Skip to content

Commit 90fb3d1

Browse files
raffisraffis
authored
feat: postgres search path, updates deps and ci pipelines (#57)
1 parent f71785e commit 90fb3d1

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

44 files changed

+1234
-1199
lines changed

‎.github/ISSUE_TEMPLATE/VULN-TEMPLATE.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
title: Vulnerabilities detected
3+
labels: security
4+
---
5+
High or critical vulnerabilities detected. Scan results are below:
6+
7+
{{ env.RESULTS }}

‎.github/workflows/main.yaml

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -5,30 +5,25 @@ on:
55
branches:
66
- master
77

8+
permissions: {}
9+
810
jobs:
911
build:
1012
runs-on: ubuntu-latest
1113
steps:
1214
- name: Harden Runner
13-
uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
15+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
1416
with:
15-
egress-policy: audit
17+
egress-policy: audit
1618
- name: Checkout
17-
uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3
19+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
1820
- name: Setup Go
19-
uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
20-
with:
21-
go-version: 1.20.x
22-
- name: Restore Go cache
23-
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
21+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
2422
with:
25-
path: ~/go/pkg/mod
26-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
27-
restore-keys: |
28-
${{ runner.os }}-go-
23+
go-version: 1.22.x
2924
- name: Tests
3025
run: make test
3126
- name: Send go coverage report
32-
uses: shogo82148/actions-goveralls@31ee804b8576ae49f6dc3caa22591bc5080e7920 #v1.6.0
27+
uses: shogo82148/actions-goveralls@785c9d68212c91196d3994652647f8721918ba11 # v1.9.0
3328
with:
3429
path-to-profile: coverage.out

‎.github/workflows/pr-actions.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: pr-actions
2+
3+
permissions: {}
4+
5+
on:
6+
pull_request:
7+
branches:
8+
- 'master'
9+
10+
jobs:
11+
ensure-sha-pinned:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Harden Runner
15+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
16+
with:
17+
egress-policy: audit
18+
19+
- name: Checkout
20+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
21+
- name: Ensure SHA pinned actions
22+
uses: zgosalvez/github-actions-ensure-sha-pinned-actions@3c16e895bb662b4d7e284f032cbe8835a57773cc # v3.0.11
23+
with:
24+
# slsa-github-generator requires using a semver tag for reusable workflows.
25+
# See: https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators
26+
allowlist: |
27+
slsa-framework/slsa-github-generator

‎.github/workflows/pr-build.yaml

Lines changed: 39 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,18 @@ on:
77
- synchronize
88
- reopened
99

10+
permissions: {}
11+
1012
jobs:
1113
lint-chart:
1214
runs-on: ubuntu-latest
1315
steps:
1416
- name: Harden Runner
15-
uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
17+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
1618
with:
1719
egress-policy: audit
1820
- name: Checkout
19-
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
21+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
2022
with:
2123
fetch-depth: 0
2224

@@ -25,7 +27,7 @@ jobs:
2527
with:
2628
version: v3.4.0
2729

28-
- uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
30+
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
2931
with:
3032
python-version: 3.7
3133

@@ -46,22 +48,15 @@ jobs:
4648
runs-on: ubuntu-latest
4749
steps:
4850
- name: Harden Runner
49-
uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
51+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
5052
with:
5153
egress-policy: audit
5254
- name: Checkout
53-
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
55+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
5456
- name: Setup Go
55-
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
56-
with:
57-
go-version: 1.20.x
58-
- name: Restore Go cache
59-
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
57+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
6058
with:
61-
path: ~/go/pkg/mod
62-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
63-
restore-keys: |
64-
${{ runner.os }}-go-
59+
go-version: 1.22.x
6560
- name: fmt
6661
run: make fmt
6762
- name: vet
@@ -81,28 +76,21 @@ jobs:
8176
strategy:
8277
matrix:
8378
kubernetes-version:
84-
- "1.25"
85-
- "1.26"
8679
- "1.27"
8780
- "1.28"
81+
- "1.29"
82+
- "1.30"
8883
steps:
8984
- name: Harden Runner
90-
uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
85+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
9186
with:
9287
egress-policy: audit
9388
- name: Checkout
94-
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
89+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
9590
- name: Setup Go
96-
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
97-
with:
98-
go-version: 1.20.x
99-
- name: Restore Go cache
100-
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
91+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
10192
with:
102-
path: ~/go/pkg/mod
103-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
104-
restore-keys: |
105-
${{ runner.os }}-go-
93+
go-version: 1.22.x
10694
- name: run test
10795
run: make test ENVTEST_K8S_VERSION=${{ matrix.kubernetes-version }}
10896

