Skip to content

Commit 56fc06c

Browse files
rhmdndrhmdnd
committed
Setup CI for compliance-sdk library
We have a library that contains a CEL scanner for integrating into the Compliance Operator, making it easier for users to define their own compliance checks. This commit sets up some initial CI jobs that we can start using to gate the project.
1 parent 9957221 commit 56fc06c

7 files changed

Lines changed: 412 additions & 0 deletions

File tree

‎ci-operator/config/ComplianceAsCode/compliance-sdk/ComplianceAsCode-compliance-sdk-main.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
build_root:
2+
image_stream_tag:
3+
name: release
4+
namespace: openshift
5+
tag: golang-1.24
6+
releases:
7+
initial:
8+
integration:
9+
name: "4.19"
10+
namespace: ocp
11+
latest:
12+
integration:
13+
include_built_images: true
14+
name: "4.19"
15+
namespace: ocp
16+
resources:
17+
'*':
18+
requests:
19+
cpu: 200m
20+
memory: 400Mi
21+
tests:
22+
- as: compliance-sdk-integration-tests
23+
skip_if_only_changed: ^.*md$|^OWNERS$|^LICENSE$
24+
steps:
25+
cluster_profile: quay-aws
26+
env:
27+
BASE_DOMAIN: quay.devcluster.openshift.com
28+
test:
29+
- as: test
30+
cli: latest
31+
commands: make test-integration
32+
from: src
33+
resources:
34+
requests:
35+
cpu: 100m
36+
workflow: ipi-aws
37+
- as: compliance-sdk-unit-tests
38+
steps:
39+
cluster_profile: quay-aws
40+
env:
41+
BASE_DOMAIN: quay.devcluster.openshift.com
42+
test:
43+
- as: test
44+
cli: latest
45+
commands: make test-unit
46+
from: src
47+
resources:
48+
requests:
49+
cpu: 100m
50+
- as: compliance-sdk-lint
51+
steps:
52+
cluster_profile: quay-aws
53+
env:
54+
BASE_DOMAIN: quay.devcluster.openshift.com
55+
test:
56+
- as: test
57+
cli: latest
58+
commands: make lint
59+
from: src
60+
resources:
61+
requests:
62+
cpu: 100m
63+
zz_generated_metadata:
64+
branch: main
65+
org: ComplianceAsCode
66+
repo: compliance-sdk

‎ci-operator/config/ComplianceAsCode/compliance-sdk/OWNERS‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
component: "compliance-sdk"
2+
approvers:
3+
- xiaojiey
4+
- Vincent056
5+
- rhmdnd
6+
- yuumasato
7+
reviewers:
8+
- xiaojiey
9+
- Vincent056
10+
- rhmdnd
11+
- yuumasato

‎ci-operator/jobs/ComplianceAsCode/compliance-sdk/ComplianceAsCode-compliance-sdk-main-presubmits.yaml‎

