draft: modularize workflow and test #1613

vivekr-splunk · 2025-11-17T02:42:37Z

Description

What does this PR have in it?

Key Changes

Highlight the updates in specific files

Testing and Verification

How did you test these changes? What automated tests are added?

Related Issues

Jira tickets, GitHub issues, Support tickets...

PR Checklist

Code changes adhere to the project's coding standards.
Relevant unit and integration tests are included.
Documentation has been updated accordingly.
All tests pass locally.
The PR description follows the project's guidelines.

.github/workflows/modernized-build-test-push.yml

.github/workflows/reusable-build-operator.yml

.github/workflows/reusable-integration-test.yml

.github/workflows/test-composite-actions.yml

.github/workflows/modernized-build-test-push.yml

github-advanced-security · 2025-11-17T05:26:54Z

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

coveralls · 2025-11-17T18:50:31Z

Pull Request Test Coverage Report for Build 19453083700

Details

0 of 0 changed or added relevant lines in 0 files are covered.
No unchanged relevant lines lost coverage.
Overall coverage remained the same at 86.565%

Totals
Change from base Build 18368704520:	0.0%
Covered Lines:	10709
Relevant Lines:	12371

💛 - Coveralls

Copilot

Pull Request Overview

This draft PR modularizes the CI/CD workflows by introducing reusable composite actions and workflow templates to reduce duplication and improve maintainability across the repository's GitHub Actions infrastructure.

Key Changes:

Introduced 5 composite actions for common tasks (setup-operator-tools, setup-k8s-tools, configure-cloud-auth, collect-test-artifacts, build-and-sign-image)
Added 4 reusable workflows for integration testing, image building/verification, and composite action testing
Updated Go dependencies (Ginkgo v2.23.4→v2.27.2, Gomega v1.38.0→v1.38.2, go-logr v1.4.2→v1.4.3, and various golang.org/x packages)
Reordered imports in 8 test files to follow Go conventions (dot imports after regular imports)

Reviewed Changes

Copilot reviewed 19 out of 21 changed files in this pull request and generated 17 comments.

Show a summary per file

File	Description
.github/workflows/test-composite-actions.yml	New workflow to test composite actions on the workflow-fix branch
.github/workflows/reusable-verify-image.yml	Reusable workflow for verifying container image signatures using cosign
.github/workflows/reusable-integration-test.yml	Reusable workflow template for running integration tests across cloud platforms
.github/workflows/reusable-build-operator.yml	Reusable workflow for building and scanning operator images with Trivy
.github/workflows/modernized-build-test-push.yml	Modernized build/test workflow leveraging new composite actions and reusable workflows
.github/actions/setup-operator-tools/action.yml	Composite action for installing Operator SDK and Ginkgo
.github/actions/setup-k8s-tools/action.yml	Composite action for installing kubectl, helm, eksctl, and k8s add-ons
.github/actions/configure-cloud-auth/action.yml	Composite action for multi-cloud authentication (AWS/Azure/GCP)
.github/actions/collect-test-artifacts/action.yml	Composite action for collecting and uploading test logs and artifacts
.github/actions/build-and-sign-image/action.yml	Composite action for building container images and signing with cosign
go.mod	Updated direct dependencies (Ginkgo, Gomega, go-logr) and added/removed indirect dependencies
go.sum	Synchronized checksums for updated and new indirect dependencies
test/smoke/smoke_test.go	Reordered imports (moved types import after ginkgo dot import)
test/smartstore/smartstore_test.go	Reordered imports (moved types import after ginkgo dot import)
test/smartstore/manager_smartstore_test.go	Reordered imports (moved types import after ginkgo dot import)
test/secret/secret_s1_test.go	Reordered imports (moved types import after ginkgo dot import)
test/secret/secret_m4_test.go	Reordered imports (moved types import after ginkgo dot import)
test/secret/secret_c3_test.go	Reordered imports (moved types import after ginkgo dot import)
test/secret/manager_secret_s1_test.go	Reordered imports (moved types import after ginkgo dot import)
test/secret/manager_secret_m4_test.go	Reordered imports (moved types import after ginkgo dot import)
cmd/main.go	Removed trailing whitespace from comment and fixed indentation

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-18T15:30:15Z

.github/actions/build-and-sign-image/action.yml

+
+    - name: Set up Cosign
+      if: inputs.sign-image == 'true'
+      uses: sigstore/cosign-installer@main


Using @main for the sigstore/cosign-installer action is not recommended for production workflows as it can introduce breaking changes without notice. Pin to a specific version or use a commit SHA for stability and security.

