From 115d3b47c5c017cfab5990af2ae47d5e62a94d48 Mon Sep 17 00:00:00 2001 From: Stacky McStackface Date: Wed, 12 Aug 2026 12:39:56 +0000 Subject: [PATCH 1/3] chore: Generated commit to update templated files since the last template run up to stackabletech/operator-templating@9d5273b3309c4dd25c1dbacd61bd5ecca0146b46 Reference-to: stackabletech/operator-templating@9d5273b (DO NOT MERGE. Will be tested in https://github.com/stackabletech/zookeeper-operator first.) --- .github/workflows/build.yaml | 183 +++++++----------- .github/workflows/general_daily_security.yml | 6 +- .../workflows/integration-test-custom.yaml | 49 +++++ .../workflows/integration-test-profile.yaml | 59 ++++++ .github/workflows/pr_prek.yaml | 8 +- Makefile | 36 +++- deploy/helm/zookeeper-operator/Chart.yaml | 15 ++ renovate.json | 2 +- 8 files changed, 244 insertions(+), 114 deletions(-) create mode 100644 .github/workflows/integration-test-custom.yaml create mode 100644 .github/workflows/integration-test-profile.yaml diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 88eeaa47..e4e725c6 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -39,16 +39,18 @@ jobs: detect-changes: name: Detect relevant changed files runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Checkout Repository - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false fetch-depth: 0 - name: Check for changed files id: check - uses: stackabletech/actions/detect-changes@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 + uses: stackabletech/actions/detect-changes@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 with: patterns: | - '.github/workflows/build.yaml' @@ -57,8 +59,9 @@ jobs: - 'deploy/**' - '.cargo/**' - 'docker/**' - - 'Cargo.*' - - '*.rs' + - '**/Cargo.toml' + - 'Cargo.lock' + - '**/*.rs' outputs: detected: ${{ steps.check.outputs.detected }} @@ -67,17 +70,19 @@ jobs: if: needs.detect-changes.outputs.detected == 'true' needs: [detect-changes] runs-on: ubuntu-latest + permissions: + contents: read env: RUSTC_BOOTSTRAP: 1 steps: - name: Install host dependencies - uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3 + uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3 with: packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https version: ubuntu-latest - name: Checkout Repository - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false submodules: recursive @@ -93,16 +98,20 @@ jobs: key: udeps - name: Install cargo-udeps - uses: stackabletech/cargo-install-action@8f7dbbcd2ebe22717efc132d0dd61e80841994b9 # cargo-udeps + uses: stackabletech/cargo-install-action@e3e2dcf8d0f0e5bdbc619bf6ee7560dd68152d3c # cargo-udeps - name: Run cargo-udeps run: cargo udeps --workspace --all-targets build-container-image: name: Build/Publish ${{ matrix.runner.arch }} Image - if: (github.event_name != 'merge_group') && needs.detect-changes.outputs.detected == 'true' + if: | + github.repository_owner == 'stackabletech' + && (github.event_name != 'merge_group') + && needs.detect-changes.outputs.detected == 'true' needs: [detect-changes] permissions: + contents: read id-token: write strategy: fail-fast: false @@ -115,13 +124,13 @@ jobs: operator-version: ${{ steps.version.outputs.OPERATOR_VERSION }} steps: - name: Install host dependencies - uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3 + uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3 with: packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https version: ${{ matrix.runner.name }} - name: Checkout Repository - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false submodules: recursive @@ -156,7 +165,7 @@ jobs: echo "OPERATOR_VERSION=$NEW_VERSION" | tee -a "$GITHUB_OUTPUT" - name: Install Nix - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31.5.2 + uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0 - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain shell: bash @@ -164,7 +173,7 @@ jobs: - name: Build Container Image id: build - uses: stackabletech/actions/build-container-image@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 + uses: stackabletech/actions/build-container-image@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 with: image-name: ${{ env.OPERATOR_NAME }} image-index-manifest-tag: ${{ steps.version.outputs.OPERATOR_VERSION }} @@ -173,7 +182,7 @@ jobs: - name: Publish Container Image to oci.stackable.tech if: ${{ !github.event.pull_request.head.repo.fork }} - uses: stackabletech/actions/publish-image@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 + uses: stackabletech/actions/publish-image@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 with: image-registry-uri: oci.stackable.tech image-registry-username: robot$sdp+github-action-build @@ -184,7 +193,7 @@ jobs: - name: Publish Container Image to quay.io if: ${{ !github.event.pull_request.head.repo.fork }} - uses: stackabletech/actions/publish-image@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 + uses: stackabletech/actions/publish-image@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 with: image-registry-uri: quay.io image-registry-username: stackable+robot_sdp_github_action_build @@ -196,27 +205,25 @@ jobs: publish-index-manifest: name: Publish/Sign ${{ needs.build-container-image.outputs.operator-version }} Index if: | - (github.event_name != 'merge_group') + github.repository_owner == 'stackabletech' + && (github.event_name != 'merge_group') && needs.detect-changes.outputs.detected == 'true' && !github.event.pull_request.head.repo.fork needs: - detect-changes - build-container-image permissions: + contents: read id-token: write runs-on: ubuntu-latest - outputs: - oci-index-digest: ${{ steps.publish-oci.outputs.image-index-manifest-digest }} - quay-index-digest: ${{ steps.publish-quay.outputs.image-index-manifest-digest }} steps: - name: Checkout Repository - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Publish and Sign Image Index to oci.stackable.tech - id: publish-oci - uses: stackabletech/actions/publish-image-index-manifest@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 + uses: stackabletech/actions/publish-image-index-manifest@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 with: image-registry-uri: oci.stackable.tech image-registry-username: robot$sdp+github-action-build @@ -225,8 +232,7 @@ jobs: image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }} - name: Publish and Sign Image Index to quay.io - id: publish-quay - uses: stackabletech/actions/publish-image-index-manifest@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 + uses: stackabletech/actions/publish-image-index-manifest@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 with: image-registry-uri: quay.io image-registry-username: stackable+robot_sdp_github_action_build @@ -234,84 +240,29 @@ jobs: image-repository: stackable/sdp/${{ env.OPERATOR_NAME }} image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }} - # Generate SLSA build provenance for the multi-arch image index and attach it - # to the published image in each registry. The reusable workflow signs the - # provenance with keyless signing (GitHub Actions as the OIDC identity) and - # pushes the attestation next to the image. - provenance-oci: - name: Generate Provenance for ${{ needs.build-container-image.outputs.operator-version }} (oci.stackable.tech) - if: | - (github.event_name != 'merge_group') - && needs.detect-changes.outputs.detected == 'true' - && !github.event.pull_request.head.repo.fork - needs: - - detect-changes - - build-container-image - - publish-index-manifest - permissions: - actions: read # detect the build workflow that generated the image - id-token: write # mint the OIDC token for keyless signing - packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved - # MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the reusable - # workflow cannot verify its own provenance. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 - with: - # The 'env' context is not available in job-level 'with' inputs of - # reusable workflow calls (unlike step-level 'with'), so OPERATOR_NAME - # can't be used here and the operator name is templated in directly. - image: oci.stackable.tech/sdp/zookeeper-operator - digest: ${{ needs.publish-index-manifest.outputs.oci-index-digest }} - registry-username: robot$sdp+github-action-build - secrets: - registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }} - - provenance-quay: - name: Generate Provenance for ${{ needs.build-container-image.outputs.operator-version }} (quay.io) - if: | - (github.event_name != 'merge_group') - && needs.detect-changes.outputs.detected == 'true' - && !github.event.pull_request.head.repo.fork - needs: - - detect-changes - - build-container-image - - publish-index-manifest - permissions: - actions: read # detect the build workflow that generated the image - id-token: write # mint the OIDC token for keyless signing - packages: write # needed until