@@ -112,22 +100,15 @@ jobs:
112100
profiles: ${{ steps.profiles.outputs.matrix }}
113101
steps:
114102
- name: Harden Runner
115-
uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
103+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
116104
with:
117105
egress-policy: audit
118106
- name: Checkout
119-
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
107+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
120108
- name: Setup Go
121-
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
109+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
122110
with:
123-
go-version: 1.20.x
124-
- name: Restore Go cache
125-
uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
126-
with:
127-
path: ~/go/pkg/mod
128-
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
129-
restore-keys: |
130-
${{ runner.os }}-go-
111+
go-version: 1.22.x
131112
- name: build
132113
run: make build
133114
- name: Check if working tree is dirty
@@ -144,7 +125,7 @@ jobs:
144125
run: |
145126
docker save --output db-controller-container.tar db-controller:latest
146127
- name: Upload image
147-
uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce #v3.1.2
128+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
148129
with:
149130
name: db-controller-container
150131
path: db-controller-container.tar
@@ -164,21 +145,21 @@ jobs:
164145
profile: ${{ fromJson(needs.build.outputs.profiles) }}
165146
steps:
166147
- name: Harden Runner
167-
uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09 # v2.5.1
148+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
168149
with:
169150
egress-policy: audit
170151
- name: Checkout
171-
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
152+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
172153
- name: Setup Go
173-
uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
154+
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
174155
with:
175-
go-version: 1.20.x
156+
go-version: 1.22.x
176157
- name: Setup Kubernetes
177158
uses: engineerd/setup-kind@aa272fe2a7309878ffc2a81c56cfe3ef108ae7d0 #v0.5.0
178159
with:
179160
version: v0.17.0
180161
- name: Download db-controller container
181-
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a #v3.0.2
162+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
182163
with:
183164
name: db-controller-container
184165
path: /tmp
@@ -187,7 +168,7 @@ jobs:
187168
docker load --input /tmp/db-controller-container.tar
188169
docker image ls -a
189170
- name: Setup Kustomize
190-
uses: imranismail/setup-kustomize@6691bdeb1b0a3286fb7f70fd1423c10e81e5375f # v2.0.0
171+
uses: imranismail/setup-kustomize@2ba527d4d055ab63514ba50a99456fc35684947f # v2.1.0
191172
- name: Run test
192173
run: |
193174
make kind-test TEST_PROFILE=${{ matrix.profile }}
@@ -198,37 +179,38 @@ jobs:
198179
kubectl -n db-system describe pods
199180
kubectl -n db-system get all
200181
kubectl -n db-system logs deploy/db-controller
201-
182+
kubectl -n db-system get dbinstance -o yaml
183+
202184
test-chart:
203185
runs-on: ubuntu-latest
204186
needs:
205187
- build
206188
- lint-chart
207189
steps:
208190
- name: Harden Runner
209-
uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
191+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
210192
with:
211193
egress-policy: audit
212194
- name: Checkout
213-
uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3
195+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
214196
with:
215197
fetch-depth: 0
216198

217199
- name: Set up Helm
218200
uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 #v3.5
219201

