nightly: add OCP+Regal builds to catch breaking changes (#8460)

* nightly: add OCP build to catch breaking changes Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> * nightly: add Regal build + e2e test run w/ opa main Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> * .github: Add linter ignores for secrets-outside-env. Signed-off-by: Philip Conrad <philip@chariot-chaser.net> --------- Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com> Signed-off-by: Philip Conrad <philip@chariot-chaser.net> Co-authored-by: Philip Conrad <philip@chariot-chaser.net>
2026-08-12 19:32:48 -06:00 · 2026-04-01 08:23:49 +02:00
parent fa913dd5d3
commit bad337a637
5 changed files with 163 additions and 42 deletions
@@ -15,13 +15,13 @@ jobs:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
-          token: ${{ secrets.GH_PUSH_TOKEN }}
+          token: ${{ secrets.GH_PUSH_TOKEN }} # zizmor: ignore[secrets-outside-env]
          persist-credentials: false

      - name: Get latest Regal release
        id: latest
        env:
-          GH_TOKEN: ${{ secrets.GH_PUSH_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_PUSH_TOKEN }} # zizmor: ignore[secrets-outside-env]
        run: |
          LATEST_VERSION=$(gh api repos/open-policy-agent/regal/releases/latest --jq '.tag_name')
          echo "version=$LATEST_VERSION" >> $GITHUB_OUTPUT
@@ -115,7 +115,7 @@ jobs:
      - name: Create pull request
        if: steps.check.outputs.needed == 'true' && steps.changes.outputs.has_changes == 'true'
        env:
-          GH_TOKEN: ${{ secrets.GH_PUSH_TOKEN }}
+          GH_TOKEN: ${{ secrets.GH_PUSH_TOKEN }} # zizmor: ignore[secrets-outside-env]
          STEPS_LATEST_OUTPUTS_VERSION: ${{ steps.latest.outputs.version }}
        run: |
          VERSION="${STEPS_LATEST_OUTPUTS_VERSION}"
@@ -4,9 +4,9 @@ on:
  schedule:
    - cron:  '0 8 * * 0-4' # Sun-Thu, at 8:00 UTC

-permissions: 
+permissions:
  contents: read
-  
+
 jobs:
  race-detector:
    name: Go Race Detector
@@ -22,11 +22,9 @@ jobs:

      - name: Slack Notification
        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
        with:
-          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
          webhook-type: incoming-webhook
          payload: |
            {
@@ -60,11 +58,9 @@ jobs:

      - name: Slack Notification
        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
        with:
-          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
          webhook-type: incoming-webhook
          payload: |
            {
@@ -88,11 +84,9 @@ jobs:

      - name: Slack Notification
        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
        with:
-          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
          webhook-type: incoming-webhook
          payload: |
            {
@@ -119,11 +113,142 @@ jobs:

      - name: Slack Notification
        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
        with:
-          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
+          webhook-type: incoming-webhook
+          payload: |
+            {
+              "text": "Nightly check failed: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} - ${{ github.job }}>"
+            }
+
+  test-ocp-with-opa-main:
+    name: Test OCP with OPA main
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Check out OPA code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: opa
+
+      - id: go_version
+        name: Read go version
+        run: echo "go_version=$(cat opa/.go-version)" >> $GITHUB_OUTPUT
+
+      - name: Install Go (${{ steps.go_version.outputs.go_version }})
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version: ${{ steps.go_version.outputs.go_version }}
+
+      - name: Get latest OCP release tag
+        id: ocp_release
+        run: |
+          tag=$(gh api repos/open-policy-agent/opa-control-plane/releases/latest --jq '.tag_name')
+          echo "tag=$tag" >> $GITHUB_OUTPUT
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+      - name: Check out OCP ${{ steps.ocp_release.outputs.tag }}
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: open-policy-agent/opa-control-plane
+          ref: ${{ steps.ocp_release.outputs.tag }}
+          persist-credentials: false
+          path: ocp
+
+      - name: Update OPA to main
+        working-directory: ocp
+        run: |
+          go mod edit -replace github.com/open-policy-agent/opa=../opa
+          go mod tidy
+
+      - name: Build
+        working-directory: ocp
+        run: make build
+
+      - name: Test
+        working-directory: ocp
+        run: make test
+
+      - name: e2e tests
+        working-directory: ocp
+        run: |
+          set -euo pipefail
+          matches=(opactl_*)
+          export OPACTL="$(pwd)/${matches[0]}"
+          $OPACTL version
+          go test -tags=e2e ./e2e/... -v
+
+      - name: Slack Notification
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
+        with:
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
+          webhook-type: incoming-webhook
+          payload: |
+            {
+              "text": "Nightly check failed: <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|${{ github.workflow }} - ${{ github.job }}>"
+            }
+
+  test-regal-with-opa-main:
+    name: Test Regal with OPA main
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Check out OPA code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          path: opa
+
+      - id: go_version
+        name: Read go version
+        run: echo "go_version=$(cat opa/.go-version)" >> $GITHUB_OUTPUT
+
+      - name: Install Go (${{ steps.go_version.outputs.go_version }})
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        with:
+          go-version: ${{ steps.go_version.outputs.go_version }}
+
+      - name: Get latest Regal release tag
+        id: regal_release
+        run: |
+          tag=$(gh api repos/open-policy-agent/regal/releases/latest --jq '.tag_name')
+          echo "tag=$tag" >> $GITHUB_OUTPUT
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+      - name: Check out Regal ${{ steps.regal_release.outputs.tag }}
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: open-policy-agent/regal
+          ref: ${{ steps.regal_release.outputs.tag }}
+          persist-credentials: false
+          path: regal
+
+      - name: Update OPA to main
+        working-directory: regal
+        run: |
+          go mod edit -replace github.com/open-policy-agent/opa=../opa
+          go mod tidy
+
+      - name: Build
+        working-directory: regal
+        run: go build -tags=regal_standalone
+
+      - name: Test
+        working-directory: regal
+        run: go test ./...
+
+      - name: e2e tests
+        working-directory: regal
+        run: go test -tags e2e ./e2e -count=1
+
+      - name: Slack Notification
+        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
+        with:
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
          webhook-type: incoming-webhook
          payload: |
            {
@@ -170,11 +295,9 @@ jobs:

