Skip to content

Commit 41fb4d2

Browse files
jotakjotak
authored
GH workflows: Remove trigger on pull_request_target (#2512)
* GH workflows: Remove trigger on pull_request_target Replaced with pull_request + workflow_run Although the risk of pwn request attacks was mitigated with the ok-to-test label protection, this was still human-error prone. This workflow increases security by not running any code with secret access privileges. * build catalog after operator/bundle are pushed
1 parent 65f3d96 commit 41fb4d2

File tree

3 files changed

+93
-47
lines changed

3 files changed

+93
-47
lines changed

‎.github/workflows/build_image_pr.yml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Build PR image and upload artifact
2+
on:
3+
pull_request:
4+
types: [labeled]
5+
6+
env:
7+
WF_REGISTRY: quay.io/netobserv
8+
WF_IMAGE: network-observability-operator
9+
WF_ORG: netobserv
10+
WF_RELIMG_VERSION: main
11+
12+
jobs:
13+
build-pr-image:
14+
if: ${{ github.event.label.name == 'ok-to-test' }}
15+
name: Build PR image and upload artifact
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: actions/checkout@v3
19+
- name: Install make
20+
run: sudo apt -y install make
21+
- name: get short sha
22+
run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
23+
- name: build and save operator image
24+
run: OCI_BUILD_OPTS="--label quay.expires-after=2w" IMAGE=${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}:${{ env.short_sha }} CLEAN_BUILD=1 make tar-image
25+
- name: get related images target
26+
if: startsWith(github.ref_name, 'release-')
27+
run: echo "WF_RELIMG_VERSION=${{ github.ref_name }}" >> $GITHUB_ENV
28+
- name: build and save bundle image
29+
run: OCI_BUILD_OPTS="--label quay.expires-after=2w" IMAGE_ORG=${{ env.WF_ORG }} VERSION=${{ env.short_sha }} PLG_VERSION=${{ env.WF_RELIMG_VERSION }} FLP_VERSION=${{ env.WF_RELIMG_VERSION }} BPF_VERSION=${{ env.WF_RELIMG_VERSION }} BUNDLE_VERSION=0.0.0-sha-${{ env.short_sha }} CLEAN_BUILD=1 BUNDLE_SET_DATE=true make bundle bundle-tar
30+
- name: save PR number
31+
run: |
32+
echo ${{ github.event.number }} > ./out/pr-id
33+
echo ${{ env.short_sha }} > ./out/short-sha
34+
- name: upload artifacts
35+
uses: actions/upload-artifact@v4
36+
with:
37+
name: pr
38+
path: out/

‎.github/workflows/push_image_pr.yml‎

Lines changed: 39 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,79 +1,73 @@
1-
name: Build and push PR image to quay.io
1+
name: Push PR image to quay.io
22
on:
3-
pull_request_target:
4-
types: [labeled]
3+
workflow_run:
4+
workflows: ["Build PR image and upload artifact"]
5+
types:
6+
- completed
57

68
env:
79
WF_REGISTRY_USER: netobserv+github_ci
8-
WF_REGISTRY: quay.io/netobserv
9-
WF_IMAGE: network-observability-operator
10-
WF_ORG: netobserv
11-
WF_RELIMG_VERSION: main
1210

