Skip to content

feat!: New secret management abstraction #7571

feat!: New secret management abstraction

feat!: New secret management abstraction #7571

Workflow file for this run

name: CI
on:
push:
branches:
- main
- release
pull_request:
branches:
- main
- release
env:
GO_VERSION: "1.26.2"
GOLANGCI_LINT_VERSION: "v2.9.0"
HELM_VERSION: "3.18.5"
HELM_UNITTEST_VERSION: "v1.0.0"
KUBECONFORM_VERSION: "0.7.0"
KUBERNETES_API_VERSION: "1.32.0"
NODE_VERSION: "24.8.0"
RUBY_VERSION: "3.4"
COSIGN_VERSION: "v2.4.3"
CYCLONEDX_GOMOD_VERSION: "v1.9.0"
HUGO_VERSION: "0.150.0"
DOCUMENTATION_URL: "https://dadrus.github.io/heimdall/"
permissions: {}
jobs:
check-changes:
runs-on: ubuntu-24.04
permissions:
contents: read
pull-requests: read
outputs:
code_changed: ${{steps.changes.outputs.code}}
test_data_changed: ${{steps.changes.outputs.testdata}}
image_config_changed: ${{steps.changes.outputs.imageconfig}}
helm_chart_changed: ${{steps.changes.outputs.helmchart}}
docs_changed: ${{steps.changes.outputs.docs}}
ci_config_changed: ${{steps.changes.outputs.ci}}
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Check code changes
id: changes
uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
with:
base: ${{ github.ref }}
filters: |
code:
- '*.go'
- '**/*.go'
- 'schema/*.json'
- 'go.mod'
- 'go.sum'
testdata:
- 'cmd/**/*.yaml'
- 'internal/**/*.yaml'
imageconfig:
- 'docker/Dockerfile'
helmchart:
- 'charts/**'
docs:
- 'docs/**'
ci:
- '.github/workflows/**'
check-licenses:
runs-on: ubuntu-24.04
permissions:
contents: read
needs:
- check-changes
if: >
needs.check-changes.outputs.code_changed == 'true' ||
needs.check-changes.outputs.ci_config_changed == 'true'
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: "${{ env.GO_VERSION }}"
- name: Get google/go-licenses package
run: go install github.com/google/go-licenses@v1.6.0
- name: Check the licenses
run: go-licenses check --disallowed_types=forbidden,restricted,reciprocal,permissive,unknown .
lint-code:
runs-on: ubuntu-24.04
permissions:
contents: read
pull-requests: write
timeout-minutes: 10
needs:
- check-changes
if: >
needs.check-changes.outputs.code_changed == 'true' ||
needs.check-changes.outputs.ci_config_changed == 'true'
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
fetch-depth: 0
- name: Review code
uses: reviewdog/action-golangci-lint@c76cceaaab89abe74e649d2e34c6c9adc26662d2 # v2.10.0
with:
go_version: "${{ env.GO_VERSION }}"
golangci_lint_version: "${{ env.GOLANGCI_LINT_VERSION }}"
reporter: github-pr-review
fail_level: error
lint-api:
runs-on: ubuntu-24.04
permissions:
contents: read
needs:
- check-changes
if: >
needs.check-changes.outputs.docs_changed == 'true' ||
needs.check-changes.outputs.ci_config_changed == 'true'
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Setup Node
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: ${{ env.NODE_VERSION }}
- name: Run Redocly CLI
run: npx --yes @redocly/cli@1.34.3 lint
lint-dockerfiles:
runs-on: ubuntu-24.04
permissions:
contents: read
pull-requests: write
needs:
- check-changes
if: >
needs.check-changes.outputs.image_config_changed == 'true' ||
needs.check-changes.outputs.ci_config_changed == 'true'
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Run hadolint
uses: reviewdog/action-hadolint@921946a7ebaaf08ac72607bad67209f4e52b5407 # v1.50.5
with:
reporter: github-pr-review
reviewdog_flags: -fail-level=error
lint-helm-chart:
runs-on: ubuntu-24.04
permissions:
contents: read
needs:
- check-changes
if: >
needs.check-changes.outputs.helm_chart_changed == 'true' ||
needs.check-changes.outputs.ci_config_changed == 'true'
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Setup k8s tools
uses: yokawasa/action-setup-kube-tools@5778123f7b071387e9c8e522492d8f39427dc6c7 # v0.13.4
with:
setup-tools: |
helm
kubeconform
helm: '${{ env.HELM_VERSION }}'
kubeconform: '${{ env.KUBECONFORM_VERSION }}'
- name: Helm Lint
run: helm lint ./charts/heimdall
- name: Kubeconform decision mode deployment
run: |
helm template --kube-version ${{ env.KUBERNETES_API_VERSION }} --set crds.enabled=true ./charts/heimdall > generated-config.yaml
kubeconform \
-schema-location default \
-schema-location "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/{{ .NormalizedKubernetesVersion }}/{{ .ResourceKind }}.json" \
--skip RuleSet -kubernetes-version ${{ env.KUBERNETES_API_VERSION }} generated-config.yaml
- name: Kubeconform proxy mode deployment
run: |
helm template --kube-version ${{ env.KUBERNETES_API_VERSION }} --set crds.enabled=true --set operationMode=proxy ./charts/heimdall > generated-config.yaml
kubeconform \
-schema-location default \
-schema-location "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/{{ .NormalizedKubernetesVersion }}/{{ .ResourceKind }}.json" \
--skip RuleSet -kubernetes-version ${{ env.KUBERNETES_API_VERSION }} generated-config.yaml