Example:

uses: sigstore/[email protected]

Suggested change

uses: sigstore/cosign-installer@main

uses: sigstore/cosign-installer@v3.5.0

Copilot · 2025-11-18T15:30:15Z

.github/actions/setup-k8s-tools/action.yml

+      if: inputs.eksctl-version != ''
+      shell: bash
+      run: |
+        curl --silent --insecure --location "https://github.com/weaveworks/eksctl/releases/download/${{ inputs.eksctl-version }}/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp


The insecure flag --insecure is used when downloading eksctl. This disables certificate verification and could allow man-in-the-middle attacks. Remove the --insecure flag to ensure secure downloads.

Change:

curl --silent --location "https://github.com/weaveworks/eksctl/releases/download/${{ inputs.eksctl-version }}/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp

Suggested change

curl --silent --insecure --location "https://github.com/weaveworks/eksctl/releases/download/${{ inputs.eksctl-version }}/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp

curl --silent --location "https://github.com/weaveworks/eksctl/releases/download/${{ inputs.eksctl-version }}/eksctl_$(uname -s)_amd64.tar.gz" | tar xz -C /tmp

Copilot · 2025-11-18T15:30:16Z

.github/workflows/reusable-integration-test.yml

+      TEST_CLUSTER_PLATFORM: ${{ inputs.cluster-platform }}
+      TEST_CLUSTER_NAME: ${{ inputs.cluster-name }}
+      ECR_REPOSITORY: ${{ secrets.ECR_REPOSITORY }}
+      ECR_REGISTRY: ${{ secrets.ECR_REPOSITORY }}


[nitpick] The environment variable ECR_REGISTRY is set to the same value as ECR_REPOSITORY (line 96), but ECR_REGISTRY doesn't appear to be used anywhere in the workflow. Consider removing this redundant variable or clarifying its purpose if it's used by the make commands.

Suggested change

ECR_REGISTRY: ${{ secrets.ECR_REPOSITORY }}

Copilot · 2025-11-18T15:30:16Z

.github/workflows/modernized-build-test-push.yml

+    branches:
+      - main
+      - develop
+      - workflow-fix  # Added for testing


[nitpick] The comment on line 12 mentions "Added for testing" which suggests this is a temporary addition. Ensure this comment is removed or updated before merging to clarify whether workflow-fix is a permanent supported branch.

Suggested change

- workflow-fix # Added for testing

- workflow-fix

Copilot · 2025-11-18T15:30:16Z

.github/workflows/test-composite-actions.yml

+    branches:
+      - workflow-fix


The workflow triggers on the workflow-fix branch which appears to be a temporary test branch. This should be removed before merging to ensure the workflow doesn't run on unintended branches in production.

Suggested change

branches:

- workflow-fix

# branches:

# - workflow-fix

Copilot · 2025-11-18T15:30:19Z

.github/actions/build-and-sign-image/action.yml

+outputs:
+  image-digest:
+    description: 'Image digest SHA'
+    value: ${{ steps.build.outputs.digest }}


The outputs section is defined but there's no step with id: build that sets the digest output. The build step doesn't have an id, so ${{ steps.build.outputs.digest }} will always be empty. Either add an id: build to the "Build and Push Image" step and ensure it outputs the digest, or remove the unused outputs section.

Copilot · 2025-11-18T15:30:19Z

.github/actions/setup-operator-tools/action.yml

+    - name: Install Operator SDK
+      shell: bash
+      run: |
+        export ARCH=$(case $(uname -m) in x86_64) echo -n amd64 ;; aarch64) echo -n arm64 ;; *) echo -n $(uname -m) ;; esac)


[nitpick] The script uses inline shell evaluation with $(case ...) which can be fragile. While functional, this could be simplified for better readability:

ARCH=$(uname -m) case $ARCH in x86_64) ARCH=amd64 ;; aarch64) ARCH=arm64 ;; esac export ARCH export OS=$(uname | awk '{print tolower($0)}')

Suggested change

export ARCH=$(case $(uname -m) in x86_64) echo -n amd64 ;; aarch64) echo -n arm64 ;; *) echo -n $(uname -m) ;; esac)

ARCH=$(uname -m)

case "$ARCH" in

x86_64) ARCH=amd64 ;;

aarch64) ARCH=arm64 ;;

esac

export ARCH

Copilot · 2025-11-18T15:30:20Z

.github/workflows/test-composite-actions.yml

+          aws sts get-caller-identity
+          echo ""
+          echo "✅ configure-cloud-auth composite action works for AWS!"


