-
Notifications
You must be signed in to change notification settings - Fork 7
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
chore: update practices around maintaining the UDS Common framework (#…
…253)
- Loading branch information
Showing
18 changed files
with
233 additions
and
121 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,8 @@ | ||
| ## Description | ||
|
|
||
| ... | ||
|
|
||
| ## Checklist before merging | ||
|
|
||
| - [ ] ADR proposed if making an architectural change to the repo | ||
| - [ ] Tests run, docs added or updated as needed |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| name: Scorecards supply-chain security | ||
| on: | ||
| # Only the default branch is supported. | ||
| branch_protection_rule: | ||
| schedule: | ||
| - cron: 30 1 * * 6 | ||
| push: | ||
| branches: [main] | ||
| # This allows other repositories to call this workflow in a reusable way | ||
| workflow_call: | ||
|
|
||
| # Declare default permissions as read only. | ||
| permissions: read-all | ||
|
|
||
| jobs: | ||
| run: | ||
| name: Scorecards analysis | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| # Needed to upload the results to code-scanning dashboard. | ||
| security-events: write | ||
| # Used to receive a badge. | ||
| id-token: write | ||
|
|
||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | ||
| with: | ||
| persist-credentials: false | ||
|
|
||
| - name: Run analysis | ||
| uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0 | ||
| with: | ||
| results_file: results.sarif | ||
| results_format: sarif | ||
| repo_token: ${{ secrets.SCORECARD_READ_TOKEN }} | ||
| publish_results: true | ||
|
|
||
| # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF | ||
| # format to the repository Actions tab. | ||
| - name: Upload artifact | ||
| uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0 | ||
| with: | ||
| name: SARIF file | ||
| path: results.sarif | ||
| retention-days: 5 | ||
|
|
||
| # Upload the results to GitHub's code scanning dashboard. | ||
| - name: Upload to code-scanning | ||
| uses: github/codeql-action/upload-sarif@294a9d92911152fe08befb9ec03e240add280cb3 # v3.26.8 | ||
| with: | ||
| sarif_file: results.sarif |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,100 +1,33 @@ | ||
| # UDS Common | ||
| # 🦄 UDS Common | ||
|
|
||
| This repository contains common configuration and tasks used in UDS Packages for management, setup, creation, deployment, and publishing of packages and bundles. It also includes [UDS package practices](./docs/package_integration/uds-package-practices.md) defining requirements and standards to obtain the [<img alt="Made for UDS" src="docs/made-for-uds.svg" height="20px"/>](https://github.com/defenseunicorns/uds-core) Badges. | ||
| [](https://github.com/defenseunicorns/uds-common/releases) | ||
| [](https://github.com/defenseunicorns/uds-common/actions/workflows/tag-and-release.yaml) | ||
| [](https://api.securityscorecards.dev/projects/github.com/defenseunicorns/uds-common) | ||
|
|
||
| ## Task Usage | ||
|
|
||
| The tasks are designed to be consumed via remote task includes and GitHub Actions (WIP). It is typically easiest to include tasks in a single root level `tasks.yaml`. Includes should follow the standard remote include pattern documented by UDS CLI: | ||
|
|
||
| ```yaml | ||
| includes: | ||
| - deploy: https://raw.githubusercontent.com/defenseunicorns/uds-common/$TAG/tasks/deploy.yaml | ||
| ``` | ||
| Pinning to a specific tag of a task (rather than `main`) with renovate watching for updates is recommended since tasks do rely on dependencies like command syntax for `zarf` and `uds` as well as the published versions of `uds-core`. | ||
|
|
||
| ## Supported Tool Versions | ||
|
|
||
| - UDS CLI: 0.17.0 | ||
| - UDS Core: 0.28.0 | ||
| - K3D: 5.7.4 | ||
| - Lula: 0.8.0 | ||
|
|
||
| NOTE: Zarf is not required for tasks in this repo, the vendored zarf (`uds zarf`) included with UDS CLI is used instead to prevent version mismatches. | ||
|
|
||
| ## Task Files | ||
|
|
||
| There are multiple task files available in this repository with different objectives and required variables. | ||
|
|
||
| ### setup.yaml | ||
|
|
||
| This task file includes two tasks: | ||
|
|
||
| - `k3d-test-cluster` sets up a k3d cluster running the `uds-core-istio-dev` package. This provides a baseline cluster with Istio and the UDS Core Pepr capabilities necessary to test against. | ||
| - `registry-login` performs a registry login and retry a max of 10 times at a desired retry interval (in seconds). It reads in variables for the task to use for the registry login parameters. The variable inputs are: | ||
| - `REGISTRY`: the target registry | ||
| - `REGISTRY_USERNAME`: the username for the registry | ||
| - `REGISTRY_PASSWORD`: the password for the registry | ||
| - `REGISTRY_RETRY_INTERVAL`: the number in seconds to wait between retries | ||
|
|
||
| ### create.yaml | ||
|
|
||
| This task file includes two tasks: | ||
|
|
||
| - `package`: creates a zarf package located at the base of the repository. It has a required variable of `FLAVOR` which defaults to `upstream` and inputs to override the default path and options used for creation (useful in publishing workflows). | ||
