From ec3ba7d774f493907b22bc7fe1383ba62b3dc743 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 6 Oct 2026 12:35:28 -0600 Subject: [PATCH 1/7] feat: add go testbed source Signed-off-by: Sean Tronsen --- Dockerfile | 8 ++++++++ Makefile | 29 +++++++++++++++++++++++++++++ cmd/testbed/main.go | 24 ++++++++++++++++++++++++ cmd/testbed/main_test.go | 15 +++++++++++++++ go.mod | 3 +++ go.mod.license | 2 ++ 6 files changed, 81 insertions(+) create mode 100644 Dockerfile create mode 100644 Makefile create mode 100644 cmd/testbed/main.go create mode 100644 cmd/testbed/main_test.go create mode 100644 go.mod create mode 100644 go.mod.license diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..5062711 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,8 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +# Built by GoReleaser (dockers_v2): binaries come prebuilt in the context. +FROM gcr.io/distroless/static +ARG TARGETPLATFORM +COPY $TARGETPLATFORM/testbed /usr/bin/testbed +ENTRYPOINT ["/usr/bin/testbed"] diff --git a/Makefile b/Makefile new file mode 100644 index 0000000..28f9510 --- /dev/null +++ b/Makefile @@ -0,0 +1,29 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +IMAGE_TAG ?= $(shell git describe --tags --always --abbrev=0) +QUADLET_DIR ?= build/quadlet + +.PHONY: all +all: build + +.PHONY: build +build: ## Build the binary + go build -o bin/testbed ./cmd/testbed + +.PHONY: test +test: ## Run unit tests + go test -race ./... + +.PHONY: quadlet-render +quadlet-render: ## Pin the quadlet image tag for packaging (accepts IMAGE_TAG, QUADLET_DIR) + mkdir -p $(QUADLET_DIR) + if ! grep -q '@IMAGE_TAG@' packaging/systemd/testbed.container; then \ + echo "error: @IMAGE_TAG@ placeholder missing from testbed.container" >&2; \ + exit 1; \ + fi + sed 's|@IMAGE_TAG@|$(IMAGE_TAG)|' packaging/systemd/testbed.container > $(QUADLET_DIR)/testbed.container + +.PHONY: clean +clean: ## Remove build outputs + rm -rf bin build dist diff --git a/cmd/testbed/main.go b/cmd/testbed/main.go new file mode 100644 index 0000000..5e05477 --- /dev/null +++ b/cmd/testbed/main.go @@ -0,0 +1,24 @@ +// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +// SPDX-License-Identifier: MIT + +// Command testbed is a trivial binary used to exercise the +// OpenCHAMI/github-actions build and release workflows. +package main + +import "fmt" + +// Set via -ldflags by GoReleaser. +var ( + version = "dev" + commit = "none" + buildHost = "unknown" +) + +// Info returns the build metadata line printed by the binary. +func Info() string { + return fmt.Sprintf("testbed %s (commit %s, built on %s)", version, commit, buildHost) +} + +func main() { + fmt.Println(Info()) +} diff --git a/cmd/testbed/main_test.go b/cmd/testbed/main_test.go new file mode 100644 index 0000000..80dd8f2 --- /dev/null +++ b/cmd/testbed/main_test.go @@ -0,0 +1,15 @@ +// SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +// SPDX-License-Identifier: MIT + +package main + +import ( + "strings" + "testing" +) + +func TestInfo(t *testing.T) { + if got := Info(); !strings.HasPrefix(got, "testbed ") { + t.Fatalf("Info() = %q, want prefix %q", got, "testbed ") + } +} diff --git a/go.mod b/go.mod new file mode 100644 index 0000000..02e6168 --- /dev/null +++ b/go.mod @@ -0,0 +1,3 @@ +module github.com/openchami/github-actions-testbed + +go 1.26 diff --git a/go.mod.license b/go.mod.license new file mode 100644 index 0000000..380948c --- /dev/null +++ b/go.mod.license @@ -0,0 +1,2 @@ +SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +SPDX-License-Identifier: MIT From cf486bdb74d259be01d8db0f72a4e1633beb0e58 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 6 Oct 2026 12:37:56 -0600 Subject: [PATCH 2/7] feat: add packaging + experimental workflows for testing Signed-off-by: Sean Tronsen --- .github/workflows/build.yml | 49 +++++++ .github/workflows/cleanup.yml | 17 +++ .github/workflows/dependency-review.yml | 24 ++++ .github/workflows/govulncheck.yml | 24 ++++ .github/workflows/lint.yml | 35 +++++ .github/workflows/release.yml | 94 +++++++++++++ .github/workflows/reuse.yml | 23 +++ .github/workflows/scorecard.yml | 30 ++++ .github/workflows/stale.yml | 18 +++ .github/workflows/test.yml | 32 +++++ .goreleaser.yaml | 132 ++++++++++++++++++ packaging/configs/testbed.yaml | 5 + packaging/deb/copyright | 25 ++++ packaging/deb/copyright.license | 2 + packaging/scripts/postinstall.sh | 18 +++ packaging/scripts/postremove.sh | 7 + packaging/scripts/preremove.sh | 12 ++ packaging/systemd/testbed.container | 15 ++ .../testbed.container.d/10-defaults.conf | 5 + 19 files changed, 567 insertions(+) create mode 100644 .github/workflows/build.yml create mode 100644 .github/workflows/cleanup.yml create mode 100644 .github/workflows/dependency-review.yml create mode 100644 .github/workflows/govulncheck.yml create mode 100644 .github/workflows/lint.yml create mode 100644 .github/workflows/release.yml create mode 100644 .github/workflows/reuse.yml create mode 100644 .github/workflows/scorecard.yml create mode 100644 .github/workflows/stale.yml create mode 100644 .github/workflows/test.yml create mode 100644 .goreleaser.yaml create mode 