Skip to content

Commit ba3e522

Browse files
cpanatocpanato
authored
clean up jobs (#14)
1 parent 0aebaae commit ba3e522

7 files changed

Lines changed: 174 additions & 192 deletions

File tree

‎.github/ISSUE_TEMPLATE/bug_report.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,21 @@ Steps to reproduce the behavior:
1717
2. ...
1818

1919
**Additional Information**
20-
- Dockerfile
20+
- Dockerfile
2121
Please provide either the Dockerfile you're trying to build or one that can reproduce this error.
2222
- Build Context
2323
Please provide or clearly describe any files needed to build the Dockerfile (ADD/COPY commands)
2424
- Kaniko Image (fully qualified with digest)
25-
25+
2626
**Triage Notes for the Maintainers**
2727
<!-- 🎉🎉🎉 Thank you for an opening an issue !!! 🎉🎉🎉
2828
We are doing our best to get to this. Please help us by helping us prioritize your issue by filling the section below -->
2929

30-
30+
3131
| **Description** | **Yes/No** |
3232
|----------------|---------------|
3333
| Please check if this a new feature you are proposing | <ul><li>- [ ] </li></ul>|
34-
| Please check if the build works in docker but not in kaniko | <ul><li>- [ ] </li></ul>|
34+
| Please check if the build works in docker but not in kaniko | <ul><li>- [ ] </li></ul>|
3535
| Please check if this error is seen when you use `--cache` flag | <ul><li>- [ ] </li></ul>|
36-
| Please check if your dockerfile is a multistage dockerfile | <ul><li>- [ ] </li></ul>|
37-
36+
| Please check if your dockerfile is a multistage dockerfile | <ul><li>- [ ] </li></ul>|
37+

‎.github/dependabot.yml‎

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,17 @@
1+
---
12
version: 2
23
updates:
3-
- package-ecosystem: gomod
4-
directory: /
5-
schedule:
6-
interval: daily
7-
- package-ecosystem: github-actions
8-
directory: /
9-
schedule:
10-
interval: daily
11-
- package-ecosystem: docker
12-
directory: /deploy
13-
schedule:
14-
interval: weekly
4+
- package-ecosystem: gomod
5+
directory: /
6+
schedule:
7+
interval: daily
8+
9+
- package-ecosystem: github-actions
10+
directory: /
11+
schedule:
12+
interval: daily
13+
14+
- package-ecosystem: docker
15+
directory: /deploy
16+
schedule:
17+
interval: daily

‎.github/pull_request_template.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ _See [the contribution guide](../CONTRIBUTING.md) for more details._
2121

2222
**Reviewer Notes**
2323

24-
- [ ] The code flow looks good.
24+
- [ ] The code flow looks good.
2525
- [ ] Unit tests and or integration tests added.
2626

2727

‎.github/workflows/images.yaml‎

Lines changed: 112 additions & 105 deletions
Original file line numberDiff line numberDiff line change
@@ -22,121 +22,128 @@ jobs:
2222
# want an image built and tagged for each commit.
2323
group: build-images-${{ matrix.image }}-${{ github.head_ref || github.sha }}
2424
cancel-in-progress: true
25+
2526
permissions:
2627
contents: read # Read the repo contents.
2728
id-token: write # Produce identity token for keyless signing.
29+
2830
runs-on: ubuntu-latest
2931
strategy:
3032
fail-fast: false
3133
matrix:
3234
image:
33-
- executor
34-
- executor-debug
35-
- executor-slim
36-
- warmer
35+
- executor
36+
- executor-debug
37+
- executor-slim
38+
- warmer
3739

3840
include:
39-
- image: executor
40-
target: kaniko-executor
41-
platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
42-
image-name: gcr.io/kaniko-project/executor
43-
tag: ${{ github.sha }}
44-
release-tag: latest
45-
46-
- image: executor-debug
47-
target: kaniko-debug
48-
platforms: linux/amd64,linux/arm64,linux/s390x
49-
image-name: gcr.io/kaniko-project/executor
50-
tag: ${{ github.sha }}-debug
51-
release-tag: debug
52-
53-
- image: executor-slim
54-
target: kaniko-slim
55-
platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
56-
image-name: gcr.io/kaniko-project/executor
57-
tag: ${{ github.sha }}-slim
58-
release-tag: slim
59-
60-
- image: warmer
61-
target: kaniko-warmer
62-
platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
63-
image-name: gcr.io/kaniko-project/warmer
64-
tag: ${{ github.sha }}
65-
release-tag: latest
41+
- image: executor
42+
target: kaniko-executor
43+
platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
44+
image-name: gcr.io/kaniko-project/executor
45+
tag: ${{ github.sha }}
46+
release-tag: latest
47+
48+
- image: executor-debug
49+
target: kaniko-debug
50+
platforms: linux/amd64,linux/arm64,linux/s390x
51+
image-name: gcr.io/kaniko-project/executor
52+
tag: ${{ github.sha }}-debug
53+
release-tag: debug
54+
55+
- image: executor-slim
56+
target: kaniko-slim
57+
platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
58+
image-name: gcr.io/kaniko-project/executor
59+
tag: ${{ github.sha }}-slim
60+
release-tag: slim
61+
62+
- image: warmer
63+
target: kaniko-warmer
64+
platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
65+
image-name: gcr.io/kaniko-project/warmer
66+
tag: ${{ github.sha }}
67+
release-tag: latest
6668

