Release pipeline #111
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,157 @@ | ||
| name: Manual Helm chart release with frozen versions | ||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| kuadrantVersion: | ||
| description: 'Version with optional RC suffix and product. k=kuadrant r=RHCL (example: 1.0.0-k, 2.3.4-rc1-r)' | ||
| required: true | ||
| type: string | ||
| indexImage: | ||
| description: 'Kuadrant operator index image (example: quay.io/kuadrant/kuadrant-operator-catalog:v1.4.3)' | ||
| required: true | ||
| type: string | ||
| ocpVersion: | ||
| description: 'Openshift version to pin operator versions for. (example: v4.22)' | ||
| required: true | ||
| default: v4.22 | ||
|
|
||
| env: | ||
| HELM_VERSION: ${{ inputs.kuadrantVersion }}-${{ inputs.ocpVersion }} | ||
|
|
||
| run-name: "Release of ${{ inputs.kuadrantVersion }}-${{ inputs.ocpVersion }}" | ||
|
|
||
| jobs: | ||
| release: | ||
| runs-on: ubuntu-latest | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
| concurrency: | ||
| group: helm-gh-pages-publish | ||
| cancel-in-progress: false | ||
| steps: | ||
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7 | ||
| - name: Validate kuadrant version format | ||
| run: | | ||
| if ! [[ "${{ inputs.kuadrantVersion }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)*-(k|r)$ ]]; then | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🔴 Critical | ⚡ Quick win Do not render workflow inputs directly into shell source. A quote or shell metacharacter in an input can alter the command before validation completes. Put inputs in environment variables, then use quoted shell variables. Use
🧰 Tools🪛 zizmor (1.29.0)[error] 28-28: code injection via template expansion (template-injection): may expand into attacker-controllable code (template-injection) 📍 Affects 1 file
🤖 Prompt for AI AgentsSource: Linters/SAST tools There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- workflow outline ---'
ast-grep outline .github/workflows/manual-release.yml --items all || true
printf '%s\n' '--- relevant lines ---'
nl -ba .github/workflows/manual-release.yml | sed -n '20,110p'
printf '%s\n' '--- direct workflow-input expressions in run blocks ---'
rg -n -C 3 '\$\{\{\s*inputs\.[A-Za-z0-9_]+\s*\}\}' .github/workflows/manual-release.ymlLength of output: 854 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- relevant workflow section ---'
sed -n '20,115p' .github/workflows/manual-release.yml
printf '%s\n' '--- direct workflow-input expressions ---'
grep -n -C 3 -E '\$\{\{[[:space:]]*inputs\.[[:alnum:]_]+[[:space:]]*\}\}' \
.github/workflows/manual-release.yml || trueLength of output: 5879
For example, this is unsafe even though the expression appears between quotes: if ! [[ "${{ inputs.kuadrantVersion }}" =~ ... ]]; thenGitHub expands the expression before Bash parses the command. An input containing The workflow must assign inputs through The finding remains valid. You are interacting with an AI system. There was a problem hiding this comment. nit: |
||
| echo "ERROR: Version must be in format X.Y.Z[-rcX]-(k|r) (e.g., 1.0.0-k, 2.3.4-rc1-r)" | ||
| exit 1 | ||
| fi | ||
| - name: Validate ocp version format | ||
| run: | | ||
| if ! [[ "${{ inputs.ocpVersion }}" =~ ^v[0-9]+\.[0-9]+$ ]]; then | ||
| echo "ERROR: Version must be in format vX.Y (e.g., v4.22)" | ||
| exit 1 | ||
| fi | ||
|
|
||
| - name: Check tag does not already exist | ||
| run: | | ||
| if git ls-remote --exit-code --refs --tags origin "refs/tags/$HELM_VERSION" >/dev/null; then | ||
|
There was a problem hiding this comment. The tag existence check is at the beginning, but the tag is created only at the end after publishing to gh-pages. If the run fails between these steps, on a re-run the tag check passes (the tag doesn't exist yet), but the chart is already on gh-pages, and helm repo index |
||
| echo "ERROR: Tag $HELM_VERSION already exists" | ||
| exit 1 | ||
| fi | ||
|
coderabbitai[bot] marked this conversation as resolved.
