finch-daemon/.github/workflows/ci.yaml at a80284f8b9f656a357510753dbdb30819835935f · runfinch/finch-daemon · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: CI
on:
  push:
    branches:
      - main
    paths-ignore:
      - '**.md'
  pull_request:
    branches:
      - main
    paths-ignore:
      - '**.md'
  workflow_dispatch:
env:
  GO_VERSION: '1.25.11'
  GOLANGCI_LINT_VERSION: '2.7.0'
  GOTOOLCHAIN: 'auto'
jobs:
  git-secrets:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - name: Pull latest awslabs/git-secrets repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          repository: awslabs/git-secrets
          ref: 1.3.0
          fetch-tags: true
          path: git-secrets
      - name: Install git secrets from source
        run: sudo make install
        working-directory: git-secrets
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Scan repository for git secrets
        run: |
          git secrets --register-aws
          git secrets --scan-history
  lint:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        working_dir: ['.']
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: golangci/golangci-lint-action@v9
        with:
          version: v${{ env.GOLANGCI_LINT_VERSION }}
          working-directory: ${{ matrix.working_dir }}
          args: --fix=false --timeout=5m
  yamllint:
    name: yamllint-lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - run: yamllint .
  build:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        go-version: ['1.25.11', '1.26.0']
    timeout-minutes: 10
    steps:
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ matrix.go-version }}
      - name: Checkout finch-deamon repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Build the daemon
        run: make build
      - name: Run unit tests
        run: make test-unit
      - name: Create build artifacts
        run: tar -cvf build-artifacts.tar bin/
      - name: Upload build artifacts
        if: matrix.go-version == '1.25.11'
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: build-artifacts
          path: build-artifacts.tar
  e2e-test:
    name: e2e-test (containerd ${{ matrix.containerd }}, nerdctl ${{ matrix.nerdctl }})
    runs-on: ubuntu-latest
    needs: [build]
    strategy:
      matrix:
        runc: ["1.3.3", "1.4.0", "1.5.0"]
        containerd: ["1.7.30", "2.1.5", "2.2.1", "2.3.2"]
        nerdctl: ["2.2.2", "2.3.0"]
        buildkit: ["0.30.0", "0.31.0"]
      fail-fast: false
    timeout-minutes: 10
    steps:
      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version: ${{ env.GO_VERSION }}
      - name: Checkout finch-daemon repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Stop pre-existing containerd and docker services
        run: |
          sudo systemctl stop docker
          sudo systemctl stop containerd
      - name: Install Dependencies for e2e Testing
        run: ./setup-test-env.sh --runc-version ${{ matrix.runc }} --containerd-version ${{ matrix.containerd }} --nerdctl-version ${{ matrix.nerdctl }} --buildkit-version ${{ matrix.buildkit }}
      - name: Download build artifacts
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: build-artifacts
      - name: Extract build artifacts
        run: tar -xvf build-artifacts.tar
      - name: Remove default podman network config
        run: |
          sudo ls /etc/cni/net.d
          sudo rm /etc/cni/net.d/87-podman-bridge.conflist
      - name: Verify Rego file presence
        run: ls -l ${{ github.workspace }}/docs/sample-rego-policies/example.rego
      - name: Set Rego file path
        run: echo "REGO_FILE_PATH=${{ github.workspace }}/docs/sample-rego-policies/example.rego" >> $GITHUB_ENV
      - name: Start finch-daemon with opa Authz
        run: sudo bin/finch-daemon --debug --experimental --rego-file ${{ github.workspace }}/docs/sample-rego-policies/example.rego --skip-rego-perm-check --socket-owner $UID --socket-addr /run/finch.sock --pidfile /run/finch.pid &
      - name: Run opa e2e tests
        run: sudo env "PATH=$PATH" "GOTOOLCHAIN=$GOTOOLCHAIN" make test-e2e-opa
      - name: Clean up Daemon socket
        run: sudo rm /run/finch.sock && sudo rm /run/finch.pid && sudo rm /run/finch-credential.sock
      - name: Start finch-daemon
        run: sudo cp bin/docker-credential-finch /usr/bin && sudo bin/finch-daemon  --debug --socket-owner $UID &
      - name: Run e2e test
        run: sudo env "PATH=$PATH" "GOTOOLCHAIN=$GOTOOLCHAIN" make test-e2e
      - name: Clean up Daemon socket
        run: sudo rm /var/run/finch.sock && sudo rm /run/finch.pid && sudo rm /var/run/finch-credential.sock