2022-12-26 14:46:36 -05:00
name : "Chore: Daily Tasks"
2022-11-10 10:46:44 -05:00
on :
2023-02-03 06:21:10 -05:00
schedule :
2023-03-16 06:09:35 -04:00
- cron : "0 0 * * *"
2022-11-10 10:46:44 -05:00
workflow_dispatch :
2023-02-03 06:21:10 -05:00
permissions :
issues : write
pull-requests : write
concurrency :
group : lock
2022-11-10 10:46:44 -05:00
jobs :
generate-readme :
runs-on : ubuntu-latest
name : "Generate readme files"
2022-12-26 16:10:21 -05:00
container :
2023-05-05 10:32:00 -04:00
image : ghcr.io/truecharts/devcontainer:3.1.10@sha256:c239addf725eb5cedf79517f8089fdafdc32b5270d1893ee87ae6e511b9bcae3
2022-11-10 10:46:44 -05:00
steps :
- name : Checkout
2023-04-14 15:59:14 -04:00
uses : actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
2022-11-10 10:46:44 -05:00
with :
token : ${{ secrets.BOT_TOKEN }}
2023-01-31 14:59:12 -05:00
fetch-depth : 1
2023-01-17 18:06:10 -05:00
2022-12-26 14:46:36 -05:00
- name : Setting repo parent dir as safe safe.directory
run : git config --global --add safe.directory "$GITHUB_WORKSPACE"
2023-01-17 18:06:10 -05:00
2022-11-10 10:46:44 -05:00
- name : generate readme.md
shell : bash
run : |
2023-05-23 08:14:16 -04:00
for train in stable operators SCALE incubator games enterprise develop non-free deprecated dependency core; do
2022-11-10 10:46:44 -05:00
for chart in charts/${train}/*; do
if [ -d "${chart}" ]; then
echo "Generating readme.md for ${train}/${chart}"
cp "templates/README.md.tpl" "${chart}/README.md"
sed -i "s/TRAINPLACEHOLDER/${train}/" "${chart}/README.md"
sed -i "s/CHARTPLACEHOLDER/${chartname}/" "${chart}/README.md"
fi
done
done
- name : generate HelmIgnore
shell : bash
run : |
2023-05-23 08:14:16 -04:00
for train in stable operators SCALE incubator games enterprise develop non-free deprecated dependency core; do
2022-11-10 10:46:44 -05:00
for chart in charts/${train}/*; do
if [ -d "${chart}" ]; then
echo "Attempting to sync HelmIgnore file for: ${chartname}"
rm -rf ${chart}/.helmignore
cp templates/chart/.helmignore ${chart}/
fi
done
done
2023-01-17 18:06:10 -05:00
2023-01-31 14:53:40 -05:00
- name : Checkout
2023-04-14 15:59:14 -04:00
uses : actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
2023-01-31 14:53:40 -05:00
with :
repository : truecharts/website
path : website
fetch-depth : 1
token : ${{ secrets.BOT_TOKEN }}
2022-12-26 14:46:36 -05:00
- name : Bump and Sync
shell : bash
run : |
# Designed to ensure the appversion in Chart.yaml is in sync with the primary Chart tag if found
# Also makes sure that home link is pointing to the correct url
sync_tag() {
fix: Build links to Docker images for Chart.yaml (#6963)
* style: Split long lines, follow .editorconfig
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: Clarify why some sources are being excluded
The explanation is also meant to remind anyone that sees it that the
code could inadvertently remove a sources sequence entry that was
intentionally added, because it can not tell.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: Comment the image-to-URL code
Signed-off-by: Dan Christensen <opello@opello.org>
* refactor: Use case instead of if-ladder
This is a faithful move from the if-ladder to a case statement that
preserves the existing behavior, with optimization to follow. The
behavior of the function before and after this change is the same.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: Remove dead code
No "container source" entry from description_list.md has a scheme. The
values are parsed from the Dockerfiles and would not have one there
either.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: tccr.io image links
Parse the tccr.io prefix specifically instead of just checking for the
substring tccr which could result in a false positive.