https://github.com/slsa-framework/slsa-github-generator/issues/1257 is resolved - # MUST be referenced by a @vX.Y.Z tag (not a SHA), otherwise the reusable - # workflow cannot verify its own provenance. - uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0 - with: - # The 'env' context is not available in job-level 'with' inputs of - # reusable workflow calls (unlike step-level 'with'), so OPERATOR_NAME - # can't be used here and the operator name is templated in directly. - image: quay.io/stackable/sdp/zookeeper-operator - digest: ${{ needs.publish-index-manifest.outputs.quay-index-digest }} - registry-username: stackable+robot_sdp_github_action_build - secrets: - registry-password: ${{ secrets.QUAY_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }} - publish-helm-chart: name: Package/Publish ${{ needs.build-container-image.outputs.operator-version }} Helm Chart if: | - (github.event_name != 'merge_group') + github.repository_owner == 'stackabletech' + && (github.event_name != 'merge_group') && needs.detect-changes.outputs.detected == 'true' + && !github.event.pull_request.head.repo.fork needs: - detect-changes - build-container-image permissions: + contents: read id-token: write runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false submodules: recursive - name: Package, Publish, and Sign Helm Chart to oci.stackable.tech - uses: stackabletech/actions/publish-helm-chart@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 + uses: stackabletech/actions/publish-helm-chart@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 with: chart-registry-uri: oci.stackable.tech chart-registry-username: robot$sdp-charts+github-action-build @@ -323,7 +274,7 @@ jobs: publish-and-sign: ${{ !github.event.pull_request.head.repo.fork }} - name: Package, Publish, and Sign Helm Chart to quay.io - uses: stackabletech/actions/publish-helm-chart@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 + uses: stackabletech/actions/publish-helm-chart@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 with: chart-registry-uri: quay.io chart-registry-username: stackable+robot_sdp_charts_github_action_build @@ -338,7 +289,8 @@ jobs: openshift-preflight-check: name: Run OpenShift Preflight Check for ${{ needs.build-container-image.outputs.operator-version }}-${{ matrix.arch }} if: | - (github.event_name != 'merge_group') + github.repository_owner == 'stackabletech' + && (github.event_name != 'merge_group') && needs.detect-changes.outputs.detected == 'true' && !github.event.pull_request.head.repo.fork needs: @@ -354,13 +306,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Run OpenShift Preflight Check for oci.stackable.tech - uses: stackabletech/actions/run-openshift-preflight@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 + uses: stackabletech/actions/run-openshift-preflight@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 with: image-index-uri: oci.stackable.tech/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }} image-architecture: ${{ matrix.arch }} - name: Run OpenShift Preflight Check for quay.io - uses: stackabletech/actions/run-openshift-preflight@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 + uses: stackabletech/actions/run-openshift-preflight@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 with: image-index-uri: quay.io/stackable/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }} image-architecture: ${{ matrix.arch }} @@ -372,50 +324,65 @@ jobs: # WARNING: Do not change the name unless you will also be changing the # Required Checks (in branch protections) in GitHub settings. name: Finished Build and Publish + # Run even when a dependency failed, was skipped or cancelled, so that this + # gate reflects the real outcome. Without `always()` a failed dependency + # would *skip* this job, and GitHub treats a skipped required check as + # passing - making a broken build mergeable. + if: always() + # List every leaf job directly. A transitive failure (e.g. a failed + # publish-index-manifest that skips openshift-preflight-check) does not + # surface as `failure` in `needs.*.result` unless the failing job is a + # direct dependency. needs: + - detect-changes - cargo-udeps - - openshift-preflight-check + - build-container-image + - publish-index-manifest - publish-helm-chart + - openshift-preflight-check runs-on: ubuntu-latest steps: - - run: echo "We are done here" + # Skipped dependencies are fine (jobs skip legitimately on merge_group + # events, forks, or when detect-changes finds no relevant changes). Only + # a failure or cancellation must fail this gate. + - name: Fail on any failed or cancelled dependency + env: + RESULTS: ${{ join(needs.