Skip to content

Commit 281dc0d

Browse files
ascerraascerra
committed
add sealights workflow so that it can be triggered in PR
Signed-off-by: Adam Scerra <ascerra@redhat.com>
1 parent deac91a commit 281dc0d

File tree

2 files changed

+194
-0
lines changed

2 files changed

+194
-0
lines changed

‎.github/workflows/checks-sealights.yaml‎

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
# Copyright The Enterprise Contract Contributors
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
#
15+
# SPDX-License-Identifier: Apache-2.0
16+
17+
---
18+
name: Sealights
19+
20+
on:
21+
pull_request_target:
22+
types: [opened, synchronize, reopened, labeled, unlabeled]
23+
push:
24+
branches:
25+
- main
26+
- release-*
27+
workflow_dispatch:
28+
29+
permissions:
30+
contents: read
31+
32+
concurrency:
33+
group: ${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.event.pull_request.number) || github.ref }}
34+
cancel-in-progress: true
35+
36+
jobs:
37+
38+
Initialize:
39+
runs-on: ubuntu-latest
40+
env:
41+
SEALIGHTS_LOG_LEVEL: none
42+
outputs:
43+
bsid: ${{ steps.sealights-scan.outputs.bsid }}
44+
steps:
45+
- name: Determine workflow run event context
46+
run: echo "on-event=${{ github.event_name }}" >> $GITHUB_ENV
47+
48+
- name: Handle invalid context for pull requests
49+
if: ${{ env.on-event == 'pull_request' && (!github.event.pull_request.head.sha || !github.event.pull_request.number) }}
50+
run: |
51+
echo "Invalid context for this workflow run. Exiting."
52+
exit 1
53+
- name: Checkout repository
54+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
55+
with:
56+
# Needed in hack/derive-version.sh
57+
fetch-depth: 0
58+
59+
- name: Restore Cache
60+
uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
61+
with:
62+
key: main
63+
path: '**'
64+
65+
- name: Setup Go environment
66+
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
67+
with:
68+
go-version-file: go.mod
69+
cache: false
70+
71+
- name: Check go versions
72+
uses: enterprise-contract/github-workflows/golang-version-check@main
73+
74+
- name: Download SeaLights Go agent and CLI tool
75+
run: |
76+
echo "[Sealights] Downloading Sealights Golang & CLI Agents..."
77+
case $(lscpu | awk '/Architecture:/{print $2}') in
78+
x86_64) SL_ARCH="linux-amd64";;
79+
arm) SL_ARCH="linux-arm64";;
80+
esac
81+
wget -nv -O sealights-go-agent.tar.gz https://agents.sealights.co/slgoagent/latest/slgoagent-$SL_ARCH.tar.gz
82+
wget -nv -O sealights-slcli.tar.gz https://agents.sealights.co/slcli/latest/slcli-$SL_ARCH.tar.gz
83+
tar -xzf ./sealights-go-agent.tar.gz && tar -xzf ./sealights-slcli.tar.gz
84+
rm -f ./sealights-go-agent.tar.gz ./sealights-slcli.tar.gz
85+
./slgoagent -v 2> /dev/null | grep version && ./slcli -v 2> /dev/null | grep version
86+
87+
- name: Write SeaLights token into file
88+
run: echo "${SEALIGHTS_AGENT_TOKEN}" > sltoken.txt
89+
env:
90+
SEALIGHTS_AGENT_TOKEN: '${{secrets.SEALIGHTS_AGENT_TOKEN}}'
91+
92+
- name: Initiating the SeaLights agent
93+
run: |
94+
echo "[Sealights] Initiating the SeaLights agent to Golang and handing it the token"
95+
./slcli config init --lang go --token ./sltoken.txt
96+
- name: Configuring SeaLights - on pull_request event
97+
if: env.on-event == 'pull_request'
98+
run: |
99+
echo "[Sealights] Configuring SeaLights to scan the pull request branch"
100+
echo "Latest commit sha: ${LATEST_COMMIT_SHA}"
101+
echo "PR Number: ${PULL_REQUEST_NUMBER}"
102+
./slcli config create-pr-bsid --app ec-cli --target-branch "main" --pull-request-number ${PULL_REQUEST_NUMBER} --latest-commit ${LATEST_COMMIT_SHA} --repository-url https://github.com/enterprise-contract/ec-cli.git
103+
env:
104+
PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
105+
LATEST_COMMIT_SHA: ${{github.event.pull_request.head.sha}}
106+
107+
- name: Configuring SeaLights - on push event
108+
if: env.on-event == 'push'
109+
run: |
110+
echo "[Sealights] Configuring SeaLights to scan the main branch after pull request was closed"
111+
./slcli config create-bsid --app ec-cli --branch main --build ${LATEST_COMMIT_SHA}
112+
env:
113+
LATEST_COMMIT_SHA: ${{ github.sha }}
114+
115+
- name: Run the SeaLights scan
116+
id: sealights-scan
117+
run: |
118+
echo "[Sealights] Running the SeaLights scan"
119+
./slcli scan --bsid buildSessionId.txt --path-to-scanner ./slgoagent --workspacepath ./ --scm git --scmBaseUrl https://github.com/enterprise-contract/ec-cli.git --scmVersion “0” --scmProvider github
120+
echo bsid=$(< buildSessionId.txt) | tee -a "$GITHUB_OUTPUT"
121+
- name: clean all SeaLights secret stuff
122+
run: |
123+
echo "[Sealights] Cleaning up after SeaLights run"
124+
rm sltoken.txt
125+
- name: Save workspace
126+
uses: actions/cache@v4
127+
with:
128+
path: ${{ github.workspace }}
129+
key: workspace-${{ github.run_id }}
130+
131+
Test:
132+
runs-on: ubuntu-latest
133+
needs: Initialize
134+
steps:
135+
- name: Restore workspace
136+
uses: actions/cache@v4
137+
with:
138+
path: ${{ github.workspace }}
139+
key: workspace-${{ github.run_id }}
140+
141+
- name: Harden Runner
142+
uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
143+
with:
144+
egress-policy: audit
145+
disable-telemetry: true
146+
147+
- name: Generate
148+
run: make generate
149+
150+
- name: Test
151+
run: make test
152+
153+
Acceptance:
154+
runs-on: ubuntu-latest
155+
needs: [Initialize, Test]
156+
env:
157+
BSID: ${{ needs.Initialize.outputs.bsid }}
158+
SEALIGHTS_LOG_LEVEL: none
159+
SEALIGHTS_CONNECTION_TIMEOUT: 120s
160+
steps:
161+
- name: Restore workspace
162+
uses: actions/cache@v4
163+
with:
164+
path: ${{ github.workspace }}
165+
key: workspace-${{ github.run_id }}
166+
167+
- name: Update podman
168+
run: |
169+
"${GITHUB_WORKSPACE}/hack/ubuntu-podman-update.sh"
170+
- name: Create a test session
171+
run: ./slcli test start-stage --bsid=$BSID --testStage "Acceptance Tests"
172+
173+
- name: Acceptance test
174+
run: make acceptance-sealights
175+
176+
- name: Upload test results, end test session
177+
if: success() || failure()
178+
run: |
179+
cat ./junit-acceptance.xml
180+
./slcli test upload-reports --bsid=$BSID --report-location ./junit-acceptance.xml
181+
./slcli test end-stage --bsid=$BSID --executionId "Acceptance Tests"

