redhat-cop/github-actions

Collection of GitHub Actions implementations

Repository Layout

This repository contains:

• standalone GitHub Actions that can be called from your workflows
• example workflows that you can copy into your own repositories

Included in this repo:

Actions

• chart-repo-pr-action
• confbatstest
• github-dispatches
• redhat-csp-download
• s2i
• set-helm-version
• ssh-agent
• disconected-csv

Workflows

Contributing

If you would like to contribute to this repository, you can do one of the following:

GitHub Action

If you have an action that you'd like to contribute, you can create a directory at the root of the repository and then create your action inside of there. This would look something like:

/my-awesome-action
  - action.yml
  - entrypoint.sh
  ... etc.

We're looking to keep the individual GitHub Actions at the root of this repository as it reduces the complexity of importing them into external workflows.

Workflows

If you have an example workflow that you would like to contribute, you can similarly create a new directory under the existing workflows directory. From there you can then add your content and descriptions, etc.

Note: For workflows, we're looking for something more than you can find in individual how-to's for a single action. The ideal workflow example would be pulling together sets of actions or multiple workflows to accomplish a larger goal.

github-actions's Issues

Create Operator CSV Action

Creation of a GitHub action to process a CSV to ensure it follows best practices:

• All images referenced by digest
• Sets related image field and environment variables
• Runtime data
  • containerImage annotation
  • createdAt annotation

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

• Update dependency cryptography to v43.0.1
• Update dependency argcomplete to v3.5.0
• Update dependency certifi to v2024.8.30
• Update dependency cffi to v1.17.1
• Update dependency cli/cli to v2.55.0
• Update dependency idna to v3.8
• Update dependency lxml to v5.3.0
• Update dependency zipp to v3.20.1
• Update github/codeql-action action to v3.26.6
• Update quay.io/skopeo/stable Docker tag to v1.16.1
• 🔐 Create all rate-limited PRs at once 🔐

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update dependency ansible-core to v2.17.3
• Update dependency helm/helm to v3.15.4
• Update dependency homebrew/openshift-cli to v4.16.9
• Update dependency importlib-resources to v6.4.4
• Update dependency pyyaml to v6.0.2
• Update dependency tomlkit to v0.13.2
• Update actions/upload-artifact action to v4.4.0
• Update dependency @eslint/js to v9.10.0
• Update dependency ansible to v10.3.0
• Update dependency open-policy-agent/opa to v0.68.0
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

ansible-galaxy

redhat-csp-download/ansible/requirements.yml

dockerfile

chart-repo-pr-action/Dockerfile

• registry.access.redhat.com/ubi9/ubi-minimal 9.4-1194@sha256:104cf11d890aeb7dd5728b7d7732e175a0e4018f1bb00d2faebcc8f6bf29bd52

confbatstest/Dockerfile

• ghcr.io/redhat-cop/github-actions/confbatstest v4.3@sha256:d8b6b83631370b1cfda8dd41865d4bfda17f81d1f0b626e7357a10aa465f278e

confbatstest/Dockerfile_build

• ghcr.io/plexsystems/konstraint v0.36.0@sha256:bd68202968e50ec54ef5385c2f854c43fad70e7556f27f0bce1fe93ec76ab517
• registry.access.redhat.com/ubi9/ubi 9.4-1181@sha256:1ee4d8c50d14d9c9e9229d9a039d793fcbc9aa803806d194c957a397cf1d2b17
• registry.access.redhat.com/ubi9/python-39 1-192@sha256:01c9e53b32acd96f9fe7781727140df6868c91ebc916ed95dc58999fbf4d8ddd

disconnected-csv/Dockerfile

• quay.io/skopeo/stable v1.15.2

github-dispatches/Dockerfile

• ghcr.io/redhat-cop/github-actions/github-dispatches v4.3@sha256:ab25a23e25232d5b4cccfdcc853440e24f6a26196edde3c5c99366885c87bba2

