Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Updates to proposal 1 #102

Merged
merged 8 commits into from
Jun 28, 2024
Merged
45 changes: 25 additions & 20 deletions docs/proposals/proposal-001-trigger-and-deploy.md
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ multiple configurations of Falco and more CNCF projects as they are onboarded.

### Goals

- Trigger the pipeline when a new release of a project happens
- Trigger the pipeline once a day for the latest version of the project
rossf7 marked this conversation as resolved.
Show resolved Hide resolved
- Allow additional runs of the pipeline by calling a GitHub webhook
- Deploy the new version of the project using flux
- Delete the resources at the end of the pipeline run
Expand All @@ -75,8 +75,8 @@ team

## Proposal

We will watch for new releases of the project by subscribing to the Atom feed
of releases that GitHub publish e.g. https://github.com/falcosecurity/falco/releases.atom
Once a day we will get the latest release of the project via the GitHub REST API
e.g. https://api.github.com/repos/falcosecurity/falco/releases/latest

Our automation will call the GitHub REST API to trigger the pipeline.

Expand Down Expand Up @@ -116,33 +116,38 @@ removed. In future we could create nodes on demand and delete on completion.

### Subscribing to Releases

A YAML file of CNCF projects and any sub components will be stored in the
A JSON file of CNCF projects and any sub components will be stored in the
tooling repo e.g.

```yaml
# projects.yaml
projects:
- name: falco
sub_components:
- ebpf
- modern-ebpf
- kmod
```json
{
"projects": [
{
"name": "falco",
"organization": "falcosecurity",
"sub_components": [
rossf7 marked this conversation as resolved.
Show resolved Hide resolved
"ebpf",
"modern-ebpf",
"kmod"
]
}
]
}
```

A scheduled GitHub Action will run every hour and check the Atom feed of
each project for new releases. To manage the state a GitHub [repository variable](https://docs.github.com/en/actions/learn-github-actions/variables)
per CNCF project is used to store the latest release version.
A scheduled GitHub Action will run once a day at 08:00 UTC and check the GitHub
REST API of each project for its latest release.

If a new release is detected the action will trigger the pipeline for the new
release and update the variable with the new version. This is to ensure each
release is only triggered once.
e.g. https://api.github.com/repos/falcosecurity/falco/releases/latest

If sub components are specified then the pipeline will be triggered once per
sub component.

Note: 08:00 UTC is chosen to be during daylight when solar energy should be available.

### Trigger

The green reviews pipeline will be triggered by sending a [workflow_dispatch](https://docs.github.com/en/rest/actions/workflows?apiVersion=2022-11-28#create-a-workflow-dispatch-event)
The benchmark pipeline will be triggered by sending a [workflow_dispatch](https://docs.github.com/en/rest/actions/workflows?apiVersion=2022-11-28#create-a-workflow-dispatch-event)
event via the GitHub REST API.

Inputs are
Expand All @@ -157,7 +162,7 @@ and `ebpf`
curl -X POST \
-H "Accept: application/vnd.github.v3+json" \
-H "Authorization: token $GITHUB_PAT" \
https://api.github.com/repos/cncf-tags/green-reviews-tooling/actions/workflows/pipeline.yaml/dispatches \
https://api.github.com/repos/cncf-tags/green-reviews-tooling/actions/workflows/benchmark-pipeline.yaml/dispatches \
-d '{"ref":"0.2.0", "inputs": {"cncf_project": "falco", "cncf_project_sub": "modern-ebpf","version":"0.37.0"}}'
```

Expand Down