Merge branch 'main' into feature/custom-test-rock-artifact-names

Author: zhijie-yang

.github/ISSUE_TEMPLATE/--onboarding.yaml

@@ -3,7 +3,7 @@ description: Request adding a new image to the OCI Factory
 labels: "onboarding"
 title: "[ONBOARDING] "
 assignees:
-  - cjdcordeiro
+  - zhijie-yang
 body:
   - type: markdown
     attributes:

.github/actions/check-trivyignore/action.yaml

@@ -0,0 +1,58 @@
+name: Check Trivyignore
+description: 'Check if the trivyignore file is up to date'
+# Reference: https://github.com/canonical/operator-workflows/blob/c68a31ba2c953765654b2c04b6a760b65f9bfe83/.github/workflows/integration_test.yaml#L305
+
+inputs:
+  image-ref:
+    description: 'The image to be scanned'
+    required: true
+  trivyignores:
+    description: 'The path to the trivyignore file'
+    required: true
+  severity:
+    description: 'The severity level to be scanned'
+    default: 'HIGH,CRITICAL'
+  skip-files:
+    description: 'The files to be skipped'
+    default: '/bin/pebble,/usr/bin/pebble'
+
+runs:
+  using: "composite" 
+  steps:
+    - name: "Detect trivy installation"
+      id: detect-trivy
+      shell: bash
+      run: |
+        if ! command -v trivy &> /dev/null
+        then
+          echo "trivy-installed=false" >> $GITHUB_OUTPUT
+        else
+          echo "trivy-installed=true" >> $GITHUB_OUTPUT
+        fi
+
+    - name: "Install trivy if not present"
+      if: ${{ steps.detect-trivy.outputs.trivy-installed == 'false' }}
+      uses: aquasecurity/setup-trivy@v0.2.4
+
+    - name: "Check unnecessary trivyignore entries"
+      shell: bash
+      run: |
+        if [ -f "${{ inputs.trivyignores }}" ]
+          then
+            json_output=$(trivy image ${{ inputs.image-ref }} --severity ${{ inputs.severity }} -q \
+                      -f json --ignorefile "" --skip-files ${{ inputs.skip-files }} --exit-code 0)
+            output=$(echo $json_output | jq -r '.Results[] | .Vulnerabilities | try to_entries[] | .value.VulnerabilityID' \
+                    2>/dev/null \
+                    || echo "No vulnerabilities found")
+            line=0
+            while read CVE;
+            do
+              line=$(( line + 1 ))
+              if [[ "$output" != *"$CVE"* && ! "$CVE" =~ ^#.* ]]
+              then
+              echo "::notice file=${{ inputs.trivyignores }},line=${line}::$CVE not present anymore, can be safely removed."
+              fi
+            done < ${{ inputs.trivyignores }}
+          else
+            echo "::warning::File ${{ inputs.trivyignores }} not found."
+          fi

.github/actions/checkout/action.yaml

@@ -15,9 +15,6 @@ inputs:
   submodules: 
     description: 'Whether to checkout submodules. true|false|recursive according to actions/checkout@v4'
     default: 'false'
-  github-server-url: 
-    description: 'The base URL for the GitHub instance that you are trying to clone from'
-    default: 'https://github.com'
   token:
     description: "Github token for pulling from private repositories"
     default: ''
@@ -26,17 +23,17 @@ inputs:
 runs:
   using: "composite" 
   steps:
+
+    - uses: actions/setup-python@v5
+      with:
+        python-version: "3.x"
+
     - name: Checkout
       shell: bash
       run: |
         
         # If URL lacks the protocol, assume it is a github repo 
-        if [[ "${{ inputs.repository }}" =~ https?:// ]]
-        then
-          git_url="${{ inputs.repository }}"
-        else
-          git_url="${{ inputs.github-server-url }}/${{ inputs.repository }}.git"
-        fi
+        git_url="$(python3 ./src/shared/source_url.py "${{ inputs.repository }}")"
 
