fix: security advisories #733
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| ############################################################################## | |
| # pr-preview-destroy workflow | |
| ############################################################################## | |
| name: pr-preview-destroy | |
| on: | |
| schedule: | |
| - cron: '0 0 * * *' | |
| pull_request: | |
| types: [closed, unlabeled] | |
| permissions: {} | |
| jobs: | |
| ############################################################################ | |
| # PR Preview Destroy Job | |
| ############################################################################ | |
| pr-preview-destroy: | |
| name: pr-preview-destroy | |
| if: >- | |
| (github.event_name == 'schedule' || github.event_name == 'pull_request') && | |
| (github.event.action == 'unlabeled' && (contains(github.event.label.name, 'pr-preview-threshold') || | |
| contains(github.event.label.name, 'pr-preview-centralized') || | |
| contains(github.event.label.name, 'pr-preview-thresholdWithEnclave') || | |
| contains(github.event.label.name, 'pr-preview-centralizedWithEnclave'))) || | |
| (github.event.action == 'closed' && | |
| (contains(toJSON(github.event.pull_request.labels.*.name), 'pr-preview-threshold') || | |
| contains(toJSON(github.event.pull_request.labels.*.name), 'pr-preview-centralized') || | |
| contains(toJSON(github.event.pull_request.labels.*.name), 'pr-preview-thresholdWithEnclave') || | |
| contains(toJSON(github.event.pull_request.labels.*.name), 'pr-preview-centralizedWithEnclave'))) | |
| runs-on: runs-on=github.run_id/runner=16cpu-linux-x64/spot=false | |
| timeout-minutes: 1800 | |
| # Environment variables used throughout the job | |
| env: | |
| NAMESPACE: 'kms-ci-${{ github.actor }}-${{ github.event.pull_request.number }}' | |
| steps: | |
| # ====================================================================== | |
| # TOOLING SETUP | |
| # ====================================================================== | |
| - name: Setup tailscale | |
| uses: tailscale/github-action@84a3f23bb4d843bcf4da6cf824ec1be473daf4de # v3.2.3 | |
| with: | |
| oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }} | |
| oauth-secret: ${{ secrets.TS_OAUTH_SECRET }} | |
| tags: tag:kms-ci | |
| - name: Setup helm | |
| run: | | |
| curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash | |
| export PATH=$PATH:/usr/local/bin | |
| - name: setup kubectl | |
| uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede | |
| # ====================================================================== | |
| # KUBERNETES CONFIG & DESTROY NAMESPACE | |
| # ====================================================================== | |
| - name: Setup kubeconfig | |
| run: | | |
| ################################################################### | |
| # Configure kubeconfig to connect to the Tailscale Kubernetes cluster | |
| ################################################################### | |
| echo "Configuring kubeconfig for Tailscale cluster..." | |
| tailscale configure kubeconfig tailscale-operator-zws-dev.diplodocus-boa.ts.net | |
| - name: Destroy namespace | |
| if: github.event_name != 'schedule' | |
| run: | | |
| ################################################################### | |
| # Destroy namespace | |
| ################################################################### | |
| if kubectl get namespace "${NAMESPACE}" > /dev/null 2>&1; then | |
| echo "Namespace ${NAMESPACE} exists" | |
| echo "Destroying namespace ${NAMESPACE}..." | |
| helm list -n "${NAMESPACE}" --short | xargs -L1 helm uninstall -n "${NAMESPACE}" | |
| kubectl delete namespace "${NAMESPACE}" --grace-period=1 --timeout=5s --wait=false | |
| echo "Waiting for namespace to be destroyed..." | |
| kubectl wait --for=delete namespace/"${NAMESPACE}" --timeout=120s | |
| echo "Namespace ${NAMESPACE} destroyed" | |
| kubectl get namespace | |
| else | |
| echo "Namespace ${NAMESPACE} does not exist" | |
| exit 0 | |
| fi | |
| - name: Find namespaces to destroy | |
| if: github.event_name == 'schedule' | |
| id: find-namespaces-to-destroy | |
| run: | | |
| echo "Finding namespaces to destroy..." | |
| echo "namespaces=$(kubectl get namespaces -o json | jq -r '.items[] | select(.metadata.name | startswith("kms-ci-")) | .metadata.name')" >> "$GITHUB_OUTPUT" | |
| - name: Destroy namespaces | |
| if: github.event_name == 'schedule' | |
| env: | |
| NAMESPACES: ${{ steps.find-namespaces-to-destroy.outputs.namespaces }} | |
| run: | | |
| echo "Destroying namespaces: $NAMESPACES" | |
| for namespace in $(echo "$NAMESPACES" | tr ',' '\n'); do | |
| echo "Destroying namespace: $namespace" | |
| helm list -n "${namespace}" --short | xargs -L1 helm uninstall -n "${namespace}" | |
| kubectl delete namespace "${namespace}" --grace-period=1 --timeout=5s --wait=false | |
| echo "Waiting for namespace to be destroyed..." | |
| kubectl wait --for=delete namespace/"${namespace}" --timeout=120s | |
| echo "Namespace ${namespace} destroyed" | |
| done |