Upsync (for later)

.github/dependabot.yaml

@@ -0,0 +1,72 @@
+version: 2
+updates:
+  - package-ecosystem: "gomod"
+    directory: "/balancer"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      golang-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "gomod"
+    directory: "/cleaner"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      golang-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "gomod"
+    directory: "/progress-watchdog"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      golang-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: "npm"
+    directory: "/balancer/ui"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      npm-dependencies:
+        patterns:
+          - "*"
+        dependency-type: "development"
+        update-types:
+          - "minor"
+          - "patch"
+      npm-dev-dependencies:
+        patterns:
+          - "*"
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "chore"
+      include: "scope"
+    groups:
+      docker-dependencies:
+        patterns:
+          - "*"

.github/release.yml

@@ -0,0 +1,17 @@
+changelog:
+  categories:
+    - title: "🚀 Features"
+      labels:
+        - "feature"
+        - "enhancement"
+    - title: "🐛 Bug Fixes"
+      labels:
+        - "fix"
+        - "bugfix"
+        - "bug"
+    - title: "📚 Docs"
+      label: "documentation"
+    - title: "🌐 I18N"
+      label: "i18n"
+    - title: "🧰 Maintenance"
+      label: "i18n"

.github/workflows/publish.yml

@@ -1,67 +1,100 @@
+name: "Release Build"
 on:
   release:
     types: [published]
-name: "Publish Docker Images"
+env:
+  CONTAINER_REGISTRY: ghcr.io/juice-shop
 jobs:
   helmRelease:
-    name: "Package Helm Chart"
+    name: "Publish Helm Chart"
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
-      - uses: actions/checkout@v1
-      - name: "Install yq"
-        run: |
-          sudo snap install yq
-      - name: "Patch Chart.yaml to the current released version"
-        working-directory: helm/multi-juicer/
+      - uses: actions/checkout@v4
+
+      - id: release-version
+        name: Parse Release Version
         run: |
           RELEASE_VERSION="${GITHUB_REF#refs/*/}"
           # Remove leading 'v' from git tag to create valid semver
           RELEASE_VERSION="${RELEASE_VERSION//v}"
-          # patch the version & appVersion in the Chart.yaml to the release version
-          yq eval -i ".version = \"$RELEASE_VERSION\", .appVersion = \"$RELEASE_VERSION\"" Chart.yaml
-      - uses: J12934/[email protected]
-        with:
-          access-token: ${{ secrets.ACCESS_TOKEN }}
-          charts-folder: helm
-          deploy-branch: gh-pages
+          echo "version=$RELEASE_VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: "Login to Package Registry"
+        run: 'echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login --username ${{ github.actor }} --password-stdin ${{ env.CONTAINER_REGISTRY }}'
+
+      - name: "Package Helm Chart"
+        working-directory: helm/multi-juicer/
+        run: |
+          helm package --version "${{ steps.release-version.outputs.version }}" --app-version "${{ steps.release-version.outputs.version }}" .
+
+      - name: "Push Helm Chart"
+        working-directory: helm/multi-juicer/
+        run: |
+          helm push "multi-juicer-${{ steps.release-version.outputs.version }}.tgz" oci://${{ env.CONTAINER_REGISTRY }}/multi-juicer/helm
+
   dockerBuilds:
     name: "Build"
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write # needed for signing the images with GitHub OIDC Token
     strategy:
       matrix:
         component:
           - progress-watchdog
           - cleaner
-          - juice-balancer
+          - balancer
     steps:
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
+
+      - name: Install Cosign
+        uses: sigstore/cosign-installer@v3
 
-      - name: Docker Meta
-        id: docker_meta
-        uses: docker/metadata-action@v3
+      - id: image-metadata
+        name: Container Image Metadata
+        uses: docker/metadata-action@v5
         with:
-          images: iteratec/${{ matrix.component }}
+          images: ${{ env.CONTAINER_REGISTRY }}/multi-juicer/${{ matrix.component }}
           tags: |
             type=semver,pattern={{raw}}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/setup-buildx-action@v3
+      - name: Login to Container Registry
+        uses: docker/login-action@v3
         with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
+          registry: ${{ env.CONTAINER_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract JuiceShop Version from Helm Values
+        id: extract-juice-shop-version
+        run: |
+          JUICE_SHOP_VERSION=$(yq eval '.config.juiceShop.tag' helm/multi-juicer/values.yaml)
+          echo "version=$JUICE_SHOP_VERSION" >> "$GITHUB_OUTPUT"
 