6769
steps:
68-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
69-
70-
# Setup auth if not a PR.
71-
- if: github.event_name != 'pull_request'
72-
uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
73-
with:
74-
credentials_json: '${{ secrets.GCR_DEVOPS_SERVICE_ACCOUNT_KEY }}'
75-
export_environment_variables: true
76-
create_credentials_file: true
77-
- if: github.event_name != 'pull_request'
78-
uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
79-
- if: github.event_name != 'pull_request'
80-
run: gcloud auth configure-docker
81-
82-
# Don't build for all platforms on PRs.
83-
- id: platforms
84-
run: |
85-
event="${{ github.event_name }}"
86-
if [[ "$event" == "pull_request" ]]; then
87-
echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
88-
else
89-
platforms="${{ matrix.platforms }}"
90-
echo "platforms=${platforms}" >> $GITHUB_OUTPUT
91-
fi
92-
# Build and push with Docker.
93-
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
94-
with:
95-
platforms: ${{ matrix.platforms }}
96-
- uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
97-
- uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
98-
id: build-and-push
99-
with:
100-
context: .
101-
file: ./deploy/Dockerfile
102-
platforms: ${{ steps.platforms.outputs.platforms }}
103-
push: ${{ github.event_name != 'pull_request' }} # Only push if not a PR.
104-
tags: ${{ matrix.image-name }}:${{ matrix.tag }}
105-
no-cache-filters: certs
106-
# https://github.com/docker/build-push-action/blob/master/docs/advanced/cache.md#github-cache
107-
cache-from: type=gha
108-
cache-to: type=gha,mode=max
109-
target: ${{ matrix.target }}
110-
111-
# Sign images if not a PR.
112-
- if: github.event_name != 'pull_request'
113-
uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
114-
- if: github.event_name != 'pull_request'
115-
run: |
116-
cosign sign --yes \
117-
--key gcpkms://projects/kaniko-project/locations/global/keyRings/cosign/cryptoKeys/cosign \
118-
${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }}
119-
cosign sign --yes \
120-
${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }}
121-
122-
# If a tag push, use crane to add more tags.
123-
- if: startsWith(github.ref, 'refs/tags/v')
124-
uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4
125-
- if: startsWith(github.ref, 'refs/tags/v')
126-
name: Apply release tags
127-
run: |
128-
tag=${GITHUB_REF/refs\/tags\//}
129-
130-
# Tag :latest, :debug, :slim
131-
crane cp ${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }} \
132-
${{ matrix.image-name }}:${{ matrix.release-tag }}
133-
134-
if [[ "${{ matrix.release-tag }}" == "latest" ]]; then
135-
# Tag :latest images as :v1.X.Y
136-
crane cp ${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }} \
137-
${{ matrix.image-name }}:${tag}
138-
else
139-
# Or tag :v1.X.Y-debug and :v1.X.Y-slim
70+
- name: Harden Runner
71+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
72+
with:
73+
egress-policy: audit
74+
75+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
76+
77+
# Setup auth if not a PR.
78+
- if: github.event_name != 'pull_request'
79+
uses: google-github-actions/auth@ba79af03959ebeac9769e648f473a284504d9193 # v2.1.10
80+
with:
81+
credentials_json: '${{ secrets.GCR_DEVOPS_SERVICE_ACCOUNT_KEY }}'
82+
export_environment_variables: true
83+
create_credentials_file: true
84+
- if: github.event_name != 'pull_request'
85+
uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
86+
- if: github.event_name != 'pull_request'
87+
run: gcloud auth configure-docker
88+
89+
# Don't build for all platforms on PRs.
90+
- id: platforms
91+
run: |
92+
event="${{ github.event_name }}"
93+
if [[ "$event" == "pull_request" ]]; then
94+
echo "platforms=linux/amd64" >> $GITHUB_OUTPUT
95+
else
96+
platforms="${{ matrix.platforms }}"
97+
echo "platforms=${platforms}" >> $GITHUB_OUTPUT
98+
fi
99+
# Build and push with Docker.
100+
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
101+
with:
102+
platforms: ${{ matrix.platforms }}
103+
- uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
104+
- uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
105+
id: build-and-push
106+
with:
107+
context: .
108+
file: ./deploy/Dockerfile
109+
platforms: ${{ steps.platforms.outputs.platforms }}
110+
push: ${{ github.event_name != 'pull_request' }} # Only push if not a PR.
111+
tags: ${{ matrix.image-name }}:${{ matrix.tag }}
112+
no-cache-filters: certs
113+
# https://github.com/docker/build-push-action/blob/master/docs/advanced/cache.md#github-cache
114+
cache-from: type=gha
115+
cache-to: type=gha,mode=max
116+
target: ${{ matrix.target }}
117+
118+
# Sign images if not a PR.
119+
- if: github.event_name != 'pull_request'
120+
uses: sigstore/cosign-installer@3454372f43399081ed03b604cb2d021dabca52bb # v3.8.2
121+
- if: github.event_name != 'pull_request'
122+
run: |
123+
cosign sign --yes \
124+
--key gcpkms://projects/kaniko-project/locations/global/keyRings/cosign/cryptoKeys/cosign \
125+
${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }}
126+
cosign sign --yes \
127+
${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }}
128+
129+
# If a tag push, use crane to add more tags.
130+
- if: startsWith(github.ref, 'refs/tags/v')
131+
uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4
132+
- if: startsWith(github.ref, 'refs/tags/v')
133+
name: Apply release tags
134+
run: |
135+
tag=${GITHUB_REF/refs\/tags\//}
136+
137+
# Tag :latest, :debug, :slim
140138
crane cp ${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }} \
141-
${{ matrix.image-name }}:${tag}-${{ matrix.release-tag }}
142-
fi
139+
${{ matrix.image-name }}:${{ matrix.release-tag }}
140+
141+
if [[ "${{ matrix.release-tag }}" == "latest" ]]; then
142+
# Tag :latest images as :v1.X.Y
143+
crane cp ${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }} \
144+
${{ matrix.image-name }}:${tag}
145+
else
146+
# Or tag :v1.X.Y-debug and :v1.X.Y-slim
147+
crane cp ${{ matrix.image-name }}@${{ steps.build-and-push.outputs.digest }} \
148+
${{ matrix.image-name }}:${tag}-${{ matrix.release-tag }}
149+
fi