         # if a token is provided, use it
         if ! [[ -z "${{ inputs.token }}" ]]; then

.github/actions/commit-releases-json/action.yaml

@@ -0,0 +1,58 @@
+name: Commit Releases JSON
+description: Commits the _releases.json file to the current repository.
+
+inputs:
+  image-name:
+    description: 'OCI image name to fetch the releases JSON for'
+    required: true
+  releases-branch:
+    description: 'Branch where the _releases.json file is located'
+    required: false
+    default: '_releases'
+  directory:
+    description: 'Directory where the _releases branch of the OCI Factory is checked out'
+    default: oci-factory-releases
+    required: false
+  message:
+    description: 'Commit message for the changes made to _releases.json'
+    required: true
+  email:
+    description: 'Email address to use for the commit author'
+    required: true
+  actor:
+    description: 'GitHub actor to use for the commit author'
+    default: ${{ github.actor }}
+  force:
+    description: 'Force push the changes to the branch'
+    required: false
+    default: '0'
+
+runs:
+  using: "composite"
+  steps:
+    - name: commit _releases.json
+      shell: bash
+      run: |
+        if [[ "$RUNNER_DEBUG" == "1" ]]; then
+          set -x
+        fi
+
+        if [ "${{ inputs.force }}" != "0" ]; then
+          FORCE='--force'
+        fi
+
+        cd ${{ inputs.directory }}
+
+        git config user.email "${{ inputs.email }}"
+        git config user.name "${{ inputs.actor }}"
+
+        git add oci/${{ inputs.image-name }}/_releases.json
+        git commit -m "${{ inputs.message }}"
+        
+        git branch actions-temp-branch
+        git fetch origin ${{ inputs.releases-branch }}
+        git checkout ${{ inputs.releases-branch }}
+        git merge actions-temp-branch
+        git branch -d actions-temp-branch
+
+        git push origin ${{ inputs.releases-branch }} $FORCE

.github/actions/fetch-releases-json/action.yaml

@@ -0,0 +1,42 @@
+name: Fetch Releases JSON
+description: Fetches the _releases.json file to the current repository.
+
+inputs:
+  image-name:
+    description: 'OCI image name to fetch the releases JSON for'
+    required: true
+  releases-branch:
+    description: 'Branch where the _releases.json file is located'
+    required: false
+    default: '_releases'
+  directory:
+    description: 'Directory where the _releases branch of the OCI Factory is checked out'
+    default: oci-factory-releases
+
+
+
+runs:
+  using: "composite"
+  steps:
+    - name: Fetch _releases.json
+      uses: actions/checkout@v4
+      with:
+        repository: canonical/oci-factory
+        path: ${{ inputs.directory }}
+        ref: ${{ inputs.releases-branch }}
+
+    - name: Copy _releases.json
+      shell: bash
+      run: |
+        if [[ "$RUNNER_DEBUG" == "1" ]]; then
+          set -x
+        fi
+
+        if [[ "${{ inputs.image-name }}" = "*" ]]; then
+          echo "Copying all _releases.json files"
+          cd ${{ inputs.directory }}
+          find . -name "_releases.json" -exec cp --parents {} $OLDPWD \;
+          cd $OLDPWD
+        elif [[ -f "${{ inputs.directory }}/oci/${{ inputs.image-name }}/_releases.json" ]]; then
+          cp ${{ inputs.directory }}/oci/${{ inputs.image-name }}/_releases.json oci/${{ inputs.image-name }}/_releases.json
+        fi

.github/actions/install-umoci/action.yaml

@@ -0,0 +1,21 @@
+name: Install umoci
+description: Reusable action that installs umoci
+
+inputs:
+  umoci-version:
+    description: The version of umoci to install
+    default: "v0.4.7"
+  umoci-binary:
+    description: The name of the umoci binary to install
+    default: "umoci.amd64"
+
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install umoci
+      shell: bash
+      run: |
+        wget https://github.com/opencontainers/umoci/releases/download/${{ inputs.umoci-version }}/${{ inputs.umoci-binary }}
+        sudo mv ${{ inputs.umoci-binary }} /usr/bin/umoci
+        sudo chmod +x /usr/bin/umoci

.github/actions/validate-actor/action.yaml

@@ -34,5 +34,6 @@ runs:
       env:
         GITHUB_TOKEN: ${{ github.token }}
       run: |
-        echo "The workflow is not triggered by a permitted user. Cancelling the workflow."
+        source src/shared/logs.sh
+        log_error "The workflow is not triggered by a permitted user. Cancelling the workflow."
         gh run cancel ${{ github.run_id }}

.github/actions/validate-actor/test-validate-actor.bats

@@ -15,32 +15,32 @@ setup() {
     exit_status=$?
   } || true
   [[ $exit_status -eq 1 ]]
-  [[ $(echo "${output}"| tail -n 1) = "The workflow is triggered by a user neither as a code owner nor a maintainer of the image img" ]]
+  [[ $(echo "${output}" | tail -n 1) =~ "The workflow is triggered by a user neither as a code owner nor a maintainer of the image img" ]]
 }
 