Lines changed: 224 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
presubmits:
2+
ComplianceAsCode/compliance-sdk:
3+
- agent: kubernetes
4+
always_run: true
5+
branches:
6+
- ^main$
7+
- ^main-
8+
cluster: build07
9+
context: ci/prow/compliance-sdk-integration-tests
10+
decorate: true
11+
decoration_config:
12+
skip_cloning: true
13+
labels:
14+
ci-operator.openshift.io/cloud: aws
15+
ci-operator.openshift.io/cloud-cluster-profile: quay-aws
16+
ci.openshift.io/generator: prowgen
17+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
18+
name: pull-ci-ComplianceAsCode-compliance-sdk-main-compliance-sdk-integration-tests
19+
rerun_command: /test compliance-sdk-integration-tests
20+
spec:
21+
containers:
22+
- args:
23+
- --gcs-upload-secret=/secrets/gcs/service-account.json
24+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
25+
- --lease-server-credentials-file=/etc/boskos/credentials
26+
- --report-credentials-file=/etc/report/credentials
27+
- --secret-dir=/secrets/ci-pull-credentials
28+
- --target=compliance-sdk-integration-tests
29+
command:
30+
- ci-operator
31+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
32+
imagePullPolicy: Always
33+
name: ""
34+
resources:
35+
requests:
36+
cpu: 10m
37+
volumeMounts:
38+
- mountPath: /etc/boskos
39+
name: boskos
40+
readOnly: true
41+
- mountPath: /secrets/ci-pull-credentials
42+
name: ci-pull-credentials
43+
readOnly: true
44+
- mountPath: /secrets/gcs
45+
name: gcs-credentials
46+
readOnly: true
47+
- mountPath: /secrets/manifest-tool
48+
name: manifest-tool-local-pusher
49+
readOnly: true
50+
- mountPath: /etc/pull-secret
51+
name: pull-secret
52+
readOnly: true
53+
- mountPath: /etc/report
54+
name: result-aggregator
55+
readOnly: true
56+
serviceAccountName: ci-operator
57+
volumes:
58+
- name: boskos
59+
secret:
60+
items:
61+
- key: credentials
62+
path: credentials
63+
secretName: boskos-credentials
64+
- name: ci-pull-credentials
65+
secret:
66+
secretName: ci-pull-credentials
67+
- name: manifest-tool-local-pusher
68+
secret:
69+
secretName: manifest-tool-local-pusher
70+
- name: pull-secret
71+
secret:
72+
secretName: registry-pull-credentials
73+
- name: result-aggregator
74+
secret:
75+
secretName: result-aggregator
76+
trigger: (?m)^/test( | .* )compliance-sdk-integration-tests,?($|\s.*)
77+
- agent: kubernetes
78+
always_run: true
79+
branches:
80+
- ^main$
81+
- ^main-
82+
cluster: build07
83+
context: ci/prow/compliance-sdk-lint
84+
decorate: true
85+
decoration_config:
86+
skip_cloning: true
87+
labels:
88+
ci-operator.openshift.io/cloud: aws
89+
ci-operator.openshift.io/cloud-cluster-profile: quay-aws
90+
ci.openshift.io/generator: prowgen
91+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
92+
name: pull-ci-ComplianceAsCode-compliance-sdk-main-compliance-sdk-lint
93+
rerun_command: /test compliance-sdk-lint
94+
spec:
95+
containers:
96+
- args:
97+
- --gcs-upload-secret=/secrets/gcs/service-account.json
98+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
99+
- --lease-server-credentials-file=/etc/boskos/credentials
100+
- --report-credentials-file=/etc/report/credentials
101+
- --secret-dir=/secrets/ci-pull-credentials
102+
- --target=compliance-sdk-lint
103+
command:
104+
- ci-operator
105+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
106+
imagePullPolicy: Always
107+
name: ""
108+
resources:
109+
requests:
110+
cpu: 10m
111+
volumeMounts:
112+
- mountPath: /etc/boskos
113+
name: boskos
114+
readOnly: true
115+
- mountPath: /secrets/ci-pull-credentials
116+
name: ci-pull-credentials
117+
readOnly: true
118+
- mountPath: /secrets/gcs
119+
name: gcs-credentials
120+
readOnly: true
121+
- mountPath: /secrets/manifest-tool
122+
name: manifest-tool-local-pusher
123+
readOnly: true
124+
- mountPath: /etc/pull-secret
125+
name: pull-secret
126+
readOnly: true
127+
- mountPath: /etc/report
128+
name: result-aggregator
129+
readOnly: true
130+
serviceAccountName: ci-operator
131+
volumes:
132+
- name: boskos
133+
secret:
134+
items:
135+
- key: credentials
136+
path: credentials
137+
secretName: boskos-credentials
138+
- name: ci-pull-credentials
139+
secret:
140+
secretName: ci-pull-credentials
141+
- name: manifest-tool-local-pusher
142+
secret:
143+
secretName: manifest-tool-local-pusher
144+
- name: pull-secret
145+
secret:
146+
secretName: registry-pull-credentials
147+
- name: result-aggregator
148+
secret:
149+
secretName: result-aggregator
150+
trigger: (?m)^/test( | .* )compliance-sdk-lint,?($|\s.*)
151+
- agent: kubernetes
152+
always_run: true
153+
branches:
154+
- ^main$
155+
- ^main-
156+
cluster: build07
157+
context: ci/prow/compliance-sdk-unit-tests
158+
decorate: true
159+
decoration_config:
160+
skip_cloning: true
161+
labels:
162+
ci-operator.openshift.io/cloud: aws
163+
ci-operator.openshift.io/cloud-cluster-profile: quay-aws
164+
ci.openshift.io/generator: prowgen
165+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
166+
name: pull-ci-ComplianceAsCode-compliance-sdk-main-compliance-sdk-unit-tests
167+
rerun_command: /test compliance-sdk-unit-tests
168+
spec:
169+
containers:
170+
- args:
171+
- --gcs-upload-secret=/secrets/gcs/service-account.json
172+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
173+
- --lease-server-credentials-file=/etc/boskos/credentials
174+
- --report-credentials-file=/etc/report/credentials
175+
- --secret-dir=/secrets/ci-pull-credentials
176+
- --target=compliance-sdk-unit-tests
177+
command:
178+
- ci-operator
179+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
180+
imagePullPolicy: Always
181+
name: ""
182+
resources:
183+
requests:
184+
cpu: 10m
185+
volumeMounts:
186+
- mountPath: /etc/boskos
187+
name: boskos
188+
readOnly: true
189+
- mountPath: /secrets/ci-pull-credentials
190+
name: ci-pull-credentials
191+
readOnly: true
192+
- mountPath: /secrets/gcs
193+
name: gcs-credentials
194+
readOnly: true
195+
- mountPath: /secrets/manifest-tool
196+
name: manifest-tool-local-pusher
197+
readOnly: true
198+
- mountPath: /etc/pull-secret
199+
name: pull-secret
200+
readOnly: true
201+
- mountPath: /etc/report
202+
name: result-aggregator
203+
readOnly: true
204+
serviceAccountName: ci-operator
205+
volumes:
206+
- name: boskos
207+
secret:
208+
items:
209+
- key: credentials
210+
path: credentials
211+
secretName: boskos-credentials
212+
- name: ci-pull-credentials
213+
secret:
214+
secretName: ci-pull-credentials
215+
- name: manifest-tool-local-pusher
216+
secret:
217+
secretName: manifest-tool-local-pusher
218+
- name: pull-secret
219+
secret:
220+
secretName: registry-pull-credentials
221+
- name: result-aggregator
222+
secret:
223+
secretName: result-aggregator
224+
trigger: (?m)^/test( | .* )compliance-sdk-unit-tests,?($|\s.*)

