Michael AdamandBlaine Gardner
9b2b9b7be2
Fixes: #14466 The OpenSSF scorecard report https://scorecard.dev/viewer/?uri=github.com/rook/rook warns about excessive token-permissions in the rook project's github CI workflows. This bulk change aims at improving this by 1. adding top-level read permissions where missing for integration tests. 2. adding write permissions as needed for the auto-assign workflow. 3. removing the warned-about and unused create-tag workflow Signed-off-by: Michael Adam <obnox@samba.org> Co-authored-by: Blaine Gardner <b.blaine.gardner@gmail.com>
71 lines
2.4 KiB
YAML
71 lines
2.4 KiB
YAML
name: Integration test CephMultiClusterDeploySuite
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- master
|
|
- release-*
|
|
paths-ignore:
|
|
- "Documentation/**"
|
|
- "design/**"
|
|
|
|
defaults:
|
|
run:
|
|
# reference: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#using-a-specific-shell
|
|
shell: bash --noprofile --norc -eo pipefail -x {0}
|
|
|
|
# cancel the in-progress workflow when PR is refreshed.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event_name == 'pull_request' && github.head_ref || github.sha }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
TestCephMultiClusterDeploySuite:
|
|
if: ${{ github.event_name == 'pull_request' && github.ref != 'refs/heads/master' && !contains(github.event.pull_request.labels.*.name, 'skip-ci') }}
|
|
runs-on: ubuntu-22.04
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
kubernetes-versions: ["v1.30.0"]
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: consider debugging
|
|
uses: ./.github/workflows/tmate_debug
|
|
with:
|
|
use-tmate: ${{ secrets.USE_TMATE }}
|
|
|
|
- name: setup cluster resources
|
|
uses: ./.github/workflows/integration-test-config-latest-k8s
|
|
with:
|
|
kubernetes-version: ${{ matrix.kubernetes-versions }}
|
|
|
|
- name: TestCephMultiClusterDeploySuite
|
|
run: |
|
|
tests/scripts/github-action-helper.sh collect_udev_logs_in_background
|
|
DEVICE_NAME="$(tests/scripts/github-action-helper.sh find_extra_block_dev)"
|
|
export BLOCK="/dev/${DEVICE_NAME}"
|
|
export TEST_SCRATCH_DEVICE="/dev/${DEVICE_NAME}1"
|
|
export DEVICE_FILTER="$DEVICE_NAME"
|
|
go test -v -timeout 1800s -failfast -run CephMultiClusterDeploySuite github.com/rook/rook/tests/integration
|
|
|
|
- name: collect common logs
|
|
if: always()
|
|
run: |
|
|
export LOG_DIR="/home/runner/work/rook/rook/tests/integration/_output/tests/"
|
|
export OPERATOR_NAMESPACE="multi-core-system"
|
|
CLUSTER_NAMESPACE="multi-core" tests/scripts/collect-logs.sh
|
|
CLUSTER_NAMESPACE="multi-external" tests/scripts/collect-logs.sh
|
|
|
|
- name: Artifact
|
|
uses: actions/upload-artifact@v4
|
|
if: failure()
|
|
with:
|
|
name: ceph-multi-cluster-deploy-suite-artifact-${{ matrix.kubernetes-versions }}
|
|
path: /home/runner/work/rook/rook/tests/integration/_output/tests/
|