Skip to content

Commit 1616cf7

Browse files
czepiecczepiec
committed
[WIP] init
0 parents  commit 1616cf7

23 files changed

+883
-0
lines changed

‎.github/CODEOWNERS

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# Code owners.
2+
3+
* @czepiec

‎.github/CODE_OF_CONDUCT.md

+77
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# Contributor Covenant Code of Conduct
2+
3+
## Our Pledge
4+
5+
In the interest of fostering an open and welcoming environment, we as
6+
contributors and maintainers pledge to make participation in our project and our
7+
community a harassment-free experience for everyone, regardless of age, body
8+
size, disability, ethnicity, sex characteristics, gender identity and
9+
expression, level of experience, education, socio-economic status, nationality,
10+
personal appearance, race, religion, or sexual identity and orientation.
11+
12+
## Our Standards
13+
14+
Examples of behavior that contributes to creating a positive environment
15+
include:
16+
17+
- Using welcoming and inclusive language
18+
- Being respectful of differing viewpoints and experiences
19+
- Gracefully accepting constructive criticism
20+
- Focusing on what is best for the community
21+
- Showing empathy towards other community members
22+
23+
Examples of unacceptable behavior by participants include:
24+
25+
- The use of sexualized language or imagery and unwelcome sexual attention or
26+
advances
27+
- Trolling, insulting/derogatory comments, and personal or political attacks
28+
- Public or private harassment
29+
- Publishing others' private information, such as a physical or electronic
30+
address, without explicit permission
31+
- Other conduct which could reasonably be considered inappropriate in a
32+
professional setting
33+
34+
## Our Responsibilities
35+
36+
Project maintainers are responsible for clarifying the standards of acceptable
37+
behavior and are expected to take appropriate and fair corrective action in
38+
response to any instances of unacceptable behavior.
39+
40+
Project maintainers have the right and responsibility to remove, edit, or reject
41+
comments, commits, code, wiki edits, issues, and other contributions that are
42+
not aligned to this Code of Conduct, or to ban temporarily or permanently any
43+
contributor for other behaviors that they deem inappropriate, threatening,
44+
offensive, or harmful.
45+
46+
## Scope
47+
48+
This Code of Conduct applies within all project spaces, and it also applies when
49+
an individual is representing the project or its community in public spaces.
50+
Examples of representing a project or community include using an official
51+
project e-mail address, posting via an official social media account, or acting
52+
as an appointed representative at an online or offline event. Representation of
53+
a project may be further defined and clarified by project maintainers.
54+
55+
## Enforcement
56+
57+
Instances of abusive, harassing, or otherwise unacceptable behavior may be
58+
reported by contacting the project team at <[email protected]>. All complaints
59+
will be reviewed and investigated and will result in a response that is deemed
60+
necessary and appropriate to the circumstances. The project team is obligated to
61+
maintain confidentiality with regard to the reporter of an incident. Further
62+
details of specific enforcement policies may be posted separately.
63+
64+
Project maintainers who do not follow or enforce the Code of Conduct in good
65+
faith may face temporary or permanent repercussions as determined by other
66+
members of the project's leadership.
67+
68+
## Attribution
69+
70+
This Code of Conduct is adapted from the [Contributor Covenant][homepage],
71+
version 1.4, available at
72+
<https://www.contributor-covenant.org/version/1/4/code-of-conduct.html>.
73+
74+
For answers to common questions about this code of conduct, see
75+
<https://www.contributor-covenant.org/faq>.
76+
77+
[homepage]: https://www.contributor-covenant.org

‎.github/actionlint.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
config-variables:
2+
- IMAGE_REPOSITORY
3+
- DOCKERHUB_USERNAME

‎.github/actionlint_shellcheck.sh

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
#!/usr/bin/env sh
2+
set -e
3+
4+
# ShellCheck wrapper for actionlint
5+
6+
exec shellcheck --format=json "--shell=$6" --external-sources -

‎.github/dependabot.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: docker
4+
directories:
5+
- /variants/*
6+
schedule:
7+
interval: daily
8+
- package-ecosystem: github-actions
9+
directories:
10+
- /
11+
schedule:
12+
interval: daily