100644 packaging/configs/testbed.yaml create mode 100644 packaging/deb/copyright create mode 100644 packaging/deb/copyright.license create mode 100644 packaging/scripts/postinstall.sh create mode 100644 packaging/scripts/postremove.sh create mode 100644 packaging/scripts/preremove.sh create mode 100644 packaging/systemd/testbed.container create mode 100644 packaging/systemd/testbed.container.d/10-defaults.conf diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..f96a7b4 --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,49 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +name: build + +# Build check: GoReleaser snapshot build of everything, publishing nothing, +# then package validation. The `build` job is the required status check. + +on: + pull_request: + +permissions: + contents: read + +jobs: + goreleaser: + uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + with: + go-version-file: go.mod + + validate: + needs: goreleaser + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + with: + packages: | + - name: testbed-quadlet*.rpm + files: + - /etc/openchami + - /etc/openchami/configs + - /etc/openchami/configs/testbed.yaml + - /usr/share/containers/systemd/testbed.container + - /usr/share/containers/systemd/testbed.container.d + - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf + - /usr/share/licenses/testbed-quadlet + - /usr/share/licenses/testbed-quadlet/MIT.txt + - name: testbed-quadlet*.deb + files: + - /etc/openchami/configs/testbed.yaml + - /usr/share/containers/systemd/testbed.container + - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf + - /usr/share/doc/testbed-quadlet/copyright + + build: + if: ${{ always() }} + needs: [goreleaser, validate] + runs-on: ubuntu-slim + steps: + - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0 + with: { jobs: "${{ toJSON(needs) }}" } diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml new file mode 100644 index 0000000..a94f259 --- /dev/null +++ b/.github/workflows/cleanup.yml @@ -0,0 +1,17 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +name: cleanup + +# Deletes the pr- images when a PR closes. + +on: + pull_request: + types: [closed] + +permissions: + packages: write + +jobs: + cleanup: + uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..5e3b672 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,24 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +name: dependency-review +on: + pull_request: + +permissions: + contents: read + +jobs: + check: + uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + permissions: + contents: read # baseline for checkout + pull-requests: write # summary comment on the PR + + dependency-review: + if: ${{ always() }} + needs: [check] + runs-on: ubuntu-slim + steps: + - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0 + with: { jobs: "${{ toJSON(needs) }}" } diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml new file mode 100644 index 0000000..166afeb --- /dev/null +++ b/.github/workflows/govulncheck.yml @@ -0,0 +1,24 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +name: govulncheck +on: + pull_request: + push: + branches: + - main + +permissions: + contents: read + +jobs: + check: + uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + + govulncheck: + if: ${{ always() }} + needs: [check] + runs-on: ubuntu-slim + steps: + - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0 + with: { jobs: "${{ toJSON(needs) }}" } diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml new file mode 100644 index 0000000..f2ba4de --- /dev/null +++ b/.github/workflows/lint.yml @@ -0,0 +1,35 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +name: lint + +# All linters under one gate: the `lint` job is the required status check. + +on: + pull_request: + push: + branches: + - main + +permissions: + contents: read + +jobs: + lint-go: + uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + with: + go-version-file: go.mod + + lint-ci: + uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + permissions: + contents: read # baseline for checkout + security-events: write # zizmor SARIF upload to GHAS + + lint: + if: ${{ always() }} + needs: [lint-go, lint-ci] + runs-on: ubuntu-slim + steps: + - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0 + with: { jobs: "${{ toJSON(needs) }}" } diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..6950544 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,94 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +name: release + +# PR images and releases; build-release-goreleaser picks the mode from the +# event: +# - pull_request: pushes ghcr.io/openchami/github-actions-testbed:pr-. +# - v* tag push: semver images, signed packages, draft release, validation, +# then publish. Safe to tag freely: nothing depends on this repo. + +on: + pull_request: + push: + tags: + - v* + +permissions: + contents: read + +jobs: + # Throwaway signing key, regenerated each run. Not a secret (it travels as + # a job output); fine here, since the packages are only for testing. + test-key: + runs-on: ubuntu-slim + outputs: + gpg-key-b64: ${{ steps.key.outputs.gpg-key-b64 }} + steps: + - name: