dependabot[bot]
2fc09963e8
Bumps the ci group with 6 updates: | Package | From | To | | --- | --- | --- | | [fluxcd/gha-workflows](https://github.com/fluxcd/gha-workflows) | `0.3.0` | `0.4.0` | | [actions/setup-go](https://github.com/actions/setup-go) | `5.5.0` | `6.0.0` | | [fluxcd/pkg](https://github.com/fluxcd/pkg) | `1.20.0` | `1.22.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.29.11` | `3.30.3` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.20.5` | `0.20.6` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `3.9.2` | `3.10.0` | Updates `fluxcd/gha-workflows` from 0.3.0 to 0.4.0 - [Release notes](https://github.com/fluxcd/gha-workflows/releases) - [Commits](https://github.com/fluxcd/gha-workflows/compare/v0.3.0...v0.4.0) Updates `actions/setup-go` from 5.5.0 to 6.0.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](https://github.com/actions/setup-go/compare/d35c59abb061a4a6fb18e82ac0862c26744d6ab5...44694675825211faa026b3c33043df3e48a5fa00) Updates `fluxcd/pkg` from 1.20.0 to 1.22.0 - [Commits](https://github.com/fluxcd/pkg/compare/7f090e931301b18cbdc37d9a28b08f84ba1270fb...bf02f0a2d612cc07e0892166369fa8f63246aabb) Updates `github/codeql-action` from 3.29.11 to 3.30.3 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/3c3833e0f8c1c83d449a7478aa59c036a9165498...192325c86100d080feab897ff886c34abd4c83a3) Updates `anchore/sbom-action` from 0.20.5 to 0.20.6 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](https://github.com/anchore/sbom-action/compare/da167eac915b4e86f08b264dbdbc867b61be6f0c...f8bdd1d8ac5e901a77a92f111440fdb1b593736b) Updates `sigstore/cosign-installer` from 3.9.2 to 3.10.0 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](https://github.com/sigstore/cosign-installer/compare/d58896d6a1865668819e1d91763c7751a165e159...d7543c93d881b35a8faa02e8e3605f69b7a1ce62) --- updated-dependencies: - dependency-name: fluxcd/gha-workflows dependency-version: 0.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: actions/setup-go dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: ci - dependency-name: fluxcd/pkg dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: github/codeql-action dependency-version: 3.30.3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: anchore/sbom-action dependency-version: 0.20.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci - dependency-name: sigstore/cosign-installer dependency-version: 3.10.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci ... Signed-off-by: dependabot[bot] <support@github.com>
Flux GitHub Workflows
End-to-end Testing
The e2e workflows run a series of tests to ensure that the Flux CLI and the GitOps Toolkit controllers work well all together. The tests are written in Go, Bash, Make and Terraform.
| Workflow | Jobs | Runner | Role |
|---|---|---|---|
| e2e.yaml | e2e-amd64-kubernetes | GitHub Ubuntu | integration testing with Kubernetes Kind |
| e2e-arm64.yaml | e2e-arm64-kubernetes | Equinix Ubuntu | integration testing with Kubernetes Kind |
| e2e-bootstrap.yaml | e2e-boostrap-github | GitHub Ubuntu | integration testing with GitHub API |
| e2e-azure.yaml | e2e-amd64-aks | GitHub Ubuntu | integration testing with Azure API |
| scan.yaml | scan-fossa | GitHub Ubuntu | license scanning |
| scan.yaml | scan-snyk | GitHub Ubuntu | vulnerability scanning |
| scan.yaml | scan-codeql | GitHub Ubuntu | vulnerability scanning |
Components Update
The components update workflow scans the GitOps Toolkit controller repositories for new releases, amd when it finds a new controller version, the workflow performs the following steps:
- Updates the controller API package version in
go.mod. - Patches the controller CRDs version in the
manifests/crdsoverlay. - Patches the controller Deployment version in
manifests/basesoverlay. - Opens a Pull Request against the
mainbranch. - Triggers the e2e test suite to run for the opened PR.
| Workflow | Jobs | Runner | Role |
|---|---|---|---|
| update.yaml | update-components | GitHub Ubuntu | update the GitOps Toolkit APIs and controllers |
Release
The release workflow is triggered by a semver Git tag and performs the following steps:
- Generates the Flux install manifests (YAML).
- Generates the OpenAPI validation schemas for the GitOps Toolkit CRDs (JSON).
- Generates a Software Bill of Materials (SPDX JSON).
- Builds the Flux CLI binaries and the multi-arch container images.
- Pushes the container images to GitHub Container Registry and DockerHub.
- Signs the sbom, the binaries checksum and the container images with Cosign and GitHub OIDC.
- Uploads the sbom, binaries, checksums and install manifests to GitHub Releases.
- Pushes the install manifests as OCI artifacts to GitHub Container Registry and DockerHub.
- Signs the OCI artifacts with Cosign and GitHub OIDC.
| Workflow | Jobs | Runner | Role |
|---|---|---|---|
| release.yaml | release-flux-cli | GitHub Ubuntu | build, push and sign the CLI release artifacts |
| release.yaml | release-flux-manifests | GitHub Ubuntu | build, push and sign the Flux install manifests |