github-dispatches/Dockerfile_build

• registry.access.redhat.com/ubi9/ubi-minimal 9.4-1194@sha256:104cf11d890aeb7dd5728b7d7732e175a0e4018f1bb00d2faebcc8f6bf29bd52
• registry.access.redhat.com/ubi9/ubi-minimal 9.4-1194@sha256:104cf11d890aeb7dd5728b7d7732e175a0e4018f1bb00d2faebcc8f6bf29bd52

kyverno-cli/Dockerfile

• ghcr.io/redhat-cop/github-actions/kyverno-cli v4.3@sha256:0c25beba9cf2d26b3a7586b741d481d7ad168ec957b4660bea8faf47baf44128

kyverno-cli/Dockerfile_build

• registry.access.redhat.com/ubi9/ubi 9.4-1181@sha256:1ee4d8c50d14d9c9e9229d9a039d793fcbc9aa803806d194c957a397cf1d2b17
• registry.access.redhat.com/ubi9/python-39 1-192@sha256:01c9e53b32acd96f9fe7781727140df6868c91ebc916ed95dc58999fbf4d8ddd

redhat-csp-download/Dockerfile

• ghcr.io/redhat-cop/github-actions/redhat-csp-download v4.3@sha256:936c5330bb1a37ecf52c42fee06d31d8c573b929f55cf82d4ead47b3e6e26ad9

redhat-csp-download/Dockerfile_build

• registry.access.redhat.com/ubi9/python-312 1-20@sha256:3250ba83075131a0b21ae5da043c923f24c7694b811a1e987a2ef4b4b4b40caa

s2i/Dockerfile

• registry.access.redhat.com/ubi9/ubi-minimal 9.4-1194@sha256:104cf11d890aeb7dd5728b7d7732e175a0e4018f1bb00d2faebcc8f6bf29bd52

set-helm-version/Dockerfile

• registry.access.redhat.com/ubi9/python-39 1-192@sha256:01c9e53b32acd96f9fe7781727140df6868c91ebc916ed95dc58999fbf4d8ddd

github-actions

.github/workflows/confbatstest-build.yaml

• actions/checkout v4@692973e3d937129bcbf40652eb9f2f61becf3332
• redhat-cop/github-actions v4.3@1a584131f8a335296e866d1fb0988870ca83aefb
• hadolint/hadolint-action v3.1.0@54c9adbab1582c2ef04b2016b760714a4bfde3cf
• redhat-actions/buildah-build v2@7a95fa7ee0f02d552a32753e7414641a04307056
• redhat-actions/push-to-registry v2@5ed88d269cf581ea9ef6dd6806d01562096bee9c
• sigstore/cosign-installer v3@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20
• aquasecurity/trivy-action 0.24.0@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
• aquasecurity/trivy-action 0.24.0@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8
• slsa-framework/slsa-github-generator v2.0.0

.github/workflows/confbatstest.yaml

• actions/checkout v4@692973e3d937129bcbf40652eb9f2f61becf3332
• hadolint/hadolint-action v3.1.0@54c9adbab1582c2ef04b2016b760714a4bfde3cf

.github/workflows/disconnected-csv.yaml

• actions/checkout v4@692973e3d937129bcbf40652eb9f2f61becf3332
• hadolint/hadolint-action v3.1.0@54c9adbab1582c2ef04b2016b760714a4bfde3cf

.github/workflows/get-image-version.yaml

• actions/checkout v4@692973e3d937129bcbf40652eb9f2f61becf3332

.github/workflows/github-dispatches-build.yaml

• actions/checkout v4@692973e3d937129bcbf40652eb9f2f61becf3332
• redhat-cop/github-actions v4.3@1a584131f8a335296e866d1fb0988870ca83aefb
• hadolint/hadolint-action v3.1.0@54c9adbab1582c2ef04b2016b760714a4bfde3cf
• redhat-actions/buildah-build v2@7a95fa7ee0f02d552a32753e7414641a04307056
• redhat-actions/push-to-registry v2@5ed88d269cf581ea9ef6dd6806d01562096bee9c

.github/workflows/github-dispatches.yaml

• actions/checkout v4@692973e3d937129bcbf40652eb9f2f61becf3332
• hadolint/hadolint-action v3.1.0@54c9adbab1582c2ef04b2016b760714a4bfde3cf

