Repository navigation
(deploy) added the exav helm chart #5
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,7 @@ | ||
| chart-dirs: | ||
| - deploy/helm | ||
| # The chart version comes from the git tag at publish time, not from a bump | ||
| # in each commit, so ct must not require a version increment here. | ||
| check-version-increment: false | ||
| validate-maintainers: false | ||
| target-branch: main |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| # Lint and (on version tags) publish the Helm chart. | ||
| # | ||
| # `lint` runs on every push/PR: it runs `ct lint`, then `make test-helm`, the | ||
| # same render checks a contributor runs locally. `publish` runs only on `v*` | ||
| # tags: it checks the tag against the workspace version in Cargo.toml, then | ||
| # pushes the chart to ghcr.io as an OCI artifact. Install with: | ||
| # helm install exav oci://ghcr.io/sylvinus/exav-chart --version <X.Y.Z> \ | ||
| # --set 'signatures.sources={https://mirror.example/db/}' | ||
| name: helm | ||
|
|
||
| on: | ||
| push: | ||
| branches: [main] | ||
| tags: ["v*"] | ||
| pull_request: | ||
|
|
||
| permissions: | ||
| contents: read | ||
|
|
||
| jobs: | ||
| lint: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: sed -n '1,100p' .github/workflows/helm.yml
rg -n 'permissions:|persist-credentials|git (push|fetch|tag|checkout|submodule)' .github/workflows/helm.ymlRepository: sylvinus/exav Length of output: 2473 🏁 Script executed: printf '%s\n' '--- Makefile test-helm target ---'
rg -n -A12 -B4 '^test-helm([: ]|$)|git (push|fetch|tag|checkout|submodule)|git config|GITHUB_TOKEN|GH_TOKEN' Makefile .github .gitignore 2>/dev/null
printf '%s\n' '--- workflow post-checkout commands ---'
sed -n '20,100p' .github/workflows/helm.ymlRepository: sylvinus/exav Length of output: 9669 🏁 Script executed: wc -l scripts/test-helm.sh
cat -n scripts/test-helm.shRepository: sylvinus/exav Length of output: 2736 Disable persisted checkout credentials in both jobs.
The publish job's Proposed fix - uses: actions/checkout@v7
with:
fetch-depth: 0 # ct needs history to diff the target branch
+ persist-credentials: false
...
- - uses: actions/checkout@v7
+ - uses: actions/checkout@v7
+ with:
+ persist-credentials: false🧰 Tools🪛 zizmor (1.30.0)[warning] 24-26: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false (artipacked) 🤖 Prompt for AI Agents |
||
| with: | ||
| fetch-depth: 0 # ct needs history to diff the target branch | ||
| - uses: azure/setup-helm@v5 | ||
| - uses: helm/chart-testing-action@v2.8.0 | ||
| - name: ct lint | ||
| run: ct lint --all --config .github/ct.yaml | ||
| - run: make test-helm | ||
|
|
||
| publish: | ||
| needs: lint | ||
| if: startsWith(github.ref, 'refs/tags/v') | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| contents: read | ||
| packages: write # push to ghcr.io | ||
| steps: | ||
| - uses: actions/checkout@v7 | ||
| - uses: azure/setup-helm@v5 | ||
| - name: Verify the tag matches the workspace version | ||
| run: | | ||
| set -euo pipefail | ||
| tag_version="${GITHUB_REF_NAME#v}" | ||
| cargo_version=$(sed -n '/^\[workspace\.package\]/,/^\[/{s/^version = "\(.*\)"$/\1/p}' Cargo.toml | head -n1) | ||
| if [ "$tag_version" != "$cargo_version" ]; then | ||
| echo "tag version ($tag_version) does not match Cargo.toml workspace version ($cargo_version)" >&2 | ||
| exit 1 | ||
| fi | ||
| echo "CHART_VERSION=$tag_version" >> "$GITHUB_ENV" | ||
| - name: Log in to ghcr.io | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
| GH_ACTOR: ${{ github.actor }} | ||
| run: echo "$GH_TOKEN" | helm registry login ghcr.io --username "$GH_ACTOR" --password-stdin | ||
| - name: Package and push the chart | ||
| run: | | ||
| set -euo pipefail | ||
| v="$CHART_VERSION" | ||
| owner="${GITHUB_REPOSITORY_OWNER,,}" | ||
| helm package deploy/helm/exav-chart --version "$v" --app-version "$v" -d dist | ||
| helm push "dist/exav-chart-$v.tgz" "oci://ghcr.io/$owner" | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| ci/ | ||
| *.tgz | ||
| .git/ | ||
| .gitignore | ||
| *.swp | ||
| *.bak | ||
| *.tmp | ||
| *.orig | ||
| .DS_Store | ||
| .vscode/ | ||
| .idea/ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| apiVersion: v2 | ||
| name: exav-chart | ||
| description: A Helm chart that deploys exav, a clamd- and ICAP-compatible malware scanner. | ||
| type: application | ||
| version: 0.0.0 | ||
| appVersion: 0.0.0 | ||
| kubeVersion: ">=1.25.0-0" | ||
| home: https://exav.org | ||
| icon: https://exav.org/favicon.svg | ||
| sources: | ||
| - https://github.com/sylvinus/exav | ||
| keywords: | ||
| - antivirus | ||
| - clamav | ||
| - clamd | ||
| - icap | ||
| - malware |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🔎 Supported by static analysis
🏁 Script executed:
Repository: sylvinus/exav
Length of output: 1145
Configure the YARA oracle for this job.
make test-yara-diffskips and exits successfully whenEXAV_YR_BINis unset. The workflow does not configureEXAV_YR_BINor installyara-x-cli, so the job can pass without running the differential tests. Installyara-x-cli, setEXAV_YR_BINtoyr, or make the missing oracle fail the job.🧰 Tools
🪛 zizmor (1.30.0)
[warning] 53-53: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[warning] 1-153: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
[warning] 50-56: overly broad permissions (excessive-permissions): default permissions used due to no permissions: block
(excessive-permissions)
🤖 Prompt for AI Agents