chore(deps): update renovate/renovate docker tag to v44.56.3 #773
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| workflow_dispatch: | |
| inputs: | |
| run-openshift: | |
| description: "Run the OpenShift e2e tests" | |
| type: boolean | |
| default: false | |
| push: | |
| branches: | |
| - main | |
| permissions: | |
| contents: read | |
| jobs: | |
| change-triage: | |
| name: Check changed files | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| outputs: | |
| docs-changed: ${{ steps.event-filter.outputs.docs-changed || steps.paths-filter.outputs.docs-changed }} | |
| core-changed: ${{ steps.event-filter.outputs.core-changed || steps.paths-filter.outputs.core-changed }} | |
| operator-changed: ${{ steps.event-filter.outputs.operator-changed || steps.paths-filter.outputs.operator-changed }} | |
| grafana-changed: ${{ steps.event-filter.outputs.grafana-changed || steps.paths-filter.outputs.grafana-changed }} | |
| renovate-changed: ${{ steps.event-filter.outputs.renovate-changed || steps.paths-filter.outputs.renovate-changed }} | |
| # Run the OpenShift e2e suite on pushes to main, on the | |
| # release-please PR branch, and on demand via workflow_dispatch — but | |
| # never automatically on a regular pull request. | |
| run-openshift: ${{ github.event_name == 'push' || github.head_ref == 'release-please--branches--main' || (github.event_name == 'workflow_dispatch' && inputs.run-openshift) }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Check for changes | |
| uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3 | |
| id: paths-filter | |
| with: | |
| filters: | | |
| docs-changed: | |
| - 'documentation/**' | |
| - 'core/proto/**/*.proto' | |
| - 'operator/api/**/*.go' | |
| - 'operator/dist/chart/values.yaml' | |
| - 'Taskfile.yml' | |
| - '.github/actions/**' | |
| - '.github/workflows/ci.yml' | |
| core-changed: | |
| - 'core/!(licenses)**' | |
| - 'Taskfile.yml' | |
| - '.github/actions/**' | |
| - '.github/workflows/ci.yml' | |
| operator-changed: | |
| - 'operator/!(licenses)**' | |
| - 'Taskfile.yml' | |
| - '.github/actions/**' | |
| - '.github/workflows/ci.yml' | |
| grafana-changed: | |
| - 'observability/grafana/**/*.go' | |
| - 'observability/grafana/go.mod' | |
| - 'observability/grafana/go.sum' | |
| - 'observability/grafana/klio-dashboard.json' | |
| - 'observability/grafana/.golangci.yml' | |
| - 'Taskfile.yml' | |
| - '.github/actions/**' | |
| - '.github/workflows/ci.yml' | |
| renovate-changed: | |
| - 'renovate.json' | |
| - 'Taskfile.yml' | |
| - '.github/actions/setup-dagger/**' | |
| - '.github/workflows/ci.yml' | |
| - name: Evaluate branches | |
| id: event-filter | |
| if: github.event_name == 'push' || github.head_ref == 'release-please--branches--main' | |
| # Forcing all change flags to true for pushes to main (let's make sure we build all dev artifacts) | |
| # and release-please branch events (let's make sure our releases pass the tests) | |
| run: | | |
| echo "docs-changed=true" >> $GITHUB_OUTPUT | |
| echo "core-changed=true" >> $GITHUB_OUTPUT | |
| echo "operator-changed=true" >> $GITHUB_OUTPUT | |
| echo "grafana-changed=true" >> $GITHUB_OUTPUT | |
| echo "renovate-changed=true" >> $GITHUB_OUTPUT | |
| commitlint: | |
| name: Commit Linter | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Setup dagger | |
| uses: ./.github/actions/setup-dagger | |
| - name: Run commitlint | |
| run: | | |
| task all:commitlint | |
| documentation: | |
| name: Documentation CI | |
| needs: | |
| - change-triage | |
| if: needs.change-triage.outputs.docs-changed == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Setup dagger | |
| uses: ./.github/actions/setup-dagger | |
| - name: Run CI task | |
| run: | | |
| task documentation:ci | |
| grafana: | |
| name: Grafana Dashboard CI | |
| needs: | |
| - change-triage | |
| if: needs.change-triage.outputs.grafana-changed == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Setup dagger | |
| uses: ./.github/actions/setup-dagger | |
| - name: Run CI task | |
| run: | | |
| task grafana:ci | |
| core: | |
| name: Core CI | |
| needs: | |
| - change-triage | |
| # Also build when the OpenShift suite runs: openshift-e2e pulls the | |
| # freshly built operand image from ghcr regardless of which module changed. | |
| if: needs.change-triage.outputs.core-changed == 'true' || needs.change-triage.outputs.run-openshift == 'true' | |
| runs-on: ${{ github.repository_owner == 'cloudnative-pg' && 'ubuntu-latest-16-cores' || 'ubuntu-latest' }} | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| # Goreleaser requires tags and history to properly tag the binary | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Cleanup disk | |
| uses: ./.github/actions/cleanup-disk | |
| - name: Setup dagger | |
| uses: ./.github/actions/setup-dagger | |
| - name: Login to ghcr.io | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 | |
| with: | |
| registry: "ghcr.io" | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Run CI task | |
| run: | | |
| task core:ci | |
| - name: Upload assets | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: klio | |
| path: | | |
| core/dist/*.deb | |
| core/dist/*.rpm | |
| core/dist/*.tar.gz | |
| operator: | |
| name: Operator CI | |
| needs: | |
| - change-triage | |
| # Also build when the OpenShift suite runs: the OLM catalog and tests pull | |
| # the freshly built operator image from ghcr regardless of what changed. | |
| if: needs.change-triage.outputs.operator-changed == 'true' || needs.change-triage.outputs.run-openshift == 'true' | |
| runs-on: ${{ github.repository_owner == 'cloudnative-pg' && 'ubuntu-latest-16-cores' || 'ubuntu-latest' }} | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Cleanup disk | |
| uses: ./.github/actions/cleanup-disk | |
| - name: Setup dagger | |
| uses: ./.github/actions/setup-dagger | |
| - name: Login to ghcr.io | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 | |
| with: | |
| registry: "ghcr.io" | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Run CI task | |
| run: | | |
| task operator:ci | |
| - name: Run Red Hat preflight certification | |
| run: | | |
| # Certify the UBI variant of the operator image just built and pushed | |
| # by operator:ci. Preflight only accepts a Red Hat UBI base, so the | |
| # distroless variant is not a candidate. | |
| IMAGE=$(jq -r '.ubi."image.name" | split(",")[0]' operator/metadata.json) | |
| task olm:preflight-container IMAGE="${IMAGE}" | |
| integration-tests: | |
| name: Integration Tests | |
| needs: | |
| - change-triage | |
| if: needs.change-triage.outputs.core-changed == 'true' || needs.change-triage.outputs.operator-changed == 'true' | |
| runs-on: ${{ github.repository_owner == 'cloudnative-pg' && 'ubuntu-latest-16-cores' || 'ubuntu-latest' }} | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout Klio | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| path: klio | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| fetch-depth: 0 | |
| - name: Checkout CloudNativePG | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| repository: cloudnative-pg/cloudnative-pg | |
| path: cloudnativepg | |
| fetch-depth: 0 | |
| - name: Cleanup disk | |
| uses: ./klio/.github/actions/cleanup-disk | |
| - name: Setup dagger | |
| uses: ./klio/.github/actions/setup-dagger | |
| - name: Setup Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7 | |
| with: | |
| go-version-file: 'cloudnativepg/go.mod' | |
| - name: Start Kind cluster | |
| id: kind-cluster | |
| working-directory: cloudnativepg | |
| run: | | |
| hack/setup-cluster.sh create load deploy | |
| CLUSTERS=$(kind get clusters) | |
| echo "clusters=$CLUSTERS" >> $GITHUB_OUTPUT | |
| - name: Write e2e config | |
| working-directory: klio/operator/test/e2e | |
| run: | | |
| cp e2e-config.yaml.example e2e-config.yaml | |
| sed -i 's/storageClass: ""/storageClass: "csi-hostpath-sc"/' e2e-config.yaml | |
| - name: Run integration tests | |
| working-directory: klio | |
| env: | |
| KIND_CLUSTER_NAME: ${{ steps.kind-cluster.outputs.clusters }} | |
| run: | | |
| task integration:e2e | |
| - name: Upload e2e logs | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: e2e_cluster_logs | |
| path: klio/e2e_cluster_logs/ | |
| if-no-files-found: ignore | |
| olm: | |
| name: OLM Bundle & Catalog | |
| env: | |
| # The OpenShift Catalog is just for internal testing purpose until it won't. | |