 @test "allows code owner" {
   output=$(${BATS_TEST_DIRNAME}/validate-actor.sh "code-owner" "true" $workdir "img" 2>&1)
-  [[ $(echo "${output}"| tail -n 1) = "The workflow is triggered by code-owner as the code owner" ]]
+  [[ $(echo "${output}" | tail -n 1) =~ "The workflow is triggered by code-owner as the code owner" ]]
 }
 
 @test "allows image maintainer" {
   output=$(${BATS_TEST_DIRNAME}/validate-actor.sh "maintainer" "true" $workdir "img")
-  [[ $(echo "${output}"| tail -n 1) = "The workflow is triggered by maintainer as a maintainer of the image img" ]]
+  [[ $(echo "${output}" | tail -n 1) =~ "The workflow is triggered by maintainer as a maintainer of the image img" ]]
 }
 
 @test "allows non-code-owner-non-maintainer user" {
   output=$(${BATS_TEST_DIRNAME}/validate-actor.sh "random" "false" $workdir "img")
-  [[ $(echo "${output}"| tail -n 1) = "The workflow is not restricted to non-code-owner or non-maintainer users" ]]
+  [[ $(echo "${output}" | tail -n 1) =~ "The workflow is not restricted to non-code-owner or non-maintainer users" ]]
 }
 
 @test "user as both code-owner and maintainer is triggered as code owner" {
   echo -n " @maintainer" >> $workdir/CODEOWNERS
   output=$(${BATS_TEST_DIRNAME}/validate-actor.sh "maintainer" "true" $workdir "img")
-  [[ $(echo "${output}"| tail -n 1) = "The workflow is triggered by maintainer as the code owner" ]]
+  [[ $(echo "${output}" | tail -n 1) =~ "The workflow is triggered by maintainer as the code owner" ]]
 }
 
 @test "teams are expanded to team members" {
   echo -n "@canonical/rocks" >> $workdir/CODEOWNERS
   output=$(${BATS_TEST_DIRNAME}/validate-actor.sh "ROCKsBot" "true" $workdir "img")
-  [[ $(echo "${output}"| tail -n 1) = "The workflow is triggered by ROCKsBot as the code owner" ]]
+  [[ $(echo "${output}" | tail -n 1) =~ "The workflow is triggered by ROCKsBot as the code owner" ]]
 }

.github/actions/validate-actor/validate-actor.sh

@@ -1,16 +1,18 @@
 #!/bin/bash -e
 
+source $(dirname $0)/../../../src/shared/logs.sh
+
 actor=$1
 admin_only=$2
 workspace=$3
 image_path=$4
 
-echo "github.actor: ${actor}"
+log_debug "github.actor: ${actor}"
 actor=$(echo "$actor" | sed 's/\[/\\[/g;s/\]/\\]/g') # Escape square brackets for actors like renovate[bot]
-echo "admin-only: ${admin_only}"
+log_debug "admin-only: ${admin_only}"
 if [[ ${admin_only} == true ]]; then
     exit_status=0
-    echo "Expanding team mentions in the CODEOWNERS file"
+    log_debug "Expanding team mentions in the CODEOWNERS file"
     codeowners_file=$(mktemp)
     cp ${workspace}/CODEOWNERS ${codeowners_file}
     teams=$(grep -oE '@[[:alnum:]_.-]+\/[[:alnum:]_.-]+' ${codeowners_file} || true | sort | uniq)
@@ -24,14 +26,14 @@ if [[ ${admin_only} == true ]]; then
     done
 
     if grep -wq "@${actor}" ${codeowners_file}; then
-        echo "The workflow is triggered by ${actor} as the code owner"
+        log_info "The workflow is triggered by ${actor} as the code owner"
     elif cat ${workspace}/${image_path}/contacts.yaml | yq ".maintainers" | grep "\- " | grep -wq "${actor}"; then
-        echo "The workflow is triggered by ${actor} as a maintainer of the image ${image_path}"
+        log_info "The workflow is triggered by ${actor} as a maintainer of the image ${image_path}"
     else
-        echo "The workflow is triggered by a user neither as a code owner nor a maintainer of the image ${image_path}"
+        log_info "The workflow is triggered by a user neither as a code owner nor a maintainer of the image ${image_path}"
         exit_status=1
     fi
     exit ${exit_status}
 else
-    echo "The workflow is not restricted to non-code-owner or non-maintainer users"
+    log_info "The workflow is not restricted to non-code-owner or non-maintainer users"
 fi