*.result, ' ') }} + run: | + echo "Dependency results: $RESULTS" + for result in $RESULTS; do + if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then + echo "::error::A required job did not succeed (result: $result)" + exit 1 + fi + done + echo "We are done here" notify: name: Failure Notification if: | - (failure() || github.run_attempt > 1) + !cancelled() + && github.repository_owner == 'stackabletech' + && (contains(needs.*.result, 'failure') || github.run_attempt > 1) && github.event_name != 'merge_group' && needs.detect-changes.outputs.detected == 'true' && !github.event.pull_request.head.repo.fork needs: - detect-changes + - cargo-udeps - build-container-image - publish-index-manifest - - provenance-oci - - provenance-quay - publish-helm-chart + - openshift-preflight-check + - finished runs-on: ubuntu-latest steps: - - name: Checkout Repository - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - persist-credentials: false - - name: Send Notification - uses: stackabletech/actions/send-slack-notification@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 + uses: stackabletech/actions/send-slack-notification@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 with: publish-helm-chart-result: ${{ needs.publish-helm-chart.result }} publish-manifests-result: ${{ needs.publish-index-manifest.result }} build-result: ${{ needs.build-container-image.result }} - # Provenance is generated per registry, but the notification only has a - # single field for it, so the two results are collapsed into the worst - # one. 'failure' must be reported verbatim, otherwise the notification - # is not marked as failed. - generate-provenance-result: >- - ${{ (needs.provenance-oci.result == 'failure' || needs.provenance-quay.result == 'failure') && 'failure' - || (needs.provenance-oci.result == 'cancelled' || needs.provenance-quay.result == 'cancelled') && 'cancelled' - || (needs.provenance-oci.result == 'skipped' || needs.provenance-quay.result == 'skipped') && 'skipped' - || 'success' }} slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }} channel-id: C07UG6JH44F # notifications-container-images type: container-image-build diff --git a/.github/workflows/general_daily_security.yml b/.github/workflows/general_daily_security.yml index 8b76446b..7a4c6fab 100644 --- a/.github/workflows/general_daily_security.yml +++ b/.github/workflows/general_daily_security.yml @@ -15,8 +15,12 @@ permissions: {} jobs: audit: runs-on: ubuntu-latest + permissions: + contents: read + # rustsec/audit-check publishes its results as a Check run, which requires this scope + checks: write steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0 diff --git a/.github/workflows/integration-test-custom.yaml b/.github/workflows/integration-test-custom.yaml new file mode 100644 index 00000000..4683e387 --- /dev/null +++ b/.github/workflows/integration-test-custom.yaml @@ -0,0 +1,49 @@ +--- +name: Integration Test (Custom) + +on: + workflow_dispatch: + inputs: + test-runner: + description: Name of the test runner, eg. `amd64` (see test/interu.yaml) + required: true + test-suite: + description: Name of the test-suite, eg. `openshift` + test: + description: Name of the test, eg. `smoke` + +permissions: {} + +jobs: + test: + name: Run Integration Test + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + submodules: recursive + + - name: Run Integration Test + id: test + uses: stackabletech/actions/run-integration-test@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + with: + replicated-api-token: ${{ secrets.REPLICATED_API_TOKEN }} + otlp-bearer-token: ${{ secrets.OTLP_BEARER_TOKEN }} + test-mode-input: ${{ inputs.test-runner }} + test-suite: ${{ inputs.test-suite }} + test-mode: custom + test: ${{ inputs.test }} + + - name: Send Notification + if: ${{ failure() || github.run_attempt > 1 }} + uses: stackabletech/actions/send-slack-notification@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + with: + slack-token: ${{ secrets.SLACK_INTEGRATION_TEST_TOKEN }} + failed-tests: ${{ steps.test.outputs.failed-tests }} + test-health: ${{ steps.test.outputs.health }} + test-result: ${{ steps.test.conclusion }} + channel-id: C07UYJYSMSN # notifications-integration-tests + type: integration-test diff --git