chore(deps): update module github.com/sigstore/timestamp-authority/v2 to v2.1.0 [security] (release-2.4) #472
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - release-* | |
| pull_request: {} | |
| workflow_dispatch: {} | |
| permissions: | |
| contents: read | |
| env: | |
| # We can't run a step 'if secrets.FOO != ""' but we can run a step | |
| # 'if env.FOO' != ""', so we copy secrets to env vars for conditional checks. | |
| AWS_USR: ${{ secrets.AWS_USR }} | |
| jobs: | |
| check-diff: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31 | |
| - name: Setup Cachix | |
| uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16 | |
| with: | |
| name: crossplane | |
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - name: Verify Generated Code | |
| run: nix build .#checks.x86_64-linux.generate --print-build-logs | |
| lint: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31 | |
| - name: Setup Cachix | |
| uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16 | |
| with: | |
| name: crossplane | |
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - name: Lint | |
| run: nix build .#checks.x86_64-linux.go-lint --print-build-logs | |
| codeql: | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| security-events: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31 | |
| - name: Setup Cachix | |
| uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16 | |
| with: | |
| name: crossplane | |
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - name: Setup Nix Environment | |
| uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1 | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 | |
| with: | |
| languages: go | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 | |
| unit-tests: | |
| runs-on: ubuntu-24.04 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31 | |
| - name: Setup Cachix | |
| uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16 | |
| with: | |
| name: crossplane | |
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - name: Run Unit Tests | |
| run: nix build .#checks.x86_64-linux.test --print-build-logs | |
| - name: Publish Unit Test Coverage | |
| uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5 | |
| with: | |
| flags: unittests | |
| file: result/coverage.txt | |
| token: ${{ secrets.CODECOV_TOKEN }} | |
| # Build all artifacts | |
| build-artifacts: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-24.04 | |
| outputs: | |
| version: ${{ steps.set-version.outputs.version }} | |
| steps: | |
| - name: Cleanup Disk | |
| uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 | |
| with: | |
| android: true | |
| dotnet: true | |
| haskell: true | |
| tool-cache: true | |
| swap-storage: false | |
| large-packages: false | |
| docker-images: false | |
| - name: Checkout | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Nix | |
| uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31 | |
| - name: Setup Cachix | |
| uses: cachix/cachix-action@3ba601ff5bbb07c7220846facfa2cd81eeee15a1 # v16 | |
| with: | |
| name: crossplane | |
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| # Set buildVersion in flake.nix. The version is an input to the build. | |
| # Pure (sandboxed, reproducible) Nix build inputs can only come from git | |
| # tracked files, so we set it in flake.nix before building. | |
| - name: Set Version | |
| id: set-version | |
| run: | | |
| VERSION=$(git describe --dirty --always --tags | sed 's/-/./2g') | |
| echo "VERSION=$VERSION" >> "$GITHUB_ENV" | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| sed -i "s|buildVersion = null;|buildVersion = \"$VERSION\";|" flake.nix | |
| - name: Build Artifacts | |
| run: nix build .#release --option warn-dirty false --print-build-logs | |
| - name: Upload Artifacts | |
| uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6 | |
| with: | |
| name: output | |
| path: result/** | |
| - name: Push Artifacts to S3 | |
| if: (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release-')) && env.AWS_USR != '' | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_USR }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_PSW }} | |
| AWS_DEFAULT_REGION: us-east-1 | |
| run: nix run --option warn-dirty false .#push-artifacts -- "${GITHUB_REF##*/}" | |
| - name: Promote Artifacts to Master Channel | |
| if: github.ref == 'refs/heads/main' && env.AWS_USR != '' | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.AWS_USR }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_PSW }} | |
| AWS_DEFAULT_REGION: us-east-1 | |
| run: nix run --option warn-dirty false .#promote-artifacts -- main "$VERSION" master | |
| # Validate our generated docs. | |
| validate-docs: | |
| permissions: | |
| contents: read | |
| runs-on: ubuntu-24.04 | |
| needs: [build-artifacts] | |
| steps: | |
| - name: Checkout crossplane/docs | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 | |
| with: | |
| repository: crossplane/docs | |
| persist-credentials: false | |
| path: ./docs | |
| - name: Download Artifacts | |
| uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4 | |
| with: | |
| name: output | |
| path: . | |
| - name: Generate docs | |
| run: | | |
| chmod +x ./bin/linux_amd64/crossplane | |
| ./bin/linux_amd64/crossplane config set features.enableAlpha true | |
| ./bin/linux_amd64/crossplane generate-docs -o ./docs/content/cli/master/command-reference.md | |
| - name: Run Vale | |
| uses: vale-cli/vale-action@85f9f7f2c5f449ac0ae5b66662961bae3f77ca6a # 2.1.2 | |
| with: | |
| version: "3.14.2" | |
| files: ./docs/content/cli/master/command-reference.md | |
| vale_flags: "--config=./docs/utils/vale/.vale.ini" | |
| fail_on_error: true | |
| reporter: local | |
| filter_mode: nofilter | |
| - name: Show generated docs on failure | |
| if: ${{ failure() }} | |
| run: | | |
| cat ./docs/content/cli/master/command-reference.md | |
| # If we're running on main, create a PR to update the "master" version of | |
| # the reference docs on docs.crossplane.io, which should always reflect | |
| # the current main build. | |
| # | |
| # To reduce noise, avoid creating a docs update PR if only the version | |
| # number has changed. We assume a diffstat of +1/-1 is just a version | |
| # number change. | |
| - name: Find docs changes | |
| if: ${{ github.ref == 'refs/heads/main' }} | |
| id: find-changes | |
| run: | | |
| cd docs | |
| diffstat=$(git diff --numstat content/cli/master/command-reference.md) | |
| added=$(echo "$diffstat" | awk '{ print $1 }') | |
| deleted=$(echo "$diffstat" | awk '{ print $2 }') | |
| changed="false" | |
| if [[ ${added} -ne 1 || ${deleted} -ne 1 ]]; then | |
| changed="true" | |
| fi | |
| echo "changed=${changed}" >> "$GITHUB_OUTPUT" | |
| - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2 | |
| if: ${{ github.ref == 'refs/heads/main' && steps.find-changes.outputs.changed == 'true' }} | |
| id: generate-token | |
| with: | |
| app-id: ${{ secrets.CLI_DOCS_BOT_APP_ID }} | |
| private-key: ${{ secrets.CLI_DOCS_BOT_APP_PRIVATE_KEY }} | |
| owner: crossplane | |
| repositories: docs | |
| - name: Create docs PR | |
| if: ${{ github.ref == 'refs/heads/main' && steps.find-changes.outputs.changed == 'true' }} | |
| uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7 | |
| with: | |
| token: ${{ steps.generate-token.outputs.token }} | |
| path: ./docs | |
| commit-message: Update master CLI reference docs for ${{ needs.build-artifacts.outputs.version }} | |
| author: cli-docs-bot <info@crossplane.io> | |
| signoff: true | |
| title: Update master CLI reference docs for ${{ needs.build-artifacts.outputs.version }} | |
| # We use a static branch name so that if an existing PR is already | |
| # open it gets updated, rather than opening a sequence of PRs of which | |
| # it makes sense to merge only the most recent. | |
| branch: auto-update-cli-docs | |
| add-paths: content/cli/master/command-reference.md |