‎Makefile‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -130,6 +130,19 @@ acceptance: ## Run all acceptance tests
130130
cd acceptance && go test -coverprofile "$$ACCEPTANCE_WORKDIR/coverage-acceptance.out" -timeout $(ACCEPTANCE_TIMEOUT) ./... && \
131131
go run -modfile "$$ACCEPTANCE_WORKDIR/tools/go.mod" github.com/wadey/gocovmerge "$$ACCEPTANCE_WORKDIR/coverage-acceptance.out" > "$(ROOT_DIR)/coverage-acceptance.out"
132132

133+
acceptance-sealights: ## Run all acceptance tests with sealights integration
134+
@ACCEPTANCE_WORKDIR="$$(mktemp -d)"; \
135+
cleanup() { \
136+
cp "$${ACCEPTANCE_WORKDIR}"/features/__snapshots__/* "$(ROOT_DIR)"/features/__snapshots__/; \
137+
}; \
138+
trap cleanup EXIT; \
139+
cp -R . "$$ACCEPTANCE_WORKDIR"; \
140+
cd "$$ACCEPTANCE_WORKDIR" && \
141+
$(MAKE) build && \
142+
export COVERAGE_FILEPATH="$$ACCEPTANCE_WORKDIR"; \
143+
export COVERAGE_FILENAME="-acceptance"; \
144+
cd acceptance && SEALIGHTS_LOG_LEVEL=none go run -modfile "$$ACCEPTANCE_WORKDIR/tools/go.mod" gotest.tools/gotestsum --junitfile "$(ROOT_DIR)/junit-acceptance.xml" -- -parallel 1 -timeout $(ACCEPTANCE_TIMEOUT) ./...
145+
133146
# Add @focus above the feature you're hacking on to use this
134147
# (Mainly for use with the feature-% target below)
135148
.PHONY: focus-acceptance

0 commit comments

Comments
 (0)