|
||
|
|
||
| - name: Set up yq | ||
| run: sudo snap install yq | ||
|
|
||
| - name: Set up Helm | ||
| uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # ratchet:azure/setup-helm@v5 | ||
| with: | ||
| version: v3.18.4 | ||
|
|
||
| - name: Set up opm | ||
| run: | | ||
| OPM_VERSION=$(curl -s https://api.github.com/repos/operator-framework/operator-registry/releases/latest | jq -r '.tag_name') | ||
| curl -Lo opm "https://github.com/operator-framework/operator-registry/releases/download/${OPM_VERSION}/linux-amd64-opm" | ||
| chmod +x opm | ||
| sudo mv opm /usr/local/bin/ | ||
| opm version | ||
|
Comment on lines
+51
to
+65
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== workflow files =="
git ls-files '.github/workflows/*' || true
echo
echo "== manual-release snippets =="
if [ -f .github/workflows/manual-release.yml ]; then
cat -n .github/workflows/manual-release.yml | sed -n '1,130p'
fi
echo
echo "== yq/opm usage in workflows =="
rg -n "yq|opm|operator-registry|snap install|curl .*opm|versions" .github/workflows || trueRepository: Kuadrant/helm-charts-olm Length of output: 8468 🌐 Web query:
💡 Result: To install the yq snap, you can use the standard snap install command for the latest stable version, or specify a particular channel to install a different version or track [1][2][3]. Standard Installation To install the latest stable release of yq, run the following command in your terminal: sudo snap install yq [1][4][5] Installing a Specific Version or Channel If you need to install a specific version or major release (such as v3), you can use the --channel flag [6][3]. For example, to install the v3 stable release, you would use: sudo snap install yq --channel=v3/stable [6][3] Key Documentation and Usage Notes The yq snap is distributed with strict confinement, which limits its ability to access files outside of specific system directories [2][6][7]. If you encounter issues reading files (such as root files or files in protected directories), you may need to adjust file permissions or move the target files to a location accessible by the snap [2][7]. You can view available channels, revisions, and more detailed package information by visiting the official yq page on the Snap Store [1]. [1][6][3] Citations:
🌐 Web query:
💡 Result: For the latest GitHub release of operator-framework/operator-registry, the linux-amd64 opm binary asset is provided together with a checksums.txt file. The latest release tag is v1.71.0, whose release assets include linux-amd64-opm and checksums.txt. [1] linux-amd64-opm binary (latest release): https://github.com/operator-framework/operator-registry/releases/tag/v1.71.0 (asset listed as “linux-amd64-opm”) [1] checksums.txt (latest release): https://github.com/operator-framework/operator-registry/releases/tag/v1.71.0 (asset listed as “checksums.txt”) [1] To retrieve the exact checksum value for the linux-amd64-opm binary, download checksums.txt from that same release and look up the linux-amd64-opm entry. [1] Example: 1) curl -fsSLO https://github.com/operator-framework/operator-registry/releases/download/v1.71.0/checksums.txt 2) grep -E '^.*linux-amd64-opm$' checksums.txt Note: the sources available here show that checksums.txt exists for the release and that both assets are present, but they do not include the checksum line contents themselves in the retrieved snippets. [1] Citations: Pin
🤖 Prompt for AI Agents
Member
Author
There was a problem hiding this comment. Latests should be fine. yq is used only for formating and opm to extract information. In the worst case something fails before releasing. Can be fixed than. There was a problem hiding this comment.