220-
- uses: actions/setup-python@61a6322f88396a6271a6ee3565807d608ecaddd1 # v4.7.0
202+
- uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
221203
with:
222204
python-version: 3.7
223205

224206
- name: Set up chart-testing
225207
uses: helm/chart-testing-action@e6669bcd63d7cb57cb4380c33043eebe5d111992 # v2.6.1
226208

227209
- name: Create kind cluster
228-
uses: helm/kind-action@dda0770415bac9fc20092cacbc54aa298604d140 # v1.8.0
210+
uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
229211

230212
- name: Download db-controller container
231-
uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
213+
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
232214
with:
233215
name: db-controller-container
234216
path: /tmp
@@ -242,3 +224,9 @@ jobs:
242224
243225
- name: Run chart-testing (install)
244226
run: ct install --target-branch=master --chart-dirs chart
227+
228+
test-success:
229+
runs-on: ubuntu-latest
230+
needs: [test, e2e-tests]
231+
steps:
232+
- run: echo "all tests succeeded"

‎.github/workflows/pr-goreleaser.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
name: pr-gorelaser
2+
3+
permissions: {}
4+
5+
on:
6+
pull_request:
7+
branches:
8+
- 'master'
9+
10+
jobs:
11+
validate-config:
12+
runs-on: ubuntu-latest
13+
steps:
14+
- name: Harden Runner
15+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
16+
with:
17+
egress-policy: audit
18+
- name: Checkout
19+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
20+
- name: Validate .goreleaser.yaml
21+
uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
22+
with:
23+
version: latest
24+
args: check
25+
env:
26+
RUNNER_TOKEN: ${{ github.token }}
27+
GITHUB_TOKEN: ${{ secrets.DOODLE_OSS_BOT}}

‎.github/workflows/pr-label.yaml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,16 +3,20 @@ name: pr-label
33
on:
44
pull_request:
55

6+
permissions: {}
7+
68
jobs:
79
size-label:
810
runs-on: ubuntu-latest
911
if: ${{ !github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' }}
12+
permissions:
13+
pull-requests: write
1014
steps:
1115
- name: Harden Runner
12-
uses: step-security/harden-runner@1b05615854632b887b69ae1be8cbefe72d3ae423 # v2.6.0
16+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
1317
with:
14-
egress-policy: audit
18+
egress-policy: audit
1519
- name: size-label
16-
uses: "pascalgn/size-label-action@1619680c5ac1ef360b944bb56a57587ba4aa2af8"
20+
uses: "pascalgn/size-label-action@49850f3557d4b77f0b2e759829defd77ccc07c54"
1721
env:
1822
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

‎.github/workflows/pr-stale.yaml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: pr-stale
2+
on:
3+
schedule:
4+
- cron: '30 1 * * *'
5+
6+
permissions: {}
7+
8+
jobs:
9+
stale:
10+
runs-on: ubuntu-latest
11+
permissions:
12+
issues: write
13+
steps:
14+
- uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
15+
with:
16+
days-before-close: '120'
17+
stale-pr-label: stale
18+
repo-token: ${{ github.token }}

‎.github/workflows/pr-trivy.yaml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
name: pr-trivy
2+
on: pull_request
3+
4+
permissions: {}
5+
6+
jobs:
7+
trivy:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Harden Runner
11+
uses: step-security/harden-runner@5c7944e73c4c2a096b17a9cb74d65b6c2bbafbde # v2.9.1
12+
with:
13+
egress-policy: audit
14+
15+
- name: Trivy fs scan
16+
uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
17+
with:
18+
scan-type: 'fs'
19+
ignore-unfixed: true
20+
scanners: license,vuln,secret
21+
format: 'sarif'
22+
output: 'trivy-results.sarif'
23+
severity: 'CRITICAL,HIGH'
24+
25+
- name: Upload Trivy scan results to GitHub Security tab
26+
uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
27+
with:
28+
sarif_file: 'trivy-results.sarif'

0 commit comments

Comments
 (0)