683d0720d9
Bumps the ci group with 6 updates: | Package | From | To | | --- | --- | --- | | [actions/setup-go](https://github.com/actions/setup-go) | `6.3.0` | `6.4.0` | | [fluxcd/pkg](https://github.com/fluxcd/pkg) | `1.27.0` | `1.28.0` | | [Azure/login](https://github.com/azure/login) | `2.3.0` | `3.0.0` | | [github/codeql-action](https://github.com/github/codeql-action) | `4.32.6` | `4.35.1` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.23.1` | `0.24.0` | | [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer) | `4.1.0` | `4.1.1` | Updates `actions/setup-go` from 6.3.0 to 6.4.0 - [Release notes](https://github.com/actions/setup-go/releases) - [Commits](4b73464bb3...4a3601121d) Updates `fluxcd/pkg` from 1.27.0 to 1.28.0 - [Commits](9a8c0edd5d...357bbcc346) Updates `Azure/login` from 2.3.0 to 3.0.0 - [Release notes](https://github.com/azure/login/releases) - [Commits](a457da9ea1...532459ea53) Updates `github/codeql-action` from 4.32.6 to 4.35.1 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](0d579ffd05...c10b8064de) Updates `anchore/sbom-action` from 0.23.1 to 0.24.0 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md) - [Commits](57aae52805...e22c389904) Updates `sigstore/cosign-installer` from 4.1.0 to 4.1.1 - [Release notes](https://github.com/sigstore/cosign-installer/releases) - [Commits](ba7bc0a3fe...cad07c2e89) --- updated-dependencies: - dependency-name: actions/setup-go dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: fluxcd/pkg dependency-version: 1.28.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: Azure/login dependency-version: 3.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: ci - dependency-name: github/codeql-action dependency-version: 4.35.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: anchore/sbom-action dependency-version: 0.24.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: sigstore/cosign-installer dependency-version: 4.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci ... Signed-off-by: dependabot[bot] <support@github.com>
Flux GitHub Workflows
End-to-end Testing
The e2e workflows run a series of tests to ensure that the Flux CLI and the GitOps Toolkit controllers work well all together. The tests are written in Go, Bash, Make and Terraform.
| Workflow | Jobs | Runner | Role |
|---|---|---|---|
| e2e.yaml | e2e-amd64-kubernetes | GitHub Ubuntu | integration testing with Kubernetes Kind |
| e2e-arm64.yaml | e2e-arm64-kubernetes | Equinix Ubuntu | integration testing with Kubernetes Kind |
| e2e-bootstrap.yaml | e2e-boostrap-github | GitHub Ubuntu | integration testing with GitHub API |
| e2e-azure.yaml | e2e-amd64-aks | GitHub Ubuntu | integration testing with Azure API |
| scan.yaml | scan-fossa | GitHub Ubuntu | license scanning |
| scan.yaml | scan-snyk | GitHub Ubuntu | vulnerability scanning |
| scan.yaml | scan-codeql | GitHub Ubuntu | vulnerability scanning |
Components Update
The components update workflow scans the GitOps Toolkit controller repositories for new releases, amd when it finds a new controller version, the workflow performs the following steps:
- Updates the controller API package version in
go.mod. - Patches the controller CRDs version in the
manifests/crdsoverlay. - Patches the controller Deployment version in
manifests/basesoverlay. - Opens a Pull Request against the checked out branch.
- Triggers the e2e test suite to run for the opened PR.
| Workflow | Jobs | Runner | Role |
|---|---|---|---|
| update.yaml | update-components | GitHub Ubuntu | update the GitOps Toolkit APIs and controllers |
Release
The release workflow is triggered by a semver Git tag and performs the following steps:
- Generates the Flux install manifests (YAML).
- Generates the OpenAPI validation schemas for the GitOps Toolkit CRDs (JSON).
- Generates a Software Bill of Materials (SPDX JSON).
- Builds the Flux CLI binaries and the multi-arch container images.
- Pushes the container images to GitHub Container Registry and DockerHub.
- Signs the sbom, the binaries checksum and the container images with Cosign and GitHub OIDC.
- Uploads the sbom, binaries, checksums and install manifests to GitHub Releases.
- Pushes the install manifests as OCI artifacts to GitHub Container Registry and DockerHub.
- Signs the OCI artifacts with Cosign and GitHub OIDC.
| Workflow | Jobs | Runner | Role |
|---|---|---|---|
| release.yaml | release-flux-cli | GitHub Ubuntu | build, push and sign the CLI release artifacts |
| release.yaml | release-flux-manifests | GitHub Ubuntu | build, push and sign the Flux install manifests |