ci: add CI and E2E workflows for release-1.4

.github/workflows/ci.yml

@@ -0,0 +1,44 @@
+name: CI
+
+on:
+  pull_request:
+    branches: ["main", "release*"]
+  push:
+    branches: ["main", "release*"]
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v6
+        with:
+          version: v1.64.8
+          args: --verbose --timeout=15m
+
+  unit-test:
+    name: Unit tests
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout source
+        uses: actions/checkout@v4
+
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Build
+        run: go build ./...
+
+      - name: Run strategy tests
+        run: go test ./pkg/... -v -count=1

.github/workflows/e2e.yml

@@ -0,0 +1,154 @@
+name: E2E
+
+on:
+  pull_request:
+    branches: ["main", "release*"]
+  push:
+    branches: ["main", "release*"]
+  workflow_dispatch:
+    inputs:
+      operator_image:
+        description: "Operator image (e.g. ghcr.io/securesign/secure-sign-operator:latest)"
+        required: false
+      operator_ref:
+        description: "secure-sign-operator branch/tag for CI infrastructure"
+        required: false
+        default: release-1.4
+
+env:
+  REGISTRY: ghcr.io
+  OPERATOR_REPO: securesign/secure-sign-operator
+  OPERATOR_REF: ${{ inputs.operator_ref || 'release-1.4' }}
+  TEST_NAMESPACE: test
+
+jobs:
+  e2e:
+    name: E2E tests
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: read
+    steps:
+      - name: Checkout secure-sign-operator
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ env.OPERATOR_REPO }}
+          ref: ${{ env.OPERATOR_REF }}
+
+      - name: Checkout sigstore-e2e
+        uses: actions/checkout@v4
+        with:
+          path: e2e
+
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: e2e/go.mod
+
+      - name: Log in to GitHub Container Registry
+        uses: redhat-actions/podman-login@v1
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+          auth_file_path: /tmp/config.json
+
+      - name: Log in to registry.redhat.io
+        uses: redhat-actions/podman-login@v1
+        with:
+          username: ${{ secrets.REGISTRY_USER }}
+          password: ${{ secrets.REGISTRY_PASSWORD }}
+          registry: registry.redhat.io
+          auth_file_path: /tmp/config.json
+
+      - name: Install Kind cluster
+        id: kind
+        uses: ./.github/actions/kind-cluster
+        with:
+          config: ./ci/config.yaml
+          keycloak: "true"
+          olm: "true"
+          prometheus: "true"
+
+      - name: Build operator image
+        id: operator-image
+        run: |
+          if [ -n "${{ inputs.operator_image }}" ]; then
+            IMG="${{ inputs.operator_image }}"
+            podman pull "$IMG"
+          else
+            IMG="localhost/rhtas-operator:e2e"
+            make docker-build-skip-test IMG="$IMG" CONTAINER_TOOL=podman
+          fi
+          echo "img=$IMG" >> "$GITHUB_OUTPUT"
+
+      - name: Load operator image into Kind
+        run: |
+          podman save ${{ steps.operator-image.outputs.img }} -o operator-oci.tar
+          kind load image-archive operator-oci.tar
+
+      - name: Deploy operator
+        run: |
+          make dev-images generate && cat config/default/images.env
+          IMG=${{ steps.operator-image.outputs.img }} TARGET_PLATFORM=kubernetes make deploy
+
+      - name: Wait for operator
+        run: |
+          kubectl wait --for=condition=available deployment/rhtas-operator-controller-manager \
+            --timeout=120s -n openshift-rhtas-operator
+
+      - name: Add service hosts
+        run: |
+          echo "127.0.0.1 fulcio-server.local tuf.local rekor-server.local keycloak-internal.keycloak-system.svc rekor-search-ui.local cli-server.local tsa-server.local" \
+            | sudo tee -a /etc/hosts
+
+      - name: Install SecureSign
+        run: |
+          OIDC_HOST="${{ steps.kind.outputs.oidc_host }}"
+          sed -i "s#https://your-oidc-issuer-url#http://${OIDC_HOST}/realms/trusted-artifact-signer#" \
+            config/samples/rhtas_v1alpha1_securesign.yaml
+          kubectl create ns ${{ env.TEST_NAMESPACE }}
+          echo "Waiting for conversion webhook to be ready..."
+          for i in $(seq 1 60); do
+            kubectl create --dry-run=server -f config/samples/rhtas_v1alpha1_securesign.yaml 2>/dev/null && break
+            echo "Waiting for conversion webhook... ($i/60)"
+            sleep 5
+          done
+          kubectl create -f config/samples/rhtas_v1alpha1_securesign.yaml -n ${{ env.TEST_NAMESPACE }}
+          sleep 1
+          kubectl wait --for=condition=Ready securesign/securesign-sample \
+            --timeout=5m -n ${{ env.TEST_NAMESPACE }}
+
+      - name: Run E2E tests
+        working-directory: e2e
+        env:
+          OIDC_ISSUER_URL: "http://${{ steps.kind.outputs.oidc_host }}/realms/trusted-artifact-signer"
+          CLI_STRATEGY: cli_server
+          CLI_SERVER_URL: "http://cli-server.local"
+        run: |
+          REKOR_UI_URL=$(kubectl get rekor -o jsonpath='{.items[0].status.rekorSearchUIUrl}' -n ${{ env.TEST_NAMESPACE }})
+          export REKOR_UI_URL
+          TUF_URL=$(kubectl get tuf -o jsonpath='{.items[0].status.url}' -n ${{ env.TEST_NAMESPACE }})
+          export TUF_URL
+          REKOR_URL=$(kubectl get rekor -o jsonpath='{.items[0].status.url}' -n ${{ env.TEST_NAMESPACE }})
+          export REKOR_URL
+          FULCIO_URL=$(kubectl get fulcio -o jsonpath='{.items[0].status.url}' -n ${{ env.TEST_NAMESPACE }})
+          export FULCIO_URL
+
+          source ./tas-env-variables.sh
+
+          go run github.com/mxschmitt/playwright-go/cmd/playwright install --with-deps
+          go test -v ./test/...
+
+      - name: Dump operator logs
+        if: failure()
+        run: |
+          kubectl logs -n openshift-rhtas-operator deployment/rhtas-operator-controller-manager
+
+      - name: Archive test artifacts
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: e2e-results
+          path: e2e/test/**/k8s-dump-*.tar.gz
+          if-no-files-found: ignore

.golangci.yml

@@ -1,4 +1,7 @@
 linters-settings:
+  gosec:
+    excludes:
+      - G115
   lll:
     line-length: 170
 linters:
@@ -8,6 +11,7 @@ linters:
     - deadcode
     - depguard
     - dupl
+    - errname
     - exhaustive
     - exhaustivestruct
     - exhaustruct
@@ -26,6 +30,7 @@ linters:
     - gomnd
     - gomoddirectives
     - ifshort
+    - intrange
     - interfacer
     - ireturn
     - lll
@@ -37,6 +42,7 @@ linters:
     - nolintlint
     - nosnakecase
     - paralleltest
+    - perfsprint
     - revive
     - rowserrcheck
     - scopelint

test/rekorsearchui/rekor_search_sign_verify_test.go

@@ -14,9 +14,9 @@ import (
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/config"
 	"github.com/google/uuid"
+	"github.com/mxschmitt/playwright-go"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
-	"github.com/mxschmitt/playwright-go"
 	"github.com/securesign/sigstore-e2e/pkg/api"
 	"github.com/securesign/sigstore-e2e/pkg/clients"
 	"github.com/securesign/sigstore-e2e/test/testsupport"