Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Generate OpenVX data for every release #2276

Merged
merged 5 commits into from
Dec 19, 2023
Merged

feat: Generate OpenVX data for every release #2276

Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
376b033
Generate OpenVEX data for every release
shafeeqes Dec 15, 2023
4de960d
Address PR review feedback
shafeeqes Dec 15, 2023
0442ef3
Rename file
shafeeqes Dec 15, 2023
c11318f
Address PR review feedback
shafeeqes Dec 18, 2023
9bbed50
Address PR review feedback
shafeeqes Dec 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions .github/workflows/openvex.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
name: openvex

on:
workflow_dispatch:
push:
tags:
- 'v*.*.*'
jobs:
vexctl:
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 #v4.1.1
shafeeqes marked this conversation as resolved.
Show resolved Hide resolved
- name: Set env
shafeeqes marked this conversation as resolved.
Show resolved Hide resolved
run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm afraid running openvex for all releases would generate unnecessary noise, since we generally only maintain the latest release branches. Can we restrict this to that only? cc @mrueg

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is restricted only to a pushed tag. See line 7

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it might be better to run on release creation. https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#release

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1, better to run on releases than tags.

- uses: openvex/generate-vex@31b415924ea0d72ed5f2640f1dee59dea6c2770b
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we pin this to the latest major as well?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see openvex has not tagged any release yet. Can we pin this to the latest c59881b41451d7ccba5c3b74cd195382b8971fcd commit then?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've raised an issue regarding releases: openvex/generate-vex#2.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see openvex has not tagged any release yet. Can we pin this to the latest c59881b41451d7ccba5c3b74cd195382b8971fcd commit then?

Done.

name: Run vexctl
shafeeqes marked this conversation as resolved.
Show resolved Hide resolved
with:
product: pkg:golang/kubernetes/kube-state-metrics@${{ env.RELEASE_VERSION }}
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
product: pkg:golang/kubernetes/kube-state-metrics@${{ env.RELEASE_VERSION }}
product: pkg:golang/k8s.io/kube-state-metrics/v2@${{ env.RELEASE_VERSION }}

should this be the golang package name?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See also: https://github.com/package-url/purl-spec/blob/master/PURL-TYPES.rst#golang

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why the v2? Is it not covered by the env?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

v2 is because it expects the full name of the golang package.