This removal is primarily cost motivated. We will continue to have scheduled scans executed by ossfuzz, but for now we are disabling this job from our PR / merge queue workflows.
* Adds bypass for lint go for RFD and Docs changes.
* spacing
* Update docs test to only check for docs, examples changes or bypass
* include merge groups
* test docs change
* remove change
* Test go change
* remove go test change
* test doc changes
* remove docs test change
* fix indentation
* fix indentation
This makes two changes:
* Reduces action instance type to 16 cores. This will half the cost without a significant speed difference
* Switch from `make full` to CodeQL Auto Build. This speeds up the build by about 10 minutes. I confirmed there is not a reduction in the scan coverage
This PR implements the core of the kube-agent-updater, which is part of
https://github.com/gravitational/teleport/issues/21516#issue-1576935859
In order to have a fully working updater we still need to:
- implement the interfaces for version retrieval, image validation and maintenance trigger
- add statefulset support (and deal with the potential deadlocks)
- implement the CI and release pipeline (Dockerfile, README, Makefile, github action, drone)
- integrate in the `teleport-kube-agent` helm chart
Those changes will happen in subsequent PRs.
* Skip building webassets in CI
Building webassets is not always needed and many of our CI build just builds them and ends up not using them after.
This PR skips building the webassets for all pipelines where they are not needed. This should save us some time and $$.
* Make some changes to trigger CI
* Create the missing directory
We still plan to address this root issue, and are tracking making CodeQl faster so it can be a required PR check: https://github.com/gravitational/SecOps/issues/269
However, until then we need to switch this job to be a scheduled task rather than on every PR and push. This is partly cost motivated, but also we are already hitting our timeouts. This PR also increases the analysis timeout so that the daily job can be sure to complete.
* Unify x86/AMD64 build process
Currently, our ARM64 pipeline builds limited subset of Teleport features as none of the 3rd party dependencies (openssh, libbpf etc) are not built on AMR64. This change build all dependencies on AMR64 in the same way as we do on x86.
FIPS changes are not included as we do not support FIPS on ARM64.
* Apply suggestions from code review
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
---------
Co-authored-by: Roman Tkachenko <roman@goteleport.com>
Moving our CentOS build assets, aka Clang-10 is the first step to enabling our full Teleport to build on ARM64. This change should also save us some $$ as getting the assets from S3 sounds expensive.
* Run go mod tidy in CI
* Update e_imports.go
* Use git diff on just go.mod/go.sum, tidy api too
* Fix the e_imports list by accomodating build tags
* Wording
* Simplify commands in the workflow
* Delete go.sum before go mod tidy
* Shell suggestions
* Fix missing saml imports for upcoming PRs
* Initial pass at lint and test GHA for UI.
* Fix lint
* Add --frozen-lockfile
* Skip the e directory if it doesn't exist while linting.
* Update failing snapshots.
* use a more reasonable filter for eslint to support missing e
* ignore type check on e imports.
* ignore failing file that requires e teleterm file.
* fix lint
* quiet down the log output for prettier-write.
* Add check if protos are up to date.
A new check has been added that will detect if protobufs are up to date. The
script will exit abnormally if protobufs need to be regenerated.
* Alan's feedback.
* Restoring the script.
* Update script comment.
* Add in the set -eu.
* Add a comment for the pull_request/merge_group bit in the new github action.
* Remove helper script.
* Reduce the runner size.
In the past, we've mistakenly introduced dependencies on a newer
Go version than what the API module declares as its minimum
required version.
To prevent this from happening in the future, this job will build
the API with the version of Go declared by the API.
These workflows need to be able to check org membership
for the PR author in order to determine whether or not
the author is an internal employee. This information is
only available when authenticated.
- Determine Go version for cache key automatically instead of hardcoding.
- Do not build ghcr CI images (etcd and buildboxes) on PRs to avoid unintended breakages.
- Only build/push them on push events which mirrors our current Drone setup. We might add ability to trigger them manually via workflow_dispatch events later.
- Add release branches pattern for buildbox images trigger as well.
- Remove packages: read permission from test jobs since buildbox images are now public.
Signed-off-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: Victor Sokolov <gzigzigzeo@gmail.com>
* Include Go version in the cache key to prevent cache reuse when upgrading Go.
* Push buildboxes to Github container registry to avoid public ECR rate limiting.
Signed-off-by: Roman Tkachenko <roman@goteleport.com>
Co-authored-by: Victor Sokolov <gzigzigzeo@gmail.com>
The CI fuzz artifacts upload will now work as expected. The artifacts produced
by oss-fuzz were (partially) chmodded 600 and owned by root, so an explicit
chmod step has been added to the cifuzz workflow.
Mike Jensen