Skip to content

Commit b8be94a

Browse files
migmartrimigmartri
committed
Initialize repository
0 parents  commit b8be94a

File tree

532 files changed

+388209
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

532 files changed

+388209
-0
lines changed

‎.gitattributes

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
app/controlplane/api/gen/frontend/** linguist-generated=true
2+
app/controlplane/internal/data/ent/** linguist-generated=true
3+
app/controlplane/internal/data/ent/schema/* linguist-detectable=true

‎.github/workflows/contracts/build-and-test.cue

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
schemaVersion: "v1"
2+
runner: type: "GITHUB_ACTION"

‎.github/workflows/contracts/releases.cue

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
schemaVersion: "v1"
2+
materials: [
3+
// Binaries
4+
{type: "ARTIFACT", name: "cli-linux-amd64", output: true},
5+
{type: "ARTIFACT", name: "control-plane-linux-amd64", output: true},
6+
{type: "ARTIFACT", name: "artifact-cas-linux-amd64", output: true},
7+
// Container images
8+
{type: "CONTAINER_IMAGE", name: "control-plane-image", output: true},
9+
{type: "CONTAINER_IMAGE", name: "artifact-cas-image", output: true},
10+
// SBOMS for those container images
11+
{type: "SBOM_CYCLONEDX_JSON", name: "sbom-control-plane"},
12+
{type: "SBOM_CYCLONEDX_JSON", name: "sbom-artifact-cas"},
13+
]
14+
runner: type: "GITHUB_ACTION"

‎.github/workflows/cosign.pub

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
-----BEGIN PUBLIC KEY-----
2+
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEMBSJAtPWo4hhThSBJXF9pfheP1x7
3+
JQRD2meyc92McFO96WlRB1yW11kC24gVdxOyZvOz+qk8CR+/2GuQYleKsQ==
4+
-----END PUBLIC KEY-----

‎.github/workflows/lint.yml

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
name: Lint
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
permissions:
9+
contents: read
10+
# Optional: allow read access to pull request. Use with `only-new-issues` option.
11+
pull-requests: read
12+
jobs:
13+
golangci:
14+
name: lint
15+
strategy:
16+
fail-fast: false
17+
matrix:
18+
app:
19+
- main-module
20+
- cli
21+
- controlplane
22+
- artifact-cas
23+
runs-on: ubuntu-latest
24+
steps:
25+
- uses: actions/setup-go@v3
26+
with:
27+
go-version: "1.20"
28+
29+
- uses: actions/checkout@v3
30+
31+
- name: Lint main module
32+
uses: golangci/golangci-lint-action@v3
33+
if: ${{ matrix.app == 'main-module' }}
34+
35+
- name: Lint ${{ matrix.app }}
36+
uses: golangci/golangci-lint-action@v3
37+
if: ${{ matrix.app != 'main-module' }}
38+
with:
39+
working-directory: app/${{ matrix.app }}
40+
41+
lint-protos:
42+
runs-on: ubuntu-latest
43+
steps:
44+
- uses: actions/checkout@v2
45+
- uses: bufbuild/buf-setup-action@v1
46+
with:
47+
buf_user: ${{ secrets.buf_user }}
48+
buf_api_token: ${{ secrets.buf_api_token }}
49+
- uses: bufbuild/buf-lint-action@v1

