From 8ce13666741565f284a5b27a2d384df0bb3cfddc Mon Sep 17 00:00:00 2001 From: Moulick Aggarwal Date: Wed, 19 Oct 2022 18:31:43 +0530 Subject: [PATCH] Add releasing and scanning github actions Signed-off-by: Moulick Aggarwal --- .github/dependabot.yml | 33 +++++++++++ .github/workflows/codeql-analysis.yml | 76 +++++++++++++++++++++++++ .github/workflows/dependency-review.yml | 20 +++++++ .github/workflows/docker-build.yml | 32 +++++++++++ .github/workflows/goreleaser.yml | 63 ++++++++++++++++++++ .github/workflows/hadolint.yml | 51 +++++++++++++++++ .github/workflows/trivy.yml | 67 ++++++++++++++++++++++ .goreleaser.yml | 24 ++++++++ Dockerfile | 4 +- 9 files changed, 368 insertions(+), 2 deletions(-) create mode 100644 .github/dependabot.yml create mode 100644 .github/workflows/codeql-analysis.yml create mode 100644 .github/workflows/dependency-review.yml create mode 100644 .github/workflows/docker-build.yml create mode 100644 .github/workflows/goreleaser.yml create mode 100644 .github/workflows/hadolint.yml create mode 100644 .github/workflows/trivy.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..4991389 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,33 @@ +# To get started with Dependabot version updates, you'll need to specify which +# package ecosystems to update and where the package manifests are located. +# Please see the documentation for all configuration options: +# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates + +version: 2 +updates: + # Maintain dependencies for GitHub Actions + - package-ecosystem: "github-actions" + directory: "/" + open-pull-requests-limit: 20 + schedule: + interval: "weekly" + commit-message: + prefix: ":seedling:" + + # Maintain dependencies for Docker + - package-ecosystem: "docker" + directory: / + open-pull-requests-limit: 20 + schedule: + interval: "daily" + commit-message: + prefix: ":seedling:" + + # Maintain dependencies for go + - package-ecosystem: "gomod" + directory: "/" + open-pull-requests-limit: 20 + schedule: + interval: "daily" + commit-message: + prefix: ":seedling:" diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml new file mode 100644 index 0000000..ef47df3 --- /dev/null +++ b/.github/workflows/codeql-analysis.yml @@ -0,0 +1,76 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +# +# ******** NOTE ******** +# We have attempted to detect the languages in your repository. Please check +# the `language` matrix defined below to confirm you have the correct set of +# supported CodeQL languages. +# +name: "CodeQL" + +on: + push: + branches: + - main + - master + pull_request: + # The branches below must be a subset of the branches above + branches: + - main + - master + schedule: + - cron: '19 18 * * 5' + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write + + strategy: + fail-fast: false + matrix: + language: ['go'] + # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ] + # Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support + + steps: + - name: Checkout repository + uses: actions/checkout@v3 + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v2 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + + # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs + # queries: security-extended,security-and-quality + + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v2 + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun + + # If the Autobuild fails above, remove it and uncomment the following three lines. + # modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance. + + # - run: | + # echo "Run, Build Application using script" + # ./location_of_script_within_repo/buildscript.sh + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v2 diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml new file mode 100644 index 0000000..fe461b4 --- /dev/null +++ b/.github/workflows/dependency-review.yml @@ -0,0 +1,20 @@ +# Dependency Review Action +# +# This Action will scan dependency manifest files that change as part of a Pull Request, surfacing known-vulnerable versions of the packages declared or updated in the PR. Once installed, if the workflow run is marked as required, PRs introducing known-vulnerable packages will be blocked from merging. +# +# Source repository: https://github.com/actions/dependency-review-action +# Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement +name: 'Dependency Review' +on: [pull_request] + +permissions: + contents: read + +jobs: + dependency-review: + runs-on: ubuntu-latest + steps: + - name: 'Checkout Repository' + uses: actions/checkout@v3 + - name: 'Dependency Review' + uses: actions/dependency-review-action@v2 diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml new file mode 100644 index 0000000..ba6eced --- /dev/null +++ b/.github/workflows/docker-build.yml @@ -0,0 +1,32 @@ +name: ci + +on: + push: + branches: + - 'master' + - 'main' + +jobs: + docker: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v3 + - name: Set up QEMU + uses: docker/setup-qemu-action@v2 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v2 + - name: Login to DockerHub + uses: docker/login-action@v2 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + - name: Build and push + uses: docker/build-push-action@v3 + with: + context: . + push: true + tags: redradrat/aws-iam-operator:latest + cache-from: type=registry,ref=redradrat/aws-iam-operator:buildcache + cache-to: type=registry,ref=redradrat/aws-iam-operator:buildcache,mode=max + diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml new file mode 100644 index 0000000..08e371c --- /dev/null +++ b/.github/workflows/goreleaser.yml @@ -0,0 +1,63 @@ +name: goreleaser + +on: + push: + tags: + - '*' + +jobs: + goreleaser: + runs-on: ubuntu-latest + permissions: + contents: write + packages: write + issues: write + steps: + - name: Checkout + uses: actions/checkout@v3 + with: + fetch-depth: 0 + + - name: Set up QEMU + uses: docker/setup-qemu-action@v2 + - name: Set up Docker Buildx + id: buildx + uses: docker/setup-buildx-action@v2 + with: + install: true + + - name: Login to DockerHub + uses: docker/login-action@v2 + with: + username: ${{ secrets.DOCKERHUB_USERNAME }} + password: ${{ secrets.DOCKERHUB_TOKEN }} + + - name: Login to quay.io + uses: docker/login-action@v2 + with: + registry: quay.io + username: ${{ secrets.QUAY_USERNAME }} + password: ${{ secrets.QUAY_TOKEN }} + + - name: Login to ghcr.io + uses: docker/login-action@v2 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Set up Go + uses: actions/setup-go@v3 + with: + go-version: '1.19' + check-latest: true + cache: true + + - name: Run GoReleaser + uses: goreleaser/goreleaser-action@v3 + with: + distribution: goreleaser + version: latest + args: release --rm-dist + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/hadolint.yml b/.github/workflows/hadolint.yml new file mode 100644 index 0000000..ea3e7fd --- /dev/null +++ b/.github/workflows/hadolint.yml @@ -0,0 +1,51 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# hadoint is a Dockerfile linter written in Haskell +# that helps you build best practice Docker images. +# More details at https://github.com/hadolint/hadolint + +name: Hadolint + +on: + push: + branches: + - main + - master + pull_request: + # The branches below must be a subset of the branches above + branches: + - main + - master + schedule: + - cron: '27 20 * * 1' + +permissions: + contents: read + +jobs: + hadolint: + name: Run hadolint scanning + runs-on: ubuntu-latest + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Run hadolint + uses: hadolint/hadolint-action@f988afea3da57ee48710a9795b6bb677cc901183 + with: + dockerfile: ./Dockerfile + format: sarif + output-file: hadolint-results.sarif + no-fail: true + + - name: Upload analysis results to GitHub + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: hadolint-results.sarif + wait-for-processing: true diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml new file mode 100644 index 0000000..cecd194 --- /dev/null +++ b/.github/workflows/trivy.yml @@ -0,0 +1,67 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +name: trivy + +on: + push: + branches: + - main + - master + pull_request: + # The branches below must be a subset of the branches above + branches: + - main + - master + schedule: + - cron: '19 0 * * 3' + +permissions: + contents: read + +jobs: + scan: + permissions: + contents: read # for actions/checkout to fetch code + security-events: write # for github/codeql-action/upload-sarif to upload SARIF results + name: Build + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v3 + + - name: Run Trivy vulnerability scanner with rootfs command + uses: aquasecurity/trivy-action@master + with: + scan-type: 'rootfs' + scan-ref: '/github/workspace/' + ignore-unfixed: false + format: 'sarif' + output: 'trivy-rootfs.sarif' + severity: 'CRITICAL,HIGH' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-rootfs.sarif' + category: 'trivy-rootfs' + + - name: Build an image from Dockerfile + run: | + docker build -t docker.io/redradrat/aws-iam-operator:${{ github.sha }} . + + - name: Run Trivy vulnerability scanner + uses: aquasecurity/trivy-action@master + with: + image-ref: 'docker.io/redradrat/aws-iam-operator:${{ github.sha }}' + format: 'sarif' + output: 'trivy-oci-image.sarif' + severity: 'CRITICAL,HIGH' + + - name: Upload Trivy scan results to GitHub Security tab + uses: github/codeql-action/upload-sarif@v2 + with: + sarif_file: 'trivy-oci-image.sarif' + category: 'trivy-oci-image' diff --git a/.goreleaser.yml b/.goreleaser.yml index d5b2917..fcc87b4 100644 --- a/.goreleaser.yml +++ b/.goreleaser.yml @@ -1,8 +1,11 @@ +--- # This is an example goreleaser.yaml file with some sane defaults. # Make sure to check the documentation at http://goreleaser.com +project_name: aws-iam-operator before: hooks: # You may remove this if you don't use go modules. + - go mod tidy - go mod download # you may remove this if you don't need go generate - go generate ./... @@ -13,7 +16,15 @@ builds: - linux - windows - darwin + goarch: + - amd64 + - arm64 + - arm + goarm: + - "7" + - "6" ldflags: + - -s -w - -X main.operatorversion={{.Version}} - -X main.operatorbuilddate={{.Date}} archives: @@ -23,6 +34,10 @@ archives: windows: Windows 386: i386 amd64: x86_64 + format_overrides: + - goos: windows + format: zip + dockers: - image_templates: - "redradrat/aws-iam-operator:{{ .Tag }}-amd64" @@ -67,6 +82,15 @@ checksum: name_template: 'checksums.txt' snapshot: name_template: "{{ .Tag }}-next" + +gomod: + proxy: true + env: + - GOPROXY=https://proxy.golang.org,direct + - GOSUMDB=sum.golang.org + mod: mod + gobinary: go + changelog: sort: asc filters: diff --git a/Dockerfile b/Dockerfile index bb63d0f..bf90c22 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Build the manager binary -FROM golang:1.18 as builder +FROM docker.io/library/golang:1.18-alpine as builder WORKDIR /workspace # Copy the Go Modules manifests @@ -15,7 +15,7 @@ COPY api/ api/ COPY controllers/ controllers/ # Build -RUN CGO_ENABLED=0 GOOS=linux go build -a -o manager main.go +RUN CGO_ENABLED=0 GOOS=linux go build -ldflags "-s -w" -o manager main.go # Use distroless as minimal base image to package the manager binary # Refer to https://github.com/GoogleContainerTools/distroless for more details