gatekeeper-3.12.yaml

package:
  name: gatekeeper-3.12
  version: 3.12.0
  epoch: 10
  description: Gatekeeper - Policy Controller for Kubernetes
  copyright:
    - license: Apache-2.0
  dependencies:
    provides:
      - gatekeeper=3.12.999

environment:
  contents:
    packages:
      - build-base
      - busybox
      - ca-certificates-bundle
      - go
      - wolfi-baselayout

pipeline:
  # We can't use go/install because this requires specific ldflags to set the version
  - uses: git-checkout
    with:
      repository: https://github.com/open-policy-agent/gatekeeper
      tag: v${{package.version}}
      expected-commit: 770d9756db0487d1baa4079476c853236961a4eb
      destination: gatekeeper

  - runs: |
      cd gatekeeper
      # Mitigate CVE-2023-39325, CVE-2023-3978, CVE-2023-44487
      go get golang.org/x/net@v0.17.0
      go get golang.org/x/crypto@v0.17.0
      # Mitigate GHSA-m425-mq94-257g
      go mod edit -droprequire=google.golang.org/grpc
      go get google.golang.org/grpc@v1.58.3
      # CVE-2023-45142
      go get go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp@v0.44.0
      go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc@v1.19.0
      go get go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.19.0
      go mod tidy
      go mod vendor
      FRAMEWORKS_VERSION=$(go list -f '{{ .Version }}' -m github.com/open-policy-agent/frameworks/constraint)
      OPA_VERSION=$(go list -f '{{ .Version }}' -m github.com/open-policy-agent/opa)
      CGO_ENABLED=0 GO111MODULE=on go build -mod vendor -a -ldflags "-w -X github.com/open-policy-agent/gatekeeper/pkg/version.Version=v${{package.version}} -X main.frameworksVersion=${FRAMEWORKS_VERSION} -X main.opaVersion=${OPA_VERSION}" -o manager
      mkdir -p ${{targets.destdir}}/usr/bin
      install -Dm755 ./manager ${{targets.destdir}}/usr/bin/manager

  - uses: strip

subpackages:
  - name: ${{package.name}}-compat
    pipeline:
      - runs: |
          mkdir -p ${{targets.subpkgdir}}
          ln -sf /usr/bin/manager ${{targets.subpkgdir}}/manager
    dependencies:
      provides:
        - gatekeeper-compat=3.12.999

update:
  enabled: true
  github:
    identifier: open-policy-agent/gatekeeper
    strip-prefix: v
    use-tag: true
    tag-filter: v3.12.