‎.github/workflows/release.yaml

+133
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,133 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*.*.*"
7+
8+
jobs:
9+
test:
10+
uses: chainloop-dev/chainloop/.github/workflows/test.yml@main
11+
12+
release:
13+
name: Release CLI and control-plane/artifact-cas container images
14+
needs: test
15+
runs-on: ubuntu-latest
16+
if: github.ref_type == 'tag' # Guard to make sure we are releasing once
17+
permissions:
18+
id-token: write # required to use OIDC and retrieve Google Cloud Credentials
19+
contents: write # required for goreleaser
20+
packages: write # to push container images
21+
env:
22+
CHAINLOOP_VERSION: 0.8.89
23+
CHAINLOOP_ROBOT_ACCOUNT: ${{ secrets.CHAINLOOP_ROBOT_ACCOUNT }}
24+
CONTAINER_IMAGE_CP: ghcr.io/chainloop-dev/chainloop/control-plane:${{ github.ref_name }}
25+
CONTAINER_IMAGE_CAS: ghcr.io/chainloop-dev/chainloop/artifact-cas:${{ github.ref_name }}
26+
steps:
27+
- name: Install Cosign
28+
uses: sigstore/[email protected]
29+
30+
- name: Install Chainloop
31+
run: |
32+
curl -sfL https://chainloop.dev/install.sh | bash -s -- --version v${{ env.CHAINLOOP_VERSION }}
33+
34+
- name: Download jq
35+
run: |
36+
sudo wget -q https://github.com/stedolan/jq/releases/download/jq-1.6/jq-linux64 -O /usr/local/bin/jq
37+
sudo chmod u+x /usr/local/bin/jq
38+
39+
- name: Checkout
40+
uses: actions/checkout@v3
41+
with:
42+
fetch-depth: 0
43+
44+
- name: Initialize Attestation
45+
run: |
46+
chainloop attestation init
47+
48+
# TODO: remove once we move the releases and the installation script to Github
49+
- name: "Configure Google Cloud credentials"
50+
id: "auth-google"
51+
uses: "google-github-actions/auth@v0"
52+
with:
53+
token_format: "access_token"
54+
workload_identity_provider: projects/1044976554810/locations/global/workloadIdentityPools/chainloop-github-pool/providers/github-provider
55+
service_account: [email protected]
56+
57+
- name: Docker login to Github Packages
58+
uses: docker/login-action@v2
59+
with:
60+
registry: ghcr.io
61+
username: ${{ github.actor }}
62+
password: ${{ secrets.GITHUB_TOKEN }}
63+
64+
- name: Set up Go
65+
uses: actions/setup-go@v3
66+
with:
67+
go-version: "1.20"
68+
69+
- name: Run GoReleaser
70+
id: release
71+
uses: goreleaser/goreleaser-action@v3
72+
with:
73+
distribution: goreleaser
74+
version: latest
75+
args: release --rm-dist
76+
env:
77+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
78+
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
79+
COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
80+
81+
- uses: anchore/sbom-action@v0
82+
with:
83+
image: ${{ env.CONTAINER_IMAGE_CP }}
84+
format: cyclonedx-json
85+
artifact-name: controlplane.cyclonedx.json
86+
output-file: /tmp/sbom.cp.cyclonedx.json
87+
88+
- uses: anchore/sbom-action@v0
89+
with:
90+
image: ${{ env.CONTAINER_IMAGE_CAS }}
91+
format: cyclonedx-json
92+
artifact-name: cas.cyclonedx.json
93+
output-file: /tmp/sbom.cas.cyclonedx.json
94+
95+
- name: Add Attestation Artifacts (SBOM)
96+
run: |
97+
chainloop attestation add --name sbom-control-plane --value /tmp/sbom.cp.cyclonedx.json
98+
chainloop attestation add --name sbom-artifact-cas --value /tmp/sbom.cas.cyclonedx.json
99+
100+
- name: Add Attestation Artifacts (container images)
101+
run: |
102+
# Control plane image
103+
chainloop attestation add --name control-plane-image --value ${{ env.CONTAINER_IMAGE_CP }}
104+
# CAS image
105+
chainloop attestation add --name artifact-cas-image --value ${{ env.CONTAINER_IMAGE_CAS }}
106+
107+
- name: Add Attestation Artifacts (binaries)
108+
run: |
109+
# Binaries x86_64
110+
# TODO: add the rest of binaries
111+
echo -n '${{ steps.release.outputs.artifacts }}' | jq -r '.[] | select(.type=="Binary" and .goos=="linux" and .goarch=="amd64") | { "name": "\(.extra.ID)-\(.goos)-\(.goarch)", "path":"\(.path)"} | @base64' | while read i; do
112+
BINARY_NAME=$(echo "${i}" | base64 --decode | jq -r ${1} .name)
113+
BINARY_PATH=$(echo "${i}" | base64 --decode | jq -r ${1} .path)
114+
chainloop attestation add --name ${BINARY_NAME} --value ${BINARY_PATH}
115+
done
116+
117+
- name: Finish and Record Attestation
118+
if: ${{ success() }}
119+
run: |
120+
chainloop attestation status --full
121+
chainloop attestation push --key env://CHAINLOOP_SIGNING_KEY
122+
env:
123+
CHAINLOOP_SIGNING_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
124+
CHAINLOOP_SIGNING_KEY: ${{ secrets.COSIGN_KEY }}
125+
126+
- name: Mark attestation as failed
127+
if: ${{ failure() }}
128+
run: |
129+
chainloop attestation reset
130+
- name: Mark attestation as cancelled
131+
if: ${{ cancelled() }}
132+
run: |
133+
chainloop attestation reset --trigger cancellation

