This commit updates the `upload-artifact` and `download-artifact`
Github actions to the latest version (v4), which should eliminate
the deprecation warning spam we're seeing in CI.
Note: We had to break up the merged "binaries" target into multiple,
smaller targets, which are grouped by OS for the `post-tag` and
`post-merge` workflows, and by OS + arch for the `pull-request`
workflow.
Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
This commit adds a config for yamllint, mass-reformats all of
the existing Yaml testcases to pass linting, and adds a Yaml
linting job to the pull-request Github Actions workflow. A few
careful exceptions and ignores were added to the linter's
config to allow keeping our existing Yaml files with minimal
reformatting.
Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
This PR makes it possible to browse integrations, organizations and related softwares. Previously, these details were only available as modals on the ecosystem page.
There are also some changes to the policy enforcement on the docs content, the validation rules are much the same but have been updated to reflect that the content is stored in a new place. I have used some generated JSON in Hugo rather than using GitHub api requests to validate the files since it's A) faster, B) I think more simple, and C) easier to get Hugo to process the markdown frontmatter.
Much of the hackery in this PR (Hugo function partials to look up sets of files and get the data from them) is due to the fact that we can't use Hugo's native sections feature. All of our content is nested under docs, this means that all our pages are in the same section so custom lookups have been implemented as function partials instead to work around this.
Signed-off-by: Charlie Egan <charlie@styra.com>
Few people ever look at the output of this, and yet everyone has to wait
for it. Let's change that.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This is a bit of a bag of a few smaller things:
* workflows/nightly: skip imported gqlparser package.json
It is not used anywhere.
* .trivyignore: remove docker CVE
This has been bumped away when updating ORAS.
* website/livescripts: bump minimatch
This also updated the lockfile version... I think that's OK.
* workflows/pull-request: don't setup opa for docker image smoke test
* address netlify ignore script failure on large output
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
It had slipped my mind that those need docker, too. Previously, I've disabled
docker for those tests to avoid having them rebuild their wasm artifacts.
The wasm/Makefile change is superficial, and just meant to ensure we run this
test while the PR is WIP. Changes to .github/workflow/* alone won't trigger the
wasm tests.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* ci: remove quick-fuzz, guard wasm tests on changed files
This is a first step into running less things all the time that don't need to
be run all the time.
It's a heuristic, and as such fallible: there could always be changes that
break something in the wasm code path, because I have forgotten that there's a
dependency of some sort.
Removing the quick-fuzz target, it's never brought any issues up; and still
runs in nightly tests.
* ci: cancel previous run for PRs
From https://stackoverflow.com/a/72408109/993018.
* ci: avoid rebuilding wasm
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
ubuntu-18.04 was causing our builds to break, in a scheduled brownout.
All references to either ubuntu-latest or ubuntu-18.04 are now ubuntu-22.04.
(I figured it's better to control the version in all places.)
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
With this, we'll build our container images and binaries using golang 1.19.
Also, the go.mod version stanza is increased, letting us use go1.17+ features.
I had to run
go mod tidy -go=1.16 && go mod tidy -go=1.17
to get rid of `go mod tidy` related messages, and ran `go mod vendor`
afterwards.
* prometheus: adjust tests for new go1.19 metrics
Note that the new metrics only appear when using the Go runtime of 1.19. So,
we do the same we've done before when 1.17 brought in new metrics: add them
to the tests, and use build flags to not run the tests in the previous versions.
When the bump of github.com/prometheus/go_client to 1.13.0 was merged, it was
properly tested with all of 1.17 and 1.18. So, the previously expected metrics
should be there when using OPA from 1.17 or 1.18.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
To be brought back eventually; for now, it is just randomly failing.
We haven't been touching the Wasm interface in a while, so this test
isn't urgently needed these days.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* builtin_metadata: add v0.41.0 manually
We'll figure out how to do this in the release process, but for now, this
is enough to not have the builtin_metadata.json change appear in each PR.
* ci: pin last release of npm-opa-wasm
This is temporary; I don't want to deal with this right now.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* topdown: fix TestRego: run for all go versions, excluding the x509 error
That error has a different message on go1.16.
The previous attempt to exclude them from running caused _all tests_
to not be run.
* topdown_test/TestTopDownQueryCancellationEvery: up wait time for macos flakey tests
We've often seen this fail with "0 notes". Waiting for 10x the time
we previous waited for still seems to do the trick but should
hopefully remove the amount of failures we see in CE because of
slow macos runners.
* ci: don't run wasm build again in compat builds
The build is docker-based, and doesn't differ at all if run from a
different version of golang. So instead of re-building it in the
separate matrix jobs, we'll use the artifacts downloaded from the
artifact build job.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* build/policies: format using 0.39.0
* workflow/pull-request: use edge opa for rego PR checks
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
dependabot[bot]