opendefensecloud / artifact-conduit / 29573922805
85%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 7
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 84.746% (-0.1%) from 84.852%
29573922805

push

github

web-flow 
fix(examples/ocm): drop dependency on trevex/ocm-tools (#439)

## What
Stop depending on the personal `trevex/ocm-tools:v0.1.0` Docker Hub
image in the OCM example workflows, and build/publish our own version
instead.

Closes #355

## Why
The image used in `examples/ocm/cluster-workflow-template.yaml` was
built and pushed by hand into a personal Docker Hub namespace, with no
CI in any of our repos, and no pinned version, so nobody could tell
which `ocm` CLI version was actually in it. This is becoming more
relevant now that we use this workflow for Solar catalog chaining
(opendefensecloud/solution-arsenal#562), so it is worth fixing properly.

Turns out we already had almost everything we needed.
`examples/ocm/Dockerfile` is the exact source used to publish
`trevex/ocm-tools:v0.1.X` and it installs `ocm` via the official
`https://ocm.software/install.sh` script, which already resolves a
GitHub release, verifies its sha256, and supports pinning through an
`OCM_VERSION` env var. So instead of a new repo or a hand-rolled build,
this just:

- pins `ARG OCM_VERSION` in the Dockerfile so the version is explicit
and reproducible
- adds this Dockerfile as a third image to our existing `docker.yaml`
build/push/sign/attest matrix, published as
`ghcr.io/opendefensecloud/ocm-tools`
- points the workflow template at the new image
- adds a Renovate rule to auto-bump `OCM_VERSION` when a new
`open-component-model/ocm` release comes out, same pattern we already
use for cert-manager/trust-manager (Just as a note here, I don't know if
this is actually necessary since the open-component-model/ocm repo only
publishes the CLI v1 and I think the upstream development is now going
on in the open-component-model/open-component-model repository
publishing the v2 CLI..)

## Testing
Built the Dockerfile locally with the default `OCM_VERSION` and
confirmed the installed `ocm version` matches it exactly. Also rebuilt
with `--build-arg OCM_VERSION=<older release>` and confirmed the... (continued)

800 of 944 relevant lines covered (84.75%)

1180.05 hits per line

Coverage Regressions

Lines Coverage ∆ File
7
83.29
 -1.86% pkg/controller/order_controller.go
Jobs
ID Job ID Ran Files Coverage
1 29573922805.1 7
84.75
 GitHub Action Run
Source Files on build 29573922805