chore: Update deps #379
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| trivy-image-scan: | |
| name: Trivy Image CVE Scan (${{ matrix.name }}) | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: backend | |
| context: backend | |
| dockerfile: backend/Containerfile | |
| image: rhacs-manager-backend | |
| - name: frontend | |
| context: frontend | |
| dockerfile: frontend/Containerfile | |
| image: rhacs-manager-frontend | |
| - name: auth-header-injector | |
| context: auth-header-injector | |
| dockerfile: auth-header-injector/Containerfile | |
| image: rhacs-manager-auth-header-injector | |
| - name: mcp-server | |
| context: mcp-server | |
| dockerfile: mcp-server/Containerfile | |
| image: rhacs-manager-mcp-server | |
| permissions: | |
| contents: read | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - name: Build image for scanning | |
| run: | | |
| docker build \ | |
| -t "local/${{ matrix.image }}:ci-${{ github.sha }}" \ | |
| -f "${{ matrix.dockerfile }}" \ | |
| "${{ matrix.context }}" | |
| - name: Show built image metadata | |
| run: | | |
| docker image inspect "local/${{ matrix.image }}:ci-${{ github.sha }}" --format 'Image={{.RepoTags}} Size={{.Size}}' | |
| - name: Run Trivy report scan (always produces output) | |
| continue-on-error: true | |
| uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 | |
| with: | |
| scan-type: image | |
| image-ref: local/${{ matrix.image }}:ci-${{ github.sha }} | |
| docker-host: unix:///var/run/docker.sock | |
| scanners: vuln | |
| format: json | |
| output: trivy-report.json | |
| exit-code: "0" | |
| ignore-unfixed: false | |
| - name: Print Trivy report summary | |
| run: | | |
| if [ ! -f trivy-report.json ]; then | |
| echo "Trivy did not produce trivy-report.json for ${{ matrix.name }}." | |
| echo "Available local images:" | |
| docker images --format 'table {{.Repository}}\t{{.Tag}}\t{{.ID}}\t{{.Size}}' | head -n 20 | |
| exit 0 | |
| fi | |
| echo "Severity distribution for ${{ matrix.name }}:" | |
| jq -r ' | |
| [.Results[]?.Vulnerabilities[]?.Severity] | |
| | sort | |
| | group_by(.) | |
| | map("\(.[0])\t\(length)") | |
| | .[] | |
| ' trivy-report.json | |
| total_all="$(jq -r '[.Results[]?.Vulnerabilities[]?] | length' trivy-report.json)" | |
| echo "Total vulnerabilities (all severities): ${total_all}" | |
| echo "Top findings for ${{ matrix.name }}:" | |
| jq -r ' | |
| .Results[]?.Vulnerabilities[]? | |
| | select(.Severity == "CRITICAL" or .Severity == "HIGH") | |
| | "\(.Severity)\t\(.VulnerabilityID)\t\(.PkgName)\t\(.InstalledVersion)\t\(.FixedVersion // "n/a")" | |
| ' trivy-report.json | head -n 30 | |
| total_high_critical="$(jq -r '[.Results[]?.Vulnerabilities[]? | select(.Severity == "CRITICAL" or .Severity == "HIGH")] | length' trivy-report.json)" | |
| echo "Total HIGH/CRITICAL vulnerabilities: ${total_high_critical}" | |
| - name: Upload Trivy JSON report | |
| if: ${{ hashFiles('trivy-report.json') != '' }} | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: trivy-report-${{ matrix.name }} | |
| path: trivy-report.json | |
| helm-schema: | |
| name: Generate Helm Schema | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | |
| with: | |
| go-version: "stable" | |
| cache: false | |
| - name: Install helm-schema | |
| run: go install github.com/dadav/helm-schema/cmd/helm-schema@latest | |
| - name: Generate values.schema.json | |
| run: helm-schema -r -c deploy/helm/rhacs-manager | |
| - name: Check for uncommitted schema changes | |
| run: | | |
| if ! git diff --exit-code deploy/helm/rhacs-manager/values.schema.json; then | |
| echo "::error::values.schema.json is out of date. Run 'helm-schema -r -c deploy/helm/rhacs-manager' and commit the result." | |
| exit 1 | |
| fi | |
| lint-frontend: | |
| name: Lint Frontend | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version-file: frontend/package.json | |
| - run: bun ci | |
| working-directory: frontend | |
| - run: bun run lint | |
| working-directory: frontend | |
| build-frontend: | |
| name: Build Frontend | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version-file: frontend/package.json | |
| - run: bun ci | |
| working-directory: frontend | |
| - run: bun run build | |
| working-directory: frontend | |
| test-frontend: | |
| name: Test Frontend | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: oven-sh/setup-bun@v2 | |
| with: | |
| bun-version-file: frontend/package.json | |
| - run: bun ci | |
| working-directory: frontend | |
| - run: bun run test | |
| working-directory: frontend | |
| test-backend: | |
| name: Test Backend | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.14" | |
| - run: uv sync --dev | |
| working-directory: backend | |
| - run: uv run pytest | |
| working-directory: backend | |
| test-mcp-server: | |
| name: Test MCP Server | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.14" | |
| - run: uv sync --dev | |
| working-directory: mcp-server | |
| - run: uv run pytest | |
| working-directory: mcp-server | |
| lint-backend: | |
| name: Lint Backend | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.14" | |
| - run: uv sync --dev | |
| working-directory: backend | |
| - run: uv run ruff check . | |
| working-directory: backend | |
| - run: uv run ruff format --check . | |
| working-directory: backend | |
| lint-mcp-server: | |
| name: Lint MCP Server | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 | |
| - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6 | |
| with: | |
| python-version: "3.14" | |
| - run: uv sync --dev | |
| working-directory: mcp-server | |
| - run: uv run ruff check . | |
| working-directory: mcp-server | |
| - run: uv run ruff format --check . | |
| working-directory: mcp-server | |
| test-injector: | |
| name: Test Auth Header Injector | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 | |
| - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6 | |
| with: | |
| go-version: "stable" | |
| - run: go test ./... | |
| working-directory: auth-header-injector | |
| - run: go vet ./... | |
| working-directory: auth-header-injector |