The generated link was also going to point to a truecharts subdirectory
under mirror in the containers repository that does not exist.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: lscr.io image links
Parse the lscr.io prefix specifically instead of just checking for the
substring lscr which could result in a false positive.
The generated link would also return a 404 because the web interface
requires the image name to be passed in the query string.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: gcr.io image links
Parse the gcr.io prefix specifically instead of just checking for the
substring gcr which could result in a false positive.
Signed-off-by: Dan Christensen <opello@opello.org>
* feat: Do not add sources if no prefix is created
The intent of this code is to generate URLs to be included in
documentation to attribute inputs to the chart. If a publicly
accessible URL can not be generated from the image name it makes sense
to not add anything and instead rely on a manual edit to the Chart.yaml.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: Disable azurecr.io image links
There does not seem to be a general purpose web index to the azurecr.io
hosted images.
Signed-off-by: Dan Christensen <opello@opello.org>
* feat: Disable mcr.microsoft.com image links
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: public.ecr.aws image links
Parse the public.ecr.aws prefix specifically instead of just checking
for the substring public.ecr.aws which could result in a false positive.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: Disable ocir.io image links
There does not seem to be a general purpose web index to the ocir.io
hosted images.
Signed-off-by: Dan Christensen <opello@opello.org>
* refactor: Add Docker Hub hosted image links
From the perspective of linking to image details on the Docker Hub web
interface, there are two types of images:
1. Docker Official Images
2. all of the other images, regardless of their trustworthiness
The Docker Official Images can be referenced several ways, either on the
command line when passed to docker pull, or in the FROM instruction of a
Dockerfile:
* busybox
* library/busybox
* docker.io/busybox
* docker.io/library/busybox
Furthermore, over the years there have been several domains used for the
official Docker Hub registry:
* docker.io
* index.docker.io
* registry-1.docker.io
* registry.hub.docker.com
The goal here is handling each possible case, which makes Docker Hub
images more complex than the handling for other registries.
It also makes the case block's '*' (default) case harder to find in the
sequence of glob expressions, but this is necessary to avoid repeating
the parsing or adding another helper function.
Reference:
https://github.com/docker/hub-feedback/issues/2113
https://github.com/docker/cli/issues/3793
Signed-off-by: Dan Christensen <opello@opello.org>
* feat: ghcr.io image links
Signed-off-by: Dan Christensen <opello@opello.org>
* feat: quay.io image links
Signed-off-by: Dan Christensen <opello@opello.org>
* feat: Do not generate likely-bad links
By assuming image names that are not handled by other cases are Docker
Hub images there is a risk of generating bad links. Minimize this risk
by not generating a link if the image name for a Docker Hub link has two
slashes. This is a case that should not happen and would likely mean an
unsupported registry is being used.
There is still a risk of an unsupported registry being treated as Docker
Hub and an invalid link being generated. That case is if the domain and
image name is example.com/busybox where there is only one slash.
Signed-off-by: Dan Christensen <opello@opello.org>
* refactor: Sort cases
Sort the cases from longest to shortest prioritizing any case with a
suffix only glob over any case with a prefix glob. The intention is to
avoid having a case that can not be reached.
The combined Docker Hub and default case is last. It might make sense
to split the default case handling off but it does not seem to be a
problem right now.
Signed-off-by: Dan Christensen <opello@opello.org>
---------
Signed-off-by: Dan Christensen <opello@opello.org>
2023-02-09 07:08:53 -05:00
local chart="$1"
local chartname="$2"
local train="$3"
echo "Attempting to sync primary tag with appversion for: ${chartname}"
local tag="$(cat ${chart}/values.yaml | grep '^ tag: ' | awk -F" " '{ print $2 }' | head -1)"
tag="${tag%%@*}"
tag="${tag:-auto}"
tag=$(echo $tag | sed "s/release-//g")
tag=$(echo $tag | sed "s/release_//g")
tag=$(echo $tag | sed "s/version-//g")
tag=$(echo $tag | sed "s/version_//g")
tag="${tag#*V.}"
tag="${tag#*v-}"
tag="${tag#*v}"
tag="${tag%-*}"
tag="${tag:0:10}"
tag="${tag%-}"
tag="${tag%_}"
tag="${tag%.}"
echo "Updating tag of ${chartname} to ${tag}..."
sed -i -e "s|appVersion: .*|appVersion: \"${tag}\"|" "${chart}/Chart.yaml"
echo "Updating icon of ${chartname}..."
sed -i -e "s|icon: .*|icon: https:\/\/truecharts.org\/img\/hotlink-ok\/chart-icons\/${chartname}.png|" "${chart}/Chart.yaml"
echo "Updating home of ${chartname}..."
sed -i -e "s|home: .*|home: https:\/\/truecharts.org\/charts\/${train}\/${chartname}|" "${chart}/Chart.yaml"
echo "Attempting to update sources of ${chartname}..."
echo "Using go-yq verion: <$(go-yq -V)>"
# Get current sources, exluding those that may have been added automatically.
curr_sources=$(
go-yq '
.sources[] |
select(
. != "https://github.com/truecharts*" and
. != "https://ghcr*" and
. != "docker.io*" and
. != "https://docker.io*" and
. != "https://hub.docker*" and
. != "https://fleet.*" and
. != "https://github.com/truecharts/containers/tree/master/mirror/*" and
. != "https://public.ecr.aws*" and
. != "https://ocir.io*" and
. != "https://gcr*" and
. != "https://azurecr*" and
. != "https://quay*" and
. != "https://lscr*" and
. != "https://github.com/truecharts/containers*" and
. == "http*"
)
' \
"${chart}/Chart.yaml"
)
# Empty sources list in-place
go-yq -i 'del(.sources.[])' "${chart}/Chart.yaml"
# Add truechart source
tcsource="https://github.com/truecharts/charts/tree/master/charts/$train/$chartname" go-yq -i '.sources += env(tcsource)' "${chart}/Chart.yaml"
# Get the container image name that was parsed out of the Dockerfile for the website.
container=$(cat website/docs/charts/description_list.md | grep "\[${chartname}\]" | cut -f3 -d '|' | grep -v 'Not Found' || echo "")
# Convert the container image name to a URL.
if [ ! -z "$container" ]; then
prefix=""
case "$container" in
lscr.io/linuxserver/*)
prefix="https://fleet.linuxserver.io/image?name="
container=${container#lscr.io/}
;;
tccr.io/truecharts/*)
prefix="https://github.com/truecharts/containers/tree/master/mirror"
container=${container#tccr.io/truecharts/}
;;
mcr.microsoft.com/*)
prefix=""
;;
public.ecr.aws/*)
prefix="https://gallery.ecr.aws/"
container=${container#public.ecr.aws/}
;;
ghcr.io/*)
prefix="https://"
;;
quay.io/*)
prefix="https://"
;;
gcr.io/*)
prefix="https://"
;;
*.azurecr.io/*)
prefix=""
;;
*.ocir.io/*)
prefix=""
;;
# There have been a number of domains used for the Docker Hub registry over the years.
# NOTE: This is also the default case!
docker.io/*|index.docker.io/*|registry-1.docker.io/*|registry.hub.docker.com/*|*)
prefix="https://hub.docker.com/r/"
container=${container#docker.io/}
container=${container#index.docker.io/}
container=${container#registry-1.docker.io/}
container=${container#registry.hub.docker.com/}
# If the image name does not contain a slash it is a Docker Official Image.
if [ "$container" == "${container////}" ]; then
prefix="https://hub.docker.com/_/"
# If the user name is library it is a Docker Official Image.
elif [ "${container%%/*}" == "library" ]; then
prefix="https://hub.docker.com/_/"
