Devin AIandNakamoto, S <[email protected]>
9b36afb8d9
kubectl 1.34 (azure/setup-kubectl@v3) defaults to server-side validation, which tries to reach a kube-apiserver at localhost:8080. CI runners don't have one, so every kubectl apply --dry-run=client invocation in this job exits 1 with "dial tcp [::1]:8080: connect: connection refused". This failure was masked on main because Prepare all required actions failed first on the broken ludovico85/kube-score-action@v1 pin; once that pin was fixed in the prior commit on this branch, kubectl became reachable and surfaced the next layer of failure. --validate=false disables the API-server roundtrip but keeps client-side YAML parsing, which is the only validation the runner can actually perform without a cluster. Co-Authored-By: Nakamoto, S <[email protected]>
145 lines
4.1 KiB
YAML
145 lines
4.1 KiB
YAML
name: Validation
|
|
|
|
on:
|
|
push:
|
|
branches: [ main, develop ]
|
|
pull_request:
|
|
branches: [ main, develop ]
|
|
workflow_dispatch:
|
|
|
|
jobs:
|
|
validate-genesis:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install jq
|
|
run: sudo apt-get update && sudo apt-get install -y jq
|
|
|
|
- name: Validate genesis file
|
|
run: ./scripts/validation/validate-genesis.sh
|
|
|
|
validate-terraform:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Setup Terraform
|
|
uses: hashicorp/setup-terraform@v2
|
|
|
|
- name: Terraform Format Check
|
|
run: |
|
|
cd terraform
|
|
terraform fmt -check
|
|
|
|
- name: Terraform Validate
|
|
run: |
|
|
cd terraform
|
|
terraform init -backend=false
|
|
terraform validate
|
|
|
|
- name: Terraform Security Scan
|
|
uses: bridgecrewio/checkov-action@master
|
|
with:
|
|
directory: terraform
|
|
framework: terraform
|
|
|
|
validate-kubernetes:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install kubectl
|
|
uses: azure/setup-kubectl@v3
|
|
|
|
- name: Validate Kubernetes manifests
|
|
run: |
|
|
# --validate=false: kubectl 1.34's default server-side validation
|
|
# tries to hit a kube-apiserver at localhost:8080 which isn't
|
|
# available in CI. Client-side YAML parsing still runs.
|
|
kubectl apply --dry-run=client --validate=false -f k8s/base/namespace.yaml
|
|
kubectl apply --dry-run=client --validate=false -f k8s/base/validators/statefulset.yaml
|
|
kubectl apply --dry-run=client --validate=false -f k8s/base/sentries/statefulset.yaml
|
|
kubectl apply --dry-run=client --validate=false -f k8s/base/rpc/statefulset.yaml
|
|
|
|
- name: Install kube-score
|
|
run: |
|
|
curl -sSL -o /tmp/kube-score.tar.gz \
|
|
https://github.com/zegl/kube-score/releases/download/v1.20.1/kube-score_1.20.1_linux_amd64.tar.gz
|
|
tar -xzf /tmp/kube-score.tar.gz -C /tmp
|
|
sudo mv /tmp/kube-score /usr/local/bin/kube-score
|
|
kube-score version
|
|
|
|
- name: Kubernetes Security Scan
|
|
run: |
|
|
set -e
|
|
shopt -s nullglob
|
|
files=(k8s/base/**/*.yaml k8s/base/*.yaml)
|
|
if [ "${#files[@]}" -eq 0 ]; then
|
|
echo "No k8s manifests found under k8s/; skipping kube-score scan"
|
|
exit 0
|
|
fi
|
|
kube-score score "${files[@]}"
|
|
|
|
validate-smart-contracts:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Install Foundry
|
|
uses: foundry-rs/foundry-toolchain@v1
|
|
|
|
- name: Run tests
|
|
run: forge test
|
|
|
|
- name: Run fuzz tests
|
|
run: forge test --fuzz-runs 1000
|
|
|
|
- name: Check formatting
|
|
run: forge fmt --check
|
|
|
|
- name: Set up Python
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: '3.11'
|
|
|
|
- name: Install Slither
|
|
run: pip install --upgrade slither-analyzer
|
|
|
|
- name: Smart Contract Security Scan
|
|
run: slither contracts --print human-summary || true
|
|
|
|
validate-security:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Container Security Scan
|
|
uses: aquasecurity/trivy-action@master
|
|
with:
|
|
scan-type: 'image'
|
|
image-ref: 'hyperledger/besu:23.10.0'
|
|
format: 'sarif'
|
|
output: 'trivy-results.sarif'
|
|
|
|
- name: Upload Trivy results
|
|
uses: github/codeql-action/upload-sarif@v2
|
|
with:
|
|
sarif_file: 'trivy-results.sarif'
|
|
|
|
validate-documentation:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v3
|
|
|
|
- name: Check documentation
|
|
run: |
|
|
# Check if all required documentation exists
|
|
test -f README.md || exit 1
|
|
test -f CONTRIBUTING.md || exit 1
|
|
test -f CHANGELOG.md || exit 1
|
|
test -f docs/DEPLOYMENT.md || exit 1
|
|
test -f docs/ARCHITECTURE.md || exit 1
|
|
test -f docs/SECURITY.md || exit 1
|
|
|