k8s-sidecar.yaml

package:
  name: k8s-sidecar
  version: "1.30.2"
  epoch: 0
  description: "container intended to run inside a kubernetes cluster to collect config maps with a specified label and store the included files in a local folder"
  copyright:
    - license: MIT
  dependencies:
    runtime:
      - python-${{vars.py-version}} # gives correct /usr/bin/python3 for any callers.

vars:
  py-version: 3.13

environment:
  contents:
    packages:
      - build-base
      - busybox
      - ca-certificates-bundle
      - py${{vars.py-version}}-pip
      - wolfi-base

pipeline:
  - uses: git-checkout
    with:
      repository: https://github.com/kiwigrid/k8s-sidecar
      tag: ${{package.version}}
      expected-commit: a164c76708f6b372466ff344701ca74dc3c41734

  - runs: |
      cd src
      # Mitigate CVE-2022-40897 / GHSA-r9hx-vwmv-q579
      pip install --upgrade setuptools
      pip install --no-cache-dir -r requirements.txt --prefix=/usr --root="${{targets.destdir}}"

      # Patch CVE-2024-3651
      pip install idna==3.7
      # Patch GHSA-34jh-p97f-mpxf
      pip install urllib3==2.2.2
      # Patch GHSA-248v-346w-9cwc
      pip install certifi==2024.07.04

  - name: install src/ files to usr/share/app
    runs: |
      destd=${{targets.destdir}}/usr/share/app
      mkdir -p "$destd"
      mv src/* "$destd"

  - name: remove tests
    runs: |
      find ${{targets.destdir}} \( -type d -a -name test -o -name tests \) -exec rm -rf '{}' \+

  - uses: strip

update:
  enabled: true
  github:
    identifier: kiwigrid/k8s-sidecar
    use-tag: true

test:
  pipeline:
    - runs: |
        # This only runs in k8s but make sure it errors correctly
        python3 /usr/share/app/sidecar.py 2>&1 | grep CRITICAL
    - runs: |
        normalizer --version
        normalizer --help
        pyrsa-decrypt --help
        pyrsa-encrypt --help
        pyrsa-keygen --help
        pyrsa-priv2pub --help
        pyrsa-sign --help
        pyrsa-verify --help
        wsdump --help
    - uses: test/tw/ldd-check