fix:CR-22268-vuln-fix #856

Workflow file for this run

.github/workflows/ci-build.yaml at 892244f

	name: Integration tests
	on:
	push:
	branches:
	# - 'master'
	- "release-*"
	- "!release-1.4"
	- "!release-1.5"
	pull_request:
	branches:
	# - 'master'
	- "release-*" # Codefresh change instead of `master`

	env:
	# Golang version to use across CI steps
	GOLANG_VERSION: '1.19'

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	check-go:
	name: Ensure Go modules synchronicity
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
	- name: Setup Golang
	uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
	with:
	go-version: ${{ env.GOLANG_VERSION }}
	- name: Download all Go modules
	run: \|
	go mod download
	- name: Check for tidyness of go.mod and go.sum
	run: \|
	go mod tidy
	git diff --exit-code -- .

	build-go:
	name: Build & cache Go code
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
	- name: Setup Golang
	uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
	with:
	go-version: ${{ env.GOLANG_VERSION }}
	- name: Restore go build cache
	uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
	with:
	path: ~/.cache/go-build
	key: ${{ runner.os }}-go-build-v1-${{ github.run_id }}
	- name: Download all Go modules
	run: \|
	go mod download
	- name: Compile all packages
	run: make build-local

	lint-go:
	name: Lint Go code
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2.7.0
	- name: Setup Golang
	uses: actions/setup-go@0caeaed6fd66a828038c2da3c0f662a42862658f # v1.1.3
	with:
	go-version: ${{ env.GOLANG_VERSION }}
	- name: Run golangci-lint
	uses: golangci/golangci-lint-action@639cd343e1d3b897ff35927a75193d57cfcba299 # v3.6.0
	with:
	version: v1.46.2
	args: --timeout 10m --exclude SA5011 --verbose

	test-go:
	name: Run unit tests for Go packages
	runs-on: ubuntu-latest
	needs:
	- build-go
	env:
	GITHUB_TOKEN: ${{ secrets.E2E_TEST_GITHUB_TOKEN \|\| secrets.GITHUB_TOKEN }}
	GITLAB_TOKEN: ${{ secrets.E2E_TEST_GITLAB_TOKEN }}
	steps:
	- name: Create checkout directory
	run: mkdir -p ~/go/src/github.com/argoproj
	- name: Checkout code
	uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
	- name: Create symlink in GOPATH
	run: ln -s $(pwd) ~/go/src/github.com/argoproj/argo-cd
	- name: Setup Golang
	uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
	with:
	go-version: ${{ env.GOLANG_VERSION }}
	- name: Install required packages
	run: \|
	sudo apt-get install git -y
	- name: Switch to temporal branch so we re-attach head
	run: \|
	git switch -c temporal-pr-branch
	git status
	- name: Fetch complete history for blame information
	run: \|
	git fetch --prune --no-tags --depth=1 origin +refs/heads/:refs/remotes/origin/
	- name: Add ~/go/bin to PATH
	run: \|
	echo "/home/runner/go/bin" >> $GITHUB_PATH
	- name: Add /usr/local/bin to PATH
	run: \|
	echo "/usr/local/bin" >> $GITHUB_PATH
	- name: Restore go build cache
	uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
	with:
	path: ~/.cache/go-build
	key: ${{ runner.os }}-go-build-v1-${{ github.run_id }}
	- name: Install all tools required for building & testing
	run: \|
	make install-test-tools-local
	- name: Setup git username and email
	run: \|
	git config --global user.name "John Doe"
	git config --global user.email "[email protected]"
	- name: Download and vendor all required packages
	run: \|
	go mod download
	- name: Run all unit tests
	run: make test-local
	- name: Generate code coverage artifacts
	uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
	with:
	name: code-coverage
	path: coverage.out
	- name: Generate test results artifacts
	uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
	with:
	name: test-results
	path: test-results/

	test-go-race:
	name: Run unit tests with -race, for Go packages
	runs-on: ubuntu-latest
	needs:
	- build-go
	env:
	GITHUB_TOKEN: ${{ secrets.E2E_TEST_GITHUB_TOKEN \|\| secrets.GITHUB_TOKEN }}
	GITLAB_TOKEN: ${{ secrets.E2E_TEST_GITLAB_TOKEN }}
	steps:
	- name: Create checkout directory
	run: mkdir -p ~/go/src/github.com/argoproj
	- name: Checkout code
	uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
	- name: Create symlink in GOPATH
	run: ln -s $(pwd) ~/go/src/github.com/argoproj/argo-cd
	- name: Setup Golang
	uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
	with:
	go-version: ${{ env.GOLANG_VERSION }}
	- name: Install required packages
	run: \|
	sudo apt-get install git -y
	- name: Switch to temporal branch so we re-attach head
	run: \|
	git switch -c temporal-pr-branch
	git status
	- name: Fetch complete history for blame information
	run: \|
	git fetch --prune --no-tags --depth=1 origin +refs/heads/:refs/remotes/origin/
	- name: Add ~/go/bin to PATH
	run: \|
	echo "/home/runner/go/bin" >> $GITHUB_PATH
	- name: Add /usr/local/bin to PATH
	run: \|
	echo "/usr/local/bin" >> $GITHUB_PATH
	- name: Restore go build cache
	uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
	with:
	path: ~/.cache/go-build
	key: ${{ runner.os }}-go-build-v1-${{ github.run_id }}
	- name: Install all tools required for building & testing
	run: \|
	make install-test-tools-local
	- name: Setup git username and email
	run: \|
	git config --global user.name "John Doe"
	git config --global user.email "[email protected]"
	- name: Download and vendor all required packages
	run: \|
	go mod download
	- name: Run all unit tests
	run: make test-race-local
	- name: Generate test results artifacts
	uses: actions/upload-artifact@82c141cc518b40d92cc801eee768e7aafc9c2fa2 # v2.3.1
	with:
	name: race-results
	path: test-results/