Error handling for the aws sts get-caller-identity command is missing. If AWS authentication fails, the workflow should fail rather than silently continue. Add error handling:

if aws sts get-caller-identity; then echo "✅ configure-cloud-auth composite action works for AWS!" else echo "❌ AWS authentication failed!" exit 1 fi

Suggested change

aws sts get-caller-identity

echo ""

echo "✅ configure-cloud-auth composite action works for AWS!"

if aws sts get-caller-identity; then

echo ""

echo "✅ configure-cloud-auth composite action works for AWS!"

else

echo "❌ AWS authentication failed!"

exit 1

fi

Copilot · 2025-11-18T15:30:20Z

.github/workflows/reusable-integration-test.yml

+      TEST_BUCKET: ${{ secrets.TEST_BUCKET }}
+      TEST_INDEXES_S3_BUCKET: ${{ secrets.TEST_INDEXES_S3_BUCKET }}
+      CLUSTER_WIDE: ${{ inputs.cluster-wide }}
+      DEPLOYMENT_TYPE: ${{ inputs.deployment-type }}


[nitpick] The deployment-type input is stored in the DEPLOYMENT_TYPE environment variable but is never used in the workflow steps. Either remove this unused input/environment variable or add documentation explaining when it will be used.

Suggested change

DEPLOYMENT_TYPE: ${{ inputs.deployment-type }}

Copilot · 2025-11-18T15:30:20Z

.github/workflows/modernized-build-test-push.yml

+
+      - name: Run Code Coverage
+        run: goveralls -coverprofile=coverage.out -service=circle-ci -repotoken ${{ secrets.COVERALLS_TOKEN }}


The workflow uses ${{ secrets.COVERALLS_TOKEN }} but this secret is not documented or validated. If the secret is not set, goveralls will fail silently or with unclear errors. Consider adding a check to verify the secret exists before using it, or document that this secret is optional for non-coverage runs.

Suggested change

- name: Run Code Coverage

run: goveralls -coverprofile=coverage.out -service=circle-ci -repotoken ${{ secrets.COVERALLS_TOKEN }}

# This step uploads coverage to Coveralls. It requires the COVERALLS_TOKEN secret to be set.

- name: Run Code Coverage

if: ${{ secrets.COVERALLS_TOKEN != '' }}

run: goveralls -coverprofile=coverage.out -service=circle-ci -repotoken ${{ secrets.COVERALLS_TOKEN }}

# If the secret is not set, this step will be skipped. See documentation for details.

modularize workflow and test

da658a1

github-advanced-security bot found potential problems Nov 17, 2025

View reviewed changes

fixed an issue in the workflow

caaaa82

github-advanced-security bot found potential problems Nov 17, 2025

View reviewed changes

.github/workflows/modernized-build-test-push.yml Fixed Show fixed Hide fixed

.github/workflows/modernized-build-test-push.yml Fixed Show fixed Hide fixed

Vivek Reddy added 5 commits November 16, 2025 19:02

fixing security issue with actions

dba488a

fixing vulnerability issue

1cff270

fixing ginkgo issues

8ed2355

fixing image set

6b6b8bb

fixing cache conflict issue

d9dc927

Vivek Reddy added 4 commits November 17, 2025 07:29

fixed permission issue and secret pull

539d171

fixed image related issues

ced782c

fixed permission issue

b52dd19

removed verfication added new module

db39fea

fixed image path

c90969c

vivekr-splunk requested a review from Copilot November 18, 2025 15:21

Copilot started reviewing on behalf of vivekr-splunk November 18, 2025 15:22 View session

Copilot finished reviewing on behalf of vivekr-splunk November 18, 2025 15:25

Copilot AI reviewed Nov 18, 2025

View reviewed changes

	uses: sigstore/cosign-installer@main
	uses: sigstore/cosign-installer@v3.5.0

	curl --silent --insecure --location "https://github.com/weaveworks/eksctl/releases/download/${{ inputs.eksctl-version }}/eksctl_$(uname -s)_amd64.tar.gz" \| tar xz -C /tmp
	curl --silent --location "https://github.com/weaveworks/eksctl/releases/download/${{ inputs.eksctl-version }}/eksctl_$(uname -s)_amd64.tar.gz" \| tar xz -C /tmp

-        export ARCH=$(case $(uname -m) in x86_64) echo -n amd64 ;; aarch64) echo -n arm64 ;; *) echo -n $(uname -m) ;; esac)
+        ARCH=$(uname -m)
+        case "$ARCH" in
+          x86_64) ARCH=amd64 ;;
+          aarch64) ARCH=arm64 ;;
+        esac
+        export ARCH


		- name: Run Code Coverage
		run: goveralls -coverprofile=coverage.out -service=circle-ci -repotoken ${{ secrets.COVERALLS_TOKEN }}

draft: modularize workflow and test #1613

Are you sure you want to change the base?

draft: modularize workflow and test #1613

Uh oh!

Conversation

vivekr-splunk commented Nov 17, 2025

Description

Key Changes

Testing and Verification

Related Issues

PR Checklist

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-advanced-security bot commented Nov 17, 2025

Uh oh!

coveralls commented Nov 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 19453083700

Details

💛 - Coveralls

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 18, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

coveralls commented Nov 17, 2025 •

edited

Loading