| ENVIRONMENT: "testing" | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Cleanup disk | |
| uses: ./.github/actions/cleanup-disk | |
| - name: Setup dagger | |
| uses: ./.github/actions/setup-dagger | |
| - name: Start dagger engine with a host cgroup namespace | |
| shell: bash | |
| run: | | |
| # olm:scorecard runs k3s in a container. On cgroup v2 hosts, Docker | |
| # defaults new containers to a private cgroup namespace, which does | |
| # not always delegate the cpu controller, making k3s crash with | |
| # "failed to find cpu cgroup (v2)" (intermittently, depending on the | |
| # runner). Start the dagger engine with --cgroupns=host instead, so | |
| # containers nested inside it (like k3s) see the real host cgroup | |
| # hierarchy, where cpu is always present. | |
| image=$(dagger version | grep -oP 'image://\K[^)\s]+') | |
| docker run -d --restart always --privileged --cgroupns=host \ | |
| -v /var/lib/dagger \ | |
| --name dagger-engine-host-cgroupns \ | |
| "${image}" | |
| echo "_EXPERIMENTAL_DAGGER_RUNNER_HOST=docker-container://dagger-engine-host-cgroupns" >> "${GITHUB_ENV}" | |
| - name: Login to ghcr.io using Podman | |
| uses: redhat-actions/podman-login@50c2d9a331bb67c8fdab99b86455fad05e2e3252 # v2 | |
| with: | |
| registry: "ghcr.io" | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Run OLM task | |
| timeout-minutes: 10 | |
| run: | | |
| task olm:all | |
| - name: Upload OLM catalog | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: klio-olm | |
| path: | | |
| operator/klio-operator-catalog-source.yaml | |
| operator/klio-operator-template.yaml | |
| operator/bundle | |
| containerize-main: | |
| name: Containerize Main | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| && (needs.change-triage.outputs.core-changed == 'true' || needs.change-triage.outputs.operator-changed == 'true') | |
| needs: | |
| - change-triage | |
| runs-on: ${{ github.repository_owner == 'cloudnative-pg' && 'ubuntu-latest-16-cores' || 'ubuntu-latest' }} | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Cleanup disk | |
| uses: ./.github/actions/cleanup-disk | |
| - name: Setup dagger | |
| uses: ./.github/actions/setup-dagger | |
| - name: Login to ghcr.io | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4 | |
| with: | |
| registry: "ghcr.io" | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Containerize core main | |
| run: | | |
| task core:containerize-main | |
| - name: Containerize operator main | |
| run: | | |
| task operator:containerize-main | |
| renovate: | |
| name: Renovate Linter | |
| needs: | |
| - change-triage | |
| if: needs.change-triage.outputs.renovate-changed == 'true' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ github.event.pull_request.head.sha }} | |
| - name: Setup dagger | |
| uses: ./.github/actions/setup-dagger | |
| - name: Validate Renovate JSON | |
| run: | |
| task renovate:validate | |
| openshift-e2e: | |
| name: OpenShift E2E | |
| needs: | |
| - change-triage | |
| - core | |
| - operator | |
| - olm | |
| # OPENSHIFT_ENABLED gates the job on repositories that have the Red Hat | |
| # pull secret configured, so a repository without it skips the job instead | |
| # of failing to start the CRC cluster. | |
| # | |
| # The head-repository check is separate and necessary: on `pull_request` | |
| # the `vars` context resolves against the *base* repository, so a PR from a | |
| # fork would otherwise see OPENSHIFT_ENABLED and be dispatched — but fork | |
| # PRs receive no secrets, so REDHAT_PULL would be empty and CRC bring-up | |
| # would fail. Contributors can still run this job inside their own fork by | |
| # setting the variable and their own REDHAT_PULL secret. | |
| if: | | |
| needs.change-triage.outputs.run-openshift == 'true' && | |
| vars.OPENSHIFT_ENABLED == 'true' && | |
| (github.event_name != 'pull_request' || | |
| github.event.pull_request.head.repo.full_name == github.repository) | |
| permissions: | |
| contents: read | |
| packages: read | |
| uses: ./.github/workflows/openshift-e2e.yml | |
| with: | |
| catalog-artifact-name: klio-olm | |
| secrets: | |
| REDHAT_PULL: ${{ secrets.REDHAT_PULL }} |