Generate throwaway GPG key + id: key + run: | + set -euo pipefail + GNUPGHOME=$(mktemp -d) + export GNUPGHOME + gpg --batch --quiet --passphrase '' \ + --quick-gen-key 'github-actions testbed throwaway key ' rsa3072 sign 1d + echo "gpg-key-b64=$(gpg --batch --armor --export-secret-keys | base64 -w0)" >> "$GITHUB_OUTPUT" + + goreleaser: + needs: test-key + permissions: + contents: write # release creation, uploading assets + packages: write # image push, container provenance + id-token: write # Sigstore signing (attest-build-provenance) + attestations: write # build provenance attestations + uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + with: + go-version-file: go.mod + registry-subject-name: ghcr.io/openchami/github-actions-testbed + secrets: + gpg-key: ${{ github.event_name == 'push' && needs.test-key.outputs.gpg-key-b64 || '' }} + + trivy: + # Fork PRs build but don't push, so there is no image to scan. + needs: goreleaser + if: ${{ needs.goreleaser.outputs.digest != '' }} + uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + permissions: + contents: read # baseline for checkout + security-events: write # SARIF upload to GHAS + with: + image-ref: ghcr.io/openchami/github-actions-testbed@${{ needs.goreleaser.outputs.digest }} + exit-code: '0' + + validate: + # PR builds produce no packages (they're validated in build.yml). + if: ${{ github.event_name == 'push' }} + needs: goreleaser + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + with: + packages: | + - name: testbed-quadlet*.rpm + files: + - /etc/openchami + - /etc/openchami/configs + - /etc/openchami/configs/testbed.yaml + - /usr/share/containers/systemd/testbed.container + - /usr/share/containers/systemd/testbed.container.d + - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf + - /usr/share/licenses/testbed-quadlet + - /usr/share/licenses/testbed-quadlet/MIT.txt + - name: testbed-quadlet*.deb + files: + - /etc/openchami/configs/testbed.yaml + - /usr/share/containers/systemd/testbed.container + - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf + - /usr/share/doc/testbed-quadlet/copyright + + publish: + if: ${{ github.event_name == 'push' }} + needs: [goreleaser, validate] + permissions: + contents: write # publish the draft GitHub Release + uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml new file mode 100644 index 0000000..57e41ae --- /dev/null +++ b/.github/workflows/reuse.yml @@ -0,0 +1,23 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +name: reuse +on: + pull_request: + push: + branches: [main] + +permissions: + contents: read + +jobs: + check: + uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + + reuse: + if: ${{ always() }} + needs: [check] + runs-on: ubuntu-slim + steps: + - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0 + with: { jobs: "${{ toJSON(needs) }}" } diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml new file mode 100644 index 0000000..14b36d4 --- /dev/null +++ b/.github/workflows/scorecard.yml @@ -0,0 +1,30 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +name: scorecard +on: + branch_protection_rule: + pull_request: + push: + branches: [main] + schedule: + - cron: '39 5 * * 1' + +permissions: + contents: read + +jobs: + check: + permissions: + contents: read # baseline for checkout + security-events: write # SARIF upload to GHAS + id-token: write # publish results to the OpenSSF dashboard + uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + + scorecard: + if: ${{ always() }} + needs: [check] + runs-on: ubuntu-slim + steps: + - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0 + with: { jobs: "${{ toJSON(needs) }}" } diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml new file mode 100644 index 0000000..e02ba6b --- /dev/null +++ b/.github/workflows/stale.yml @@ -0,0 +1,18 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +name: stale +on: + schedule: + - cron: '23 3 * * *' # daily at 03:23 UTC + workflow_dispatch: + +permissions: + contents: read + +jobs: + stale: + uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + permissions: + issues: write # label, comment on, and close stale issues + pull-requests: write # label, comment on, and close stale PRs diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml new file mode 100644 index 0000000..ad875cf --- /dev/null +++ b/.github/workflows/test.yml @@ -0,0 +1,32 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +name: test + +# All tests under one gate: the `test` job is the required status check. +# Unit tests also upload coverage to Coveralls (README badge); the repo must +# be enrolled in Coveralls. + +on: + pull_request: + push: + branches: + - main + +permissions: + contents: read + +jobs: + test-unit-go: + uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + with: + go-version-file: go.mod + coverage: true + + test: + if: ${{ always() }} + needs: [test-unit-go] + runs-on: ubuntu-slim + steps: + - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0 + with: { jobs: "${{ toJSON(needs) }}" } diff --git a/.goreleaser.yaml b/.goreleaser.yaml new file mode 100644 index 0000000..6feb306 --- /dev/null +++ b/.goreleaser.yaml @@ -0,0 +1,132 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT +# +# Exercises every release effect of the OpenCHAMI/github-actions GoReleaser +# workflows. Annotated reference: +# https://github.com/OpenCHAMI/github-actions/blob/main/.goreleaser.example.yml + +version: 2 + +project_name: github-actions-testbed + +before: + hooks: + - go mod tidy + # Pin the packaged quadlet to the image this run publishes. + - make quadlet-render IMAGE_TAG={{ .Tag }} + +builds: + - id: testbed + main: ./cmd/testbed + binary: testbed + goos: [linux] + goarch: [amd64, arm64] + env: + - CGO_ENABLED=0 + ldflags: + - >- + -s -w + -X main.version={{ .Version }} + -X main.commit={{ .Commit }} + -X main.buildHost={{ .Env.BUILD_HOST }} + +archives: + - id: testbed + ids: [testbed] + formats: [tar.gz] + files: + - LICENSES/* + +checksum: + name_template: "{{ .ProjectName }}_checksums.txt" + +dockers_v2: + - id: testbed + ids: [testbed] + dockerfile: Dockerfile + images: + - ghcr.io/openchami/github-actions-testbed + tags: + - "{{ .Tag }}" # vX.Y.Z or pr-N + - '{{ if ne .Env.IS_PR_BUILD "true" }}{{ .Major }}.{{ .Minor }}{{ end }}' + - '{{ if ne .Env.IS_PR_BUILD "true" }}{{ .Major }}{{ end }}' + - '{{ if ne .Env.IS_PR_BUILD "true" }}latest{{ end }}' + platforms: + - linux/amd64 + - linux/arm64 + labels: + org.opencontainers.image.title: "{{ .ProjectName }}" + org.opencontainers.image.version: "{{ .Version }}" + org.opencontainers.image.revision: "{{ .FullCommit }}" + org.opencontainers.image.created: "{{ .Date }}" + org.opencontainers.image.source: https://github.com/OpenCHAMI/github-actions-testbed + +nfpms: + - id: testbed-quadlet + package_name: testbed-quadlet + meta: true + formats: [rpm, deb] + file_name_template: "{{ .ConventionalFileName }}" + vendor: OpenCHAMI + homepage: https://github.com/OpenCHAMI/github-actions-testbed + maintainer: "Sean Tronsen " + description: Podman Quadlet test package for the OpenCHAMI github-actions workflows. + license: MIT + section: admin + contents: + - dst: /etc/openchami + type: dir + - dst: /etc/openchami/configs + type: dir + - src: packaging/configs/testbed.yaml + dst: /etc/openchami/configs/testbed.yaml + type: "config|noreplace" + - src: build/quadlet/testbed.container + dst: /usr/share/containers/systemd/testbed.container + - dst: /usr/share/containers/systemd/testbed.container.d + type: dir + - src: packaging/systemd/testbed.container.d/10-defaults.conf + dst: /usr/share/containers/systemd/testbed.container.d/10-defaults.conf + - dst: /usr/share/licenses/testbed-quadlet + type: dir + packager: rpm + - src: LICENSES/MIT.txt + dst: /usr/share/licenses/testbed-quadlet/MIT.txt + type: license + packager: rpm + - src: packaging/deb/copyright + dst: /usr/share/doc/testbed-quadlet/copyright + packager: deb + scripts: + postinstall: packaging/scripts/postinstall.sh + preremove: packaging/scripts/preremove.sh + postremove: packaging/scripts/postremove.sh + overrides: + rpm: + release: "1.el9" + dependencies: + - podman >= 5.0.0 + - systemd + deb: + release: "1" + dependencies: + - podman (>= 5.0.0) + - systemd + rpm: + signature: + key_file: "{{ .Env.GPG_KEY_PATH }}" + +release: + disable: '{{ if eq .Env.IS_PR_BUILD "true" }}true{{ else }}false{{ end }}' + name_template: "v{{ .Version }}" + prerelease: auto + footer: | + ## Verifying packages + + ```bash + rpm --import gpg-public-key.asc + rpm -K testbed-quadlet-*.rpm + ``` + +changelog: + use: git diff --git a/packaging/configs/testbed.yaml b/packaging/configs/testbed.yaml new file mode 100644 index 0000000..5884a6c --- /dev/null +++ b/packaging/configs/testbed.yaml @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +# Example config shipped as %config(noreplace) / a deb conffile. +greeting: hello diff --git a/packaging/deb/copyright b/packaging/deb/copyright new file mode 100644 index 0000000..298dc4b --- /dev/null +++ b/packaging/deb/copyright @@ -0,0 +1,25 @@ +Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/ +Upstream-Name: github-actions-testbed +Source: https://github.com/OpenCHAMI/github-actions-testbed + +Files: * +Copyright: 2026 OpenCHAMI a Series of LF Projects, LLC +License: MIT + MIT License + . + Copyright (c) 2026 OpenCHAMI a Series of LF Projects, LLC + . + Permission is hereby granted, free of charge, to any person obtaining a copy of this software and + associated documentation files (the "Software"), to deal in the Software without restriction, including + without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the + following conditions: + . + The above copyright notice and this permission notice shall be included in all copies or substantial + portions of the Software. + . + THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT + LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO + EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER + IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE + USE OR OTHER DEALINGS IN THE SOFTWARE. diff --git a/packaging/deb/copyright.license b/packaging/deb/copyright.license new file mode 100644 index 0000000..380948c --- /dev/null +++ b/packaging/deb/copyright.license @@ -0,0 +1,2 @@ +SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +SPDX-License-Identifier: MIT diff --git a/packaging/scripts/postinstall.sh b/packaging/scripts/postinstall.sh new file mode 100644 index 0000000..f76766f --- /dev/null +++ b/packaging/scripts/postinstall.sh @@ -0,0 +1,18 @@ +#!