-
Notifications
You must be signed in to change notification settings - Fork 8
270 lines (260 loc) · 9.1 KB
/
checks.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
name: 'Checks'
env:
IS_RELEASE_BRANCH: ${{ startsWith(github.head_ref, 'release-please-') }}
on:
pull_request:
types:
- opened
- synchronize
- reopened
paths-ignore:
- '**/*.md'
- LICENSE
- CODEOWNERS
push:
branches:
- main
paths-ignore:
- '**/*.md'
- LICENSE
- CODEOWNERS
merge_group:
branches:
- main
types:
- checks_requested
paths:
- '**'
- '!**/*.md'
- 'docs/**'
- '!LICENSE'
- '!CODEOWNERS'
workflow_call:
jobs:
go:
runs-on: ubuntu-22.04
permissions:
checks: write
contents: read
pull-requests: read
strategy:
matrix:
directory:
- examples
- sdk
- service
- lib/ocrypto
- lib/fixtures
- lib/flattening
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
with:
fetch-depth: 0
- uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7
with:
go-version-file: 'service/go.mod'
check-latest: false
cache-dependency-path: |
examples/go.sum
protocol/go/go.sum
sdk/go.sum
service/go.sum
- if: env.IS_RELEASE_BRANCH == 'true'
name: prevent depending on unreleased upstream changes
run: ./.github/scripts/work-init.sh
- if: github.head_ref == format('release-please--branches--main--components--{0}', matrix.directory)
name: prevent tagging with replace directives
run: go mod edit --json | jq -e '.Replace | not'
working-directory: ${{ matrix.directory }}
- run: go mod download
working-directory: ${{ matrix.directory }}
- run: go mod verify
working-directory: ${{ matrix.directory }}
- run: go work use .
if: env.IS_RELEASE_BRANCH == 'true'
working-directory: ${{ matrix.directory }}
- name: golangci-lint
uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86
with:
version: v1.61
working-directory: ${{ matrix.directory }}
skip-cache: true
args: --out-format=colored-line-number
- if: matrix.directory == 'service'
run: .github/scripts/init-temp-keys.sh
- run: go test ./... -short
working-directory: ${{ matrix.directory }}
- if: matrix.directory == 'service'
run: go test ./service/integration -race -failfast
- name: check go fmt and go mod tidy
run: |-
go mod tidy
go fmt ./...
git restore go.sum "${GITHUB_WORKSPACE}/go.work.sum"
working-directory: ${{ matrix.directory }}
- run: git diff
- run: git diff-files --ignore-submodules
- name: Check that files have been formatted before PR submission; see above for error details
run: git diff-files --quiet --ignore-submodules
if: env.IS_RELEASE_BRANCH == 'false'
integration:
name: integration tests
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
- uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7
with:
go-version-file: 'service/go.mod'
check-latest: false
cache-dependency-path: |
service/go.sum
examples/go.sum
protocol/go/go.sum
sdk/go.sum
- if: env.IS_RELEASE_BRANCH == 'true'
run: ./.github/scripts/work-init.sh
- run: go mod download
- run: go mod verify
- run: |
.github/scripts/init-temp-keys.sh
cp opentdf-dev.yaml opentdf.yaml
- name: Added Trusted Certs
run: |
sudo chmod -R 777 ./keys
sudo apt-get install -y ca-certificates
sudo cp ./keys/localhost.crt /usr/local/share/ca-certificates
sudo update-ca-certificates
- run: docker compose up -d --wait --wait-timeout 240 || (docker compose logs && exit 1)
- run: go run ./service provision keycloak
- run: go run ./service provision fixtures
- uses: JarvusInnovations/background-action@2428e7b970a846423095c79d43f759abf979a635
name: start server in background
with:
run: >
go build -o opentdf -v service/main.go
&& .github/scripts/watch.sh opentdf.yaml ./opentdf start
wait-on: |
tcp:localhost:8080
log-output-if: true
wait-for: 90s
- run: go install github.com/fullstorydev/grpcurl/cmd/[email protected]
- name: Setup Bats and bats libs
uses: bats-core/[email protected]
- run: test/service-start.bats
- run: test/tdf-roundtrips.bats
- run: test/policy-service.bats
- name: create roundtrip test data and run tests
run: go test ./service/rttests -v
- name: enable static entitlements rego policy
run: yq eval '.services.authorization.rego.path = "./test/rego/static-entitlements.rego"' -i opentdf.yaml
- run: sleep 30
- name: validate static rego policy
run: test/rego/static-entitlements.bats
- name: enable custom entity rego policy
run: yq eval '.services.authorization.rego.path = "./test/rego/custom-entity.rego"' -i opentdf.yaml
- run: sleep 30
- name: validate custom entity rego policy
run: test/rego/custom-entity.bats
image:
name: image build
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
- uses: docker/setup-buildx-action@v3
- uses: docker/[email protected]
with:
context: .
