Skip to content
Draft
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 87 additions & 0 deletions .github/actions/setup-tackle/action.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,87 @@
name: 'Setup Tackle'
description: 'Install and configure Tackle on a Kind cluster'
author: 'Konveyor'

inputs:
command:
description: 'Command to run (install, status, uninstall)'
required: true
default: 'install'

auth:
description: 'Enable Keycloak authentication'
required: false
default: 'false'

port:
description: 'Host port for HTTP ingress'
required: false
default: '8080'

tls-port:
description: 'Host port for HTTPS ingress'
required: false
default: '8443'

cluster-name:
description: 'Kind cluster name'
required: false
default: 'tackle-test'

# Image overrides
hub-image:
description: 'Hub image (HUB env var)'
required: false

analyzer-image:
description: 'Analyzer addon image (ANALYZER_ADDON env var)'
required: false

csharp-provider-image:
description: 'C# provider image (CSHARP_PROVIDER_IMG env var)'
required: false

generic-provider-image:
description: 'Generic provider image (GENERIC_PROVIDER_IMG env var)'
required: false

java-provider-image:
description: 'Java provider image (JAVA_PROVIDER_IMG env var)'
required: false

discovery-image:
description: 'Discovery addon image (DISCOVERY_ADDON env var)'
required: false

platform-image:
description: 'Platform addon image (PLATFORM_ADDON env var)'
required: false

runs:
using: 'composite'
steps:

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are missing I think a step around downloading and setting the images up. and example is:

https://github.com/konveyor/ci/blob/main/koncur-tackle-hub/check_images.sh
and
load_img.sh

Might be worth moving these out of that action and into this action, if the koncur-tackle actions is going to use this action.

I use them here: to get the images into the kind cluster: https://github.com/konveyor/ci/blob/main/koncur-tackle-hub/action.yml#L66-L71

Hope that helps

- name: Make tackle.sh executable
shell: bash
run: chmod +x ${{ github.action_path }}/../../../scripts/tackle.sh

- name: Run tackle.sh ${{ inputs.command }}
shell: bash
env:
HUB: ${{ inputs.hub-image }}
ANALYZER_ADDON: ${{ inputs.analyzer-image }}
CSHARP_PROVIDER_IMG: ${{ inputs.csharp-provider-image }}
GENERIC_PROVIDER_IMG: ${{ inputs.generic-provider-image }}
JAVA_PROVIDER_IMG: ${{ inputs.java-provider-image }}
DISCOVERY_ADDON: ${{ inputs.discovery-image }}
PLATFORM_ADDON: ${{ inputs.platform-image }}
run: |
args=""

if [ "${{ inputs.command }}" = "install" ]; then
args="$args --auth=${{ inputs.auth }}"
args="$args --port=${{ inputs.port }}"
args="$args --tlsPort=${{ inputs.tls-port }}"
args="$args --cluster=${{ inputs.cluster-name }}"
fi

${{ github.action_path }}/../../../scripts/tackle.sh ${{ inputs.command }} $args
File renamed without changes.
File renamed without changes.
52 changes: 52 additions & 0 deletions .github/workflows/test-tackle.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
name: Tackle Setup + Status + Teardown

on:
pull_request:
types: [opened, synchronize, reopened]
paths:
- 'scripts/tackle.sh'
- '.github/actions/setup-tackle/action.yaml'
- '.github/workflows/test-tackle.yaml'

workflow_dispatch:

jobs:

build-images:
uses: konveyor/ci/.github/workflows/e2e-image-build.yaml@main
with:
repo: ${{ github.repository }}
ref: main
secrets: inherit
Comment on lines +15 to +20

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

Does GitHub Actions support secrets: inherit when a workflow in one repository owner or organization calls a reusable workflow from a different owner or organization?

💡 Result:

No, GitHub Actions does not support secrets: inherit when a workflow in one repository owner or organization calls a reusable workflow from a different owner or organization. The secrets: inherit keyword is explicitly limited to calls within the same organization or enterprise. Official GitHub documentation states: "Workflows that call reusable workflows in the same organization or enterprise can use the inherit keyword to implicitly pass the secrets." Examples use the same organization prefix (e.g., octo-org/example-repo). For cross-organization calls, secrets must be passed explicitly by name in the secrets object, and the reusable workflow must declare them in on.workflow_call.secrets. Organization-level secrets from the reusable workflow's repository are not accessible; only the caller's secrets can be passed. As of 2026-03-20, no updates enable cross-org inheritance, per docs and discussions.

Citations:


secrets: inherit does not work across different repository owners—registry credentials will not be passed to the called workflow.

GitHub Actions only supports secrets: inherit for reusable workflows called within the same organization or enterprise. This call crosses owners (konveyor/cijortel/tackle2-hub), so inherited secrets are not accessible to the called workflow. Pass required secrets explicitly by name in the secrets object.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/test-tackle.yaml around lines 8 - 10, The reusable
workflow call under the build-images job uses "uses: jortel/tackle2-hub/..."
with "secrets: inherit", which won't forward secrets across repository owners;
replace the inherit usage by listing the required secrets explicitly in a
secrets mapping (e.g., provide DOCKER_USERNAME, DOCKER_PASSWORD, REGISTRY_TOKEN,
or whichever registry/GHA secrets the called workflow expects) so the called
workflow receives credentials; update the build-images job's secrets stanza to
enumerate those secret names instead of using inherit.


test-tackle:
needs: build-images
runs-on: ubuntu-24.04
timeout-minutes: 25

strategy:
matrix:
auth: [false, true]
fail-fast: false

steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Install Tackle (${{ matrix.auth && 'with auth' || 'without auth' }})
uses: ./.github/actions/setup-tackle
with:
command: install
auth: ${{ matrix.auth }}

- name: Show Tackle status
uses: ./.github/actions/setup-tackle
with:
command: status

- name: Teardown Tackle
if: always()
uses: ./.github/actions/setup-tackle
with:
command: uninstall

Loading
Loading