/bin/sh +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT +# +# Shared by the rpm (%post) and deb (postinst) packages. $1 tells them apart: +# rpm passes the instance count (1 = install, 2+ = upgrade); deb passes +# "configure", with the previously configured version in $2 on upgrade. + +upgrade= +case "$1" in + configure) [ -n "$2" ] && upgrade=1 ;; + [0-9]*) [ "$1" -ge 2 ] && upgrade=1 ;; +esac + +systemctl daemon-reload || : +if [ -n "$upgrade" ]; then + systemctl try-restart testbed.service || : +fi diff --git a/packaging/scripts/postremove.sh b/packaging/scripts/postremove.sh new file mode 100644 index 0000000..ddb517c --- /dev/null +++ b/packaging/scripts/postremove.sh @@ -0,0 +1,7 @@ +#!/bin/sh +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT +# +# Shared by the rpm (%postun) and deb (postrm) packages. + +systemctl daemon-reload || : diff --git a/packaging/scripts/preremove.sh b/packaging/scripts/preremove.sh new file mode 100644 index 0000000..50605ee --- /dev/null +++ b/packaging/scripts/preremove.sh @@ -0,0 +1,12 @@ +#!/bin/sh +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT +# +# Shared by the rpm (%preun) and deb (prerm) packages. Stop the service only +# on real removal: rpm passes 0, deb passes "remove". + +case "$1" in + 0|remove) + systemctl stop testbed.service >/dev/null 2>&1 || : + ;; +esac diff --git a/packaging/systemd/testbed.container b/packaging/systemd/testbed.container new file mode 100644 index 0000000..74e7ef0 --- /dev/null +++ b/packaging/systemd/testbed.container @@ -0,0 +1,15 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +[Unit] +Description=OpenCHAMI github-actions testbed container + +[Container] +ContainerName=%N +Image=ghcr.io/openchami/github-actions-testbed:@IMAGE_TAG@ + +[Service] +Restart=on-failure + +[Install] +WantedBy=default.target diff --git a/packaging/systemd/testbed.container.d/10-defaults.conf b/packaging/systemd/testbed.container.d/10-defaults.conf new file mode 100644 index 0000000..28dd851 --- /dev/null +++ b/packaging/systemd/testbed.container.d/10-defaults.conf @@ -0,0 +1,5 @@ +# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC +# SPDX-License-Identifier: MIT + +[Container] +Environment=TESTBED=1 From 580c18f017ad4f3a77481302063c14dbd049cc86 Mon Sep 17 00:00:00 2001 From: Sean Tronsen <60711680+seantronsen@users.noreply.github.com> Date: Mon, 12 Oct 2026 17:19:48 -0600 Subject: [PATCH 3/7] feat: testing for actions PR 41 (#4) * chore: update sha hash pins Signed-off-by: Sean Tronsen * feat: configure testing for actions PR 41 Signed-off-by: Sean Tronsen * feat: add package file list testing for arch-specific binary packages Signed-off-by: Sean Tronsen * chore: bump workflow digests Signed-off-by: Sean Tronsen * chore: bump shas Signed-off-by: Sean Tronsen * feat: add PR 41 testing for multiple named images Signed-off-by: Sean Tronsen * chore: bump shas Signed-off-by: Sean Tronsen --------- Signed-off-by: Sean Tronsen --- .github/workflows/build.yml | 25 +++++++------ .github/workflows/cleanup.yml | 2 +- .github/workflows/dependency-review.yml | 2 +- .github/workflows/govulncheck.yml | 2 +- .github/workflows/lint.yml | 4 +- .github/workflows/release.yml | 30 +++++++-------- .github/workflows/reuse.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/stale.yml | 2 +- .github/workflows/test.yml | 2 +- .goreleaser.yaml | 50 +++++++++++++++++++++++++ 11 files changed, 87 insertions(+), 36 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index f96a7b4..09b04e0 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -14,31 +14,32 @@ permissions: jobs: goreleaser: - uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod validate: needs: goreleaser - uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - - name: testbed-quadlet*.rpm + - name: testbed-quadlet* files: - - /etc/openchami - - /etc/openchami/configs - /etc/openchami/configs/testbed.yaml - /usr/share/containers/systemd/testbed.container - - /usr/share/containers/systemd/testbed.container.d - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf - - /usr/share/licenses/testbed-quadlet + rpm-files: - /usr/share/licenses/testbed-quadlet/MIT.txt - - name: testbed-quadlet*.deb - files: - - /etc/openchami/configs/testbed.yaml - - /usr/share/containers/systemd/testbed.container - - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf + deb-files: - /usr/share/doc/testbed-quadlet/copyright + # Per-arch binary package; `[-_][0-9]` keeps it from matching testbed-quadlet. + - name: testbed[-_][0-9]* + files: + - /usr/bin/testbed + rpm-files: + - /usr/share/licenses/testbed/MIT.txt + deb-files: + - /usr/share/doc/testbed/copyright build: if: ${{ always() }} diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index a94f259..b30808a 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -14,4 +14,4 @@ permissions: jobs: cleanup: - uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 