1311
jobs:
1412
push-pr-image:
15-
if: ${{ github.event.label.name == 'ok-to-test' }}
13+
if: >
14+
github.event.workflow_run.event == 'pull_request' &&
15+
github.event.workflow_run.conclusion == 'success'
1616
name: push PR image
1717
runs-on: ubuntu-latest
1818
steps:
19-
- name: install make
20-
run: sudo apt-get install make
21-
- name: set up go 1.x
22-
uses: actions/setup-go@v3
19+
- name: download artifact
20+
uses: actions/download-artifact@v5
2321
with:
24-
go-version: '1.25'
25-
- name: checkout
26-
uses: actions/checkout@v3
27-
with:
28-
ref: "refs/pull/${{ github.event.number }}/merge"
22+
name: pr
23+
run-id: ${{github.event.workflow_run.id }}
24+
github-token: ${{secrets.GITHUB_TOKEN}}
25+
- name: load images
26+
run: |
27+
docker load --input ./operator.tar
28+
docker load --input ./bundle.tar
2929
- name: docker login to quay.io
3030
uses: docker/login-action@v2
3131
with:
3232
username: ${{ env.WF_REGISTRY_USER }}
3333
password: ${{ secrets.QUAY_SECRET }}
3434
registry: quay.io
35-
- name: get short sha
36-
run: echo "short_sha=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
37-
- name: build image
38-
run: OCI_BUILD_OPTS="--label quay.expires-after=2w" IMAGE_ORG=${{ env.WF_ORG }} IMAGE=${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}:${{ env.short_sha }} CLEAN_BUILD=1 make image-build
39-
- name: push image
40-
run: IMAGE_ORG=${{ env.WF_ORG }} IMAGE=${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}:${{ env.short_sha }} make image-push
41-
- name: build and push manifest
42-
run: IMAGE_ORG=${{ env.WF_ORG }} IMAGE=${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}:${{ env.short_sha }} make manifest-build manifest-push
43-
- name: get related images target
44-
if: startsWith(github.ref_name, 'release-')
35+
- name: push operator and bundle
4536
run: |
46-
echo "WF_RELIMG_VERSION=${{ github.ref_name }}" >> $GITHUB_ENV
47-
- name: build bundle
48-
run: OCI_BUILD_OPTS="--label quay.expires-after=2w" IMAGE_ORG=${{ env.WF_ORG }} VERSION=${{ env.short_sha }} PLG_VERSION=${{ env.WF_RELIMG_VERSION }} FLP_VERSION=${{ env.WF_RELIMG_VERSION }} BPF_VERSION=${{ env.WF_RELIMG_VERSION }} BUNDLE_VERSION=0.0.0-sha-${{ env.short_sha }} CLEAN_BUILD=1 BUNDLE_SET_DATE=true make bundle bundle-build
49-
- name: push bundle to quay.io
50-
run: IMAGE_ORG=${{ env.WF_ORG }} VERSION=${{ env.short_sha }} BUNDLE_VERSION=0.0.0-sha-${{ env.short_sha }} make bundle-push
51-
- name: build catalog
52-
run: IMAGE_ORG=${{ env.WF_ORG }} BUNDLE_VERSION=0.0.0-sha-${{ env.short_sha }} make shortlived-catalog-build
53-
- name: push catalog to quay.io
54-
run: IMAGE_ORG=${{ env.WF_ORG }} BUNDLE_VERSION=0.0.0-sha-${{ env.short_sha }} make catalog-push
55-
- uses: actions/github-script@v5
37+
DOCKER_BUILDKIT=1 docker push $(cat ./operator-name)
38+
DOCKER_BUILDKIT=1 docker push $(cat ./bundle-name)
39+
- name: build and push catalog
40+
run: |
41+
IMAGE_ORG=${{ env.WF_ORG }} BUNDLE_VERSION=0.0.0-sha-$(cat ./short-sha) make shortlived-catalog-build catalog-push
42+
- uses: actions/github-script@v6
5643
with:
5744
github-token: ${{secrets.GITHUB_TOKEN}}
5845
script: |
46+
var fs = require('fs');
47+
var issueNumber = Number(fs.readFileSync('./pr-id'));
48+
var shortSha = String(fs.readFileSync('./short-sha')).trim();
49+
var operatorImage = fs.readFileSync('./operator-name');
50+
var bundleImage = fs.readFileSync('./bundle-name');
5951
github.rest.issues.createComment({
60-
issue_number: context.issue.number,
52+
issue_number: issueNumber,
6153
owner: context.repo.owner,
6254
repo: context.repo.repo,
6355
body: `New images:
64-
* ${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}:${{ env.short_sha }}
65-
* ${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}-bundle:v0.0.0-sha-${{ env.short_sha }}
66-
* ${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}-catalog:v0.0.0-sha-${{ env.short_sha }}
56+
\`\`\`bash
57+
${operatorImage}
58+
${bundleImage}
59+
quay.io/netobserv/network-observability-operator-catalog:v0.0.0-sha-${shortSha}
60+
\`\`\`
6761
68-
They will expire after two weeks.
62+
They will expire in two weeks.
6963
7064
To deploy this build:
7165
\`\`\`bash
7266
# Direct deployment, from operator repo
73-
IMAGE=${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}:${{ env.short_sha }} make deploy
67+
IMAGE=${operatorImage} make deploy
7468
7569
# Or using operator-sdk
76-
operator-sdk run bundle ${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}-bundle:v0.0.0-sha-${{ env.short_sha }}
70+
operator-sdk run bundle ${bundleImage}
7771
\`\`\`
7872
7973
Or as a Catalog Source:
@@ -85,7 +79,7 @@ jobs:
8579
namespace: openshift-marketplace
8680
spec:
8781
sourceType: grpc
88-
image: ${{ env.WF_REGISTRY }}/${{ env.WF_IMAGE }}-catalog:v0.0.0-sha-${{ env.short_sha }}
82+
image: quay.io/netobserv/network-observability-operator-catalog:v0.0.0-sha-${shortSha}
8983
displayName: NetObserv development catalog
9084
publisher: Me
9185
updateStrategy:

