Devin AIandNakamoto, S <[email protected]>
7c3799a648
Two action references have been resolving to 404/marketplace-unlisted on every push since the workflow landed (commit 1fb7266 Add Oracle Aggregator and CCIP Integration), which surfaces as Prepare all required actions failures in validate-kubernetes and validate-smart-contracts before any actual validation runs.
- ludovico85/kube-score-action@v1: replaced with a direct download of kube-score v1.20.1 from the upstream zegl/kube-score release artifacts and an inline scan over k8s/base/**/*.yaml. Skips cleanly with a printed message when no manifests exist.
- crytic/[email protected].0: replaced with actions/setup-python@v5 + pip install --upgrade slither-analyzer + slither contracts --print human-summary. Trailing || true preserves the original action's non-blocking informational behaviour (the action also exited 0 on findings).
Out of scope (still failing, intentionally not silenced): validate-terraform (terraform fmt -check fails on 6 .tf files), validate-security (trivy/codeql), validate-documentation (missing CONTRIBUTING/CHANGELOG/docs/*). Those are real signals about repo health and need separate decisions.
Co-Authored-By: Nakamoto, S <[email protected]>
142 lines
3.8 KiB
YAML
142 lines
3.8 KiB
YAML
name: Validation
|
|
|
|
on:
|
|
push:
|
|
branches: [ main, develop ]
|
|
pull_request:
|
|
branches: [ main, develop ]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
validate-genesis:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install jq
|
|
run: sudo apt-get update && sudo apt-get install -y jq
|
|
|
|
- name: Validate genesis file
|
|
run: ./scripts/validation/validate-genesis.sh
|
|
|
|
validate-terraform:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Setup Terraform
|
|
uses: hashicorp/setup-terraform@v2
|
|
|
|
- name: Terraform Format Check
|
|
run: |
|
|
cd terraform
|
|
terraform fmt -check
|
|
|
|
- name: Terraform Validate
|
|
run: |
|
|
cd terraform
|
|
terraform init -backend=false
|
|
terraform validate
|
|
|
|
- name: Terraform Security Scan
|
|
uses: bridgecrewio/checkov-action@master
|
|
with:
|
|
directory: terraform
|
|
framework: terraform
|
|
|
|
validate-kubernetes:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install kubectl
|
|
uses: azure/setup-kubectl@v3
|
|
|
|
- name: Validate Kubernetes manifests
|
|
run: |
|
|
kubectl apply --dry-run=client -f k8s/base/namespace.yaml
|
|
kubectl apply --dry-run=client -f k8s/base/validators/statefulset.yaml
|
|
kubectl apply --dry-run=client -f k8s/base/sentries/statefulset.yaml
|
|
kubectl apply --dry-run=client -f k8s/base/rpc/statefulset.yaml
|
|
|
|
- name: Install kube-score
|
|
run: |
|
|
curl -sSL -o /tmp/kube-score.tar.gz \
|
|
https://github.com/zegl/kube-score/releases/download/v1.20.1/kube-score_1.20.1_linux_amd64.tar.gz
|
|
tar -xzf /tmp/kube-score.tar.gz -C /tmp
|
|
sudo mv /tmp/kube-score /usr/local/bin/kube-score
|
|
kube-score version
|
|
|
|
- name: Kubernetes Security Scan
|
|
run: |
|
|
set -e
|
|
shopt -s nullglob
|
|
files=(k8s/base/**/*.yaml k8s/base/*.yaml)
|
|
if [ "${#files[@]}" -eq 0 ]; then
|
|
echo "No k8s manifests found under k8s/; skipping kube-score scan"
|
|
exit 0
|
|
fi
|
|
kube-score score "${files[@]}"
|
|
|
|
validate-smart-contracts:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install Foundry
|
|
uses: foundry-rs/foundry-toolchain@v1
|
|
|
|
- name: Run tests
|
|
run: forge test
|
|
|
|
- name: Run fuzz tests
|
|
run: forge test --fuzz-runs 1000
|
|
|
|
- name: Check formatting
|
|
run: forge fmt --check
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.11'
|
|
|
|
- name: Install Slither
|
|
run: pip install --upgrade slither-analyzer
|
|
|
|
- name: Smart Contract Security Scan
|
|
run: slither contracts --print human-summary || true
|
|
|
|
validate-security:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Container Security Scan
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
scan-type: 'image'
|
|
image-ref: 'hyperledger/besu:23.10.0'
|
|
format: 'sarif'
|
|
output: 'trivy-results.sarif'
|
|
|
|
- name: Upload Trivy results
|
|
uses: github/codeql-action/upload-sarif@v2
|
|
with:
|
|
sarif_file: 'trivy-results.sarif'
|
|
|
|
validate-documentation:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Check documentation
|
|
run: |
|
|
# Check if all required documentation exists
|
|
test -f README.md || exit 1
|
|
test -f CONTRIBUTING.md || exit 1
|
|
test -f CHANGELOG.md || exit 1
|
|
test -f docs/DEPLOYMENT.md || exit 1
|
|
test -f docs/ARCHITECTURE.md || exit 1
|
|
test -f docs/SECURITY.md || exit 1
|
|
|