Skip to content

Commit a195c4f

Browse files
rhmdndrhmdnd
committed
Setup CI for compliance-sdk library
We have a library that contains a CEL scanner for integrating into the Compliance Operator, making it easier for users to define their own compliance checks. This commit sets up some initial CI jobs that we can start using to gate the project.
1 parent 9957221 commit a195c4f

3 files changed

Lines changed: 302 additions & 0 deletions

File tree

‎ci-operator/config/ComplianceAsCode/compliance-sdk/ComplianceAsCode-compliance-sdk-main.yaml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
build_root:
2+
image_stream_tag:
3+
name: release
4+
namespace: openshift
5+
tag: golang-1.24
6+
releases:
7+
initial:
8+
integration:
9+
name: "4.19"
10+
namespace: ocp
11+
latest:
12+
integration:
13+
include_built_images: true
14+
name: "4.19"
15+
namespace: ocp
16+
resources:
17+
'*':
18+
requests:
19+
cpu: 200m
20+
memory: 400Mi
21+
tests:
22+
- as: compliance-sdk-integration-tests
23+
steps:
24+
cluster_profile: quay-aws
25+
env:
26+
BASE_DOMAIN: quay.devcluster.openshift.com
27+
test:
28+
- as: test
29+
cli: latest
30+
commands: make test-integration
31+
from: src
32+
resources:
33+
requests:
34+
cpu: 100m
35+
workflow: ipi-aws
36+
- as: compliance-sdk-unit-tests
37+
steps:
38+
cluster_profile: quay-aws
39+
env:
40+
BASE_DOMAIN: quay.devcluster.openshift.com
41+
test:
42+
- as: test
43+
cli: latest
44+
commands: make test-unit
45+
from: src
46+
resources:
47+
requests:
48+
cpu: 100m
49+
workflow: ipi-aws
50+
- as: compliance-sdk-lint
51+
steps:
52+
cluster_profile: quay-aws
53+
env:
54+
BASE_DOMAIN: quay.devcluster.openshift.com
55+
test:
56+
- as: test
57+
cli: latest
58+
commands: make lint
59+
from: src
60+
resources:
61+
requests:
62+
cpu: 100m
63+
workflow: ipi-aws
64+
zz_generated_metadata:
65+
branch: main
66+
org: ComplianceAsCode
67+
repo: compliance-sdk

‎ci-operator/config/ComplianceAsCode/compliance-sdk/OWNERS‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
component: "compliance-sdk"
2+
approvers:
3+
- xiaojiey
4+
- Vincent056
5+
- rhmdnd
6+
- yuumasato
7+
reviewers:
8+
- xiaojiey
9+
- Vincent056
10+
- rhmdnd
11+
- yuumasato

‎ci-operator/jobs/ComplianceAsCode/compliance-sdk/ComplianceAsCode-compliance-sdk-main-presubmits.yaml‎

