Merge branch 'main' into refactor

.github/pull-request-template.md

@@ -11,5 +11,9 @@ Changes proposed in this pull request:
 
 - ...
 
+**Pre-Merge Checklist**
+
+- [ ] As a PR reviewer, verify code coverage and evaluate if it is acceptable.
+
 **Related issues**
 <!-- If you refer to a particular issue, provide its number. For example, `Resolves #123`, `Fixes #43`, or `See also #33`. -->

.github/workflows/rollout-module.yaml

@@ -0,0 +1,168 @@
+
+name: Rollout to channel via module-manifests
+#  Workflow requires the following variables to be defined
+#     GIT_USER_NAME - user creating head branch and PR
+#     GIT_USER_EMAIL - this user email
+#     GH_TOOLS_HOST - tools host
+#     MODULE_MANIFESTS_REPO_NAME - repository of modules manifests
+
+env:
+  FULL_MODULE_NAME: kyma-project.io/module/api-gateway
+
+  # GitHub repositories
+  MODULE_MANIFESTS_WITH_USER:  "https://${{ vars.GIT_USER_NAME }}:${{ secrets.BOT_TOKEN_GITHUB_TOOLS }}@${{ vars.GH_TOOLS_HOST }}/kyma/${{ vars.MODULE_MANIFESTS_REPO_NAME }}.git"
+
+  API_URL: "https://api.github.com/repos/kyma-project/api-gateway"
+  RELEASES_URL: "https://github.com/kyma-project/api-gateway/releases"
+  DOC_URL: "https://kyma-project.io/#/api-gateway/user/README"
+
+  # File names
+  DEFAULT_CR_FILENAME_RELEASE: apigateway-default-cr.yaml
+  DEFAULT_CR_FILENAME: api-gateway-default-cr.yaml
+  MANIFEST_FILENAME: api-gateway-manager.yaml
+  SCAN_CONFIG_FILENAME: sec-scanners-config.yaml
+
+  # needed by gh cli for GitHub enterprise
+  GH_ENTERPRISE_TOKEN: ${{ secrets.BOT_TOKEN_GITHUB_TOOLS }}
+
+on:
+  workflow_dispatch:
+    inputs:
+      label:
+        description: "Pull Request label"
+        required: true
+        type: choice
+        default: "patch"
+        options:
+          - patch
+          - minor
+          - major
+      releaseTag:
+        description: "Release Tag"
+        required: true
+      channel:
+        description: "Channel"
+        type: choice
+        options:
+          - fast
+          - regular
+        required: true
+
+jobs:
+  promote:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Validate required environment variables
+        shell: bash
+        run: |
+          [ -z "${{ vars.GIT_USER_EMAIL }}" ] && echo "GIT_USER_EMAIL is required" && exit 1 
+          [ -z "${{ vars.GIT_USER_NAME }}" ] && echo "GIT_USER_NAME is required" && exit 1 
+          [ -z "${{ vars.GH_TOOLS_HOST }}" ] && echo "GH_TOOLS_HOST is required" && exit 1 
+          [ -z "${{ vars.MODULE_MANIFESTS_REPO_NAME }}" ] && echo "MODULE_MANIFESTS_REPO_NAME is required" && exit 1 
+          echo "Validated"
+      - name: Use default (latest) Release Tag
+        if: inputs.releaseTag == 'use latest release'
+        shell: bash
+        run: |
+          latest=$(curl -s -H "Accept: application/vnd.github+json" ${API_URL}/releases/latest | jq -r '.tag_name') 
+          echo "TAG=${latest}" >> $GITHUB_ENV
+      - name: Validate given release tag
+        if: inputs.releaseTag != 'use latest release'
+        shell: bash
+        run: |
+          tags=$(curl -s -H "Accept: application/vnd.github+json" ${API_URL}/tags | jq -r '.[] | .name')
+          
+          if  echo $tags | tr " " '\n' | grep -F -q -x ${{ inputs.releaseTag }}; then
+              echo "TAG=${{ inputs.releaseTag }}" >> $GITHUB_ENV
+              echo "tag found"
+          else
+              echo "tag not found: ${{ inputs.releaseTag }}"
+              exit 1  
+          fi
+      - name: Set branch name
+        shell: bash
+        run: echo "BRANCH_NAME=api-gateway-${TAG}-${{ inputs.channel }}" >> $GITHUB_ENV
+
+      - name: Setup git and clone repo
+        shell: bash
+        run: |
+          git config --global http.https://github.tools.sap.version "HTTP/1.1"
+          git config --global user.email ${{ vars.GIT_USER_EMAIL }}
+          git config --global user.name ${{ vars.GIT_USER_NAME }}
+          git clone ${MODULE_MANIFESTS_WITH_USER}
+        env:
+          GH_TOKEN: ${{ secrets.BOT_TOKEN_GITHUB_TOOLS }}