container=${container#library/}
fi
# Avoid creating a bad link since an unsupported registry may have been used.
slashes=${container//[^\/]/}
# Bail out if the image name has more than 1 slash.
if [ ${#slashes} -gt 1 ]; then
prefix=""
echo "WARNING: Not assuming '$container' is a Docker Hub image"
fi
;;
esac
if [ -n "${prefix}" ]; then
2023-02-01 03:03:45 -05:00
container="${prefix}${container}" go-yq -i '.sources += env(container) | .sources |= unique' "${chart}/Chart.yaml"
2023-01-31 14:53:40 -05:00
fi
fix: Build links to Docker images for Chart.yaml (#6963)
* style: Split long lines, follow .editorconfig
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: Clarify why some sources are being excluded
The explanation is also meant to remind anyone that sees it that the
code could inadvertently remove a sources sequence entry that was
intentionally added, because it can not tell.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: Comment the image-to-URL code
Signed-off-by: Dan Christensen <opello@opello.org>
* refactor: Use case instead of if-ladder
This is a faithful move from the if-ladder to a case statement that
preserves the existing behavior, with optimization to follow. The
behavior of the function before and after this change is the same.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: Remove dead code
No "container source" entry from description_list.md has a scheme. The
values are parsed from the Dockerfiles and would not have one there
either.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: tccr.io image links
Parse the tccr.io prefix specifically instead of just checking for the
substring tccr which could result in a false positive.
The generated link was also going to point to a truecharts subdirectory
under mirror in the containers repository that does not exist.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: lscr.io image links
Parse the lscr.io prefix specifically instead of just checking for the
substring lscr which could result in a false positive.
The generated link would also return a 404 because the web interface
requires the image name to be passed in the query string.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: gcr.io image links
Parse the gcr.io prefix specifically instead of just checking for the
substring gcr which could result in a false positive.
Signed-off-by: Dan Christensen <opello@opello.org>
* feat: Do not add sources if no prefix is created
The intent of this code is to generate URLs to be included in
documentation to attribute inputs to the chart. If a publicly
accessible URL can not be generated from the image name it makes sense
to not add anything and instead rely on a manual edit to the Chart.yaml.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: Disable azurecr.io image links
There does not seem to be a general purpose web index to the azurecr.io
hosted images.
Signed-off-by: Dan Christensen <opello@opello.org>
* feat: Disable mcr.microsoft.com image links
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: public.ecr.aws image links
Parse the public.ecr.aws prefix specifically instead of just checking
for the substring public.ecr.aws which could result in a false positive.
Signed-off-by: Dan Christensen <opello@opello.org>
* fix: Disable ocir.io image links
There does not seem to be a general purpose web index to the ocir.io
hosted images.
Signed-off-by: Dan Christensen <opello@opello.org>
* refactor: Add Docker Hub hosted image links
From the perspective of linking to image details on the Docker Hub web
interface, there are two types of images:
1. Docker Official Images
2. all of the other images, regardless of their trustworthiness
The Docker Official Images can be referenced several ways, either on the
command line when passed to docker pull, or in the FROM instruction of a
Dockerfile:
* busybox
* library/busybox
* docker.io/busybox
* docker.io/library/busybox
Furthermore, over the years there have been several domains used for the
official Docker Hub registry:
* docker.io
* index.docker.io
* registry-1.docker.io
* registry.hub.docker.com
The goal here is handling each possible case, which makes Docker Hub
images more complex than the handling for other registries.
It also makes the case block's '*' (default) case harder to find in the
sequence of glob expressions, but this is necessary to avoid repeating
the parsing or adding another helper function.
Reference:
https://github.com/docker/hub-feedback/issues/2113
https://github.com/docker/cli/issues/3793
Signed-off-by: Dan Christensen <opello@opello.org>
* feat: ghcr.io image links
Signed-off-by: Dan Christensen <opello@opello.org>
* feat: quay.io image links
Signed-off-by: Dan Christensen <opello@opello.org>
* feat: Do not generate likely-bad links
By assuming image names that are not handled by other cases are Docker
Hub images there is a risk of generating bad links. Minimize this risk
by not generating a link if the image name for a Docker Hub link has two
slashes. This is a case that should not happen and would likely mean an
unsupported registry is being used.
