build.yaml

name: Build and Test

on:
  workflow_call:
    inputs:
      mode:
        required: true
        type: string
        description:
          mode as expected by `cc-util/.github/workflows/prepare`
          either of
          - snapshot
          - release

jobs:
  prepare:
    uses: gardener/cc-utils/.github/workflows/prepare.yaml@v1
    permissions:
      id-token: write
    with:
      mode: ${{ inputs.mode }}

  packages:
    runs-on: ubuntu-latest
    needs:
      - prepare
    permissions:
      contents: read
    outputs:
      version: ${{ steps.packages.outputs.version }}
    steps:
      - name: install setuptools
        run: |
          pip3 install --root-user-action ignore \
            setuptools
      - uses: gardener/cc-utils/.github/actions/trusted-checkout@v1
      - uses: gardener/cc-utils/.github/actions/install-gardener-gha-libs@v1
      - name: create distribution packages
        id: packages
        run: |
          set -eu

          version=${{ needs.prepare.outputs.version }}
          if [[ "${version}" == *-* ]]; then
            # version was non-final - add suffix compliant w/ pep-440
            version="${version%%-*}-dev0"
          fi

          echo "version: ${version}"
          echo "version=${version}" >> "${GITHUB_OUTPUT}"

          # pass finalised version to setup
          export ODG_CORE_LIBS_VERSION=${version}

          pkg_dir=dist
          mkdir -p ${pkg_dir}
          pkg_dir="$(readlink -f dist)"

          for path in \
            setup.py \
          ; do
          echo "building distribution package from ${path}"
          python3 ${path} \
              bdist_wheel \
              --dist-dir ${pkg_dir}
          rm -rf build
          done

          echo "Built packages"
          ls "${pkg_dir}"

          blobs_dir="${pkg_dir}/blobs.d"
          mkdir ${blobs_dir}
          resources_file=resources.yaml

          for package in \
            odg-core-libs \
            ; do
            path="$(echo $package | tr - _)-*"
            outf="${pkg_dir}/${package}.tar.gz"
            tar cJf ${outf} -C ${pkg_dir} $(cd ${pkg_dir}; ls ${path})
            mimetype=$(file -i ${outf} | cut -d: -f2 | cut -d' ' -f2-)
            leng=$(stat -c"%s" ${outf})
            digest="$(sha256sum ${outf} | cut -d' ' -f1)"
            echo "\
          - name: ${package}
            version: ${{ needs.prepare.outputs.version }}
            type: ${mimetype}
            relation: local
            access:
              type: localBlob
              localReference: sha256:${digest}
              size: ${leng}
              mediaType: ${mimetype}" \
            >> ${resources_file}
            mv ${outf} ${blobs_dir}/${digest}
          done

          cp "${resources_file}" dist/ocm_resources.yaml
          tar czf distribution-packages.tar.gz dist
      - name: export-ocm-fragments
        uses: gardener/cc-utils/.github/actions/export-ocm-fragments@v1
        with:
          ocm-resources-file: dist/ocm_resources.yaml
          blobs-directory: dist/blobs.d
      - name: upload python-packages as artefact
        uses: actions/upload-artifact@v4
        with:
          name: distribution-packages
          path: distribution-packages.tar.gz

  odg-extension-definitions:
    runs-on: ubuntu-latest
    needs:
      - prepare
    permissions:
      contents: read
    steps:
      - uses: gardener/cc-utils/.github/actions/trusted-checkout@v1
      - name: Export odg-extension-definitions
        run: |
          set -euo pipefail

          echo "${{ needs.prepare.outputs.version }}" | .ci/write-version

          mkdir blobs.d
          tar czf blobs.d/extension_definitions.tar.gz extension-definitions.yaml
      - uses: gardener/cc-utils/.github/actions/export-ocm-fragments@v1
        with:
          ocm-resources: |
            name: odg-extension-definitions
            type: odg-extension
            relation: local
            access:
              type: localBlob
              localReference: extension_definitions.tar.gz
          blobs-directory: blobs.d

  helmchart-imagemap:
    runs-on: ubuntu-latest
    needs:
      - prepare
    permissions:
      contents: read
    steps:
      - uses: gardener/cc-utils/.github/actions/trusted-checkout@v1
      - name: Export Helmchart-Imagemap
        run: |
          set -eu

          mkdir blobs.d
          mv postgresql-helmchart-imagemap.json blobs.d
      - uses: gardener/cc-utils/.github/actions/export-ocm-fragments@v1
        with:
          ocm-resources: |
            name: postgresql
            type: helmchart-imagemap
            extraIdentity:
              type: helmchart-imagemap
            relation: local
            access:
              type: localBlob
              localReference: postgresql-helmchart-imagemap.json
          blobs-directory: blobs.d