unittest-helm-chart:
runs-on: ubuntu-24.04
permissions:
contents: read
needs:
- check-changes
if: >
needs.check-changes.outputs.helm_chart_changed == 'true' ||
needs.check-changes.outputs.ci_config_changed == 'true'
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Setup k8s tools
uses: yokawasa/action-setup-kube-tools@5778123f7b071387e9c8e522492d8f39427dc6c7 # v0.13.4
with:
setup-tools: |
helm
kubeconform
helm: '${{ env.HELM_VERSION }}'
kubeconform: '${{ env.KUBECONFORM_VERSION }}'
- name: Install Helm Unittest
run: helm plugin install --version ${{ env.HELM_UNITTEST_VERSION }} https://github.com/helm-unittest/helm-unittest.git
- name: Run tests
run: |
helm unittest ./charts/heimdall
test:
runs-on: ubuntu-24.04
permissions:
contents: read
timeout-minutes: 20
needs:
- check-changes
if: >
needs.check-changes.outputs.code_changed == 'true' ||
needs.check-changes.outputs.test_data_changed == 'true' ||
needs.check-changes.outputs.ci_config_changed == 'true'
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: "${{ env.GO_VERSION }}"
- name: Install go-junit-report
run: go install github.com/jstemmer/go-junit-report/v2@v2.1.0
- name: Test
run: |
set -o pipefail
go test -v -coverprofile=coverage.cov -coverpkg=./... ./... 2>&1 | \
tee >(go-junit-report -set-exit-code > junit-report.xml)
- name: Upload test results to Codecov
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
if: always() && !cancelled()
with:
report_type: test_results
files: junit-report.xml
verbose: true
token: ${{ secrets.CODECOV_TOKEN }}
- name: Upload code coverage report to Codecov
uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
with:
report_type: coverage
files: coverage.cov
verbose: true
token: ${{ secrets.CODECOV_TOKEN }}
build-binaries:
runs-on: ubuntu-24.04
permissions:
contents: read
timeout-minutes: 20
needs:
- test
if: needs.test.result == 'success'
strategy:
matrix:
# build and publish in parallel: linux/amd64, linux/arm64, windows/amd64, darwin/amd64, darwin/arm64
goos: [ linux, windows, darwin ]
goarch: [ amd64, arm64, arm ]
exclude:
- goarch: arm
goos: darwin
- goarch: arm
goos: windows
- goarch: arm64
goos: windows
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Set up Go
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: "${{ env.GO_VERSION }}"
- name: Build
run: CGO_ENABLED=0 GOOS=${{ matrix.goos }} GOARCH=${{ matrix.goarch }} go build -trimpath -buildvcs=false -ldflags="-buildid= -w -s -X github.com/dadrus/heimdall/version.Version=${{ github.sha }}" -o ./build/
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
if: github.ref == 'refs/heads/main'
with:
name: build-result-${{ matrix.goos }}-${{ matrix.goarch }}
path: ./build/*
retention-days: 30
build-dev-container-images:
runs-on: ubuntu-24.04
permissions:
contents: read
timeout-minutes: 20
needs:
- test
- check-changes
if: >
github.ref != 'refs/heads/main' &&
(needs.test.result == 'success' || (needs.test.result == 'skipped' && needs.check-changes.outputs.image_config_changed == 'true'))
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Set up Go # required as the sbom generator is compiled using go < 1.21
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: "${{ env.GO_VERSION }}"
- name: Set up QEMU
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- name: Build images
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
context: .
file: ./docker/Dockerfile
platforms: linux/amd64,linux/arm64,linux/arm
push: false
build-args: VERSION=${{ github.sha }}
tags: ${{ github.repository }}:local
publish-dev-container-images:
runs-on: ubuntu-24.04
permissions:
contents: read
packages: write
id-token: write
timeout-minutes: 20
needs:
- test
- check-changes
if: >
github.ref == 'refs/heads/main' &&
(needs.test.result == 'success' || (needs.test.result == 'skipped' && needs.check-changes.outputs.image_config_changed == 'true'))
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
- name: Install Cosign
uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
with:
cosign-release: "${{ env.COSIGN_VERSION }}"
- name: Set up Go # required as the sbom generator is compiled using go < 1.21
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
with:
go-version: "${{ env.GO_VERSION }}"
- name: Generate SBOM
uses: CycloneDX/gh-gomod-generate-sbom@efc74245d6802c8cefd925620515442756c70d8f # v2.0.0
with:
version: "${{ env.CYCLONEDX_GOMOD_VERSION }}"
args: app -licenses -assert-licenses -json -std -output CycloneDX-SBOM.json -main .
- name: Set up QEMU
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
- name: Collect container meta-info for DockerHub
id: dockerhub-meta
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
with:
images: ${{ github.repository }}
labels: |
org.opencontainers.image.version=${{ github.sha }}