a/.github/workflows/integration-test-profile.yaml b/.github/workflows/integration-test-profile.yaml new file mode 100644 index 00000000..8d5acd6f --- /dev/null +++ b/.github/workflows/integration-test-profile.yaml @@ -0,0 +1,59 @@ +--- +name: Integration Test (Profile + Schedule) + +on: + schedule: + # At 04:00 on Sunday. See: https://crontab.guru/#0_4_*_*_0 + - cron: "0 4 * * 0" + workflow_dispatch: + inputs: + test-profile: + description: Name of the test runner, eg. `smoke-latest` or `schedule` (see test/interu.yaml) + required: true + +permissions: {} + +jobs: + test: + name: Run Integration Test + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + submodules: recursive + + - name: Determine Profile + id: profile + env: + GITHUB_EVENT_NAME: ${{ github.event_name }} + PROFILE_INPUT: ${{ inputs.test-profile }} + shell: bash + run: | + if [ "$EVENT_NAME" = "schedule" ]; then + echo "PROFILE=schedule" | tee -a "$GITHUB_OUTPUT" + else + echo "PROFILE=${PROFILE_INPUT}" | tee -a "$GITHUB_OUTPUT" + fi + + - name: Run Integration Test + id: test + uses: stackabletech/actions/run-integration-test@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + with: + replicated-api-token: ${{ secrets.REPLICATED_API_TOKEN }} + otlp-bearer-token: ${{ secrets.OTLP_BEARER_TOKEN }} + test-mode-input: ${{ steps.profile.outputs.PROFILE }} + test-mode: profile + + - name: Send Notification + if: ${{ failure() || github.run_attempt > 1 }} + uses: stackabletech/actions/send-slack-notification@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + with: + slack-token: ${{ secrets.SLACK_INTEGRATION_TEST_TOKEN }} + failed-tests: ${{ steps.test.outputs.failed-tests }} + test-health: ${{ steps.test.outputs.health }} + test-result: ${{ steps.test.conclusion }} + channel-id: C07UYJYSMSN # notifications-integration-tests + type: integration-test diff --git a/.github/workflows/pr_prek.yaml b/.github/workflows/pr_prek.yaml index 5932e4bb..8444792a 100644 --- a/.github/workflows/pr_prek.yaml +++ b/.github/workflows/pr_prek.yaml @@ -17,18 +17,20 @@ env: jobs: prek: runs-on: ubuntu-latest + permissions: + contents: read steps: - name: Install host dependencies - uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0 + uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3 with: packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https version: ubuntu-latest - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false submodules: recursive fetch-depth: 0 - - uses: stackabletech/actions/run-prek@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 + - uses: stackabletech/actions/run-prek@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 with: rust: ${{ env.RUST_TOOLCHAIN_VERSION }} hadolint: ${{ env.HADOLINT_VERSION }} diff --git a/Makefile b/Makefile index ff0a814c..08214405 100644 --- a/Makefile +++ b/Makefile @@ -28,7 +28,7 @@ docker-build: docker build --force-rm --build-arg VERSION=${VERSION} -t "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-${ARCH}" -f docker/Dockerfile . ## Chart related targets -compile-chart: version crds +compile-chart: version crds crd-annotation version: cat "deploy/helm/${OPERATOR_NAME}/Chart.yaml" | yq ".version = \"${VERSION}\" | .appVersion = \"${VERSION}\"" > "deploy/helm/${OPERATOR_NAME}/Chart.yaml.new" @@ -40,6 +40,40 @@ crds: mkdir -p extra cargo run --bin stackable-"${OPERATOR_NAME}" -- crd > extra/crds.yaml +# This adds CRD metadata for artifacthub.io (AH) to Chart.yaml. +# We don't ship CRDs in our Helm charts (anymore), so we need these annotations to provide details. +# We only list the storage version as we're unsure if AH supports more than one (docs unclear). +# +# It appends a single annotation whose value is a list, one entry per CRD. +# Example: For the secret-operator that comes out as: +# +# artifacthub.io/crds: |- +# - kind: SecretClass +# version: v1alpha2 +# name: secretclasses.secrets.stackable.tech +# displayName: SecretClass +# description: A SecretClass is a cluster-global Kubernetes resource that defines ... +# - kind: TrustStore +# version: v1alpha1 +# name: truststores.secrets.stackable.tech +# displayName: TrustStore +# description: A TrustStore requests information about how to validate secrets ... +# +# The two yq expressions are split out below so it's easier to review and see what's going on. + +# READ step: turn every CRD document in extra/crds.yaml into one AH card entry. +# `[.] | map(...)