Skip to content

Commit 5fed90d

Browse files
kevin85421kevin85421
committed
Merge remote-tracking branch 'upstream/main' into ResponseHeaderModifier
2 parents 9bf3447 + 6becde2 commit 5fed90d

File tree

168 files changed

+9316
-2350
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

168 files changed

+9316
-2350
lines changed

‎.github/PULL_REQUEST_TEMPLATE.md

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,14 @@ Before creating a PR, run through this checklist and mark each as complete.
2525
- [ ] I have updated necessary documentation
2626
- [ ] I have rebased my branch onto main
2727
- [ ] I will ensure my PR is targeting the main branch and pulling from my branch from my own fork
28+
29+
### Release notes
30+
31+
If this PR introduces a change that affects users and needs to be mentioned in the [release notes](../CHANGELOG.md),
32+
please add a brief note that summarizes the change.
33+
34+
<!-- If this PR does not require a release note, you can just write NONE in the release-note block below. -->
35+
36+
```release-note
37+
38+
```

‎.github/workflows/build.yml

Lines changed: 170 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,170 @@
1+
name: Build
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
platforms:
7+
required: true
8+
type: string
9+
image:
10+
required: true
11+
type: string
12+
tag:
13+
required: false
14+
type: string
15+
16+
defaults:
17+
run:
18+
shell: bash
19+
20+
permissions:
21+
contents: read
22+
23+
jobs:
24+
build:
25+
permissions:
26+
contents: read # for docker/build-push-action to read repo content
27+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
28+
packages: write # for docker/build-push-action to push to GHCR
29+
id-token: write # for docker/login to login to NGINX registry
30+
runs-on: ${{ github.event_name != 'pull_request' && contains(inputs.image, 'plus') && 'kic-plus' || 'ubuntu-22.04' }}
31+
services:
32+
registry:
33+
image: registry:2
34+
ports:
35+
- 5000:5000
36+
steps:
37+
- name: Checkout Repository
38+
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
39+
with:
40+
ref: ${{ inputs.tag != '' && format('refs/tags/v{0}', inputs.tag) || github.ref }}
41+
42+
- name: Fetch Cached Artifacts
43+
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
44+
with:
45+
path: ${{ github.workspace }}/dist
46+
key: nginx-gateway-fabric-${{ github.run_id }}-${{ github.run_number }}
47+
48+
- name: Docker Buildx
49+
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
50+
with:
51+
driver-opts: network=host
52+
53+
- name: Setup QEMU
54+
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
55+
with:
56+
platforms: arm64
57+
58+
- name: Login to GitHub Container Registry
59+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
60+
if: ${{ github.event_name != 'pull_request' && ! contains(inputs.image, 'plus') }}
61+
with:
62+
registry: ghcr.io
63+
username: ${{ github.repository_owner }}
64+
password: ${{ secrets.GITHUB_TOKEN }}
65+
66+
- name: Get Id Token
67+
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
68+
id: idtoken
69+
with:
70+
script: |
71+
let id_token = await core.getIDToken()
72+
core.setOutput('id_token', id_token)
73+
if: ${{ github.event_name != 'pull_request' && contains(inputs.image, 'plus')}}
74+
75+
- name: Login to NGINX Registry
76+
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
77+
with:
78+
registry: docker-mgmt.nginx.com
79+
username: ${{ steps.idtoken.outputs.id_token }}
80+
password: ${{ github.actor }}
81+
if: ${{ github.event_name != 'pull_request' && contains(inputs.image, 'plus') }}
82+
83+
- name: Docker meta
84+
id: meta
85+
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
86+
with:
87+
images: |
88+
name=ghcr.io/nginxinc/nginx-gateway-fabric,enable=${{ inputs.image == 'ngf' && github.event_name != 'pull_request' }}
89+
name=ghcr.io/nginxinc/nginx-gateway-fabric/nginx,enable=${{ inputs.image == 'nginx' && github.event_name != 'pull_request' }}
90+