5e3b672..2f42c1f 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -10,7 +10,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout pull-requests: write # summary comment on the PR diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index 166afeb..472a931 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -13,7 +13,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) govulncheck: if: ${{ always() }} diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index f2ba4de..27451c7 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -16,12 +16,12 @@ permissions: jobs: lint-go: - uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod lint-ci: - uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout security-events: write # zizmor SARIF upload to GHAS diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 6950544..ae4a60a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -43,10 +43,9 @@ jobs: packages: write # image push, container provenance id-token: write # Sigstore signing (attest-build-provenance) attestations: write # build provenance attestations - uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod - registry-subject-name: ghcr.io/openchami/github-actions-testbed secrets: gpg-key: ${{ github.event_name == 'push' && needs.test-key.outputs.gpg-key-b64 || '' }} @@ -54,7 +53,7 @@ jobs: # Fork PRs build but don't push, so there is no image to scan. needs: goreleaser if: ${{ needs.goreleaser.outputs.digest != '' }} - uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout security-events: write # SARIF upload to GHAS @@ -66,29 +65,30 @@ jobs: # PR builds produce no packages (they're validated in build.yml). if: ${{ github.event_name == 'push' }} needs: goreleaser - uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - - name: testbed-quadlet*.rpm + - name: testbed-quadlet* files: - - /etc/openchami - - /etc/openchami/configs - /etc/openchami/configs/testbed.yaml - /usr/share/containers/systemd/testbed.container - - /usr/share/containers/systemd/testbed.container.d - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf - - /usr/share/licenses/testbed-quadlet + rpm-files: - /usr/share/licenses/testbed-quadlet/MIT.txt - - name: testbed-quadlet*.deb - files: - - /etc/openchami/configs/testbed.yaml - - /usr/share/containers/systemd/testbed.container - - /usr/share/containers/systemd/testbed.container.d/10-defaults.conf + deb-files: - /usr/share/doc/testbed-quadlet/copyright + # Per-arch binary package; `[-_][0-9]` keeps it from matching testbed-quadlet. + - name: testbed[-_][0-9]* + files: + - /usr/bin/testbed + rpm-files: + - /usr/share/licenses/testbed/MIT.txt + deb-files: + - /usr/share/doc/testbed/copyright publish: if: ${{ github.event_name == 'push' }} needs: [goreleaser, validate] permissions: contents: write # publish the draft GitHub Release - uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index 57e41ae..8bea6d5 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -12,7 +12,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) reuse: if: ${{ always() }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 14b36d4..32d83d0 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -19,7 +19,7 @@ jobs: contents: read # baseline for checkout security-events: write # SARIF upload to GHAS id-token: write # publish results to the OpenSSF dashboard - uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) scorecard: if: ${{ always() }} diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index e02ba6b..a8ac2f9 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -12,7 +12,7 @@ permissions: jobs: stale: - uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) permissions: issues: write # label, comment on, and close stale issues pull-requests: write # label, comment on, and close stale PRs diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index ad875cf..276392c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -18,7 +18,7 @@ permissions: jobs: test-unit-go: - uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@5b8f3decfae1c29ef4004a6f49f1593d25eccc95 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod coverage: true diff --git a/.goreleaser.yaml b/.goreleaser.yaml index 6feb306..76d6603 100644 --- a/.goreleaser.yaml +++ b/.goreleaser.yaml @@ -60,6 +60,27 @@ dockers_v2: org.opencontainers.image.revision: "{{ .FullCommit }}" org.opencontainers.image.created: "{{ .Date }}" org.opencontainers.image.source: https://github.com/OpenCHAMI/github-actions-testbed + # Second, distinctly named image (different title label, so a different + # digest) to exercise per-image attestation. + - id: testbed-alt + ids: [testbed] + dockerfile: Dockerfile + images: + - ghcr.io/openchami/github-actions-testbed-alt + tags: + - "{{ .Tag }}" # vX.Y.Z or pr-N + - '{{ if ne .Env.IS_PR_BUILD "true" }}{{ .Major }}.