` collects the documents into a list and maps each one to the format (see above) required by AH. +# The result of this is a list of these entries. +CRD_ANNOTATION_READ := [.] | map(.spec.versions |= map(select(.storage == true))) | map({"kind": .spec.names.kind, "version": .spec.versions[0].name, "name": .metadata.name, "displayName": .spec.names.kind, "description": (.spec.versions[0].schema.openAPIV3Schema.description // "")}) + +# WRITE step: Write that list to Chart.yaml as an annotation value. +# Literal block scalar so it stays readable in Chart.yaml. +CRD_ANNOTATION_WRITE := .annotations["artifacthub.io/crds"] = strenv(CRDS) | .annotations["artifacthub.io/crds"] style="literal" + +crd-annotation: crds + @CRDS="$$(yq ea -o=yaml '$(CRD_ANNOTATION_READ)' extra/crds.yaml)" \ + yq -i '$(CRD_ANNOTATION_WRITE)' "deploy/helm/${OPERATOR_NAME}/Chart.yaml" + chart-lint: compile-chart docker run -it -v $(shell pwd):/build/helm-charts -w /build/helm-charts quay.io/helmpack/chart-testing:v3.5.0 ct lint --config deploy/helm/ct.yaml diff --git a/deploy/helm/zookeeper-operator/Chart.yaml b/deploy/helm/zookeeper-operator/Chart.yaml index e0b2e528..25abb68a 100644 --- a/deploy/helm/zookeeper-operator/Chart.yaml +++ b/deploy/helm/zookeeper-operator/Chart.yaml @@ -5,6 +5,10 @@ version: "0.0.0-dev" appVersion: "0.0.0-dev" description: "Kubernetes operator for Apache ZooKeeper. Deploy and run ZooKeeper ensembles with the Stackable Data Platform (SDP)." home: https://github.com/stackabletech/zookeeper-operator +# One known use of this is the Artifact Hub (AH) listing which shows the logo. +# AH downloads the logo and re-hosts it. +# We opted to not use the project logos (e.g. the Apache Spark logo) here due to trademark concerns. +icon: https://raw.githubusercontent.com/stackabletech/zookeeper-operator/main/.readme/static/borrowed/Icon_Stackable.svg sources: - https://github.com/stackabletech/zookeeper-operator keywords: ["apache-zookeeper", "zookeeper", "coordination", "kubernetes", "operator", "big-data"] @@ -21,3 +25,14 @@ annotations: url: https://docs.stackable.tech/home/stable/zookeeper/ - name: support url: https://github.com/stackabletech/zookeeper-operator/issues + artifacthub.io/crds: |- + - kind: ZookeeperCluster + version: v1alpha1 + name: zookeeperclusters.zookeeper.stackable.tech + displayName: ZookeeperCluster + description: A ZooKeeper cluster stacklet. This resource is managed by the Stackable operator for Apache ZooKeeper. + - kind: ZookeeperZnode + version: v1alpha1 + name: zookeeperznodes.zookeeper.stackable.tech + displayName: ZookeeperZnode + description: A claim for a single ZooKeeper ZNode tree (filesystem node). diff --git a/renovate.json b/renovate.json index 486f30ab..049c0ee7 100644 --- a/renovate.json +++ b/renovate.json @@ -3,5 +3,5 @@ "extends": [ "local>stackabletech/.github:renovate-config" ], - "ignorePaths": [".github/workflows/build.yaml", ".github/workflows/general_daily_security.yml", ".github/workflows/integration-test.yml", ".github/workflows/pr_prek.yaml"] + "ignorePaths": [".github/workflows/build.yaml", ".github/workflows/general_daily_security.yml", ".github/workflows/integration-test-custom.yaml", ".github/workflows/integration-test-profile.yaml", ".github/workflows/pr_prek.yaml"] } From 1df4b089c32bcb33e3d377f5bd3b7d85c45279af Mon Sep 17 00:00:00 2001 From: Techassi Date: Wed, 12 Aug 2026 14:51:04 +0200 Subject: [PATCH 2/3] ci: Bump stackabletech/actions to v0.17.4 --- .github/workflows/build.yaml | 28 +++++++++---------- .../workflows/integration-test-custom.yaml | 4 +-- .../workflows/integration-test-profile.yaml | 4 +-- .github/workflows/pr_prek.yaml | 2 +- 4 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index e4e725c6..461afa8c 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -12,11 +12,11 @@ on: branches: - main tags: - - '[0-9][0-9].[0-9]+.[0-9]+-rc[0-9]+' - - '[0-9][0-9].[0-9]+.[0-9]+' + - "[0-9][0-9].[0-9]+.[0-9]+-rc[0-9]+" + - "[0-9][0-9].[0-9]+.