‎.github/workflows/test.yml

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: Test
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
# We want to call this workflow during release too
9+
workflow_call:
10+
11+
jobs:
12+
build_and_test:
13+
name: Test
14+
runs-on: ubuntu-latest
15+
strategy:
16+
fail-fast: false
17+
matrix:
18+
app:
19+
- main-module
20+
- cli
21+
- controlplane
22+
- artifact-cas
23+
steps:
24+
- uses: actions/checkout@v3
25+
- uses: actions/setup-go@v3
26+
if: ${{ matrix.app != 'main-module' }}
27+
with:
28+
go-version-file: app/${{ matrix.app }}/go.mod
29+
cache: true
30+
cache-dependency-path: app/${{ matrix.app }}/go.sum
31+
32+
- uses: actions/setup-go@v3
33+
if: ${{ matrix.app == 'main-module' }}
34+
with:
35+
go-version-file: go.mod
36+
cache: true
37+
cache-dependency-path: go.sum
38+
39+
# Check that the generated ent code is up to date
40+
# see https://entgo.io/docs/ci/
41+
- uses: ent/contrib/ci@master
42+
name: "Check all generated code is checked in"
43+
if: ${{ matrix.app != 'main-module' }}
44+
with:
45+
working-directory: app/${{ matrix.app }}
46+
47+
- name: Test
48+
if: ${{ matrix.app != 'main-module' }}
49+
run: make -C app/${{ matrix.app }} test
50+
51+
- name: Test top level modules
52+
if: ${{ matrix.app == 'main-module' }}
53+
run: make test

‎.gitignore

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
# Reference https://github.com/github/gitignore/blob/master/Go.gitignore
2+
# Binaries for programs and plugins
3+
*.exe
4+
*.exe~
5+
*.dll
6+
*.so
7+
*.dylib
8+
9+
# Test binary, built with `go test -c`
10+
*.test
11+
12+
# Output of the go coverage tool, specifically when used with LiteIDE
13+
*.out
14+
15+
# Dependency directories (remove the comment below to include it)
16+
vendor/
17+
18+
# Go workspace file
19+
# go.work
20+
21+
# Compiled Object files, Static and Dynamic libs (Shared Objects)
22+
*.o
23+
*.a
24+
*.so
25+
26+
# OS General
27+
Thumbs.db
28+
.DS_Store
29+
30+
# project
31+
*.cert
32+
*.key
33+
*.log
34+
bin/
35+
36+
# Develop tools
37+
.vscode/
38+
.idea/
39+
*.swp
40+
41+
# Go releaser
42+
dist/
43+
44+
# Dev configuration associated with authentication
45+
*/*/*/secret.yaml
46+
47+
gha-creds-*.json

‎.golangci.yml

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
run:
2+
timeout: 10m
3+
4+
linters:
5+
# Note that there are some linters enabled by default, see golang-ci linters
6+
enable:
7+
- goheader
8+
- dupl
9+
- gofmt
10+
- goimports
11+
- misspell
12+
- nakedret
13+
- revive
14+
- gosec
15+
- depguard
16+
- asciicheck
17+
- whitespace
18+
- errorlint
19+
- forbidigo
20+
- gocritic
21+
- importas
22+
- prealloc
23+
- stylecheck
24+
- unconvert
25+
- dogsled
26+
- goconst
27+
- exportloopref
28+
- gocyclo
29+
- goprintffuncname
30+
# Can't enable it for now, it crashes https://github.com/ent/ent/pull/3315
31+
# - unparam
32+
33+
linters-settings:
34+
gofmt:
35+
simplify: true
36+
dupl:
37+
threshold: 400
38+
goheader:
39+
template: |-
40+
Copyright {{copyright-year}} The Chainloop Authors.
41+
42+
Licensed under the Apache License, Version 2.0 (the "License");
43+
you may not use this file except in compliance with the License.
44+
You may obtain a copy of the License at
45+
46+
http://www.apache.org/licenses/LICENSE-2.0
47+
48+
Unless required by applicable law or agreed to in writing, software
49+
distributed under the License is distributed on an "AS IS" BASIS,
50+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
51+
See the License for the specific language governing permissions and
52+
limitations under the License.
53+
values:
54+
regexp:
55+
copyright-year: 202[3]
56+
forbidigo:
57+
forbid:
58+
- ^print.*$
59+
- '^t\.Error.*$(# forbid t.Error in favor of using testify\.)?'
60+
- '^t\.Fatal.*$(# forbid t.Fatal in favor of using testify\.)?'

0 commit comments

Comments
 (0)