| - `test-bundle`: creates a test bundle located at the path `bundle/` (by default). It uses `UDS_ARCH` to override the default architecture used for creation (useful in publishing workflows). Note that this task does not create any pre-requisite zarf packages so those tasks must be run first. | ||
|
|
||
| ### deploy.yaml | ||
| This repo acts as a UDS Package Framework that contains common configuration, tasks and documentation useful for building downstream UDS Packages. It defines and helps consumers implement [UDS package practices](./docs/package_integration/uds-package-practices.md) within their specific package repositories and is intended to help streamline keeping those practices up to date over time. | ||
|
|
||
| This task file includes two tasks: | ||
| ## Contents | ||
|
|
||
| - `package`: deploys a zarf package located at the base of the repository (using the regex match `zarf-package-*-${UDS_ARCH}-*.tar.zst`). | ||
| - `test-bundle`: deploys a test bundle located at the path `bundle/` (using the regex match `bundle/uds-bundle-*-${UDS_ARCH}-*.tar.zst`) and the config file located at `bundle/uds-config.yaml`. | ||
| The repo itself contains: | ||
|
|
||
| ### publish.yaml | ||
| - [UDS tasks](tasks) to maintain, build, test, validate, and publish UDS Packages. | ||
| - [Documentation](docs) on what makes a "UDS Package" a UDS Package and how to implement one for yourself. | ||
| - [Renovate configuration](config/renovate.json5) to update Helm charts, Docker images, Zarf packages and more. | ||
| - [VSCode configuration](config/.vscode) to setup syntax highlighting for different tooling in your IDE. | ||
| - [An example](.) UDS Package for Nginx that demonstrates the general structure and acts as a test for the common tasks. | ||
|
|
||
| This task file includes two tasks: | ||
|
|
||
| - `package`: which publishes a zarf package. Inputs for this task: | ||
|
|
||
| - `PATH`: the path to the directory in which to look for the package. Defaults to `.` | ||
| - `VERSION`: the version of the zarf package to publish with no default. This should typically be version controlled by something like release-please. | ||
| - `ARCHITECTURE`: the architecture of the zarf package to publish, defaults to `${UDS_ARCH}` | ||
| - `TARGET_REPO`: the target OCI repository to publish the zarf package to (without the `oci://` scheme) - this defaults to `ghcr.io/defenseunicorns/packages/uds`. | ||
|
|
||
| The package will be matched based on the pattern `${PATH}/zarf-package-*-${ARCHITECTURE}-${VERSION}.tar.zst` and published to `oci://${TARGET_REPO}` | ||
|
|
||
| - `test-bundle`: which publishes a UDS bundle. Inputs for this task: | ||
|
|
||
| - `PATH`: the path to the directory in which to look for the bundle. Defaults to `bundle` | ||
| - `VERSION`: the version of the bundle to publish with no default. This should typically be version controlled by something like release-please. | ||
| - `ARCHITECTURE`: the architecture of the bundle to publish, defaults to `${UDS_ARCH}` | ||
| - `TARGET_REPO`: the target OCI repository to publish the bundle (without the `oci://` scheme) - this defaults to `ghcr.io/defenseunicorns/packages/uds/bundles`. | ||
|
|
||
| The bundle will be matched based on the pattern `${PATH}/uds-bundle-*-${ARCHITECTURE}-${VERSION}.tar.zst` and published to `oci://${TARGET_REPO}` | ||
|
|
||
|
|
||
| ### pull.yaml | ||
|
|
||
| This task file includes one task: | ||
|
|
||
| - `latest-package-release`: finds the latest package release for the repo and pulls it into the specified directory path. It has a required variable of `FLAVOR` which defaults to `upstream` and a `TARGET_REPO` variable which is the target OCI repository to pull the zarf package from (without the `oci://` scheme) - this defaults to `ghcr.io/defenseunicorns/packages/uds`. | ||
|
|
||
| ### lint.yaml | ||
| ## Task Usage | ||
|
|
||
| This task file includes two tasks: | ||
| Common `tasks` can be included in downstream repositories and executed with `uds run`. You can learn more about the common tasks in this repo on the [tasks README](./tasks/README.md). | ||
|
|
||
| - `deps`: installs all of the dependencies for linting the repository. | ||
| - `yaml`: lints all of the `.yaml` files within the repository. | ||
| - `oscal`: lints targeted OSCAL files within the repository. | ||
| ## Configuration Usage | ||
|
|
||
| ### compliance.yaml | ||
| Common configuration used between repositories is located in the `config` directory and is imported via specific tool mechanisms (like Renovate's `extends` key). | ||
|
|
||
| This task file includes two tasks: | ||
| ## Example Usage | ||
|
|
||
| - `validate`: performs a compliance assessment of the repository against the identified OSCAL standard. | ||
| - `evaluate`: Compares the results (when present) to evaluate compliance. | ||
| The example in this repository is based around Nginx and can be interacted with as you would in any other UDS Package repo - i.e. `uds run test-package` | ||
|
|
||
| ## Configuration Usage | ||
| ## Contributing | ||
|
|
||
| Common configuration used between repositories is located in the `config` directory and is imported via specific tool mechanisms (like Renovate's `extends` key). | ||
| Please see the [CONTRIBUTING.md](./CONTRIBUTING.md) |
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.