[0-9]+" schedule: # Run every Saturday morning: https://crontab.guru/#15_3_*_*_6 - - cron: '15 3 * * 6' + - cron: "15 3 * * 6" pull_request: # Do not limit by paths. This workflow contains a required job. merge_group: @@ -50,7 +50,7 @@ jobs: - name: Check for changed files id: check - uses: stackabletech/actions/detect-changes@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/detect-changes@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: patterns: | - '.github/workflows/build.yaml' @@ -173,7 +173,7 @@ jobs: - name: Build Container Image id: build - uses: stackabletech/actions/build-container-image@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/build-container-image@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: image-name: ${{ env.OPERATOR_NAME }} image-index-manifest-tag: ${{ steps.version.outputs.OPERATOR_VERSION }} @@ -182,7 +182,7 @@ jobs: - name: Publish Container Image to oci.stackable.tech if: ${{ !github.event.pull_request.head.repo.fork }} - uses: stackabletech/actions/publish-image@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/publish-image@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: image-registry-uri: oci.stackable.tech image-registry-username: robot$sdp+github-action-build @@ -193,7 +193,7 @@ jobs: - name: Publish Container Image to quay.io if: ${{ !github.event.pull_request.head.repo.fork }} - uses: stackabletech/actions/publish-image@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/publish-image@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: image-registry-uri: quay.io image-registry-username: stackable+robot_sdp_github_action_build @@ -223,7 +223,7 @@ jobs: persist-credentials: false - name: Publish and Sign Image Index to oci.stackable.tech - uses: stackabletech/actions/publish-image-index-manifest@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/publish-image-index-manifest@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: image-registry-uri: oci.stackable.tech image-registry-username: robot$sdp+github-action-build @@ -232,7 +232,7 @@ jobs: image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }} - name: Publish and Sign Image Index to quay.io - uses: stackabletech/actions/publish-image-index-manifest@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/publish-image-index-manifest@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: image-registry-uri: quay.io image-registry-username: stackable+robot_sdp_github_action_build @@ -262,7 +262,7 @@ jobs: submodules: recursive - name: Package, Publish, and Sign Helm Chart to oci.stackable.tech - uses: stackabletech/actions/publish-helm-chart@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/publish-helm-chart@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: chart-registry-uri: oci.stackable.tech chart-registry-username: robot$sdp-charts+github-action-build @@ -274,7 +274,7 @@ jobs: publish-and-sign: ${{ !github.event.pull_request.head.repo.fork }} - name: Package, Publish, and Sign Helm Chart to quay.io - uses: stackabletech/actions/publish-helm-chart@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/publish-helm-chart@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: chart-registry-uri: quay.io chart-registry-username: stackable+robot_sdp_charts_github_action_build @@ -306,13 +306,13 @@ jobs: runs-on: ubuntu-latest steps: - name: Run OpenShift Preflight Check for oci.stackable.tech - uses: stackabletech/actions/run-openshift-preflight@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/run-openshift-preflight@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: image-index-uri: oci.stackable.tech/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }} image-architecture: ${{ matrix.arch }} - name: Run OpenShift Preflight Check for quay.io - uses: stackabletech/actions/run-openshift-preflight@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/run-openshift-preflight@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: image-index-uri: quay.io/stackable/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }} image-architecture: ${{ matrix.arch }} @@ -378,7 +378,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Send Notification - uses: stackabletech/actions/send-slack-notification@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/send-slack-notification@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: publish-helm-chart-result: ${{ needs.publish-helm-chart.result }} publish-manifests-result: ${{ needs.publish-index-manifest.result }} diff --git a/.github/workflows/integration-test-custom.yaml b/.github/workflows/integration-test-custom.yaml index 4683e387..bacf60a6 100644 --- a/.github/workflows/integration-test-custom.yaml +++ b/.github/workflows/integration-test-custom.yaml @@ -28,7 +28,7 @@ jobs: - name: Run Integration Test id: test - uses: stackabletech/actions/run-integration-test@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/run-integration-test@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: replicated-api-token: ${{ secrets.REPLICATED_API_TOKEN }} otlp-bearer-token: ${{ secrets.OTLP_BEARER_TOKEN }} @@ -39,7 +39,7 @@ jobs: - name: Send Notification if: ${{ failure() || github.run_attempt > 1 }} - uses: stackabletech/actions/send-slack-notification@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/send-slack-notification@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: slack-token: ${{ secrets.SLACK_INTEGRATION_TEST_TOKEN }} failed-tests: ${{ steps.test.outputs.failed-tests }} diff --git a/.github/workflows/integration-test-profile.yaml b/.github/workflows/integration-test-profile.yaml index 8d5acd6f..d205ad11 100644 --- a/.github/workflows/integration-test-profile.yaml +++ b/.github/workflows/integration-test-profile.yaml @@ -40,7 +40,7 @@ jobs: - name: Run Integration Test id: test - uses: stackabletech/actions/run-integration-test@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/run-integration-test@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: replicated-api-token: ${{ secrets.REPLICATED_API_TOKEN }} otlp-bearer-token: ${{ secrets.OTLP_BEARER_TOKEN }} @@ -49,7 +49,7 @@ jobs: - name: Send Notification if: ${{ failure() || github.run_attempt > 1 }} - uses: stackabletech/actions/send-slack-notification@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + uses: stackabletech/actions/send-slack-notification@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: slack-token: ${{ secrets.SLACK_INTEGRATION_TEST_TOKEN }} failed-tests: ${{ steps.test.outputs.failed-tests }} diff --git a/.github/workflows/pr_prek.yaml b/.github/workflows/pr_prek.yaml index 8444792a..85f5303f 100644 --- a/.github/workflows/pr_prek.yaml +++ b/.github/workflows/pr_prek.yaml @@ -30,7 +30,7 @@ jobs: persist-credentials: false submodules: recursive fetch-depth: 0 - - uses: stackabletech/actions/run-prek@b5cc0acc5287f6184551b77f3ae4a5c3e41678c4 # v0.17.3 + - uses: stackabletech/actions/run-prek@bc17d3c4808a2343685853d0d757ad7614f660d4 # v0.17.4 with: rust: ${{ env.RUST_TOOLCHAIN_VERSION }} hadolint: ${{ env.HADOLINT_VERSION }} From 54b7afa0e8c46b5809016b19d5af882f561d7f70 Mon Sep 17 00:00:00 2001 From: Techassi Date: Wed, 12 Aug 2026 14:51:28 +0200 Subject: [PATCH 3/3] ci: Remove old integration test workflow --- .github/workflows/integration-test.yml | 63 -------------------------- 1 file changed, 63 deletions(-) delete mode 100644 .github/workflows/integration-test.yml diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml deleted file mode 100644 index de17f182..00000000 --- a/.github/workflows/integration-test.yml +++ /dev/null @@ -1,63 +0,0 @@ ---- -name: Integration Test - -on: - # schedule: - # # At 00:00 on Sunday. See: https://crontab.guru/#0_0_*_*_0 - # - cron: "0 0 * * 0" - workflow_dispatch: - inputs: - test-mode: - description: Test mode - required: true - type: choice - options: - - profile - - custom - test-mode-input: - description: | - The profile or the runner used. Eg: `smoke-latest` or `amd64` (see test/interu.yaml) - required: true - test-suite: - description: Name of the test-suite. Only used if test-mode is `custom` - test: - description: Name of the test. Only used of test-mode is `custom` - -permissions: {} - -jobs: - test: - name: Run Integration Test - runs-on: ubuntu-latest - # services: - # otel-collector: - # image: ghcr.io/open-telemetry/opentelemetry-collector-releases/opentelemetry-collector-k8s:0.131.1 - # volumes: - # - .:/mnt - steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 - with: - persist-credentials: false - submodules: recursive - - # TODO: Enable the scheduled runs which hard-code what profile to use - - name: Run Integration Test - id: test - uses: stackabletech/actions/run-integration-test@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 - with: - replicated-api-token: ${{ secrets.REPLICATED_API_TOKEN }} - test-mode-input: ${{ inputs.test-mode-input }} - test-suite: ${{ inputs.test-suite }} - test-mode: ${{ inputs.test-mode }} - test: ${{ inputs.test }} - - - name: Send Notification - if: ${{ failure() || github.run_attempt > 1 }} - uses: stackabletech/actions/send-slack-notification@dc83bb926cc464f0f32454e934777116bd1c7768 # v0.16.3 - with: - slack-token: ${{ secrets.SLACK_INTEGRATION_TEST_TOKEN }} - failed-tests: ${{ steps.test.outputs.failed-tests }} - test-health: ${{ steps.test.outputs.health }} - test-result: ${{ steps.test.conclusion }} - channel-id: C07UYJYSMSN # notifications-integration-tests - type: integration-test