‎.github/workflows/ci-variant.yaml

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
name: CI variants
2+
run-name: test-run-name-build-test
3+
on: # yamllint disable-line rule:truthy
4+
workflow_call:
5+
inputs:
6+
name:
7+
description: Variant name
8+
required: true
9+
type: string
10+
filter-tags:
11+
description: Regex pattern to filter CloudNativePG PostgreSQL image tags
12+
type: string
13+
permissions:
14+
actions: read
15+
contents: read
16+
security-events: write
17+
jobs:
18+
get-digests:
19+
name: Get digests
20+
permissions:
21+
contents: read
22+
runs-on: ubuntu-24.04
23+
outputs:
24+
digests: ${{ steps.get-digests.outputs.digests }}
25+
steps:
26+
- name: Checkout
27+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
28+
- id: get-digests
29+
name: Get digests
30+
run: |
31+
./scripts/get_digests.sh
32+
digests_json=$(jq -c '.' output/digests.json)
33+
printf "digests=%s\n" "${digests_json}" >>"${GITHUB_OUTPUT:?}"
34+
env:
35+
FILTER_TAGS: ${{ inputs.filter-tags }}
36+
COMPARE_REPOSITORY: czetech/cloudnativepg-postgresql
37+
COMPARE_TAG_SUFFIX: ${{ inputs.name }}
38+
- name: Upload digests to artifacts
39+
uses:
40+
# yamllint disable-line rule:line-length
41+
actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
42+
with:
43+
name: digests-${{ inputs.name }}
44+
path: output
45+
if-no-files-found: error
46+
image:
47+
name: Build image
48+
permissions:
49+
actions: read
50+
contents: read
51+
security-events: write
52+
needs: get-digests
53+
if: ${{ needs.get-digests.outputs.digests != '[]' }}
54+
runs-on: ubuntu-24.04
55+
env:
56+
IMAGE: ${{ vars.IMAGE_REPOSITORY }}:test
57+
POSTGRESQL_DIGEST: ${{ matrix.digest.digest }}
58+
steps:
59+
- name: Checkout
60+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
61+
- name: Set up QEMU
62+
uses:
63+
# yamllint disable-line rule:line-length
64+
docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
65+
- name: Set up Docker Buildx
66+
uses:
67+
# yamllint disable-line rule:line-length
68+
docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1
69+
- name: Build image
70+
uses:
71+
# yamllint disable-line rule:line-length
72+
docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
73+
with:
74+
build-args: POSTGRESQL_DIGEST
75+
cache-from: type=gha
76+
cache-to: type=gha,mode=max
77+
context: variants/${{ inputs.name }}
78+
load: true
79+
tags: ${{ env.IMAGE }}
80+
- name: Lint image with Dockle
81+
uses:
82+
erzz/dockle-action@69369bc745ee29813f730231a821bcd4f71cd290 # v1.4.0
83+
with:
84+
image: ${{ env.IMAGE }}
85+
dockle-version: 0.4.14
86+
accept-keywords: key
87+
accept-filenames: >-
88+
usr/local/lib/python3.11/dist-packages/azure/core/settings.py,
89+
usr/local/lib/python3.9/dist-packages/azure/core/settings.py
90+
- name: Scan image with Trivy
91+
uses:
92+
# yamllint disable-line rule:line-length
93+
aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
94+
with:
95+
image-ref: ${{ env.IMAGE }}
96+
format: sarif
97+
output: trivy.sarif
98+
scanners: vuln,secret,misconfig,license
99+
- name: Upload Trivy results
100+
uses:
101+
# yamllint disable-line rule:line-length
102+
github/codeql-action/upload-sarif@aa578102511db1f4524ed59b8cc2bae4f6e88195 # v3.27.6
103+
with:
104+
sarif_file: trivy.sarif
105+
category: trivy
106+
- name: Test image
107+
run: "\"./variants/${VARIANT:?}/test_image.sh\""
108+
env:
109+
VARIANT: ${{ inputs.name }}
110+
timeout-minutes: 1
111+
strategy:
112+
matrix:
113+
digest: ${{ fromJSON(needs.get-digests.outputs.digests) }}
114+
fail-fast: false