name=docker-mgmt.nginx.com/nginx-gateway-fabric/nginx-plus,enable=${{ inputs.image == 'plus' && github.event_name != 'pull_request' }}
91+
name=localhost:5000/nginx-gateway-fabric/${{ inputs.image }}
92+
flavor: |
93+
latest=${{ (inputs.tag != '' && 'true') || 'auto' }}
94+
tags: |
95+
type=semver,pattern={{version}}
96+
type=edge
97+
type=ref,event=pr
98+
type=ref,event=branch,suffix=-rc,enable=${{ startsWith(github.ref, 'refs/heads/release') }}
99+
type=raw,value=${{ inputs.tag }},enable=${{ inputs.tag != '' }}
100+
labels: |
101+
org.opencontainers.image.documentation=https://docs.nginx.com/nginx-gateway-fabric
102+
org.opencontainers.image.vendor=NGINX Inc <[email protected]>
103+
annotations: |
104+
org.opencontainers.image.documentation=https://docs.nginx.com/nginx-gateway-fabric
105+
org.opencontainers.image.vendor=NGINX Inc <[email protected]>
106+
io.artifacthub.package.readme-url=https://raw.githubusercontent.com/nginxinc/nginx-gateway-fabric/main/README.md
107+
io.artifacthub.package.logo-url=https://docs.nginx.com/nginx-gateway-fabric/images/icons/NGINX-product-icon.svg
108+
io.artifacthub.package.maintainers=[{"name":"NGINX Inc","email":"[email protected]"}]
109+
io.artifacthub.package.license=Apache-2.0
110+
io.artifacthub.package.keywords=kubernetes,gateway,nginx
111+
env:
112+
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
113+
114+
- name: Build Docker Image
115+
uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
116+
with:
117+
file: build/Dockerfile${{ inputs.image == 'nginx' && '.nginx' || '' }}${{ inputs.image == 'plus' && '.nginxplus' || '' }}
118+
context: "."
119+
target: ${{ inputs.image == 'ngf' && 'goreleaser' || '' }}
120+
tags: ${{ steps.meta.outputs.tags }}
121+
labels: ${{ steps.meta.outputs.labels }}
122+
annotations: ${{ steps.meta.outputs.annotations }}
123+
push: true
124+
platforms: ${{ inputs.platforms }}
125+
cache-from: type=gha,scope=${{ inputs.image }}
126+
cache-to: type=gha,scope=${{ inputs.image }},mode=max
127+
pull: true
128+
no-cache: ${{ github.event_name != 'pull_request' }}
129+
sbom: true
130+
provenance: mode=max
131+
build-args: |
132+
NJS_DIR=internal/mode/static/nginx/modules/src
133+
NGINX_CONF_DIR=internal/mode/static/nginx/conf
134+
BUILD_AGENT=gha
135+
secrets: |
136+
${{ contains(inputs.image, 'plus') && format('"nginx-repo.crt={0}"', secrets.NGINX_CRT) || '' }}
137+
${{ contains(inputs.image, 'plus') && format('"nginx-repo.key={0}"', secrets.NGINX_KEY) || '' }}
138+
139+
- name: Inspect SBOM and output manifest
140+
run: |
141+
docker buildx imagetools inspect localhost:5000/nginx-gateway-fabric/${{ inputs.image }}:${{ steps.meta.outputs.version }} --format '{{ json (index .SBOM "linux/amd64").SPDX }}' > sbom-${{ inputs.image }}.json
142+
docker buildx imagetools inspect localhost:5000/nginx-gateway-fabric/${{ inputs.image }}:${{ steps.meta.outputs.version }} --raw
143+
144+
- name: Scan SBOM
145+
id: scan
146+
uses: anchore/scan-action@3343887d815d7b07465f6fdcd395bd66508d486a # v3.6.4
147+
with:
148+
sbom: "sbom-${{ inputs.image }}.json"
149+
only-fixed: true
150+
add-cpes-if-none: true
151+
fail-build: false
152+
153+
- name: Upload scan result to GitHub Security tab
154+
uses: github/codeql-action/upload-sarif@379614612a29c9e28f31f39a59013eb8012a51f0 # v3.24.3
155+
continue-on-error: true
156+
with:
157+
sarif_file: ${{ steps.scan.outputs.sarif }}
158+
category: build-${{ inputs.image }}
159+
if: always()
160+
161+
- name: Upload Scan Results
162+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
163+
continue-on-error: true
164+
with:
165+
name: scan-results-${{ inputs.image }}
166+
path: |
167+
${{ steps.scan.outputs.sarif }}
168+
*.json
169+
!sbom-plus.json
170+
if: always()

‎.github/workflows/ci.yml

Lines changed: 15 additions & 93 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@ concurrency:
1717
group: ${{ github.ref_name }}-ci
1818
cancel-in-progress: true
1919

20-
env:
21-
platforms: "linux/arm64, linux/amd64"
22-
2320
permissions:
2421
contents: read
2522