A tool update can change generated values or fail after release processing starts. A checksum does not prevent this when the workflow selects a new upstream release first. 🐇 ✏️ Learnings added
You are interacting with an AI system. |
||
|
|
||
| - name: Set up container registry config | ||
| run: | | ||
| sudo mkdir -p /etc/containers | ||
| echo 'unqualified-search-registries = ["registry.access.redhat.com", "docker.io"]' | sudo tee /etc/containers/registries.conf | ||
|
|
||
| - name: Log in to registry.redhat.io | ||
| run: podman login -u "${{ secrets.REDHAT_REGISTRY_USER }}" -p "${{ secrets.REDHAT_REGISTRY_PASSWORD }}" registry.redhat.io | ||
|
|
||
| - name: Get frozen versions | ||
| id: versions | ||
| env: | ||
| TMPDIR: ${{ runner.temp }} | ||
| run: | | ||
| export CATALOG_IMAGE="registry.redhat.io/redhat/redhat-operator-index:${{ inputs.ocpVersion }}" | ||
| ./script/get-all-versions.sh > frozen-versions.yaml | ||
| echo "Frozen versions:\n\n" | ||
| cat frozen-versions.yaml | ||
|
|
||
| - name: Merge frozen versions with values files | ||
| run: | | ||
| yq eval-all '. as $item ireduce ({}; . * $item)' values.yaml frozen-versions.yaml > values-frozen.yaml | ||
| yq eval-all '. as $item ireduce ({}; . * $item)' values-tools.yaml frozen-versions.yaml > values-tools-frozen.yaml | ||
|
|
||
| echo "Merged values.yaml:" | ||
| cat values-frozen.yaml | ||
| echo "" | ||
| echo "Merged values-tools.yaml:" | ||
| cat values-tools-frozen.yaml | ||
|
|
||
| mv values-frozen.yaml values.yaml | ||
| mv values-tools-frozen.yaml values-tools.yaml | ||
|
|
||
| - name: Set index image | ||
| run: | | ||
| yq -i '.kuadrant.indexImage = "${{ inputs.indexImage }}"' values.yaml | ||
|
There was a problem hiding this comment. indexImage doesn't have any validation. Both kuadrantVersion and ocpVersion are validated via regex, but indexImage is written directly into values.yaml as a string, and the workflow never pulls or renders it anywhere (freezing - redhat-operator-index, not this image). A wrong reference, a typo, or more realistically a stale tag like :v1.4.2 instead of :v1.4.3 would pass through the entire process, the chart would be published, and the error would only show at helm install time when olm fails to pull the CatalogSource image. Probability is low since the image is copy-pasted, but I think it would be quick check (regex format check, or skopeo inspect maybe?). |
||
| echo "Set indexImage to: ${{ inputs.indexImage }}" | ||
|
|
||
| if [[ "${{ inputs.kuadrantVersion }}" == *-k ]]; then | ||
| OPERATOR_NAME="kuadrant-operator" | ||
| else | ||
| OPERATOR_NAME="rhcl-operator" | ||
| fi | ||
| yq -i ".kuadrant.operatorName = \"$OPERATOR_NAME\"" values.yaml | ||
| echo "Set operatorName to: $OPERATOR_NAME" | ||
|
|
||
| - name: Update chart versions | ||
| run: | | ||
| for chart_dir in charts/*/; do | ||
| chart_file="${chart_dir}Chart.yaml" | ||
| if [[ -f "$chart_file" ]]; then | ||
| yq -i ".version = \"$HELM_VERSION\"" "$chart_file" | ||
| yq -i ".appVersion = \"$HELM_VERSION\"" "$chart_file" | ||
| echo "Updated $chart_file to version $HELM_VERSION" | ||
| fi | ||
| done | ||
|
|
||
| - name: Package Helm charts | ||
| run: | | ||
| mkdir .cr-release-packages | ||
| helm package ./charts/* -d .cr-release-packages | ||
|
|
||
| - name: Checkout gh-pages branch | ||
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # ratchet:actions/checkout@v7 | ||
| with: | ||
| ref: gh-pages | ||
| path: gh-pages | ||
|
|
||
| - name: Copy chart to gh-pages | ||
| run: | | ||
| cp .cr-release-packages/* gh-pages/ | ||
|
|
||
| - name: Generate new index.yaml | ||
| run: | | ||
| cd gh-pages | ||
| helm repo index . --merge index.yaml | ||
|
|
||
| - name: Commit and push | ||
| run: | | ||
| cd gh-pages | ||
| git config user.name "$GITHUB_ACTOR" | ||
| git config user.email "$GITHUB_ACTOR@users.noreply.github.com" | ||
| git add . | ||
| git commit -m "Release $HELM_VERSION with frozen versions (manual release)" | ||
| git push origin gh-pages | ||
|
|
||
| - name: Create Git tag | ||
| run: | | ||
| git config user.name "$GITHUB_ACTOR" | ||
| git config user.email "$GITHUB_ACTOR@users.noreply.github.com" | ||
| git tag -a "$HELM_VERSION" -m "Release $HELM_VERSION with frozen versions" | ||
| git push origin "$HELM_VERSION" | ||
Uh oh!
There was an error while loading. Please reload this page.