fix(container): update image docker.io/cloudflare/cloudflared (2026.8… #205
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json | |
| name: "E2E" | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: {} | |
| jobs: | |
| validate-invalid: | |
| if: ${{ github.repository == 'onedr0p/cluster-template' }} | |
| name: reject-invalid (${{ matrix.fixture }}) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| fixture: | |
| - overlapping-cidrs | |
| - nested-cidr-overlap | |
| - non-canonical-cidr | |
| - tiny-svc-cidr | |
| - duplicate-gateway-addrs | |
| - duplicate-node-names | |
| - reserved-node-name | |
| - bad-mac-address | |
| - bad-repo-url | |
| - missing-known-hosts | |
| - node-addr-outside-cidr | |
| - node-uses-gateway-addr | |
| - gateway-node-collision | |
| - bad-vlan-tag | |
| - bad-bgp-asn | |
| - missing-dns-token | |
| - tunnel-without-dns | |
| - missing-external-gateway | |
| - missing-schematic | |
| - partial-bgp | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Setup mise | |
| uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 | |
| env: | |
| GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" | |
| - name: Assert schema rejects ${{ matrix.fixture }}.toml | |
| run: | | |
| fixture=./.github/template-tests/invalid/${{ matrix.fixture }}.toml | |
| if uv run --quiet --locked --no-dev ./template/scripts/validate.py "$fixture" >/dev/null 2>&1; then | |
| echo "::error::schema accepted invalid fixture ${{ matrix.fixture }} (expected rejection)" | |
| exit 1 | |
| fi | |
| echo "schema correctly rejected ${{ matrix.fixture }}" | |
| # Also surface the actual error message in the log for debuggability. | |
| uv run --quiet --locked --no-dev ./template/scripts/validate.py "$fixture" || true | |
| validator-tests: | |
| if: ${{ github.repository == 'onedr0p/cluster-template' }} | |
| name: validator-tests | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Setup mise | |
| uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 | |
| env: | |
| GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" | |
| - name: Run validator tests | |
| run: uv run --quiet --locked pytest ./template/scripts/test_validate.py | |
| validate-valid: | |
| if: ${{ github.repository == 'onedr0p/cluster-template' }} | |
| name: accept-valid (${{ matrix.fixture }}) | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| fixture: | |
| - public | |
| - private | |
| - selfhosted | |
| - no-webhook | |
| - internal | |
| - direct | |
| - single-node | |
| - multi-controller | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Setup mise | |
| uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0 | |
| with: | |
| experimental: true | |
| install_args: --locked | |
| - name: Run init recipe | |
| run: just init | |
| - name: Prepare files | |
| run: | | |
| cp ./.github/template-tests/valid/${{ matrix.fixture }}.toml cluster.toml | |
| echo '{"AccountTag":"fake","TunnelSecret":"fake","TunnelID":"fake"}' > cloudflare-tunnel.json | |
| touch kubeconfig | |
| - name: Run configure recipe | |
| run: just configure | |
| # Rendered output must already match the format-yaml pre-commit hook, | |
| # otherwise every `just configure` shows up as formatting churn. | |
| - name: Assert rendered output is formatted | |
| run: oxfmt --check ./.sops.yaml ./bootstrap ./kubernetes ./talos | |
| - name: Install flate | |
| uses: home-operations/flate/action@83b2308bc71043482a2f4e849a74b0a53cc1e014 # v0.6.1 | |
| with: | |
| base: "" | |
| - name: Run flate test | |
| run: flate test all -p ./kubernetes/flux/cluster | |
| - name: Render bootstrap helmfile charts | |
| run: just template test-helmfile | |
| - name: Dry run bootstrap talos recipe | |
| run: just --dry-run bootstrap talos | |
| - name: Create talos secret | |
| run: just bootstrap talos-secret | |
| - name: Render talos configs | |
| run: just talos render | |
| - name: Validate talos configs | |
| run: | | |
| for config in ./talos/rendered/*.yaml; do | |
| talosctl validate --config "$config" --mode metal | |
| done | |
| - name: Dry run bootstrap apps recipe | |
| run: just --dry-run bootstrap apps | |
| - name: Run reset recipe | |
| run: yes | just template reset | |
| - name: Run tidy recipe | |
| run: yes | just template tidy |