‎.github/workflows/integration-tests.yaml‎

Lines changed: 26 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ jobs:
2121
IMAGE_REPO: 'localhost:5000'
2222
REGISTRY: 'localhost:5000'
2323
DOCKER_BUILDKIT: '0'
24+
2425
strategy:
2526
fail-fast: false
2627
matrix:
@@ -31,20 +32,28 @@ jobs:
3132
- k8s-executor-build-push integration-test-k8s
3233

3334
steps:
34-
- name: Maximize build space
35-
uses: AdityaGarg8/remove-unwanted-software@90e01b21170618765a73370fcc3abbd1684a7793 # v5
36-
with:
37-
remove-android: 'true'
38-
remove-dotnet: 'true'
39-
remove-haskell: 'true'
40-
41-
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
42-
with:
43-
go-version: '1.24'
44-
check-latest: true
45-
46-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
47-
- uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
48-
49-
- run: make install-container-diff k3s-setup
50-
- run: make ${{ matrix.make-target }}
35+
- name: Harden Runner
36+
uses: step-security/harden-runner@0634a2670c59f64b4a01f0f96f84700a4088b9f0 # v2.12.0
37+
with:
38+
egress-policy: audit
39+
40+
- name: Maximize build space
41+
uses: AdityaGarg8/remove-unwanted-software@90e01b21170618765a73370fcc3abbd1684a7793 # v5
42+
with:
43+
remove-android: 'true'
44+
remove-dotnet: 'true'
45+
remove-haskell: 'true'
46+
47+
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
48+
with:
49+
go-version: '1.24'
50+
check-latest: true
51+
52+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
53+
with:
54+
persist-credentials: false
55+
56+
- uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
57+
58+
- run: make install-container-diff k3s-setup
59+
- run: make ${{ matrix.make-target }}

0 commit comments

Comments
 (0)