Lines changed: 224 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,224 @@
1+
presubmits:
2+
ComplianceAsCode/compliance-sdk:
3+
- agent: kubernetes
4+
always_run: true
5+
branches:
6+
- ^main$
7+
- ^main-
8+
cluster: build07
9+
context: ci/prow/compliance-sdk-integration-tests
10+
decorate: true
11+
decoration_config:
12+
skip_cloning: true
13+
labels:
14+
ci-operator.openshift.io/cloud: aws
15+
ci-operator.openshift.io/cloud-cluster-profile: quay-aws
16+
ci.openshift.io/generator: prowgen
17+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
18+
name: pull-ci-ComplianceAsCode-compliance-sdk-main-compliance-sdk-integration-tests
19+
rerun_command: /test compliance-sdk-integration-tests
20+
spec:
21+
containers:
22+
- args:
23+
- --gcs-upload-secret=/secrets/gcs/service-account.json
24+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
25+
- --lease-server-credentials-file=/etc/boskos/credentials
26+
- --report-credentials-file=/etc/report/credentials
27+
- --secret-dir=/secrets/ci-pull-credentials
28+
- --target=compliance-sdk-integration-tests
29+
command:
30+
- ci-operator
31+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
32+
imagePullPolicy: Always
33+
name: ""
34+
resources:
35+
requests:
36+
cpu: 10m
37+
volumeMounts:
38+
- mountPath: /etc/boskos
39+
name: boskos
40+
readOnly: true
41+
- mountPath: /secrets/ci-pull-credentials
42+
name: ci-pull-credentials
43+
readOnly: true
44+
- mountPath: /secrets/gcs
45+
name: gcs-credentials
46+
readOnly: true
47+
- mountPath: /secrets/manifest-tool
48+
name: manifest-tool-local-pusher
49+
readOnly: true
50+
- mountPath: /etc/pull-secret
51+
name: pull-secret
52+
readOnly: true
53+
- mountPath: /etc/report
54+
name: result-aggregator
55+
readOnly: true
56+
serviceAccountName: ci-operator
57+
volumes:
58+
- name: boskos
59+
secret:
60+
items:
61+
- key: credentials
62+
path: credentials
63+
secretName: boskos-credentials
64+
- name: ci-pull-credentials
65+
secret:
66+
secretName: ci-pull-credentials
67+
- name: manifest-tool-local-pusher
68+
secret:
69+
secretName: manifest-tool-local-pusher
70+
- name: pull-secret
71+
secret:
72+
secretName: registry-pull-credentials
73+
- name: result-aggregator
74+
secret:
75+
secretName: result-aggregator
76+
trigger: (?m)^/test( | .* )compliance-sdk-integration-tests,?($|\s.*)
77+
- agent: kubernetes
78+
always_run: true
79+
branches:
80+
- ^main$
81+
- ^main-
82+
cluster: build07
83+
context: ci/prow/compliance-sdk-lint
84+
decorate: true
85+
decoration_config:
86+
skip_cloning: true
87+
labels:
88+
ci-operator.openshift.io/cloud: aws
89+
ci-operator.openshift.io/cloud-cluster-profile: quay-aws
90+
ci.openshift.io/generator: prowgen
91+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
92+
name: pull-ci-ComplianceAsCode-compliance-sdk-main-compliance-sdk-lint
93+
rerun_command: /test compliance-sdk-lint
94+
spec:
95+
containers:
96+
- args:
97+
- --gcs-upload-secret=/secrets/gcs/service-account.json
98+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
99+
- --lease-server-credentials-file=/etc/boskos/credentials
100+
- --report-credentials-file=/etc/report/credentials
101+
- --secret-dir=/secrets/ci-pull-credentials
102+
- --target=compliance-sdk-lint
103+
command:
104+
- ci-operator
105+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
106+
imagePullPolicy: Always
107+
name: ""
108+
resources:
109+
requests:
110+
cpu: 10m
111+
volumeMounts:
112+
- mountPath: /etc/boskos
113+
name: boskos
114+
readOnly: true
115+
- mountPath: /secrets/ci-pull-credentials
116+
name: ci-pull-credentials
117+
readOnly: true
118+
- mountPath: /secrets/gcs
119+
name: gcs-credentials
120+
readOnly: true
121+
- mountPath: /secrets/manifest-tool
122+
name: manifest-tool-local-pusher
123+
readOnly: true
124+
- mountPath: /etc/pull-secret
125+
name: pull-secret
126+
readOnly: true
127+
- mountPath: /etc/report
128+
name: result-aggregator
129+
readOnly: true
130+
serviceAccountName: ci-operator
131+
volumes:
132+
- name: boskos
133+
secret:
134+
items:
135+
- key: credentials
136+
path: credentials
137+
secretName: boskos-credentials
138+
- name: ci-pull-credentials
139+
secret:
140+
secretName: ci-pull-credentials
141+
- name: manifest-tool-local-pusher
142+
secret:
143+
secretName: manifest-tool-local-pusher
144+
- name: pull-secret
145+
secret:
146+
secretName: registry-pull-credentials
147+
- name: result-aggregator
148+
secret:
149+
secretName: result-aggregator
150+
trigger: (?m)^/test( | .* )compliance-sdk-lint,?($|\s.*)
151+
- agent: kubernetes
152+
always_run: true
153+
branches:
154+
- ^main$
155+
- ^main-
156+
cluster: build07
157+
context: ci/prow/compliance-sdk-unit-tests
158+
decorate: true
159+
decoration_config:
160+
skip_cloning: true
161+
labels:
162+
ci-operator.openshift.io/cloud: aws
163+
ci-operator.openshift.io/cloud-cluster-profile: quay-aws
164+
ci.openshift.io/generator: prowgen
165+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
166+
name: pull-ci-ComplianceAsCode-compliance-sdk-main-compliance-sdk-unit-tests
167+
rerun_command: /test compliance-sdk-unit-tests
168+
spec:
169+
containers:
170+
- args:
171+
- --gcs-upload-secret=/secrets/gcs/service-account.json
172+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
173+
- --lease-server-credentials-file=/etc/boskos/credentials
174+
- --report-credentials-file=/etc/report/credentials
175+
- --secret-dir=/secrets/ci-pull-credentials
176+
- --target=compliance-sdk-unit-tests
177+
command:
178+
- ci-operator
179+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
180+
imagePullPolicy: Always
181+
name: ""
182+
resources:
183+
requests:
184+
cpu: 10m
185+
volumeMounts:
186+
- mountPath: /etc/boskos
187+
name: boskos
188+
readOnly: true
189+
- mountPath: /secrets/ci-pull-credentials
190+
name: ci-pull-credentials
191+
readOnly: true
192+
- mountPath: /secrets/gcs
193+
name: gcs-credentials
194+
readOnly: true
195+
- mountPath: /secrets/manifest-tool
196+
name: manifest-tool-local-pusher
197+
readOnly: true
198+
- mountPath: /etc/pull-secret
199+
name: pull-secret
200+
readOnly: true
201+
- mountPath: /etc/report
202+
name: result-aggregator
203+
readOnly: true
204+
serviceAccountName: ci-operator
205+
volumes:
206+
- name: boskos
207+
secret:
208+
items:
209+
- key: credentials
210+
path: credentials
211+
secretName: boskos-credentials
212+
- name: ci-pull-credentials
213+
secret:
214+
secretName: ci-pull-credentials
215+
- name: manifest-tool-local-pusher
216+
secret:
217+
secretName: manifest-tool-local-pusher
218+
- name: pull-secret
219+
secret:
220+
secretName: registry-pull-credentials
221+
- name: result-aggregator
222+
secret:
223+
secretName: result-aggregator
224+
trigger: (?m)^/test( | .* )compliance-sdk-unit-tests,?($|\s.*)

0 commit comments

Comments
 (0)