86b3075535
Bumps the ci group with 6 updates: | Package | From | To | | --- | --- | --- | | [actions/checkout](https://github.com/actions/checkout) | `4.1.3` | `4.1.4` | | [helm/kind-action](https://github.com/helm/kind-action) | `1.9.0` | `1.10.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.3.2` | `4.3.3` | | [anchore/sbom-action](https://github.com/anchore/sbom-action) | `0.15.10` | `0.15.11` | | [slsa-framework/slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator) | `1.10.0` | `2.0.0` | | [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request) | `6.0.4` | `6.0.5` | Updates `actions/checkout` from 4.1.3 to 4.1.4 - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](1d96c772d1...0ad4b8fada) Updates `helm/kind-action` from 1.9.0 to 1.10.0 - [Release notes](https://github.com/helm/kind-action/releases) - [Commits](99576bfa6d...0025e74a8c) Updates `actions/upload-artifact` from 4.3.2 to 4.3.3 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](1746f4ab65...65462800fd) Updates `anchore/sbom-action` from 0.15.10 to 0.15.11 - [Release notes](https://github.com/anchore/sbom-action/releases) - [Commits](ab5d7b5f48...7ccf588e3c) Updates `slsa-framework/slsa-github-generator` from 1.10.0 to 2.0.0 - [Release notes](https://github.com/slsa-framework/slsa-github-generator/releases) - [Changelog](https://github.com/slsa-framework/slsa-github-generator/blob/main/CHANGELOG.md) - [Commits](https://github.com/slsa-framework/slsa-github-generator/compare/v1.10.0...v2.0.0) Updates `peter-evans/create-pull-request` from 6.0.4 to 6.0.5 - [Release notes](https://github.com/peter-evans/create-pull-request/releases) - [Commits](9153d834b6...6d6857d369) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci - dependency-name: helm/kind-action dependency-type: direct:production update-type: version-update:semver-minor dependency-group: ci - dependency-name: actions/upload-artifact dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci - dependency-name: anchore/sbom-action dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci - dependency-name: slsa-framework/slsa-github-generator dependency-type: direct:production update-type: version-update:semver-major dependency-group: ci - dependency-name: peter-evans/create-pull-request dependency-type: direct:production update-type: version-update:semver-patch dependency-group: ci ... Signed-off-by: dependabot[bot] <support@github.com>
Flux GitHub Workflows
End-to-end Testing
The e2e workflows run a series of tests to ensure that the Flux CLI and the GitOps Toolkit controllers work well all together. The tests are written in Go, Bash, Make and Terraform.
| Workflow | Jobs | Runner | Role |
|---|---|---|---|
| e2e.yaml | e2e-amd64-kubernetes | GitHub Ubuntu | integration testing with Kubernetes Kind |
| e2e-arm64.yaml | e2e-arm64-kubernetes | Equinix Ubuntu | integration testing with Kubernetes Kind |
| e2e-bootstrap.yaml | e2e-boostrap-github | GitHub Ubuntu | integration testing with GitHub API |
| e2e-azure.yaml | e2e-amd64-aks | GitHub Ubuntu | integration testing with Azure API |
| scan.yaml | scan-fossa | GitHub Ubuntu | license scanning |
| scan.yaml | scan-snyk | GitHub Ubuntu | vulnerability scanning |
| scan.yaml | scan-codeql | GitHub Ubuntu | vulnerability scanning |
Components Update
The components update workflow scans the GitOps Toolkit controller repositories for new releases, amd when it finds a new controller version, the workflow performs the following steps:
- Updates the controller API package version in
go.mod. - Patches the controller CRDs version in the
manifests/crdsoverlay. - Patches the controller Deployment version in
manifests/basesoverlay. - Opens a Pull Request against the
mainbranch. - Triggers the e2e test suite to run for the opened PR.
| Workflow | Jobs | Runner | Role |
|---|---|---|---|
| update.yaml | update-components | GitHub Ubuntu | update the GitOps Toolkit APIs and controllers |
Release
The release workflow is triggered by a semver Git tag and performs the following steps:
- Generates the Flux install manifests (YAML).
- Generates the OpenAPI validation schemas for the GitOps Toolkit CRDs (JSON).
- Generates a Software Bill of Materials (SPDX JSON).
- Builds the Flux CLI binaries and the multi-arch container images.
- Pushes the container images to GitHub Container Registry and DockerHub.
- Signs the sbom, the binaries checksum and the container images with Cosign and GitHub OIDC.
- Uploads the sbom, binaries, checksums and install manifests to GitHub Releases.
- Pushes the install manifests as OCI artifacts to GitHub Container Registry and DockerHub.
- Signs the OCI artifacts with Cosign and GitHub OIDC.
| Workflow | Jobs | Runner | Role |
|---|---|---|---|
| release.yaml | release-flux-cli | GitHub Ubuntu | build, push and sign the CLI release artifacts |
| release.yaml | release-flux-manifests | GitHub Ubuntu | build, push and sign the Flux install manifests |