.github/workflows/kyverno-cli-build.yaml

• actions/checkout v4@692973e3d937129bcbf40652eb9f2f61becf3332
• redhat-cop/github-actions v4.3@1a584131f8a335296e866d1fb0988870ca83aefb
• hadolint/hadolint-action v3.1.0@54c9adbab1582c2ef04b2016b760714a4bfde3cf
• redhat-actions/buildah-build v2@7a95fa7ee0f02d552a32753e7414641a04307056
• redhat-actions/push-to-registry v2@5ed88d269cf581ea9ef6dd6806d01562096bee9c

.github/workflows/kyverno-cli.yaml

• actions/checkout v4@692973e3d937129bcbf40652eb9f2f61becf3332
• hadolint/hadolint-action v3.1.0@54c9adbab1582c2ef04b2016b760714a4bfde3cf

.github/workflows/redhat-csp-download-build.yaml

• actions/checkout v4@692973e3d937129bcbf40652eb9f2f61becf3332
• redhat-cop/github-actions v4.3@1a584131f8a335296e866d1fb0988870ca83aefb
• hadolint/hadolint-action v3.1.0@54c9adbab1582c2ef04b2016b760714a4bfde3cf
• redhat-actions/buildah-build v2@7a95fa7ee0f02d552a32753e7414641a04307056
• redhat-actions/push-to-registry v2@5ed88d269cf581ea9ef6dd6806d01562096bee9c

.github/workflows/redhat-csp-download.yaml

• actions/checkout v4@692973e3d937129bcbf40652eb9f2f61becf3332
• hadolint/hadolint-action v3.1.0@54c9adbab1582c2ef04b2016b760714a4bfde3cf

.github/workflows/scorecard.yml

• actions/checkout v4.1.7@692973e3d937129bcbf40652eb9f2f61becf3332
• ossf/scorecard-action v2.4.0@62b2cac7ed8198b15735ed49ab1e5cf35480ba46
• actions/upload-artifact v4.3.4@0b2256b8c012f0828dc542b3febcab082c67f72b
• github/codeql-action v3.25.15@afb54ba388a7dca6ecae48f608c4ff05ff4cc77a

.github/workflows/set-helm-version.yaml

• actions/checkout v4@692973e3d937129bcbf40652eb9f2f61becf3332
• hadolint/hadolint-action v3.1.0@54c9adbab1582c2ef04b2016b760714a4bfde3cf

.github/workflows/ssh-agent-build.yaml

• actions/checkout v4@692973e3d937129bcbf40652eb9f2f61becf3332
• actions/setup-node v4@1e60f620b9541d16bece96c5465dc8ee9832be0b

.github/workflows/ssh-agent.yaml

• actions/checkout v4@692973e3d937129bcbf40652eb9f2f61becf3332

npm

ssh-agent/package.json

• @actions/core 1.10.1
• @eslint/eslintrc 3.1.0
• @eslint/js 9.8.0
• @vercel/ncc 0.38.1
• eslint-config-prettier 9.1.0
• globals 15.9.0
• prettier 3.3.3

pip_requirements

confbatstest/requirements.txt

• argcomplete ==3.4.0
• pyyaml ==6.0.1
• tomlkit ==0.13.0
• xmltodict ==0.13.0
• yq ==3.4.3

kyverno-cli/requirements.txt

• argcomplete ==3.4.0
• pyyaml ==6.0.1
• tomlkit ==0.13.0
• xmltodict ==0.13.0
• yq ==3.4.3

redhat-csp-download/ansible/requirements.txt

• ansible ==10.2.0
• ansible-core ==2.17.2
• certifi ==2024.7.4
• cffi ==1.16.0
• charset-normalizer ==3.3.2
• cryptography ==43.0.0
• idna ==3.7
• importlib-resources ==6.4.0
• jinja2 ==3.1.4
• lxml ==5.2.2
• markupsafe ==2.1.5
• packaging ==24.1
• pycparser ==2.22
• pyyaml ==6.0.1
• requests ==2.32.3
• resolvelib ==1.0.1
• urllib3 ==2.2.2
• zipp ==3.19.2