@@ -71,7 +68,7 @@ jobs:
7168
run: make unit-test
7269

7370
- name: Upload Coverage Report
74-
uses: actions/upload-artifact@694cdabd8bdb0f10b2cea11669e1bf5453eed0a6 # v4.2.0
71+
uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
7572
with:
7673
name: cover-${{ github.run_id }}.html
7774
path: ${{ github.workspace }}/cover.html
@@ -86,7 +83,7 @@ jobs:
8683
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
8784

8885
- name: Setup Node.js Environment
89-
uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
86+
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
9087
with:
9188
node-version: 18
9289
- run: npm --prefix ${{ github.workspace }}/internal/mode/static/nginx/modules install-ci-test
@@ -111,7 +108,7 @@ jobs:
111108
go-version: stable
112109

113110
- name: Create/Update Draft
114-
uses: lucacome/draft-release@52f02d1a69b61568e54ab5cf86ce91503bac4066 # v1.0.2
111+
uses: lucacome/draft-release@a98777f0bae0a6815cc1df77ebe48ca70e7cb970 # v1.0.3
115112
with:
116113
minor-label: "enhancement"
117114
major-label: "change"
@@ -123,11 +120,11 @@ jobs:
123120
if: ${{ github.event_name == 'push' && github.ref != 'refs/heads/main' }}
124121

125122
- name: Download Syft
126-
uses: anchore/sbom-action/download-syft@41f7a6c033dbcdf78917f23b652c8b8146298c85 # v0.15.4
123+
uses: anchore/sbom-action/download-syft@b6a39da80722a2cb0ef5d197531764a89b5d48c3 # v0.15.8
127124
if: github.ref_type == 'tag'
128125

129126
- name: Install Cosign
130-
uses: sigstore/cosign-installer@9614fae9e5c5eddabb09f90a270fcb487c9f7149 # v3.3.0
127+
uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 # v3.4.0
131128
if: github.ref_type == 'tag'
132129

133130
- name: Build binary
@@ -168,7 +165,7 @@ jobs:
168165

169166
- name: NGF Docker meta
170167
id: ngf-meta
171-
uses: docker/metadata-action@dbef88086f6cef02e264edb7dbf63250c17cef6c # v5.5.0
168+
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
172169
with:
173170
images: |
174171
name=ghcr.io/nginxinc/nginx-gateway-fabric
@@ -180,7 +177,7 @@ jobs:
180177
181178
- name: NGINX Docker meta
182179
id: nginx-meta
183-
uses: docker/metadata-action@dbef88086f6cef02e264edb7dbf63250c17cef6c # v5.5.0
180+
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
184181
with:
185182
images: |
186183
name=ghcr.io/nginxinc/nginx-gateway-fabric/nginx
@@ -245,97 +242,22 @@ jobs:
245242

