Skip to content

Commit f484039

Browse files
rhmdndrhmdnd
committed
Setup CI for compliance-sdk library
We have a library that contains a CEL scanner for integrating into the Compliance Operator, making it easier for users to define their own compliance checks. This commit sets up some initial CI jobs that we can start using to gate the project.
1 parent 9957221 commit f484039

7 files changed

Lines changed: 409 additions & 0 deletions

File tree

‎ci-operator/config/ComplianceAsCode/compliance-sdk/ComplianceAsCode-compliance-sdk-main.yaml‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
build_root:
2+
image_stream_tag:
3+
name: release
4+
namespace: openshift
5+
tag: golang-1.24
6+
releases:
7+
initial:
8+
integration:
9+
name: "4.19"
10+
namespace: ocp
11+
latest:
12+
integration:
13+
include_built_images: true
14+
name: "4.19"
15+
namespace: ocp
16+
resources:
17+
'*':
18+
requests:
19+
cpu: 200m
20+
memory: 400Mi
21+
tests:
22+
- as: compliance-sdk-integration-tests
23+
skip_if_only_changed: ^.*md$|^OWNERS$|^LICENSE$
24+
steps:
25+
cluster_profile: quay-aws
26+
env:
27+
BASE_DOMAIN: quay.devcluster.openshift.com
28+
test:
29+
- as: test
30+
cli: latest
31+
commands: make test-integration
32+
from: src
33+
resources:
34+
requests:
35+
cpu: 100m
36+
workflow: ipi-aws
37+
- as: compliance-sdk-unit-tests
38+
steps:
39+
cluster_profile: quay-aws
40+
test:
41+
- as: test
42+
cli: latest
43+
commands: make test-unit
44+
from: src
45+
resources:
46+
requests:
47+
cpu: 100m
48+
- as: compliance-sdk-lint
49+
steps:
50+
cluster_profile: quay-aws
51+
test:
52+
- as: test
53+
cli: latest
54+
commands: make lint
55+
from: src
56+
resources:
57+
requests:
58+
cpu: 100m
59+
zz_generated_metadata:
60+
branch: main
61+
org: ComplianceAsCode
62+
repo: compliance-sdk

‎ci-operator/config/ComplianceAsCode/compliance-sdk/OWNERS‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
component: "compliance-sdk"
2+
approvers:
3+
- xiaojiey
4+
- Vincent056
5+
- rhmdnd
6+
- yuumasato
7+
reviewers:
8+
- xiaojiey
9+
- Vincent056
10+
- rhmdnd
11+
- yuumasato

‎ci-operator/jobs/ComplianceAsCode/compliance-sdk/ComplianceAsCode-compliance-sdk-main-presubmits.yaml‎