There is still a risk of an unsupported registry being treated as Docker
Hub and an invalid link being generated. That case is if the domain and
image name is example.com/busybox where there is only one slash.
Signed-off-by: Dan Christensen <opello@opello.org>
* refactor: Sort cases
Sort the cases from longest to shortest prioritizing any case with a
suffix only glob over any case with a prefix glob. The intention is to
avoid having a case that can not be reached.
The combined Docker Hub and default case is last. It might make sense
to split the default case handling off but it does not seem to be a
problem right now.
Signed-off-by: Dan Christensen <opello@opello.org>
---------
Signed-off-by: Dan Christensen <opello@opello.org>
2023-02-09 07:08:53 -05:00
fi
# Add the rest of the sources
while IFS= read -r line; do
src="$line" go-yq -i '.sources += env(src)' "${chart}/Chart.yaml" || echo "src set error"
done <<< "$curr_sources"
echo "Sources of ${chartname} updated!"
}
2022-12-26 14:46:36 -05:00
export -f sync_tag
2023-01-17 18:06:10 -05:00
2023-05-23 08:14:16 -04:00
for train in enterprise stable operators incubator dependency; do
2022-12-26 14:46:36 -05:00
echo "Correcting Chart.yaml for Train: ${train}..."
for chart in $(ls "charts/${train}"); do
echo "Correcting Chart.yaml for Chart: ${chart}..."
sync_tag "charts/${train}/${chart}" "${chart}" "${train}"
2022-12-26 16:03:55 -05:00
done
2022-12-26 14:46:36 -05:00
done
2023-01-17 18:06:10 -05:00
2022-12-26 14:46:36 -05:00
- name : Cleanup
run : |
rm -rf changes.json
rm -rf master
2022-11-10 10:46:44 -05:00
- name : Commit changes
run : |
git config user.name "TrueCharts-Bot"
git config user.email "bot@truecharts.org"
2022-12-26 16:53:07 -05:00
git pull
2022-11-10 10:46:44 -05:00
git add --all
git commit -sm "Commit daily changes" || exit 0
git push
2023-01-17 18:06:10 -05:00
2022-12-26 14:46:36 -05:00
generate-security-reports :
runs-on : ubuntu-latest
2022-12-26 16:24:39 -05:00
name : "Generate Security Reports"
2022-12-26 14:46:36 -05:00
container :
2023-05-05 10:32:00 -04:00
image : ghcr.io/truecharts/devcontainer:3.1.10@sha256:c239addf725eb5cedf79517f8089fdafdc32b5270d1893ee87ae6e511b9bcae3
2022-12-26 14:46:36 -05:00
steps :
- name : Install Kubernetes tools
2023-02-21 17:10:54 -05:00
uses : yokawasa/action-setup-kube-tools@af4ebb1af1efd30c5bd84a2e9773355ad6362a33 # v0.9.3
2022-12-26 14:46:36 -05:00
with :
setup-tools : |
helmv3
helm : "3.8.0"
- name : Prep Helm
run : |
helm repo add truecharts https://charts.truecharts.org
helm repo add truecharts-library https://library-charts.truecharts.org
2023-05-15 05:34:44 -04:00
helm repo add truecharts-deps https://deps.truecharts.org
2022-12-26 14:46:36 -05:00
helm repo update
- name : Checkout
2023-04-14 15:59:14 -04:00
uses : actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
2022-12-26 14:46:36 -05:00
with :
token : ${{ secrets.BOT_TOKEN }}
2023-01-31 14:59:37 -05:00
fetch-depth : 1
2022-12-26 14:46:36 -05:00
- name : Setting repo parent dir as safe safe.directory
run : git config --global --add safe.directory "$GITHUB_WORKSPACE"
- name : Checkout website
2023-04-14 15:59:14 -04:00
uses : actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
2022-12-26 14:46:36 -05:00
with :
fetch-depth : 1
repository : truecharts/website
token : ${{ secrets.BOT_TOKEN }}
path : website
2023-01-17 18:06:10 -05:00
2022-12-26 14:46:36 -05:00
- name : fetch dependencies
shell : bash
run : |
.github/scripts/fetch_helm_deps.sh
- name : generate security reports
shell : bash
run : |
#!/bin/bash
render() {
local chart="$1"
local chartname="$2"
local train="$3"
echo "Rendering helm-template for ${chartname}"
mkdir -p ${chart}/render
helm template ${chart} >> ${chart}/render/app.yaml || echo "Helm template failed..."