246243
build:
247244
name: Build Image
248-
runs-on: ubuntu-22.04
249245
needs: [vars, binary]
250246
strategy:
251247
fail-fast: false
252248
matrix:
253-
container: [ngf, nginx]
249+
image: [ngf, nginx, plus]
250+
platforms: ["linux/arm64, linux/amd64"]
251+
uses: ./.github/workflows/build.yml
252+
with:
253+
image: ${{ matrix.image }}
254+
platforms: ${{ matrix.platforms }}
254255
permissions:
255256
contents: read # for docker/build-push-action to read repo content
256257
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
257258
packages: write # for docker/build-push-action to push to GHCR
258-
steps:
259-
- name: Checkout Repository
260-
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
261-
262-
- name: Fetch Cached Artifacts
263-
uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
264-
with:
265-
path: ${{ github.workspace }}/dist
266-
key: nginx-gateway-fabric-${{ github.run_id }}-${{ github.run_number }}
267-
268-
- name: Docker Buildx
269-
uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
270-
271-
- name: Setup QEMU
272-
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
273-
with:
274-
platforms: arm64
275-
276-
- name: Login to GitHub Container Registry
277-
uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
278-
if: ${{ github.event_name != 'pull_request' }}
279-
with:
280-
registry: ghcr.io
281-
username: ${{ github.repository_owner }}
282-
password: ${{ secrets.GITHUB_TOKEN }}
283-
284-
- name: Docker meta
285-
id: meta
286-
uses: docker/metadata-action@dbef88086f6cef02e264edb7dbf63250c17cef6c # v5.5.0
287-
with:
288-
images: |
289-
name=ghcr.io/nginxinc/nginx-gateway-fabric${{ matrix.container == 'nginx' && '/nginx' || '' }}
290-
tags: |
291-
type=semver,pattern={{version}}
292-
type=edge
293-
type=ref,event=pr
294-
type=ref,event=branch,suffix=-rc,enable=${{ startsWith(github.ref, 'refs/heads/release') }}
295-
296-
- name: Build Docker Image
297-
uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
298-
with:
299-
file: ${{ matrix.container == 'nginx' && 'build/Dockerfile.nginx' || 'build/Dockerfile' }}
300-
context: "."
301-
target: ${{ matrix.container == 'ngf' && 'goreleaser' || '' }}
302-
tags: ${{ steps.meta.outputs.tags }}
303-
labels: ${{ steps.meta.outputs.labels }}
304-
load: ${{ github.event_name == 'pull_request' }}
305-
push: ${{ github.event_name != 'pull_request' }}
306-
platforms: ${{ github.event_name != 'pull_request' && env.platforms || '' }}
307-
cache-from: type=gha,scope=${{ matrix.container }}
308-
cache-to: type=gha,scope=${{ matrix.container }},mode=max
309-
pull: true
310-
no-cache: ${{ github.event_name != 'pull_request' }}
311-
sbom: ${{ github.event_name != 'pull_request' }}
312-
provenance: false
313-
build-args: |
314-
NJS_DIR=internal/mode/static/nginx/modules/src
315-
NGINX_CONF_DIR=internal/mode/static/nginx/conf
316-
317-
- name: Run Trivy vulnerability scanner
318-
uses: aquasecurity/trivy-action@d43c1f16c00cfd3978dde6c07f4bbcf9eb6993ca # 0.16.1
319-
continue-on-error: true
320-
with:
321-
image-ref: ghcr.io/nginxinc/nginx-gateway-fabric${{ matrix.container == 'nginx' && '/nginx' || '' }}:${{ steps.meta.outputs.version }}
322-
format: "sarif"
323-
output: trivy-results-nginx-gateway-fabric${{ matrix.container == 'nginx' && '-nginx' || '' }}.sarif
324-
ignore-unfixed: "true"
325-
326-
- name: Upload Trivy scan results to GitHub Security tab
327-
uses: github/codeql-action/upload-sarif@0b21cf2492b6b02c465a3e5d7c473717ad7721ba # v3.23.1
328-
continue-on-error: true
329-
with:
330-
sarif_file: trivy-results-nginx-gateway-fabric${{ matrix.container == 'nginx' && '-nginx' || '' }}.sarif
331-
332-
- name: Upload Scan Results
333-
uses: actions/upload-artifact@694cdabd8bdb0f10b2cea11669e1bf5453eed0a6 # v4.2.0
334-
continue-on-error: true
335-
with:
336-
name: trivy-results-nginx-gateway-fabric${{ matrix.container == 'nginx' && '-nginx' || '' }}.sarif
337-
path: trivy-results-nginx-gateway-fabric${{ matrix.container == 'nginx' && '-nginx' || '' }}.sarif
338-
if: always()
259+
id-token: write # for docker/login to login to NGINX registry
260+
secrets: inherit
339261

340262
publish-helm:
341263
name: Package and Publish Helm Chart

‎.github/workflows/codeql-analysis.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ jobs:
4444

4545
# Initializes the CodeQL tools for scanning.
4646
- name: Initialize CodeQL
47-
uses: github/codeql-action/init@0b21cf2492b6b02c465a3e5d7c473717ad7721ba # v3.23.1
47+
uses: github/codeql-action/init@379614612a29c9e28f31f39a59013eb8012a51f0 # v3.24.3
4848
with:
4949
languages: ${{ matrix.language }}
5050
# If you wish to specify custom queries, you can do so here or in a config file.
@@ -63,7 +63,7 @@ jobs:
6363
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
6464
# If this step fails, then you should remove it and run the build manually (see below)
6565
- name: Autobuild
66-
uses: github/codeql-action/autobuild@0b21cf2492b6b02c465a3e5d7c473717ad7721ba # v3.23.1
66+
uses: github/codeql-action/autobuild@379614612a29c9e28f31f39a59013eb8012a51f0 # v3.24.3
6767

6868
# ℹ️ Command-line programs to run using the OS shell.
6969
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
@@ -76,6 +76,6 @@ jobs:
7676
# ./location_of_script_within_repo/buildscript.sh
7777

7878
- name: Perform CodeQL Analysis
79-
uses: github/codeql-action/analyze@0b21cf2492b6b02c465a3e5d7c473717ad7721ba # v3.23.1
79+
uses: github/codeql-action/analyze@379614612a29c9e28f31f39a59013eb8012a51f0 # v3.24.3
8080
with:
8181
category: "/language:${{matrix.language}}"

0 commit comments

Comments
 (0)