      - name: Slack Notification
        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
        with:
-          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
          webhook-type: incoming-webhook
          payload: |
            {
@@ -18,7 +18,7 @@ jobs:
      - name: Check out code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
-          token: ${{ secrets.GH_PUSH_TOKEN }} # required to push to protected branch below
+          token: ${{ secrets.GH_PUSH_TOKEN }} # zizmor: ignore[secrets-outside-env] required to push to protected branch below
          persist-credentials: true

      - name: Generate
@@ -194,12 +194,12 @@ jobs:

      - name: Deploy OPA Edge
        env:
-          DOCKER_USER: ${{ secrets.DOCKER_USER }}
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }}
-          S3_RELEASE_BUCKET: ${{ secrets.S3_RELEASE_BUCKET }}
+          DOCKER_USER: ${{ secrets.DOCKER_USER }} # zizmor: ignore[secrets-outside-env]
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }} # zizmor: ignore[secrets-outside-env]
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} # zizmor: ignore[secrets-outside-env]
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} # zizmor: ignore[secrets-outside-env]
+          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }} # zizmor: ignore[secrets-outside-env]
+          S3_RELEASE_BUCKET: ${{ secrets.S3_RELEASE_BUCKET }} # zizmor: ignore[secrets-outside-env]
        # Only run if required secrets are provided
        if: ${{ env.S3_RELEASE_BUCKET && env.AWS_ACCESS_KEY_ID && env.AWS_SECRET_ACCESS_KEY && env.DOCKER_USER && env.DOCKER_PASSWORD }}
        run: make deploy-ci
@@ -216,9 +216,9 @@ jobs:

      - name: Build and Push opa-wasm-builder
        env:
-          DOCKER_USER: ${{ secrets.DOCKER_USER }}
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          DOCKER_WASM_BUILDER_IMAGE: ${{ secrets.DOCKER_WASM_BUILDER_IMAGE }}
+          DOCKER_USER: ${{ secrets.DOCKER_USER }} # zizmor: ignore[secrets-outside-env]
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }} # zizmor: ignore[secrets-outside-env]
+          DOCKER_WASM_BUILDER_IMAGE: ${{ secrets.DOCKER_WASM_BUILDER_IMAGE }} # zizmor: ignore[secrets-outside-env]
        # Only run if required secrets are provided
        if: ${{ env.DOCKER_USER && env.DOCKER_PASSWORD }}
        run: make push-wasm-builder-image
@@ -136,9 +136,9 @@ jobs:
      - name: Build and Deploy OPA Docker Images
        id: build-and-deploy
        env:
-          DOCKER_USER: ${{ secrets.DOCKER_USER }}
-          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
-          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }}
+          DOCKER_USER: ${{ secrets.DOCKER_USER }} # zizmor: ignore[secrets-outside-env]
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }} # zizmor: ignore[secrets-outside-env]
+          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }} # zizmor: ignore[secrets-outside-env]
        # Only run if required secrets are provided
        if: ${{ env.DOCKER_USER && env.DOCKER_PASSWORD }}
        run: make release-ci
@@ -49,11 +49,9 @@ jobs:

      - name: Slack Notification
        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != '' }}
+        if: ${{ failure() && secrets.SLACK_WEBHOOK_URL != '' }} # zizmor: ignore[secrets-outside-env]
        with:
-          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }}
+          webhook: ${{ secrets.SLACK_NOTIFICATION_WEBHOOK }} # zizmor: ignore[secrets-outside-env]
          webhook-type: incoming-webhook
          payload: |
            {