Skip to content

chore(deps): update prom/prometheus docker tag to v3.1.0 #168

chore(deps): update prom/prometheus docker tag to v3.1.0

chore(deps): update prom/prometheus docker tag to v3.1.0 #168

Workflow file for this run

name: ci
concurrency:
cancel-in-progress: ${{ ! startsWith(github.ref, 'refs/tags/v') }}
group: ci-${{ github.ref_name }}-${{ github.event_name }}
on:
push:
branches:
- main
tags:
- "v*"
pull_request:
branches:
- main
env:
ANSIBLE_FORCE_COLOR: "1"
PY_COLORS: "1"
jobs:
trivy:
if: github.event_name == 'push' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
scan-type:
- fs
- config
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Cache trivy db
uses: actions/cache@v4
with:
path: |
~/.cache/trivy
~/work/temp
key: ${{ runner.os }}-trivy-db-${{ hashFiles('**/trivy.yaml') }}
restore-keys: |
${{ runner.os }}-trivy-db-
- name: Run Trivy vulnerability scanner in fs mode
uses: aquasecurity/trivy-action@master
with:
format: sarif
ignore-unfixed: true
output: trivy-results.sarif
scan-ref: .
scan-type: ${{ matrix.scan-type }}
severity: CRITICAL,HIGH
token-setup-trivy: ${{ secrets.GH_PAT }}
trivy-config: trivy.yaml
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: "trivy-results.sarif"
test:
if: github.event_name == 'push' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
permissions:
contents: read
services:
prometheus:
image: prom/prometheus:v3.1.0
ports:
- 9090:9090
loki:
image: grafana/loki:3.3.1
ports:
- 3100:3100
strategy:
fail-fast: false
matrix:
role:
- haproxy
- kratos
- node_exporter
- oathkeeper
- promtail
- pushgateway
- vmagent
env:
VMAGENT_REMOTE_WRITE_URL: http://localhost:9090/api/v1/write
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Check ansible
run: ansible --version
- name: Cache Ansible collections
uses: actions/cache@v4
with:
path: |
~/.ansible/collections
~/.ansible/plugins
key: ${{ runner.os }}-ansible-${{ hashFiles('**/requirements.yml') }}
restore-keys: |
${{ runner.os }}-ansible-
- name: Prepare localhost inventory
run: |
cat << 'EOF' > localhost.yml
all:
hosts:
localhost:
ansible_connection: local
EOF
- name: Install the dependencies
run: |
ansible-galaxy collection install -r requirements.yml
ansible-galaxy collection install ./
- name: Ansible playbook
run: ansible-playbook playbook.yml -i localhost.yml -t ${{ matrix.role }}
release-please:
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
runs-on: ubuntu-latest
outputs:
releases_created: ${{ steps.release-please.outputs.releases_created }}
tag_name: ${{ steps.release-please.outputs.tag_name }}
permissions:
contents: write
pull-requests: write
steps:
- id: release-please
name: Release please
uses: googleapis/release-please-action@v4
with:
release-type: simple
publish-galaxy:
needs:
- test
- release-please
if: needs.release-please.outputs.releases_created == 'true'
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- name: Checkout code
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Build collection
run: ansible-galaxy collection build
- id: publish
name: Publish to Ansible Galaxy
run: |
namespace=$(yq -r .namespace galaxy.yml)
name=$(yq -r .name galaxy.yml)
version=$(yq -r .version galaxy.yml)
if [ v"$version" != "${{ needs.release-please.outputs.tag_name }}" ]; then
echo "Version in galaxy.yml ($version) does not match git tag (${{ needs.release-please.outputs.tag_name }})"
exit 1
fi
ansible-galaxy collection publish \
$namespace-$name-$version.tar.gz \
--token ${{ secrets.ANSIBLE_GALAXY_TOKEN }}
echo "asset=$namespace-$name-$version.tar.gz" >> $GITHUB_OUTPUT
ansible-lint:
if: github.event_name == 'push' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Run ansible-lint
uses: ansible/ansible-lint@main
with:
setup_python: "true"
requirements_file: requirements.yml
sonarcloud:
if: github.event_name == 'push' || github.event_name == 'pull_request'
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: SonarCloud Scan
uses: SonarSource/sonarcloud-github-action@master
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}