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
presubmits:
2+
ComplianceAsCode/compliance-sdk:
3+
- agent: kubernetes
4+
always_run: false
5+
branches:
6+
- ^main$
7+
- ^main-
8+
cluster: build07
9+
context: ci/prow/compliance-sdk-integration-tests
10+
decorate: true
11+
decoration_config:
12+
skip_cloning: true
13+
labels:
14+
ci-operator.openshift.io/cloud: aws
15+
ci-operator.openshift.io/cloud-cluster-profile: quay-aws
16+
ci.openshift.io/generator: prowgen
17+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
18+
name: pull-ci-ComplianceAsCode-compliance-sdk-main-compliance-sdk-integration-tests
19+
rerun_command: /test compliance-sdk-integration-tests
20+
skip_if_only_changed: ^.*md$|^OWNERS$|^LICENSE$
21+
spec:
22+
containers:
23+
- args:
24+
- --gcs-upload-secret=/secrets/gcs/service-account.json
25+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
26+
- --lease-server-credentials-file=/etc/boskos/credentials
27+
- --report-credentials-file=/etc/report/credentials
28+
- --secret-dir=/secrets/ci-pull-credentials
29+
- --target=compliance-sdk-integration-tests
30+
command:
31+
- ci-operator
32+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
33+
imagePullPolicy: Always
34+
name: ""
35+
resources:
36+
requests:
37+
cpu: 10m
38+
volumeMounts:
39+
- mountPath: /etc/boskos
40+
name: boskos
41+
readOnly: true
42+
- mountPath: /secrets/ci-pull-credentials
43+
name: ci-pull-credentials
44+
readOnly: true
45+
- mountPath: /secrets/gcs
46+
name: gcs-credentials
47+
readOnly: true
48+
- mountPath: /secrets/manifest-tool
49+
name: manifest-tool-local-pusher
50+
readOnly: true
51+
- mountPath: /etc/pull-secret
52+
name: pull-secret
53+
readOnly: true
54+
- mountPath: /etc/report
55+
name: result-aggregator
56+
readOnly: true
57+
serviceAccountName: ci-operator
58+
volumes:
59+
- name: boskos
60+
secret:
61+
items:
62+
- key: credentials
63+
path: credentials
64+
secretName: boskos-credentials
65+
- name: ci-pull-credentials
66+
secret:
67+
secretName: ci-pull-credentials
68+
- name: manifest-tool-local-pusher
69+
secret:
70+
secretName: manifest-tool-local-pusher
71+
- name: pull-secret
72+
secret:
73+
secretName: registry-pull-credentials
74+
- name: result-aggregator
75+
secret:
76+
secretName: result-aggregator
77+
trigger: (?m)^/test( | .* )compliance-sdk-integration-tests,?($|\s.*)
78+
- agent: kubernetes
79+
always_run: true
80+
branches:
81+
- ^main$
82+
- ^main-
83+
cluster: build07
84+
context: ci/prow/compliance-sdk-lint
85+
decorate: true
86+
decoration_config:
87+
skip_cloning: true
88+
labels:
89+
ci-operator.openshift.io/cloud: aws
90+
ci-operator.openshift.io/cloud-cluster-profile: quay-aws
91+
ci.openshift.io/generator: prowgen
92+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
93+
name: pull-ci-ComplianceAsCode-compliance-sdk-main-compliance-sdk-lint
94+
rerun_command: /test compliance-sdk-lint
95+
spec:
96+
containers:
97+
- args:
98+
- --gcs-upload-secret=/secrets/gcs/service-account.json
99+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
100+
- --lease-server-credentials-file=/etc/boskos/credentials
101+
- --report-credentials-file=/etc/report/credentials
102+
- --secret-dir=/secrets/ci-pull-credentials
103+
- --target=compliance-sdk-lint
104+
command:
105+
- ci-operator
106+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
107+
imagePullPolicy: Always
108+
name: ""
109+
resources:
110+
requests:
111+
cpu: 10m
112+
volumeMounts:
113+
- mountPath: /etc/boskos
114+
name: boskos
115+
readOnly: true
116+
- mountPath: /secrets/ci-pull-credentials
117+
name: ci-pull-credentials
118+
readOnly: true
119+
- mountPath: /secrets/gcs
120+
name: gcs-credentials
121+
readOnly: true
122+
- mountPath: /secrets/manifest-tool
123+
name: manifest-tool-local-pusher
124+
readOnly: true
125+
- mountPath: /etc/pull-secret
126+
name: pull-secret
127+
readOnly: true
128+
- mountPath: /etc/report
129+
name: result-aggregator
130+
readOnly: true
131+
serviceAccountName: ci-operator
132+
volumes:
133+
- name: boskos
134+
secret:
135+
items:
136+
- key: credentials
137+
path: credentials
138+
secretName: boskos-credentials
139+
- name: ci-pull-credentials
140+
secret:
141+
secretName: ci-pull-credentials
142+
- name: manifest-tool-local-pusher
143+
secret:
144+
secretName: manifest-tool-local-pusher
145+
- name: pull-secret
146+
secret:
147+
secretName: registry-pull-credentials
148+
- name: result-aggregator
149+
secret:
150+
secretName: result-aggregator
151+
trigger: (?m)^/test( | .* )compliance-sdk-lint,?($|\s.*)
152+
- agent: kubernetes
153+
always_run: true
154+
branches:
155+
- ^main$
156+
- ^main-
157+
cluster: build07
158+
context: ci/prow/compliance-sdk-unit-tests
159+
decorate: true
160+
decoration_config:
161+
skip_cloning: true
162+
labels:
163+
ci-operator.openshift.io/cloud: aws
164+
ci-operator.openshift.io/cloud-cluster-profile: quay-aws
165+
ci.openshift.io/generator: prowgen
166+
pj-rehearse.openshift.io/can-be-rehearsed: "true"
167+
name: pull-ci-ComplianceAsCode-compliance-sdk-main-compliance-sdk-unit-tests
168+
rerun_command: /test compliance-sdk-unit-tests
169+
spec:
170+
containers:
171+
- args:
172+
- --gcs-upload-secret=/secrets/gcs/service-account.json
173+
- --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
174+
- --lease-server-credentials-file=/etc/boskos/credentials
175+
- --report-credentials-file=/etc/report/credentials
176+
- --secret-dir=/secrets/ci-pull-credentials
177+
- --target=compliance-sdk-unit-tests
178+
command:
179+
- ci-operator
180+
image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
181+
imagePullPolicy: Always
182+
name: ""
183+
resources:
184+
requests:
185+
cpu: 10m
186+
volumeMounts:
187+
- mountPath: /etc/boskos
188+
name: boskos
189+
readOnly: true
190+
- mountPath: /secrets/ci-pull-credentials
191+
name: ci-pull-credentials
192+
readOnly: true
193+
- mountPath: /secrets/gcs
194+
name: gcs-credentials
195+
readOnly: true
196+
- mountPath: /secrets/manifest-tool
197+
name: manifest-tool-local-pusher
198+
readOnly: true
199+
- mountPath: /etc/pull-secret
200+
name: pull-secret
201+
readOnly: true
202+
- mountPath: /etc/report
203+
name: result-aggregator
204+
readOnly: true
205+
serviceAccountName: ci-operator
206+
volumes:
207+
- name: boskos
208+
secret:
209+
items:
210+
- key: credentials
211+
path: credentials
212+
secretName: boskos-credentials
213+
- name: ci-pull-credentials
214+
secret:
215+
secretName: ci-pull-credentials
216+
- name: manifest-tool-local-pusher
217+
secret:
218+
secretName: manifest-tool-local-pusher
219+
- name: pull-secret
220+
secret:
221+
secretName: registry-pull-credentials
222+
- name: result-aggregator
223+
secret:
224+
secretName: result-aggregator
225+
trigger: (?m)^/test( | .* )compliance-sdk-unit-tests,?($|\s.*)