-      - name: Build and Push
-        uses: docker/build-push-action@v3
+      - id: build-and-push
+        name: Build and Push
+        uses: docker/build-push-action@v6
         with:
           context: ./${{ matrix.component }}
           file: ./${{ matrix.component }}/Dockerfile
-          platforms: linux/amd64,linux/arm/v7,linux/arm64
+          platforms: linux/amd64,linux/arm64
           push: true
-          tags: ${{ steps.docker_meta.outputs.tags }}
-          labels: ${{ steps.docker_meta.outputs.labels }}
+          tags: ${{ steps.image-metadata.outputs.tags }}
+          labels: ${{ steps.image-metadata.outputs.labels }}
+          build-args: |
+            JUICE_SHOP_VERSION=${{ steps.extract-juice-shop-version.outputs.version }}
+
+      - name: Sign the images with GitHub OIDC Token
+        env:
+          DIGEST: ${{ steps.build-and-push.outputs.digest }}
+          TAGS: ${{ steps.image-metadata.outputs.tags }}
+        run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}

.github/workflows/test.yml

@@ -1,52 +1,90 @@
 on: [push, pull_request]
-name: "Run Tests"
+name: "Tests"
+permissions:
+  contents: read
+env:
+  GO_STATIC_CHECK_VERSION: "2025.1"
 jobs:
   cleaner:
     name: Cleaner
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: cleaner
     steps:
-      - uses: actions/checkout@master
-      - name: Install Balancer
-        run: |
-          cd cleaner
-          npm ci
-      - name: Run Linter
-        run: |
-          cd cleaner
-          npm run lint
-      - name: Test Balancer
-        run: |
-          cd cleaner
-          npm test -- --ci --color --verbose
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: "cleaner/go.mod"
+          cache-dependency-path: "cleaner/go.sum"
+      - name: "Lint"
+        run: go vet ./...
+      - uses: dominikh/[email protected]
+        with:
+          version: "${{ env.GO_STATIC_CHECK_VERSION }}"
+          working-directory: cleaner
+      - name: "Test"
+        run: go test -cover ./...
+
   balancer:
     name: Balancer
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: balancer
     steps:
-      - uses: actions/checkout@master
-      - name: "Install & Build BalancerUI"
-        run: |
-          cd juice-balancer/ui
-          npm ci
-          npm run build
-      - name: Install Balancer
-        run: |
-          cd juice-balancer
-          npm ci
-      - name: Run Linter
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: "balancer/go.mod"
+          cache-dependency-path: "balancer/go.sum"
+      - name: "Place index.html file into ui build folder"
         run: |
-          cd juice-balancer
-          npm run lint
-      - name: Test Balancer
-        run: |
-          cd juice-balancer
-          npm test -- --ci --color --verbose
-  progressWatchdog:
+          mkdir ui/build/
+          cp ui/index.html ui/build/index.html
+      - name: "Lint"
+        run: go vet ./...
+      - uses: dominikh/[email protected]
+        with:
+          version: "${{ env.GO_STATIC_CHECK_VERSION }}"
+          working-directory: balancer
+      - name: "Test"
+        run: go test -cover ./...
+
+  progress-watchdog:
     name: ProgressWatchdog
     runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: progress-watchdog
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: "progress-watchdog/go.mod"
+          cache-dependency-path: "progress-watchdog/go.sum"
+      - name: "Lint"
+        run: go vet ./...
+      - uses: dominikh/[email protected]
+        with:
+          version: "${{ env.GO_STATIC_CHECK_VERSION }}"
+          working-directory: progress-watchdog
+      - name: "Test"
+        run: go test -cover ./...
+
+  helm:
+    name: Helm
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: helm/multi-juicer/
     steps:
-      - uses: actions/checkout@master
-      - name: "Test ProgressWatchdog"
+      - uses: actions/checkout@v4
+      - name: Verify tools
+        run: |
+          helm version
+      - name: Install Helm Unit Test Plugin
         run: |
-          cd progress-watchdog
-          go vet
-          go test -cover
+          helm plugin install https://github.com/helm-unittest/helm-unittest.git --version 0.6.2
+      - name: Helm-Chart Unit Tests | Operator
+        run: helm unittest .