gha: Split the Kata Containers CI workflow

We've been facing some issues in order to properly run, in a safe way, the workflows for the Kata Containers CI. This happens as the `pull_request` target doesn't allow passing any secrets to workflows; and the `pull_request_target` workflow, which allows passing the secrets, doesn't run on the PR itself but rather on the target PR branch. :-/ https://securitylab.github.com/research/github-actions-preventing-pwn-requests/ proposes a reasonable solution, which I'm trying to mimic here. Signed-off-by: Fabiano Fidêncio <[email protected]>
kata-containers · Apr 4, 2023 · 792fe6f · 792fe6f
1 parent 1c6d7cb
commit 792fe6f
Show file tree

Hide file tree

Showing 4 changed files with 39 additions and 51 deletions.
diff --git a/.github/workflows/build-kata-static-tarball.yaml b/.github/workflows/build-kata-static-tarball.yaml
@@ -0,0 +1,9 @@
+name: CI | Build Kata Containers artefacts
+on:
+  pull_request
+
+jobs:
+  build-kata-static-tarball-amd64:
+    uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml
+    with:
+      tarball-suffix: -${{ github.sha }}
diff --git a/.github/workflows/ci-on-push.yaml b/.github/workflows/ci-on-push.yaml
diff --git a/.github/workflows/publish-kata-deploy-payload.yaml b/.github/workflows/publish-kata-deploy-payload.yaml
@@ -0,0 +1,19 @@
+name: CI | Publish kata-deploy payload
+on:
+  workflow_run:
+    workflows:
+      - CI | Build Kata Containers artefacts
+    types:
+      - completed
+
+jobs:
+  publish-kata-deploy-payload-amd64:
+    if: ${{ github.event.workflow_run.conclusion == 'success' }}
+    uses: ./.github/workflows/publish-kata-deploy-payload-amd64.yaml
+    with:
+      tarball-suffix: -${{ github.event.workflow_run.head_sha }}
+      registry: ghcr.io
+      repo: ${{ github.repository_owner }}/kata-deploy-ci
+      tag: -${{ github.event.workflow_run.head_sha }}-amd64
+      quay-io-login-continue-on-error: true
+    secrets: inherit
diff --git a/.github/workflows/run-k8s-tests-on-aks.yaml b/.github/workflows/run-k8s-tests-on-aks.yaml
@@ -1,16 +1,13 @@
 name: CI | Run kubernetes tests on AKS
 on:
-  workflow_call:
-    inputs:
-      registry:
-        required: true
-        type: string
-      repo:
-        required: true
-        type: string
-      tag:
-        required: true
-        type: string
+  workflow_run:
+    workflows: 
+      - CI | Publish kata-deploy payload
+    types:
+      - completed
+
+env:
+  ci_image: ghcr.io/kata-containers/kata-deploy-ci/${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }}-amd64
 
 jobs:
   create-aks:
@@ -54,13 +51,13 @@ jobs:
 
       - name: Download credentials for the Kubernetes CLI to use them
         run: |
-          az aks get-credentials -g "kataCI" -n ${{ github.event.pull_request.number }}-${{ github.sha }}-${{ matrix.vmm }}-amd64
+          az aks get-credentials -g "kataCI" -n -${{ github.event.workflow_run.head_sha }}-${{ matrix.vmm }}-amd64
 
       - name: Deploy kata-deploy
         run: |
-          sed -i -e "s|quay.io/kata-containers/kata-deploy:latest|${{ inputs.registry }}/${{ inputs.repo }}:${{ inputs.tag }}|g" tools/packaging/kata-deploy/kata-deploy/base/kata-deploy.yaml
+          sed -i -e "s|quay.io/kata-containers/kata-deploy:latest|$ci_image|g" tools/packaging/kata-deploy/kata-deploy/base/kata-deploy.yaml
           cat tools/packaging/kata-deploy/kata-deploy/base/kata-deploy.yaml
-          cat tools/packaging/kata-deploy/kata-deploy/base/kata-deploy.yaml | grep "${{ inputs.registry }}/${{ inputs.repo }}:${{ inputs.tag }}" || die "Failed to setup the tests image"
+          cat tools/packaging/kata-deploy/kata-deploy/base/kata-deploy.yaml | grep "$ci_image" || die "Failed to setup the tests image"
 
           kubectl apply -f tools/packaging/kata-deploy/kata-rbac/base/kata-rbac.yaml
           kubectl apply -f tools/packaging/kata-deploy/kata-deploy/base/kata-deploy.yaml