‎Makefile‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -374,6 +374,14 @@ extract-binaries: ## Extract all MULTIARCH_TARGETS binaries
374374
mkdir -p release-assets; \
375375
$(foreach target,$(MULTIARCH_TARGETS),$(call extract_target,$(target)))
376376

377+
.PHONY: tar-image
378+
tar-image: MULTIARCH_TARGETS=amd64
379+
tar-image: image-build ## Build single arch (amd64) and save as a tar
380+
$(OCI_BIN) tag $(IMAGE)-amd64 $(IMAGE)
381+
mkdir -p ./out
382+
$(OCI_BIN) save -o out/operator.tar $(IMAGE)
383+
echo $(IMAGE) > ./out/operator-name
384+
377385
##@ Deployment
378386

379387
install: kustomize ## Install CRDs into the K8s cluster specified in ~/.kube/config.
@@ -451,7 +459,13 @@ bundle-build: ## Build the bundle image.
451459

452460
.PHONY: bundle-push
453461
bundle-push: ## Push the bundle image.
454-
$(OCI_BIN) push ${BUNDLE_IMAGE};
462+
$(OCI_BIN) push ${BUNDLE_IMAGE}
463+
464+
.PHONY: bundle-tar
465+
bundle-tar: bundle-build ## Build bundle image and save as a tar
466+
mkdir -p ./out
467+
$(OCI_BIN) save -o out/bundle.tar $(BUNDLE_IMAGE)
468+
echo $(BUNDLE_IMAGE) > ./out/bundle-name
455469

456470
# A comma-separated list of bundle images (e.g. make catalog-build BUNDLE_IMAGES=example.com/operator-bundle:v0.1.0,example.com/operator-bundle:v0.2.0).
457471
# These images MUST exist in a registry and be pull-able.
@@ -480,7 +494,7 @@ shortlived-catalog-build: ## Build a temporary catalog image, expiring after 2 w
480494
# Push the catalog image.
481495
.PHONY: catalog-push
482496
catalog-push: ## Push a catalog image.
483-
$(OCI_BIN) push ${CATALOG_IMAGE};
497+
$(OCI_BIN) push ${CATALOG_IMAGE}
484498

485499
# Deploy the catalog.
486500
.PHONY: catalog-deploy

0 commit comments

Comments
 (0)