Skip to content

common: pin and verify the components #271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Vicente-Cheng merged 2 commits into from
Mar 31, 2026
Merged

common: pin and verify the components #271

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2db8ea3
gha: bump rancher-eio/read-vault-secrets
Vicente-Cheng Mar 31, 2026
79bfac2
common: pin and verify the components
Vicente-Cheng Mar 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/factory.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ jobs:
run: make ci

- name: Read some Secrets
uses: rancher-eio/read-vault-secrets@0da85151ad1f19ed7986c41587e45aac1ace74b6 # v3
uses: rancher-eio/read-vault-secrets@d266f55186f80a893839f6e15662e67388e443e6 # v3
if: ${{ inputs.push == true }}
with:
secrets: |
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/fossa.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ jobs:
# The FOSSA token is shared between all repos in Harvester's GH org. It can
# be used directly and there is no need to request specific access to EIO.
- name: Read FOSSA token
uses: rancher-eio/read-vault-secrets@0da85151ad1f19ed7986c41587e45aac1ace74b6 # v3
uses: rancher-eio/read-vault-secrets@d266f55186f80a893839f6e15662e67388e443e6 # v3
with:
secrets: |
secret/data/github/org/harvester/fossa/credentials token | FOSSA_API_KEY_PUSH_ONLY
Expand Down
9 changes: 2 additions & 7 deletions Dockerfile.dapper
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,15 +4,10 @@ ARG DAPPER_HOST_ARCH
ENV HOST_ARCH=${DAPPER_HOST_ARCH} ARCH=${DAPPER_HOST_ARCH}

RUN zypper -n rm container-suseconnect && \
zypper -n install git curl docker gzip tar wget awk
zypper -n install git curl docker gzip tar wget awk docker-buildx

## install golangci
RUN curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s latest

# The docker version in dapper is too old to have buildx. Install it manually.
RUN curl -sSfL https://github.com/docker/buildx/releases/download/v0.13.1/buildx-v0.13.1.linux-${ARCH} -o buildx-v0.13.1.linux-${ARCH} && \
chmod +x buildx-v0.13.1.linux-${ARCH} && \
mv buildx-v0.13.1.linux-${ARCH} /usr/local/bin/buildx
COPY --from=golangci/golangci-lint:v2.11.4-alpine@sha256:72bcd68512b4e27540dd3a778a1b7afd45759d8145cfb3c089f1d7af53e718e9 /usr/bin/golangci-lint /usr/local/bin/golangci-lint

## install controller-gen
RUN go install sigs.k8s.io/controller-tools/cmd/controller-gen@v0.18.0
Expand Down
13 changes: 12 additions & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,19 @@
TARGETS := $(shell ls scripts)

SHA512SUM_Linux_aarch64 := 781951b31e5ff018a04e755c6da7163b31a81edda61f1bed4def8d0e24229865c58a3d26aa0cc4184058d91ebcae300ead2cad16d3c46ccb1098419e3e41a016
SHA512SUM_Linux_x86_64 := d2ec27ecf9362e2fafd27d76d85a5c5b92b53aefe07cffa76bf9887db6bee07b1023cca8fc32a2c9bdd2ecfadaee71397066b41bd37c9ebbbbce09913f0884d4
SHA512SUM_Darwin_arm64 := 8a356c89ad32af1698ae8615a6e303773a8ac58b114368454d59965ec2aa8282e780d1e228d37c301ce6f87596f68bfe7f204eb5f4c019c386a58dd94153ddcf
SHA512SUM_Darwin_x86_64 := dbab05de04dda26793f4ae7875d0fba96ee54b0228e192fd40c0b2116ed345b5444047fc2e0c90cb481f28cbe0e0452bcecb268c8d074cd8615eb2f5463c30b6
SHA512SUM_Windows_x86_64 := 807aee2f68b6da35cb0885558f5cbc9a6c8747a56c7a200f0e1fcac9e2fd0da570cbb39e48b3192bd1a71805f2ab38fd19d77faebba97a89e5d9a8b430ee429e