+
+      - name: Sync Repo and create branch
+        working-directory: module-manifests
+        shell: bash
+        run: |
+          git remote add upstream ${MODULE_MANIFESTS_WITH_USER}
+          git fetch upstream
+          git merge upstream/main
+          git checkout -B ${BRANCH_NAME}
+          mkdir -p modules/api-gateway/${{ inputs.channel }}
+      - name: Download artifacts
+        working-directory: module-manifests/modules/api-gateway/${{ inputs.channel }}
+        shell: bash
+        env:
+          CHANNEL: ${{ inputs.channel }}
+        run: |
+          curl -JL ${RELEASES_URL}/download/${TAG}/${MANIFEST_FILENAME} >${MANIFEST_FILENAME}
+          curl -JL ${RELEASES_URL}/download/${TAG}/${DEFAULT_CR_FILENAME_RELEASE} >${DEFAULT_CR_FILENAME}
+      - name: Create module configuration
+        env:
+          CHANNEL: ${{ inputs.channel }}
+        working-directory: module-manifests/modules/api-gateway/${{ inputs.channel }}
+        shell: bash
+        run: |
+          echo "Creating module configuration file:"
+          MODULE_VERSION="${TAG}"
+          FILE_NAME="${MANIFEST_FILENAME}"
+          
+          cat <<EOF | tee module-config.yaml
+          name: ${FULL_MODULE_NAME}
+          channel: ${CHANNEL}
+          version: "${MODULE_VERSION}"
+          manifest: ${FILE_NAME}
+          defaultCR: ${DEFAULT_CR_FILENAME}
+          labels:
+            "operator.kyma-project.io/controller-name": "manifest"
+            "operator.kyma-project.io/managed-by": "lifecycle-manager"
+          annotations:
+            "operator.kyma-project.io/doc-url": "${DOC_URL}"
+          moduleRepo: https://github.com/kyma-project/api-gateway.git
+          EOF
+      - name: Commit and push changes
+        shell: bash
+        working-directory: module-manifests
+        env:
+          FORK_ORIGIN: "https://${{ vars.GIT_USER_NAME }}:${{ secrets.BOT_TOKEN_GITHUB_TOOLS }}@${{ vars.GH_TOOLS_HOST }}/${{ vars.GIT_USER_NAME }}/${{ vars.MODULE_MANIFESTS_REPO_NAME }}.git"
+        run: |
+          git add .
+          git commit -m "Configuration files update"
+          git remote set-url origin ${FORK_ORIGIN}
+          git push --set-upstream origin ${BRANCH_NAME} -f
+      - name: Create PR if needed
+        working-directory: module-manifests
+        shell: bash
+        env:
+          CHANNEL: ${{ inputs.channel }}
+          MODULE_MANIFESTS_REPO_URL: "https://${{ vars.GH_TOOLS_HOST }}/kyma/${{ vars.MODULE_MANIFESTS_REPO_NAME }}"
+        run: |
+          prs=$(gh pr list -R "${MODULE_MANIFESTS_REPO_URL}" -A ${{ vars.GIT_USER_NAME }} --state open --json headRefName | jq -r '.[] | .headRefName')
+          if  echo $prs | tr " " '\n' | grep -F -q -x ${BRANCH_NAME}; then
+              echo "opened PR already exists, no need to create new one, PR will be updated by push from previous step"
+              exit 0
+          fi
+          gh pr create -B main -H ${{ vars.GIT_USER_NAME }}:${BRANCH_NAME} -R ${MODULE_MANIFESTS_REPO_URL} --title "Promote API Gateway ${TAG} to ${CHANNEL} channel" --fill --body "${RELEASES_URL}/${TAG}"
+      - name: Label the PR with patch/minor label
+        working-directory: module-manifests
+        shell: bash
+        env:
+          CHANNEL: ${{ inputs.channel }}
+          MODULE_MANIFESTS_REPO_URL: "https://${{ vars.GH_TOOLS_HOST }}/kyma/${{ vars.MODULE_MANIFESTS_REPO_NAME }}"
+          LABEL: ${{ inputs.label }}
+        run: |
+          gh pr edit ${{ vars.GIT_USER_NAME }}:${BRANCH_NAME} -R "${MODULE_MANIFESTS_REPO_URL}" --add-label "${LABEL}"

sec-scanners-config.yaml

@@ -1,6 +1,6 @@
 module-name: api-gateway
 protecode:
-  - europe-docker.pkg.dev/kyma-project/prod/api-gateway-manager:v20240620-6d3b661b
+  - europe-docker.pkg.dev/kyma-project/prod/api-gateway-manager:v20240701-d2e5878b
   - europe-docker.pkg.dev/kyma-project/prod/external/oryd/oathkeeper:v0.38.25-beta.1
   - europe-docker.pkg.dev/kyma-project/prod/external/oryd/oathkeeper-maester:v0.1.5
 whitesource: