Skip to content

Commit 93ad549

Browse files
author
tylertitsworth
committed
revert actions to pr
1 parent e68e575 commit 93ad549

17 files changed

+136
-246
lines changed

‎.github/action.yml

+24
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,10 @@ inputs:
4545
required: false
4646
default: false
4747
type: boolean
48+
outputs:
49+
container-group:
50+
description: "Container Group"
51+
value: ${{ steps.container-output.outputs.group }}
4852
runs:
4953
using: composite
5054
steps:
@@ -69,6 +73,26 @@ runs:
6973
COMPOSE_PROJECT_NAME=${{ env.project-number }} \
7074
${{ inputs.env_overrides }} docker compose -p ${{ env.project-number }} up --build --force-recreate --always-recreate-deps --no-start
7175
working-directory: ${{ inputs.group_dir }}
76+
- name: Print Containers
77+
id: container-output
78+
shell: bash
79+
run: |
80+
mkdir matrix
81+
images=$(REGISTRY=${{ inputs.registry }} \
82+
REPO=${{ inputs.repo }} \
83+
COMPOSE_PROJECT_NAME=${{ env.project-number }} \
84+
${{ inputs.env_overrides }} docker compose -p ${{ env.project-number }} images --format json)
85+
for image in $(echo $images | jq -r --arg registry "$REGISTRY" '.[] | select(.Repository | contains($registry)) | .Tag'); do
86+
echo "$image" > matrix/$image.txt
87+
done
88+
echo "group=${{ inputs.group_dir }}" | tr '/' '_' >> $GITHUB_OUTPUT
89+
working-directory: ${{ inputs.group_dir }}
90+
- uses: actions/upload-artifact@v4
91+
with:
92+
name: ${{ env.project-number }}-${{ steps.container-output.outputs.group }}
93+
path: ${{ inputs.group_dir }}/matrix/*
94+
retention-days: 1
95+
overwrite: true
7296
- name: Push Containers
7397
shell: bash
7498
if: ${{ !fromJson(inputs.no-push) }}

‎.github/scan/action.yml

+35
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Copyright (c) 2024 Intel Corporation
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: 'Aqua Security Trivy'
16+
description: 'Scans container images for vulnerabilities with Trivy without building the image. For use behind firewalls.'
17+
author: 'tyler.titsworth@intel.com'
18+
inputs:
19+
image-ref:
20+
description: 'image reference(for backward compatibility)'
21+
required: true
22+
output:
23+
description: 'writes results to a file with the specified file name'
24+
required: true
25+
runs:
26+
using: 'docker'
27+
image: "docker://ghcr.io/aquasecurity/trivy"
28+
entrypoint: trivy
29+
args:
30+
- '--timeout=30m'
31+
- image
32+
- '--format=sarif'
33+
- '--no-progress'
34+
- '--output=${{ inputs.output }}'
35+
- ${{ inputs.image-ref }}

‎.github/workflows/chart-ci.yaml

+1-12
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,7 @@
1515
name: Helm Chart CI
1616
on:
1717
merge_group: null
18-
pull_request_target:
19-
types: [opened, edited, reopened, synchronize]
20-
branches: [main]
18+
pull_request:
2119
paths:
2220
- 'workflows/charts/**'
2321
permissions: read-all
@@ -33,15 +31,6 @@ jobs:
3331
with:
3432
egress-policy: audit
3533
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
36-
if: ${{ github.event_name == 'pull_request_target' }}
37-
with:
38-
fetch-depth: 0
39-
ref: "refs/pull/${{ github.event.number }}/merge"
40-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
41-
if: ${{ github.event_name == 'merge_group' }}
42-
with:
43-
fetch-depth: 0
44-
ref: ${{ github.event.merge_group.head_ref }}
4534
- uses: intel/ai-containers/workflows/charts@main
4635
with:
4736
kubeconfig_path: ${{ secrets.KUBECONFIG_PATH }}

‎.github/workflows/container-ci.yaml

+63-24
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,6 @@ on:
2525
description: 'Enter Bash Env Variable Overrides in `KEY=VAL KEY2=VAL2` format:'
2626
required: false
2727
type: string
28-
ref:
29-
description: 'Enter Git Ref:'
30-
required: true
31-
default: 'main'
32-
type: string
3328
runner_label:
3429
description: 'Enter Validation Runner Label:'
3530
default: test-runner
@@ -61,13 +56,10 @@ on:
6156
no_start:
6257
required: false
6358
type: boolean
64-
ref:
65-
required: true
66-
type: string
6759
jobs:
68-
####################################################################################################
69-
# Compose Build
70-
####################################################################################################
60+
####################################################################################################
61+
# Compose Build
62+
####################################################################################################
7163
setup-build:
7264
outputs:
7365
matrix: ${{ steps.build-matrix.outputs.matrix }}
@@ -78,8 +70,6 @@ jobs:
7870
with:
7971
egress-policy: audit
8072
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
81-
with:
82-
ref: ${{ inputs.ref }}
8373
- name: Set Matrix
8474
id: build-matrix
8575
run: echo "matrix=$(jq -c . < ${{ inputs.group_dir }}/.actions.json)" >> $GITHUB_OUTPUT
@@ -93,10 +83,10 @@ jobs:
9383
strategy:
9484
matrix: ${{ fromJson(needs.setup-build.outputs.matrix) }}
9585
fail-fast: false
86+
outputs:
87+
group: ${{ steps.build-group.outputs.container-group }}
9688
steps:
9789
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
98-
with:
99-
ref: ${{ inputs.ref }}
10090
if: ${{ !inputs.no_build }}
10191
- uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
10292
with:
@@ -115,9 +105,63 @@ jobs:
115105
repo: ${{ secrets.REPO }}
116106
no-push: ${{ inputs.no_push }}
117107
no-start: ${{ inputs.no_start }}
118-
####################################################################################################
119-
# Generic Test Runner
120-
####################################################################################################
108+
####################################################################################################
109+
# Trivy Scan
110+
####################################################################################################
111+
setup-scan:
112+
needs: [build-containers]
113+
runs-on: ubuntu-latest
114+
outputs:
115+
matrix: ${{ steps.scan-matrix.outputs.matrix }}
116+
steps:
117+
- name: Harden Runner
118+
uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
119+
with:
120+
egress-policy: audit
121+
- uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
122+
with:
123+
path: matrix
124+
- name: Set Matrix
125+
id: scan-matrix
126+
run: echo "matrix=$(cat matrix/*-${{ needs.build-containers.outputs.group }}/*.txt | jq -R '.' | jq -sc '. | unique')" >> $GITHUB_OUTPUT
127+
scan-containers:
128+
needs: [setup-scan]
129+
if: ${{ !inputs.no_build }}
130+
runs-on: k8-runners
131+
permissions:
132+
actions: read
133+
packages: read
134+
pull-requests: write
135+
security-events: write
136+
strategy:
137+
matrix:
138+
container: ${{ fromJSON(needs.setup-scan.outputs.matrix) }}
139+
fail-fast: false
140+
steps:
141+
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
142+
- uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
143+
with:
144+
registry: ${{ secrets.REGISTRY }}
145+
username: ${{ secrets.REGISTRY_USER }}
146+
password: ${{ secrets.REGISTRY_TOKEN }}
147+
- name: Pull Image
148+
run: docker pull ${{ secrets.REGISTRY }}/${{ secrets.REPO }}:${{ matrix.container }}
149+
- name: Scan Container
150+
uses: intel/ai-containers/.github/scan@5c68c9c8ff7f634fff3abcc17c46970e0b9b0dde # main
151+
with:
152+
image-ref: ${{ secrets.REGISTRY }}/${{ secrets.REPO }}:${{ matrix.container }}
153+
output: ${{ matrix.container }}-scan.sarif
154+
- name: Cleanup
155+
if: always()
156+
run: docker rmi -f ${{ secrets.REGISTRY }}/${{ secrets.REPO }}:${{ matrix.container }}
157+
- uses: github/codeql-action/upload-sarif@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff # v3.25.8
158+
with:
159+
sarif_file: '${{ matrix.container }}-scan.sarif'
160+
category: '${{ matrix.container }}'
161+
continue-on-error: true
162+
####################################################################################################
163+
# Generic Test Runner
164+
####################################################################################################
121165
setup-test:
122166
needs: [build-containers]
123167
runs-on: ubuntu-latest
@@ -129,8 +173,6 @@ jobs:
129173
with:
130174
egress-policy: audit
131175
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
132-
with:
133-
ref: ${{ inputs.ref }}
134176
- name: Get Recipes
135177
id: test-matrix
136178
run: echo "matrix=$(find ${{ inputs.group_dir }} -type f -name 'tests.yaml' -exec dirname {} \; | jq -R -s -c 'split("\n")[:-1]')" >> $GITHUB_OUTPUT
@@ -148,8 +190,6 @@ jobs:
148190
with:
149191
egress-policy: audit
150192
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
151-
with:
152-
ref: ${{ inputs.ref }}
153193
- uses: docker/login-action@0d4c9c5ea7693da7b068278f7b52bda2a190a446 # v3.2.0
154194
with:
155195
registry: ${{ secrets.REGISTRY }}
@@ -159,9 +199,8 @@ jobs:
159199
uses: intel/ai-containers/test-runner@main
160200
with:
161201
cache_registry: ${{ secrets.CACHE_REGISTRY }}
162-
perf_repo: ${{ secrets.PERF_REPO }}
163202
recipe_dir: ${{ inputs.group_dir }}
164203
registry: ${{ secrets.REGISTRY }}
165204
repo: ${{ secrets.REPO }}
166205
test_dir: ${{ matrix.tests }}
167-
token: ${{ secrets.PERF_TOKEN }}
206+
token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/dependency-review.yaml

+1-3
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,7 @@
2222
# Source repository: https://github.com/actions/dependency-review-action
2323
name: 'Dependency Review'
2424
on:
25-
pull_request_target:
26-
types: [opened, edited, reopened, synchronize]
27-
branches: [main]
25+
pull_request: null
2826
permissions:
2927
contents: read
3028
concurrency:

‎.github/workflows/docs.yaml

+1-14
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,7 @@
1515
name: Docs
1616
on:
1717
merge_group: null
18-
pull_request_target:
19-
types: [opened, edited, reopened, synchronize]
20-
branches: [main]
18+
pull_request: null
2119
push:
2220
branches:
2321
- main
@@ -38,17 +36,6 @@ jobs:
3836
with:
3937
egress-policy: audit
4038
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
41-
if: ${{ github.event_name == 'push' }}
42-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
43-
if: ${{ github.event_name == 'pull_request_target' }}
44-
with:
45-
fetch-depth: 0
46-
ref: "refs/pull/${{ github.event.number }}/merge"
47-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
48-
if: ${{ github.event_name == 'merge_group' }}
49-
with:
50-
fetch-depth: 0
51-
ref: ${{ github.event.merge_group.head_ref }}
5239
- uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
5340
with:
5441
python-version: 3.8

‎.github/workflows/integration-test.yaml

+2-8
Original file line numberDiff line numberDiff line change
@@ -14,9 +14,7 @@
1414

1515
name: Integration Tests
1616
on:
17-
pull_request_target:
18-
types: [opened, edited, reopened, synchronize]
19-
branches: [main]
17+
pull_request: null
2018
permissions: read-all
2119
concurrency:
2220
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -32,15 +30,12 @@ jobs:
3230
with:
3331
egress-policy: audit
3432
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
35-
with:
36-
fetch-depth: 0
37-
ref: "refs/pull/${{ github.event.number }}/merge"
3833
- name: Output Modified Group Directories
3934
id: group-list
4035
run: |
4136
# Get diff array filtered by specific filetypes
4237
DIFF=$(git diff --diff-filter=d \
43-
--name-only ${{ github.event.merge_group.base_sha || github.event.pull_request.base.sha }}...${{ github.event.merge_group.head_sha || github.event.pull_request.head.sha }} \
38+
--name-only ${{ github.event.pull_request.base.sha }}...${{ github.event.pull_request.head.sha }} \
4439
-- '*/*Dockerfile' '*.py' '*.yaml' '*.yml' '*.sh' '*/*requirements.txt' '*.json' | \
4540
jq -R '.' | jq -sc '.' \
4641
)
@@ -71,7 +66,6 @@ jobs:
7166
uses: intel/ai-containers/.github/workflows/container-ci.yaml@main
7267
with:
7368
group_dir: ${{ matrix.group }}
74-
ref: "refs/pull/${{ github.event.number }}/merge"
7569
secrets: inherit
7670
status-check:
7771
needs: [group-diff, pipeline-ci]

‎.github/workflows/lint.yaml

-6
Original file line numberDiff line numberDiff line change
@@ -30,14 +30,8 @@ jobs:
3030
with:
3131
egress-policy: audit
3232
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
33-
if: ${{ github.event_name == 'pull_request' }}
3433
with:
3534
fetch-depth: 0
36-
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
37-
if: ${{ github.event_name == 'merge_group' }}
38-
with:
39-
fetch-depth: 0
40-
ref: ${{ github.event.merge_group.head_ref }}
4135
- uses: super-linter/super-linter/slim@88ea3923a7e1f89dd485d079f6eb5f5e8f937589 # v6.6.0
4236
env:
4337
# To report GitHub Actions status checks

‎.github/workflows/merge_check.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -26,22 +26,22 @@ jobs:
2626
checkName: helm-ci
2727
ref: ${{ github.event.merge_group.head_ref }}
2828
timeoutSeconds: 1800
29-
token: ${{ secrets.ACTION_TOKEN }}
29+
token: ${{ secrets.GITHUB_TOKEN }}
3030
- uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be
3131
if: ${{ steps.helm-ci.outputs.conclusion == 'success' }}
3232
id: integration-test
3333
with:
3434
checkName: integration-test
3535
ref: ${{ github.event.merge_group.head_ref }}
3636
timeoutSeconds: 1800
37-
token: ${{ secrets.ACTION_TOKEN }}
37+
token: ${{ secrets.GITHUB_TOKEN }}
3838
- uses: fountainhead/action-wait-for-check@5a908a24814494009c4bb27c242ea38c93c593be
3939
if: ${{ steps.integration-test.outputs.conclusion == 'success' }}
4040
id: coverage
4141
with:
4242
checkName: coverage
4343
ref: ${{ github.event.merge_group.head_ref }}
4444
timeoutSeconds: 1800
45-
token: ${{ secrets.ACTION_TOKEN }}
45+
token: ${{ secrets.GITHUB_TOKEN }}
4646
- if: ${{ steps.coverage.outputs.conclusion != 'success' }}
4747
run: exit 1

‎.github/workflows/scorecard.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ jobs:
4646
with:
4747
results_file: results.sarif
4848
results_format: sarif
49-
repo_token: ${{ secrets.ACTION_TOKEN }}
49+
repo_token: ${{ secrets.GITHUB_TOKEN }}
5050
publish_results: true
5151
- uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
5252
with:

0 commit comments

Comments
 (0)