	codegen:
	name: Check changes to generated code
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
	- name: Setup Golang
	uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
	with:
	go-version: ${{ env.GOLANG_VERSION }}
	- name: Create symlink in GOPATH
	run: \|
	mkdir -p ~/go/src/github.com/argoproj
	cp -a ../argo-cd ~/go/src/github.com/argoproj
	- name: Add ~/go/bin to PATH
	run: \|
	echo "/home/runner/go/bin" >> $GITHUB_PATH
	- name: Add /usr/local/bin to PATH
	run: \|
	echo "/usr/local/bin" >> $GITHUB_PATH
	- name: Download & vendor dependencies
	run: \|
	# We need to vendor go modules for codegen yet
	go mod download
	go mod vendor -v
	working-directory: /home/runner/go/src/github.com/argoproj/argo-cd
	- name: Install toolchain for codegen
	run: \|
	make install-codegen-tools-local
	make install-go-tools-local
	working-directory: /home/runner/go/src/github.com/argoproj/argo-cd
	- name: Run codegen
	run: \|
	set -x
	export GOPATH=$(go env GOPATH)
	git checkout -- go.mod go.sum
	make codegen-local
	working-directory: /home/runner/go/src/github.com/argoproj/argo-cd
	- name: Check nothing has changed
	run: \|
	set -xo pipefail
	git diff --exit-code -- . ':!go.sum' ':!go.mod' ':!assets/swagger.json' \| tee codegen.patch
	working-directory: /home/runner/go/src/github.com/argoproj/argo-cd

	build-ui:
	name: Build, test & lint UI code
	runs-on: ubuntu-latest
	steps:
	- name: Checkout code
	uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
	- name: Setup NodeJS
	uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6
	with:
	node-version: "12.22.0"
	- name: Restore node dependency cache
	id: cache-dependencies
	uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
	with:
	path: ui/node_modules
	key: ${{ runner.os }}-node-dep-v2-${{ hashFiles('**/yarn.lock') }}
	- name: Install node dependencies
	run: \|
	cd ui && yarn install --frozen-lockfile --ignore-optional --non-interactive
	- name: Build UI code
	run: \|
	yarn test
	yarn build
	env:
	NODE_ENV: production
	NODE_ONLINE_ENV: online
	HOST_ARCH: amd64
	working-directory: ui/
	- name: Run ESLint
	run: yarn lint
	working-directory: ui/

	analyze:
	name: Process & analyze test artifacts
	runs-on: ubuntu-latest
	needs:
	- test-go
	- build-ui
	env:
	sonar_secret: ${{ secrets.SONAR_TOKEN }}
	steps:
	- name: Checkout code
	uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
	with:
	fetch-depth: 0
	- name: Restore node dependency cache
	id: cache-dependencies
	uses: actions/cache@88522ab9f39a2ea568f7027eddc7d8d8bc9d59c8 # v3.3.1
	with:
	path: ui/node_modules
	key: ${{ runner.os }}-node-dep-v2-${{ hashFiles('**/yarn.lock') }}
	- name: Remove other node_modules directory
	run: \|
	rm -rf ui/node_modules/argo-ui/node_modules
	- name: Create test-results directory
	run: \|
	mkdir -p test-results
	- name: Get code coverage artifiact
	uses: actions/download-artifact@cbed621e49e4c01b044d60f6c80ea4ed6328b281 # v2.1.1
	with:
	name: code-coverage
	- name: Get test result artifact
	uses: actions/download-artifact@cbed621e49e4c01b044d60f6c80ea4ed6328b281 # v2.1.1
	with:
	name: test-results
	path: test-results
	- name: Upload code coverage information to codecov.io
	uses: codecov/codecov-action@29386c70ef20e286228c72b668a06fd0e8399192 # v1.5.2
	with:
	file: coverage.out
	- name: Perform static code analysis using SonarCloud
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
	SCANNER_VERSION: 4.2.0.1873
	SCANNER_PATH: /tmp/cache/scanner
	OS: linux
	run: \|
	# We do not use the provided action, because it does contain an old
	# version of the scanner, and also takes time to build.
	set -e
	mkdir -p ${SCANNER_PATH}
	export SONAR_USER_HOME=${SCANNER_PATH}/.sonar
	if [[ ! -x "${SCANNER_PATH}/sonar-scanner-${SCANNER_VERSION}-${OS}/bin/sonar-scanner" ]]; then
	curl -Ol https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-${SCANNER_VERSION}-${OS}.zip
	unzip -qq -o sonar-scanner-cli-${SCANNER_VERSION}-${OS}.zip -d ${SCANNER_PATH}
	fi

	chmod +x ${SCANNER_PATH}/sonar-scanner-${SCANNER_VERSION}-${OS}/bin/sonar-scanner
	chmod +x ${SCANNER_PATH}/sonar-scanner-${SCANNER_VERSION}-${OS}/jre/bin/java

	# Explicitly set NODE_MODULES
	export NODE_MODULES=${PWD}/ui/node_modules
	export NODE_PATH=${PWD}/ui/node_modules

	${SCANNER_PATH}/sonar-scanner-${SCANNER_VERSION}-${OS}/bin/sonar-scanner
	if: env.sonar_secret != ''

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix:CR-22268-vuln-fix #856

Workflow file

fix:CR-22268-vuln-fix #856

Jobs

Run details

Workflow file for this run