.dapper:
@echo Downloading dapper
@curl -sL https://releases.rancher.com/dapper/latest/dapper-$$(uname -s)-$$(uname -m) > .dapper.tmp
@curl -sL https://releases.rancher.com/dapper/v0.6.0/dapper-`uname -s`-`uname -m` > .dapper.tmp
@CHECKSUM=$$(shasum -a 512 .dapper.tmp | awk '{print $$1}'); \
if [ "$$CHECKSUM" != "$(SHA512SUM_$(shell uname -s)_$(shell uname -m))" ]; then \
echo "Checksum verification failed!"; \
exit 1; \
fi
@@chmod +x .dapper.tmp
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The .dapper recipe uses @@chmod, which Make interprets as “silent” (@) plus a literal @ passed to the shell. That results in trying to execute a command named @chmod and will fail, breaking make ci/any target that depends on .dapper. Use a single leading @ (or none) before chmod.

Suggested change
@@chmod +x .dapper.tmp
@chmod +x .dapper.tmp

Copilot uses AI. Check for mistakes.
@./.dapper.tmp -v
@mv .dapper.tmp .dapper
Expand Down
10 changes: 8 additions & 2 deletions ci/scripts/helpers.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,17 @@

TOP_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )/" &> /dev/null && pwd )"

HELM_VERSION=v3.20.0
HELM_SUM_amd64=dbb4c8fc8e19d159d1a63dda8db655f9ffa4aac1b9a6b188b34a40957119b286
HELM_SUM_arm64=bfb14953295d5324d47ab55f3dfba6da28d46c848978c8fbf412d4271bdc29f1
HELM_SUM="HELM_SUM_${ARCH}"

# ensure helm command
if [[ $(ensure_command helm) -eq 1 ]]; then
echo "no helm, try to curl..."
curl -O https://get.helm.sh/helm-v3.9.4-linux-amd64.tar.gz
tar -zxvf helm-v3.9.4-linux-amd64.tar.gz
curl -O https://get.helm.sh/helm-${HELM_VERSION}-linux-${ARCH}.tar.gz
echo "${!HELM_SUM}" helm-${HELM_VERSION}-linux-${ARCH}.tar.gz | sha256sum -c -
tar xvzf helm-${HELM_VERSION}-linux-${ARCH}.tar.gz
HELM=$TOP_DIR/linux-amd64/helm
Copy link

Copilot AI Mar 31, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The extracted helm binary path is still hardcoded to linux-amd64/helm, but the download/extract is now architecture-dependent (linux-${ARCH}). This will break on arm64 (and is inconsistent even on amd64 if ARCH differs). Point HELM at the extracted linux-${ARCH}/helm directory (or derive it from the tar contents).

Suggested change
HELM=$TOP_DIR/linux-amd64/helm
HELM=$TOP_DIR/linux-${ARCH}/helm

Copilot uses AI. Check for mistakes.
$HELM version
else
Expand Down
2 changes: 1 addition & 1 deletion scripts/package_controller
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ if [ -e ${DOCKERFILE}.${ARCH} ]; then
DOCKERFILE=${DOCKERFILE}.${ARCH}
fi

buildx build --load -f ${DOCKERFILE} -t ${IMAGE} .
docker buildx build --load -f ${DOCKERFILE} -t ${IMAGE} .
echo Built ${IMAGE}
if [[ -n ${BUILD_FOR_CI} ]]; then
docker push ${IMAGE}
Expand Down
2 changes: 1 addition & 1 deletion scripts/package_webhook
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ if [ -e ${DOCKERFILE}.${ARCH} ]; then
DOCKERFILE=${DOCKERFILE}.${ARCH}
fi

buildx build --load -f ${DOCKERFILE} -t ${IMAGE} .
docker buildx build --load -f ${DOCKERFILE} -t ${IMAGE} .
echo Built ${IMAGE}
if [[ -n ${BUILD_FOR_CI} ]]; then
docker push ${IMAGE}
Expand Down
Loading