  lint:
    runs-on: ubuntu-latest
    needs:
      - packages
    permissions:
      contents: read
    steps:
      - uses: gardener/cc-utils/.github/actions/trusted-checkout@v1
      - name: Retrieve Distribution Packages
        uses: actions/download-artifact@v4
        with:
          name: distribution-packages
      - name: lint
        run: |
          tar xf distribution-packages.tar.gz -C /tmp

          echo "installing linters"
          if ! pip3 install --pre --upgrade --break-system-packages \
            --find-links /tmp/dist \
            -r requirements.bdba-client.txt \
            -r requirements.odg-client.txt \
            -r requirements.txt \
            numpy \
            scipy \
            bandit \
            ruff \
            setuptools \
              > /tmp/pip3-install.log; then
            echo "error while trying to install packages:"
            cat /tmp/pip3-install.log
          fi

          echo "running linters"
          blobs_dir=blobs.d
          mkdir $blobs_dir
          bandit_logfile=bandit.log
          bandit_evidence="${blobs_dir}/bandit.tar.gz"

          bandit_extra_args="-f txt -o ${bandit_logfile}" \
            make lint

          # pass bandit.log + used cfg (pyproject.toml) as evidence
          tar czf $bandit_evidence $bandit_logfile pyproject.toml

          echo "running format checker"
          make format
      - uses: gardener/cc-utils/.github/actions/export-ocm-fragments@v1
        with:
          ocm-resources: |
            name: sast-linting-evidence
            relation: local
            access:
              type: localBlob
              localReference: bandit.tar.gz
            labels:
              - name: gardener.cloud/purposes
                value:
                  - lint
                  - sast
                  - pybandit
              - name: gardener.cloud/comment
                value: |
                  we use bandit (linter) for SAST-Scans.
                  See: https://bandit.readthedocs.io/en/latest/
          blobs-directory: blobs.d

  unittests:
    runs-on: ubuntu-latest
    needs:
      - packages
    permissions:
      contents: read
    steps:
      - uses: gardener/cc-utils/.github/actions/trusted-checkout@v1
      - name: Retrieve Distribution Packages
        uses: actions/download-artifact@v4
        with:
          name: distribution-packages
      - name: run-tests
        run: |
          tar xf distribution-packages.tar.gz -C /tmp

          echo "installing packages"
          if ! pip3 install --pre --upgrade --break-system-packages \
            --find-links /tmp/dist \
            -r requirements-dev.txt \
              > /tmp/pip3-install.log; then
            echo "error while trying to install packages:"
            cat /tmp/pip3-install.log
          fi

          echo "running tests"
          .ci/smoke-test
          make test

  oci-image:
    name: Build OCI-Image
    uses: gardener/cc-utils/.github/workflows/oci-ocm.yaml@v1
    needs:
      - packages # needed indirectly (python-packages artefact)
      - prepare
    permissions:
      contents: read
      packages: write
      id-token: write
    with:
      name: core
      version: ${{ needs.prepare.outputs.version }}
      oci-registry: ${{ needs.prepare.outputs.oci-registry }}
      oci-repository: odg/core
      dockerfile: Dockerfile
      ctx: oci-image
      oci-platforms: linux/arm64,linux/amd64
      build-ctx-artefact: distribution-packages
      untar-build-ctx-artefact: distribution-packages.tar.gz
      build-args: |
        ODG_CORE_LIBS_VERSION=${{ needs.packages.outputs.version }}
      ocm-labels: |
        name: gardener.cloud/cve-categorisation
        value:
          network_exposure: public
          authentication_enforced: true
          user_interaction: end-user
          confidentiality_requirement: high
          integrity_requirement: high
          availability_requirement: high

  helmcharts:
    name: Build Helmcharts
    uses: gardener/cc-utils/.github/workflows/helmchart-ocm.yaml@v1
    needs:
      - prepare
      - oci-image
    permissions:
      contents: read
      packages: write
      id-token: write
    strategy:
      matrix:
        args:
          - name: delivery-service
            dir: charts/delivery-service
            mappings:
              - ref: ocm-resource:core.repository
                attribute: image.repository
              - ref: ocm-resource:core.tag
                attribute: image.tag
          - name: extensions
            dir: charts/extensions
            mappings:
              - ref: ocm-resource:core.repository
                attribute: global.image.repository
              - ref: ocm-resource:core.tag
                attribute: global.image.tag
          - name: bootstrapping
            dir: charts/bootstrapping
            mappings: []
    with:
      name: ${{ matrix.args.name }}
      dir: ${{ matrix.args.dir }}
      ocm-repository: ${{ needs.prepare.outputs.ocm-releases-repository }}
      oci-registry: ${{ needs.prepare.outputs.oci-registry }}
      oci-repository: charts/odg
      ocm-mappings: ${{ toJSON(matrix.args.mappings) }}