‎.github/workflows/ci.yaml

+92
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
name: CI
2+
# run-name: test-run-name-variants
3+
on: # yamllint disable-line rule:truthy
4+
pull_request: {}
5+
push: {}
6+
# schedule:
7+
# - cron: 0 1 * * *
8+
# workflow_dispatch: {}
9+
permissions:
10+
actions: read
11+
contents: read
12+
security-events: write
13+
jobs:
14+
pre-commit:
15+
name: Ensure pre-commit passes
16+
permissions:
17+
contents: read
18+
runs-on: ubuntu-24.04
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
22+
- name: Run pre-commit
23+
uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
24+
actions-sha:
25+
name: Ensure SHA pinned actions
26+
permissions:
27+
contents: read
28+
runs-on: ubuntu-24.04
29+
steps:
30+
- name: Checkout
31+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
32+
- name: Ensure SHA pinned actions
33+
uses:
34+
# yamllint disable-line rule:line-length
35+
zgosalvez/github-actions-ensure-sha-pinned-actions@5d6ac37a4cef8b8df67f482a8e384987766f0213 # v3.0.17
36+
list-variants:
37+
name: List variants
38+
permissions:
39+
contents: read
40+
runs-on: ubuntu-24.04
41+
outputs:
42+
variants: ${{ steps.list-variants.outputs.variants }}
43+
steps:
44+
- name: Checkout
45+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
46+
- id: get-changed-files
47+
name: Get changed files
48+
uses:
49+
# yamllint disable-line rule:line-length
50+
tj-actions/changed-files@4edd678ac3f81e2dc578756871e4d00c19191daf # v45.0.4
51+
with:
52+
dir_names: true
53+
dir_names_exclude_current_dir: true
54+
dir_names_max_depth: "1"
55+
matrix: true
56+
path: variants
57+
- id: list-variants
58+
name: List variants
59+
run: |
60+
./scripts/list_variants.sh
61+
variants_json=$(jq -c '.' output/variants.json)
62+
printf "variants=%s\n" "${variants_json}" >>"${GITHUB_OUTPUT:?}"
63+
env:
64+
FILTER_VARIANTS: >-
65+
${{
66+
contains(fromJSON('["pull_request", "push"]'), github.event_name)
67+
&& steps.get-changed-files.outputs.all_changed_and_modified_files
68+
}}
69+
- name: Upload variants to artifacts
70+
uses:
71+
# yamllint disable-line rule:line-length
72+
actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
73+
with:
74+
name: variants
75+
path: output
76+
if-no-files-found: error
77+
variants:
78+
name: Variants
79+
permissions:
80+
actions: read
81+
contents: read
82+
security-events: write
83+
needs: list-variants
84+
if: ${{ needs.list-variants.outputs.variants != '[]' }}
85+
uses: ./.github/workflows/ci-variant.yaml
86+
with:
87+
name: ${{ matrix.variant.name }}
88+
filter-tags: ${{ matrix.variant.config.filter-tags }}
89+
strategy:
90+
matrix:
91+
variant: ${{ fromJSON(needs.list-variants.outputs.variants) }}
92+
fail-fast: false

‎.github/workflows/dockerhub-description.yaml

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Docker Hub description
2+
on: # yamllint disable-line rule:truthy
3+
push:
4+
branches:
5+
- main
6+
paths:
7+
- .github/workflows/dockerhub-description.yaml
8+
- README.md
9+
permissions:
10+
contents: read
11+
jobs:
12+
update-description:
13+
name: Update description
14+
permissions:
15+
contents: read
16+
runs-on: ubuntu-24.04
17+
environment: dockerhub-description
18+
steps:
19+
- name: Checkout
20+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21+
- name: Update Docker Hub description
22+
uses:
23+
# yamllint disable-line rule:line-length
24+
peter-evans/dockerhub-description@e98e4d1628a5f3be2be7c231e50981aee98723ae # v4.0.0
25+
with:
26+
username: ${{ vars.DOCKERHUB_USERNAME }}
27+
password: ${{ secrets.DOCKERHUB_TOKEN }}
28+
repository: ${{ vars.IMAGE_REPOSITORY }}
29+
enable-url-completion: true

‎.gitignore

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
/output/

‎.hadolint.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
failure-threshold: style

‎.markdownlint.yaml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
MD003:
2+
style: atx
3+
MD004:
4+
style: dash
5+
MD009:
6+
strict: true
7+
MD013:
8+
stern: true
9+
MD029:
10+
style: one
11+
MD046:
12+
style: fenced
13+
MD048:
14+
style: backtick
15+
MD049:
16+
style: asterisk
17+
MD050:
18+
style: asterisk
19+
MD054:
20+
collapsed: false
21+
url_inline: false
22+
MD055:
23+
style: leading_and_trailing

0 commit comments

Comments
 (0)