set-helm-version/requirements.txt

• ruamel-yaml ==0.18.6
• ruamel-yaml-clib ==0.2.8

regex

chart-repo-pr-action/Dockerfile

• cli/cli v2.53.0

confbatstest/Dockerfile_build

• helm/helm v3.15.3
• stedolan/jq 1.6
• homebrew/openshift-cli 4.16.4
• open-policy-agent/opa v0.67.0
• open-policy-agent/conftest v0.55.0

github-dispatches/Dockerfile_build

• stedolan/jq 1.6

kyverno-cli/Dockerfile_build

• helm/helm v3.15.3
• stedolan/jq 1.6
• homebrew/openshift-cli 4.16.4
• open-policy-agent/opa v1.9.0

---

• Check this box to trigger a request for Renovate to run again on this repository

[disconnected csv] - fix warning when building the container for this action

fix the current warning when building the container for this action:

WARNING: Running pip install with root privileges is generally not a good idea. Try `pip3 install --user` instead.

Should we try to merge this stuff into the "upstream" / official Red Hat actions repo

https://github.com/redhat-actions is the new home for official actions. How much of the work here could be moved towards this official source for red hattishnes?

github action for checking branch refs

Similar to WIP action, but warns people about the fact that their branch ref might need to change on their merge.

Even better would be to do the branch ref change on merge for people, but not sure that's possible

How to handle releases per action?

What are peoples thoughts on how we do GitHub releases for this repo? I am presuming each release would follow a naming of:

• {action-name}-{verison}

i.e.: confbatstest-1.1.0

but thought I'd see if anyone else has other ideas?

cc @tylerauerbeck @jacobsee @pabrahamsson

Does the ci-bot need enabling?

OWNERS file exists but the bot doesnt seem to be enabled. Something manually needed to be done @pabrahamsson ?

disconnected-csv github action failing - ruamel.yaml round_trip_load deprecated

There appears to be a deprecated function in ruamel.yaml python package causing release PRs to fail.

The error: https://github.com/redhat-cop/vault-config-operator/actions/runs/6658073094/job/18094709725

Traceback (most recent call last):
  File "//add_related_image.py", line 19, in <module>
    csv = yaml.round_trip_load(stream)
          ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/github/lib/python3.11/site-packages/ruamel/yaml/main.py", line 1113, in round_trip_load
    error_deprecation('round_trip_load_all', 'load')
  File "/home/github/lib/python3.11/site-packages/ruamel/yaml/main.py", line 1025, in error_deprecation
    raise AttributeError(s, name=None)
AttributeError: 
"round_trip_load_all()" has been removed, use

  yaml = YAML()
  yaml.load(...)

Notes:
Deprecation line: https://github.com/redhat-cop/github-actions/blob/master/disconnected-csv/add_related_image.py#L19
Latest ruamel.yaml package appears to be 0.18.2
Docs: https://yaml.readthedocs.io/en/latest/api/

Support additional tag options in the S2I action

We may want to push multiple tags sometimes, so we should support options for this.

i.e. always push latest in addition to the specified tag, something tagged v1.2 might also want to push v1, etc

[disconnected csv] - RFE - allow any environment variable to reference images

currently this action expects variable referencing images to start with a prefix referenced by: RELATED_IMAGE_ENV_PREFIX.
This approach might be hard to use for preexisting operators. Allow for additional logic:

1. provide a list of environment variables that reference images.
2. scan for environment variable values and consider those that match to an image, via regexp.
   The user should be able to activate either or all of those approaches.

[disconnected-csv] - RFE - provide this action via prebuilt image

currently when this action is used a step is added to the pipeline to build the container for this action:

Build container for action use: '/home/runner/work/_actions/redhat-cop/github-actions/master/disconnected-csv/Dockerfile'.

please provide a way to use a prebuilt container, this will save time in every build.

s2i test

Not sure if anything was agreed, so opening this to track:

• #12 (comment)