org.opencontainers.image.documentation=${{ env.DOCUMENTATION_URL }}
- name: Collect container meta-info for GHCR
id: ghcr-meta
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
with:
images: ghcr.io/${{ github.repository }}
labels: |
org.opencontainers.image.version=${{ github.sha }}
org.opencontainers.image.documentation=${{ env.DOCUMENTATION_URL }}
- name: Login to DockerHub
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
username: ${{ secrets.DOCKERHUB_USER }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Login to GitHub
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Build and push dev image to DockerHub
id: dockerhub-image
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
context: .
file: ./docker/Dockerfile
platforms: linux/amd64,linux/arm64,linux/arm
push: true
build-args: VERSION=${{ github.sha }}
labels: ${{ steps.dockerhub-meta.outputs.labels }}
tags: |
${{ github.repository }}:dev
${{ github.repository }}:dev-${{ github.sha }}
- name: Build and push dev image to GHCR
id: ghcr-image
uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
with:
context: .
file: ./docker/Dockerfile
platforms: linux/amd64,linux/arm64,linux/arm
push: true
build-args: VERSION=${{ github.sha }}
labels: ${{ steps.ghcr-meta.outputs.labels }}
tags: |
ghcr.io/${{ github.repository }}:dev
ghcr.io/${{ github.repository }}:dev-${{ github.sha }}
- name: Sign the image published in DockerHub
if: steps.dockerhub-image.conclusion == 'success'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
COSIGN_REPOSITORY: ${{ github.repository }}-signatures
run: cosign sign --yes ${{ github.repository }}@${{ steps.dockerhub-image.outputs.digest }}
- name: Attest and attach SBOM to the image published in DockerHub
if: steps.dockerhub-image.conclusion == 'success'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
COSIGN_REPOSITORY: ${{ github.repository }}-sbom
run: cosign attest --yes --predicate CycloneDX-SBOM.json --type cyclonedx ${{ github.repository }}@${{ steps.dockerhub-image.outputs.digest }}
- name: Sign the image published in GitHub
if: steps.ghcr-image.conclusion == 'success'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
COSIGN_REPOSITORY: ghcr.io/${{ github.repository }}-signatures
run: cosign sign --yes ghcr.io/${{ github.repository }}@${{ steps.ghcr-image.outputs.digest }}
- name: Attest and attach SBOM to the image published in GitHub
if: steps.ghcr-image.conclusion == 'success'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
COSIGN_REPOSITORY: ghcr.io/${{ github.repository }}-sbom
run: cosign attest --yes --predicate CycloneDX-SBOM.json --type cyclonedx ghcr.io/${{ github.repository }}@${{ steps.ghcr-image.outputs.digest }}
build-dev-documentation:
runs-on: ubuntu-24.04
permissions:
contents: read
timeout-minutes: 20
needs:
- check-changes
if: >
needs.check-changes.outputs.docs_changed == 'true' ||
needs.check-changes.outputs.ci_config_changed == 'true'
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
with:
egress-policy: audit
- name: Checkout repository
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
with:
persist-credentials: false
submodules: true # Fetch Hugo themes (true OR recursive)
fetch-depth: 0 # Fetch all history for .GitInfo and .Lastmod
- name: Setup Hugo
uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3.0.0
with:
hugo-version: ${{ env.HUGO_VERSION }}
extended: true
- name: Setup Node
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with:
node-version: ${{ env.NODE_VERSION }}
- name: Setup ruby
uses: ruby/setup-ruby@7372622e62b60b3cb750dcd2b9e32c247ffec26a # v1.302.0
with:
ruby-version: ${{ env.RUBY_VERSION }}
- name: Install asciidoctor
run: gem install asciidoctor asciidoctor-diagram asciidoctor-html5s asciidoctor-diagram-ditaamini rouge
- name: Install dependencies
working-directory: ./docs
run: npm ci
- name: Update version string to dev version
uses: jacobtomlinson/gha-find-replace@2ff30f644d2e0078fc028beb9193f5ff0dcad39e # v3
with:
find: "x-current-version"
replace: "dev"
regex: false
include: docs/**
- name: Build documentation
working-directory: ./docs
run: hugo --minify -d ./public
- name: Upload documentation artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: dev-docs
path: ./docs/public/*
retention-days: 1
deploy-dev-documentation:
runs-on: ubuntu-24.04
permissions:
contents: write
timeout-minutes: 20
needs:
- build-dev-documentation
if: github.ref == 'refs/heads/main'
steps:
- name: Harden Runner
uses: step-security/harden-runner@6c3c2f2c1c457b00c10c4848d6f5491db3b629df # v2.18.0
with:
egress-policy: audit
- name: Download documentation artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: dev-docs
path: ./docs
- name: Deploy documentation
uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
with:
github_token: ${{ secrets.GITHUB_TOKEN }}
publish_dir: ./docs
destination_dir: dev