}
helm_sec_scan() {
local chart="$1"
local chartname="$2"
local train="$3"
echo "Scanning helm security for ${chartname}"
mkdir -p ${chart}/render
rm -rf website/docs/charts/${train}/${chartname}/helm-security.md || echo "removing old helm-security file failed..."
echo "# Helm Security" >> website/docs/charts/${train}/${chartname}/helm-security.md
echo "" >> website/docs/charts/${train}/${chartname}/helm-security.md
echo "## Helm-Chart" >> website/docs/charts/${train}/${chartname}/helm-security.md
echo "" >> website/docs/charts/${train}/${chartname}/helm-security.md
echo "##### Scan Results" >> website/docs/charts/${train}/${chartname}/helm-security.md
echo "" >> website/docs/charts/${train}/${chartname}/helm-security.md
2023-01-31 17:55:14 -05:00
trivy config --namespaces builtin.kubernetes.* -f template --template "@./templates/trivy-config.tpl" ${chart}/render >> website/docs/charts/${train}/${chartname}/helm-security.md || echo "trivy scan failed..."
2022-12-26 14:46:36 -05:00
}
container_sec_scan() {
local chart="$1"
local chartname="$2"
local train="$3"
echo "Scanning container security for ${chartname}"
mkdir -p ${chart}/render
rm -rf website/docs/charts/${train}/${chartname}/container-security.md || echo "removing old container-security file failed..."
echo "# Container Security" >> website/docs/charts/${train}/${chartname}/container-security.md
echo "" >> website/docs/charts/${train}/${chartname}/container-security.md
echo "##### Detected Containers" >> website/docs/charts/${train}/${chartname}/container-security.md
echo "" >> website/docs/charts/${train}/${chartname}/container-security.md
find ${chart}/render/ -name '*.yaml' -type f -exec cat {} \; | grep image: | sed "s/image: //g" | sed "s/\"//g" >> ${chart}/render/containers.tmp
cat ${chart}/render/containers.tmp >> website/docs/charts/${train}/${chartname}/container-security.md
echo "" >> website/docs/charts/${train}/${chartname}/container-security.md
echo "##### Scan Results" >> website/docs/charts/${train}/${chartname}/container-security.md
echo "" >> website/docs/charts/${train}/${chartname}/container-security.md
for container in $(cat ${chart}/render/containers.tmp | sort | uniq); do
if [[ "$container" == *"truecharts/alpine"* || "$container" == *"truecharts/ubuntu"* || "$container" == *"truecharts/kubectl"* ]]; then
echo "Skipping ${container}, as it's a shared common container..."
else
echo "**Container: ${container}**" >> website/docs/charts/${train}/${chartname}/container-security.md
echo "" >> website/docs/charts/${train}/${chartname}/container-security.md
trivy image --security-checks vuln -f template --template "@./templates/trivy-container.tpl" ${container} >> website/docs/charts/${train}/${chartname}/container-security.md || echo "trivy container scan failed..."
echo "" >> website/docs/charts/${train}/${chartname}/container-security.md
fi
done
}
cleanfiles() {
local chart="$1"
local chartname="$2"
local train="$3"
echo "sanitising website output for ${chartname}..."
