From 94a1969ce9ca765b899c7fbc6c2d790ff8b23a79 Mon Sep 17 00:00:00 2001 From: kdacosta0 Date: Tue, 14 Jul 2026 15:27:10 +0200 Subject: [PATCH] ci: add CI and E2E workflows for release-1.4 Backport ci.yml and e2e.yml from main so that PRs targeting release branches get CI coverage. Without these, PRs merged with no checks. Changes from main: - ci.yml: golangci-lint pinned to v1.64.8 (v1 config format on this branch) - e2e.yml: OPERATOR_REF defaults to release-1.4 - .golangci.yml: disable errname (not used on main v2 config either) Co-Authored-By: Claude Opus 4.6 --- .github/workflows/ci.yml | 44 +++++ .github/workflows/e2e.yml | 154 ++++++++++++++++++ .golangci.yml | 6 + .../rekor_search_sign_verify_test.go | 2 +- 4 files changed, 205 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/ci.yml create mode 100644 .github/workflows/e2e.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..d3f34d9 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,44 @@ +name: CI + +on: + pull_request: + branches: ["main", "release*"] + push: + branches: ["main", "release*"] + +jobs: + lint: + name: Lint + runs-on: ubuntu-24.04 + steps: + - name: Checkout source + uses: actions/checkout@v4 + + - name: Install Go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + + - name: golangci-lint + uses: golangci/golangci-lint-action@v6 + with: + version: v1.64.8 + args: --verbose --timeout=15m + + unit-test: + name: Unit tests + runs-on: ubuntu-24.04 + steps: + - name: Checkout source + uses: actions/checkout@v4 + + - name: Install Go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + + - name: Build + run: go build ./... + + - name: Run strategy tests + run: go test ./pkg/... -v -count=1 diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml new file mode 100644 index 0000000..608d49e --- /dev/null +++ b/.github/workflows/e2e.yml @@ -0,0 +1,154 @@ +name: E2E + +on: + pull_request: + branches: ["main", "release*"] + push: + branches: ["main", "release*"] + workflow_dispatch: + inputs: + operator_image: + description: "Operator image (e.g. ghcr.io/securesign/secure-sign-operator:latest)" + required: false + operator_ref: + description: "secure-sign-operator branch/tag for CI infrastructure" + required: false + default: release-1.4 + +env: + REGISTRY: ghcr.io + OPERATOR_REPO: securesign/secure-sign-operator + OPERATOR_REF: ${{ inputs.operator_ref || 'release-1.4' }} + TEST_NAMESPACE: test + +jobs: + e2e: + name: E2E tests + runs-on: ubuntu-24.04 + permissions: + contents: read + packages: read + steps: + - name: Checkout secure-sign-operator + uses: actions/checkout@v4 + with: + repository: ${{ env.OPERATOR_REPO }} + ref: ${{ env.OPERATOR_REF }} + + - name: Checkout sigstore-e2e + uses: actions/checkout@v4 + with: + path: e2e + + - name: Install Go + uses: actions/setup-go@v5 + with: + go-version-file: e2e/go.mod + + - name: Log in to GitHub Container Registry + uses: redhat-actions/podman-login@v1 + with: + registry: ${{ env.REGISTRY }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + auth_file_path: /tmp/config.json + + - name: Log in to registry.redhat.io + uses: redhat-actions/podman-login@v1 + with: + username: ${{ secrets.REGISTRY_USER }} + password: ${{ secrets.REGISTRY_PASSWORD }} + registry: registry.redhat.io + auth_file_path: /tmp/config.json + + - name: Install Kind cluster + id: kind + uses: ./.github/actions/kind-cluster + with: + config: ./ci/config.yaml + keycloak: "true" + olm: "true" + prometheus: "true" + + - name: Build operator image + id: operator-image + run: | + if [ -n "${{ inputs.operator_image }}" ]; then + IMG="${{ inputs.operator_image }}" + podman pull "$IMG" + else + IMG="localhost/rhtas-operator:e2e" + make docker-build-skip-test IMG="$IMG" CONTAINER_TOOL=podman + fi + echo "img=$IMG" >> "$GITHUB_OUTPUT" + + - name: Load operator image into Kind + run: | + podman save ${{ steps.operator-image.outputs.img }} -o operator-oci.tar + kind load image-archive operator-oci.tar + + - name: Deploy operator + run: | + make dev-images generate && cat config/default/images.env + IMG=${{ steps.operator-image.outputs.img }} TARGET_PLATFORM=kubernetes make deploy + + - name: Wait for operator + run: | + kubectl wait --for=condition=available deployment/rhtas-operator-controller-manager \ + --timeout=120s -n openshift-rhtas-operator + + - name: Add service hosts + run: | + echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local keycloak-internal.keycloak-system.svc rekor-search-ui.local cli-server.local tsa-server.local" \ + | sudo tee -a /etc/hosts + + - name: Install SecureSign + run: | + OIDC_HOST="${{ steps.kind.outputs.oidc_host }}" + sed -i "s#https://your-oidc-issuer-url#http://${OIDC_HOST}/realms/trusted-artifact-signer#" \ + config/samples/rhtas_v1alpha1_securesign.yaml + kubectl create ns ${{ env.TEST_NAMESPACE }} + echo "Waiting for conversion webhook to be ready..." + for i in $(seq 1 60); do + kubectl create --dry-run=server -f config/samples/rhtas_v1alpha1_securesign.yaml 2>/dev/null && break + echo "Waiting for conversion webhook... ($i/60)" + sleep 5 + done + kubectl create -f config/samples/rhtas_v1alpha1_securesign.yaml -n ${{ env.TEST_NAMESPACE }} + sleep 1 + kubectl wait --for=condition=Ready securesign/securesign-sample \ + --timeout=5m -n ${{ env.TEST_NAMESPACE }} + + - name: Run E2E tests + working-directory: e2e + env: + OIDC_ISSUER_URL: "http://${{ steps.kind.outputs.oidc_host }}/realms/trusted-artifact-signer" + CLI_STRATEGY: cli_server + CLI_SERVER_URL: "http://cli-server.local" + run: | + REKOR_UI_URL=$(kubectl get rekor -o jsonpath='{.items[0].status.rekorSearchUIUrl}' -n ${{ env.TEST_NAMESPACE }}) + export REKOR_UI_URL + TUF_URL=$(kubectl get tuf -o jsonpath='{.items[0].status.url}' -n ${{ env.TEST_NAMESPACE }}) + export TUF_URL + REKOR_URL=$(kubectl get rekor -o jsonpath='{.items[0].status.url}' -n ${{ env.TEST_NAMESPACE }}) + export REKOR_URL + FULCIO_URL=$(kubectl get fulcio -o jsonpath='{.items[0].status.url}' -n ${{ env.TEST_NAMESPACE }}) + export FULCIO_URL + + source ./tas-env-variables.sh + + go run github.com/mxschmitt/playwright-go/cmd/playwright install --with-deps + go test -v ./test/... + + - name: Dump operator logs + if: failure() + run: | + kubectl logs -n openshift-rhtas-operator deployment/rhtas-operator-controller-manager + + - name: Archive test artifacts + uses: actions/upload-artifact@v4 + if: always() + with: + name: e2e-results + path: e2e/test/**/k8s-dump-*.tar.gz + if-no-files-found: ignore diff --git a/.golangci.yml b/.golangci.yml index 2611432..247b6fd 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -1,4 +1,7 @@ linters-settings: + gosec: + excludes: + - G115 lll: line-length: 170 linters: @@ -8,6 +11,7 @@ linters: - deadcode - depguard - dupl + - errname - exhaustive - exhaustivestruct - exhaustruct @@ -26,6 +30,7 @@ linters: - gomnd - gomoddirectives - ifshort + - intrange - interfacer - ireturn - lll @@ -37,6 +42,7 @@ linters: - nolintlint - nosnakecase - paralleltest + - perfsprint - revive - rowserrcheck - scopelint diff --git a/test/rekorsearchui/rekor_search_sign_verify_test.go b/test/rekorsearchui/rekor_search_sign_verify_test.go index a053015..594b9c3 100644 --- a/test/rekorsearchui/rekor_search_sign_verify_test.go +++ b/test/rekorsearchui/rekor_search_sign_verify_test.go @@ -14,9 +14,9 @@ import ( "github.com/go-git/go-git/v5" "github.com/go-git/go-git/v5/config" "github.com/google/uuid" + "github.com/mxschmitt/playwright-go" . "github.com/onsi/ginkgo/v2" . "github.com/onsi/gomega" - "github.com/mxschmitt/playwright-go" "github.com/securesign/sigstore-e2e/pkg/api" "github.com/securesign/sigstore-e2e/pkg/clients" "github.com/securesign/sigstore-e2e/test/testsupport"