‎ci-operator/jobs/ComplianceAsCode/compliance-sdk/OWNERS‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
component: "compliance-sdk"
2+
approvers:
3+
- xiaojiey
4+
- Vincent056
5+
- rhmdnd
6+
- yuumasato
7+
reviewers:
8+
- xiaojiey
9+
- Vincent056
10+
- rhmdnd
11+
- yuumasato

‎core-services/prow/02_config/ComplianceAsCode/compliance-sdk/OWNERS‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
approvers:
2+
- rhmdnd
3+
- vincent056
4+
- xiaojiey
5+
- yuumasato
6+
options: {}
7+
reviewers:
8+
- rhmdnd
9+
- vincent056
10+
- xiaojiey
11+
- yuumasato

‎core-services/prow/02_config/ComplianceAsCode/compliance-sdk/_pluginconfig.yaml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
approve:
2+
- commandHelpLink: https://go.k8s.io/bot-commands
3+
repos:
4+
- ComplianceAsCode/compliance-sdk
5+
require_self_approval: false
6+
external_plugins:
7+
ComplianceAsCode/compliance-sdk:
8+
- endpoint: http://refresh
9+
events:
10+
- issue_comment
11+
name: refresh
12+
- endpoint: http://cherrypick
13+
events:
14+
- issue_comment
15+
- pull_request
16+
name: cherrypick
17+
- endpoint: http://needs-rebase
18+
events:
19+
- pull_request
20+
name: needs-rebase
21+
- endpoint: http://jira-lifecycle-plugin
22+
events:
23+
- issue_comment
24+
- pull_request
25+
name: jira-lifecycle-plugin
26+
lgtm:
27+
- repos:
28+
- ComplianceAsCode/compliance-sdk
29+
review_acts_as_lgtm: true
30+
plugins:
31+
ComplianceAsCode/compliance-sdk:
32+
plugins:
33+
- assign
34+
- blunderbuss
35+
- cat
36+
- dog
37+
- heart
38+
- golint
39+
- goose
40+
- help
41+
- hold
42+
- label
43+
- lgtm
44+
- lifecycle
45+
- override
46+
- pony
47+
- retitle
48+
- shrug
49+
- sigmention
50+
- skip
51+
- trigger
52+
- verify-owners
53+
- owners-label
54+
- wip
55+
- yuks
56+
- approve

0 commit comments

Comments
 (0)