rm -rf ${chart}/render
2023-01-31 18:01:50 -05:00
sed -i 's|<br>|<br />|g' website/docs/charts/${train}/${chartname}/helm-security.md ||:
sed -i 's|<br>|<br />|g' website/docs/charts/${train}/${chartname}/container-security.md ||:
sed -i 's|<hr>|<hr />|g' website/docs/charts/${train}/${chartname}/helm-security.md ||:
sed -i 's|<hr>|<hr />|g' website/docs/charts/${train}/${chartname}/container-security.md ||:
2022-12-26 14:46:36 -05:00
}
2023-05-23 08:14:16 -04:00
for train in enterprise stable operators incubator dependency; do
2022-12-26 14:46:36 -05:00
echo "Processing Charts for Train: ${train}..."
for chart in $(ls "charts/${train}"); do
2023-01-31 18:01:50 -05:00
render "charts/${train}/${chart}" ${chart} ${train} || echo "rendering failed for ${chart}"
helm_sec_scan "charts/${train}/${chart}" ${chart} ${train} || echo "helm chart processing failed for ${chart}"
if [ ${train} == "enterprise" ]; then
container_sec_scan "charts/${train}/${chart}" ${chart} ${train} || echo "container processing failed for ${chart}"
fi
cleanfiles "charts/${train}/${chart}" ${chart} ${train} || echo "cleaning failed for ${chart}"
2022-12-26 14:46:36 -05:00
done
done
echo "finsihed security scan"
- name : Commit Website Changes
run : |
cd website
git config user.name "TrueCharts-Bot"
git config user.email "bot@truecharts.org"
2022-12-26 16:53:07 -05:00
git pull
2022-12-26 14:46:36 -05:00
git add --all
git commit -sm "Commit released docs for TrueCharts" || exit 0
git push
2023-02-03 06:21:10 -05:00
lock-threads :
runs-on : ubuntu-latest
steps :
2023-02-08 02:26:25 -05:00
- uses : dessant/lock-threads@c1b35aecc5cdb1a34539d14196df55838bb2f836 # v4
2023-02-03 06:21:10 -05:00
with :
github-token : ${{ secrets.BOT_TOKEN }}
2023-03-16 06:09:35 -04:00
issue-inactive-days : "7"
exclude-any-issue-labels : ""
issue-comment : "This issue is locked to prevent necro-posting on closed issues. Please create a new issue or contact staff on discord of the problem persists"
issue-lock-reason : ""
pr-inactive-days : "7"
pr-comment : "This PR is locked to prevent necro-posting on closed PRs. Please create a issue or contact staff on discord if you want to further discuss this"
pr-lock-reason : "resolved"
2023-02-03 06:21:10 -05:00
log-output : true
2023-03-16 06:09:35 -04:00
2023-03-16 06:11:00 -04:00
check-contributors :
2023-03-16 06:10:29 -04:00
name : Check Contributors
2023-03-16 06:09:35 -04:00
runs-on : ubuntu-latest
steps :
- name : Checkout
2023-04-14 15:59:14 -04:00
uses : actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3
2023-03-16 06:09:35 -04:00
with :
token : ${{ secrets.BOT_TOKEN }}
fetch-depth : 1
2023-04-07 05:40:48 -04:00
- uses : actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3
2023-03-16 06:09:35 -04:00
with :
node-version : 18
2023-04-07 05:40:48 -04:00
- uses : borales/actions-yarn@97ba8bebfe5b549bb7999261698a52a81fd62f1b # v4.2.0
2023-03-16 06:09:35 -04:00
with :
cmd : install --frozen-lockfile
- name : List missing and unknown contributors
2023-03-16 06:16:13 -04:00
env :
PRIVATE_TOKEN : ${{ secrets.BOT_TOKEN }}
2023-03-16 06:09:35 -04:00
run : |
awk -F', ' '{ for( i=1; i<=NF; i++ ) print $i }' <<<$(yarn all-contributors check)