{{ .Minor }}{{ end }}' + - '{{ if ne .Env.IS_PR_BUILD "true" }}{{ .Major }}{{ end }}' + - '{{ if ne .Env.IS_PR_BUILD "true" }}latest{{ end }}' + platforms: + - linux/amd64 + - linux/arm64 + labels: + org.opencontainers.image.title: "{{ .ProjectName }}-alt" + org.opencontainers.image.version: "{{ .Version }}" + org.opencontainers.image.revision: "{{ .FullCommit }}" + org.opencontainers.image.created: "{{ .Date }}" + org.opencontainers.image.source: https://github.com/OpenCHAMI/github-actions-testbed nfpms: - id: testbed-quadlet @@ -115,6 +136,35 @@ nfpms: rpm: signature: key_file: "{{ .Env.GPG_KEY_PATH }}" + # Binary package: one per goarch, so a single package glob matches several + # files across architectures. + - id: testbed + package_name: testbed + ids: [testbed] + formats: [rpm, deb] + file_name_template: "{{ .ConventionalFileName }}" + vendor: OpenCHAMI + homepage: https://github.com/OpenCHAMI/github-actions-testbed + maintainer: "Sean Tronsen " + description: Test binary package for the OpenCHAMI github-actions workflows. + license: MIT + section: admin + contents: + - src: LICENSES/MIT.txt + dst: /usr/share/licenses/testbed/MIT.txt + type: license + packager: rpm + - src: packaging/deb/copyright + dst: /usr/share/doc/testbed/copyright + packager: deb + overrides: + rpm: + release: "1.el9" + deb: + release: "1" + rpm: + signature: + key_file: "{{ .Env.GPG_KEY_PATH }}" release: disable: '{{ if eq .Env.IS_PR_BUILD "true" }}true{{ else }}false{{ end }}' From 7598d364c3118a73d48441049e380098327be104 Mon Sep 17 00:00:00 2001 From: Sean Tronsen <60711680+seantronsen@users.noreply.github.com> Date: Mon, 12 Oct 2026 18:44:48 -0600 Subject: [PATCH 4/7] feat: add testing for renovate linter (#5) Signed-off-by: Sean Tronsen --- .github/workflows/build.yml | 4 ++-- .github/workflows/cleanup.yml | 2 +- .github/workflows/dependency-review.yml | 2 +- .github/workflows/govulncheck.yml | 2 +- .github/workflows/lint.yml | 9 ++++++--- .github/workflows/release.yml | 8 ++++---- .github/workflows/reuse.yml | 2 +- .github/workflows/scorecard.yml | 2 +- .github/workflows/stale.yml | 2 +- .github/workflows/test.yml | 2 +- renovate.json | 7 +++++++ renovate.json.license | 3 +++ 12 files changed, 29 insertions(+), 16 deletions(-) create mode 100644 renovate.json create mode 100644 renovate.json.license diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 09b04e0..9a9ea67 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -14,13 +14,13 @@ permissions: jobs: goreleaser: - uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/build-check-goreleaser.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod validate: needs: goreleaser - uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - name: testbed-quadlet* diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index b30808a..cc29267 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -14,4 +14,4 @@ permissions: jobs: cleanup: - uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 2f42c1f..0518ec6 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -10,7 +10,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/dependency-review.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout pull-requests: write # summary comment on the PR diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml index 472a931..f113905 100644 --- a/.github/workflows/govulncheck.yml +++ b/.github/workflows/govulncheck.yml @@ -13,7 +13,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/govulncheck.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) govulncheck: if: ${{ always() }} diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 27451c7..3d5097f 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -16,19 +16,22 @@ permissions: jobs: lint-go: - uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/lint-go.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod lint-ci: - uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/lint-ci.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout security-events: write # zizmor SARIF upload to GHAS + lint-renovate: + uses: OpenCHAMI/github-actions/.github/workflows/lint-renovate.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) + lint: if: ${{ always() }} - needs: [lint-go, lint-ci] + needs: [lint-go, lint-ci, lint-renovate] runs-on: ubuntu-slim steps: - uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # v1.3.0 diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ae4a60a..bff9d72 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -43,7 +43,7 @@ jobs: packages: write # image push, container provenance id-token: write # Sigstore signing (attest-build-provenance) attestations: write # build provenance attestations - uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/build-release-goreleaser.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod secrets: @@ -53,7 +53,7 @@ jobs: # Fork PRs build but don't push, so there is no image to scan. needs: goreleaser if: ${{ needs.goreleaser.outputs.digest != '' }} - uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) permissions: contents: read # baseline for checkout security-events: write # SARIF upload to GHAS @@ -65,7 +65,7 @@ jobs: # PR builds produce no packages (they're validated in build.yml). if: ${{ github.event_name == 'push' }} needs: goreleaser - uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/validate-packages.