenAPI specs (for docs) to https://github.com/progress-platform-services/open-api-specifications/tree/main/chef

‎.github/workflows/ci-all-security-main.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ name: TruffleHog Secret Scan
33
on:
44
workflow_dispatch:
55
pull_request:
6-
#todo - add required branches like release**, CHEF-18 etc..
6+
#todo - add required branches like release**, CHEF-18 etc.. - actually add these in the repo starting event (snce inpsec is different from onfra 19)
77
branches: [ main ]
88

99
jobs:

0 commit comments

Comments
 (0)