‎ci-operator/jobs/ComplianceAsCode/compliance-sdk/OWNERS‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
component: "compliance-sdk"
2+
approvers:
3+
- xiaojiey
4+
- Vincent056
5+
- rhmdnd
6+
- yuumasato
7+
reviewers:
8+
- xiaojiey
9+
- Vincent056
10+
- rhmdnd
11+
- yuumasato

‎core-services/prow/02_config/ComplianceAsCode/compliance-sdk/OWNERS‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
approvers:
2+
- rhmdnd
3+
- vincent056
4+
- xiaojiey
5+
- yuumasato
6+
options: {}
7+
reviewers:
8+
- rhmdnd
9+
- vincent056
10+
- xiaojiey
11+
- yuumasato

‎core-services/prow/02_config/ComplianceAsCode/compliance-sdk/_pluginconfig.yaml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
approve:
2+
- commandHelpLink: https://go.k8s.io/bot-commands
3+
repos:
4+
- ComplianceAsCode/compliance-sdk
5+
require_self_approval: false
6+
external_plugins:
7+
ComplianceAsCode/compliance-sdk:
8+
- endpoint: http://refresh
9+
events:
10+
- issue_comment
11+
name: refresh
12+
- endpoint: http://cherrypick
13+
events:
14+
- issue_comment
15+
- pull_request
16+
name: cherrypick
17+
- endpoint: http://needs-rebase
18+
events:
19+
- pull_request
20+
name: needs-rebase
21+
- endpoint: http://jira-lifecycle-plugin
22+
events:
23+
- issue_comment
24+
- pull_request
25+
name: jira-lifecycle-plugin
26+
lgtm:
27+
- repos:
28+
- ComplianceAsCode/compliance-sdk
29+
review_acts_as_lgtm: true
30+
plugins:
31+
ComplianceAsCode/compliance-sdk:
32+
plugins:
33+
- assign
34+
- blunderbuss
35+
- cat
36+
- dog
37+
- heart
38+
- golint
39+
- goose
40+
- help
41+
- hold
42+
- label
43+
- lgtm
44+
- lifecycle
45+
- override
46+
- pony
47+
- retitle
48+
- shrug
49+
- sigmention
50+
- skip
51+
- trigger
52+
- verify-owners
53+
- owners-label
54+
- wip
55+
- yuks
56+
- approve

0 commit comments

Comments
 (0)