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) with: packages: | - name: testbed-quadlet* @@ -91,4 +91,4 @@ jobs: needs: [goreleaser, validate] permissions: contents: write # publish the draft GitHub Release - uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml index 8bea6d5..84d5cf8 100644 --- a/.github/workflows/reuse.yml +++ b/.github/workflows/reuse.yml @@ -12,7 +12,7 @@ permissions: jobs: check: - uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) reuse: if: ${{ always() }} diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 32d83d0..0e4eb91 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -19,7 +19,7 @@ jobs: contents: read # baseline for checkout security-events: write # SARIF upload to GHAS id-token: write # publish results to the OpenSSF dashboard - uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) scorecard: if: ${{ always() }} diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml index a8ac2f9..b5890be 100644 --- a/.github/workflows/stale.yml +++ b/.github/workflows/stale.yml @@ -12,7 +12,7 @@ permissions: jobs: stale: - uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/stale.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) permissions: issues: write # label, comment on, and close stale issues pull-requests: write # label, comment on, and close stale PRs diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 276392c..9f1f819 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -18,7 +18,7 @@ permissions: jobs: test-unit-go: - uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@8708e0d6dc89d72a6a07fc3f204dfb3a798b9f6a # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) with: go-version-file: go.mod coverage: true diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..8ec9325 --- /dev/null +++ b/renovate.json @@ -0,0 +1,7 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "github>OpenCHAMI/.github//renovate-config/default", + "config:recommended" + ] +} diff --git a/renovate.json.license b/renovate.json.license new file mode 100644 index 0000000..db315fb --- /dev/null +++ b/renovate.json.license @@ -0,0 +1,3 @@ +SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC + +SPDX-License-Identifier: MIT From 69e9052b1fa2712ff140bb5f0bc5b1e7a11887de Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Mon, 12 Oct 2026 18:50:09 -0600 Subject: [PATCH 5/7] feat: add testing for decoupled trivy scan Signed-off-by: Sean Tronsen --- .github/workflows/release.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index bff9d72..eca9fbd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,15 +50,15 @@ jobs: gpg-key: ${{ github.event_name == 'push' && needs.test-key.outputs.gpg-key-b64 || '' }} trivy: - # Fork PRs build but don't push, so there is no image to scan. + # Scans the images named in .goreleaser.yaml (testbed and testbed-alt) at + # this run's tag (pr- on PRs); fork PRs push nothing, so nothing matches. needs: goreleaser - if: ${{ needs.goreleaser.outputs.digest != '' }} - uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/trivy-image-scan.yml@3f4837668325e804c057a415e108d1393af3406a # github-actions under test (seantronsen/feat/decouple-trivy) permissions: contents: read # baseline for checkout + packages: read # read image versions security-events: write # SARIF upload to GHAS with: - image-ref: ghcr.io/openchami/github-actions-testbed@${{ needs.goreleaser.outputs.digest }} exit-code: '0' validate: From b2fc26ac81a3ca2b8af6ff0ecf644e0c9522b091 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 13 Oct 2026 13:50:04 -0600 Subject: [PATCH 6/7] feat!: update testing for the newly decoupled registry clean up workflow Signed-off-by: Sean Tronsen --- .github/workflows/cleanup.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml index cc29267..064b881 100644 --- a/.github/workflows/cleanup.yml +++ b/.github/workflows/cleanup.yml @@ -3,15 +3,17 @@ name: cleanup -# Deletes the pr- images when a PR closes. +# Deletes the pr- images named in .goreleaser.yaml (testbed and +# testbed-alt) when a PR closes. on: pull_request: types: [closed] permissions: - packages: write + contents: read # checkout, to read .goreleaser.yaml + packages: write # delete image versions jobs: cleanup: - uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@7af41e39e2270b711bd18385f1586df9f7bf98de # github-actions under test (seantronsen/feat/decouple-pr-cleanup) From 24b9eeeb7e6414ce21e1002e75e67559be39f964 Mon Sep 17 00:00:00 2001 From: Sean Tronsen Date: Tue, 13 Oct 2026 14:11:59 -0600 Subject: [PATCH 7/7] feat: testing for actions PR 47 Signed-off-by: Sean Tronsen --- .github/workflows/test.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 9f1f819..61edeb0 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -18,10 +18,11 @@ permissions: jobs: test-unit-go: - uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@466cf8d13ea0a1c493f3bfe9c35cc155eb8da367 # github-actions under test (seantronsen/feat/redesign-deployment) + uses: OpenCHAMI/github-actions/.github/workflows/test-unit-go.yml@94dcf268d84a4bf0396e2a93f56769199cd7cb7a # github-actions under test (seantronsen/feat/runner-selection) with: go-version-file: go.mod coverage: true + runner: ubuntu-latest # exercises the runner input (default: ubuntu-slim) test: if: ${{ always() }}