file: ./Dockerfile
push: false
platform-xtest:
uses: opentdf/tests/.github/workflows/xtest.yml@main
with:
# use commit instead of ref so we can "go get" specific sdk version
platform-ref: ${{ github.event.pull_request.head.sha || github.sha }}
# test latest otdfctl CLI 'main' against platform PR branch
otdfctl-test:
name: otdfctl e2e tests
runs-on: ubuntu-latest
steps:
- uses: opentdf/platform/test/start-up-with-containers@main
with:
platform-ref: ${{ github.event.pull_request.head.sha || github.sha }}
- uses: opentdf/otdfctl/e2e@main
with:
otdfctl-ref: 'main'
buflint:
name: Protocol Buffer Lint and Gencode Up-to-date check
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
- uses: bufbuild/buf-setup-action@62ee92603c244ad0da98bab36a834a999a5329e6
with:
github_token: ${{ github.token }}
- uses: bufbuild/buf-lint-action@06f9dd823d873146471cfaaf108a993fe00e5325
with:
input: service
- uses: bufbuild/buf-breaking-action@c57b3d842a5c3f3b454756ef65305a50a587c5ba
with:
input: service
against: 'https://github.com/opentdf/platform.git#branch=main,subdir=service'
- uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7
with:
go-version-file: 'service/go.mod'
check-latest: false
cache-dependency-path: |
service/go.sum
protocol/go/go.sum
sdk/go.sum
examples/go.sum
- run: cd service && go get github.com/pseudomuto/protoc-gen-doc/cmd/protoc-gen-doc
- run: cd service && go install github.com/pseudomuto/protoc-gen-doc/cmd/protoc-gen-doc
- run: make proto-generate
- name: Restore go.mod after installing protoc-gen-doc
run: git restore {service,protocol/go}/go.{mod,sum}
- name: validate go mod tidy
run: |-
cd protocol/go
go mod tidy
git restore go.sum "${GITHUB_WORKSPACE}/go.work.sum"
- run: git diff
- run: git diff-files --ignore-submodules
- name: Check that make proto-generate has run before PR submission; see above for error details
run: git diff-files --quiet --ignore-submodules
ci:
needs:
- buflint
- go
- image
- integration
- license
- platform-xtest
- otdfctl-test
runs-on: ubuntu-22.04
if: ${{ !cancelled() }}
steps:
- if: contains(needs.*.result, 'failure')
run: echo "Failed due to ${{ contains(needs.*.result, 'failure') }}" && exit 1
license:
name: license check
runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
- uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7
with:
go-version-file: 'service/go.mod'
check-latest: false
cache: false
- name: install go-licenses
run: go install github.com/google/go-licenses@5348b744d0983d85713295ea08a20cca1654a45e
- name: check service licenses
run: >
go-licenses check --disallowed_types=forbidden --include_tests
./service
- name: check sdk licenses
run: >
go-licenses check --disallowed_types=forbidden --include_tests
./sdk
- name: check examples licenses
run: >
go-licenses check --disallowed_types=forbidden --include_tests
./examples