Migrate Github Actions from https://github.com/PharmaLedger-IMI/helmc…

…hart-ethadapter to here (#19)

* checkin from helmchart-ethadapter

* doc and checkin script for codeowners

* doc and cleanup

* doc

* disable checkov

* remove readme as helm unittests fail

* added missing chart testing config file

* move to _old_charts

* move

* dummy chart

* add missing pre-commit config

.github/CODEOWNERS

@@ -0,0 +1,9 @@
+# See https://github.com/scottrigby/prometheus-helm-charts/issues/12
+# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
+# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners#codeowners-syntax
+
+# The repo admins team will be the default owners for everything in the repo.
+# Unless a later match takes precedence, they will be requested for review when someone opens a pull request.
+* @tgip-work
+
+/charts/ethadapter/ @tgip-work 

.github/workflows/chart_testing.yaml

@@ -0,0 +1,32 @@
+#
+# Checks if the version has been bumped for each changed Chart on a Pull Request.
+# https://github.com/helm/chart-testing
+#
+name: Chart testing
+
+on: pull_request
+
+jobs:
+  chart-testing:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0
+        name: Checkout
+        with:
+          fetch-depth: 0
+
+      #
+      # Note: v3.5.0 = sha256:40d3529ca14fb02940091ae0b3fa77ce6c96ad78b31bbb243f4eed5ac33bdbe4
+      #
+      - name: Run chart-testing (list-changed)
+        id: list-changed
+        run: |
+          changed=$(docker run --rm --workdir=/data --volume "$(pwd)":/data quay.io/helmpack/chart-testing@sha256:40d3529ca14fb02940091ae0b3fa77ce6c96ad78b31bbb243f4eed5ac33bdbe4 ct list-changed --config ct.yaml)
+          if [[ -n "$changed" ]]; then
+            echo "::set-output name=changed::true"
+          fi
+
+      - name: Run chart-testing (lint)
+        id: lint
+        run: |
+          docker run --rm --workdir=/data --volume "$(pwd)":/data quay.io/helmpack/chart-testing@sha256:40d3529ca14fb02940091ae0b3fa77ce6c96ad78b31bbb243f4eed5ac33bdbe4 ct lint --config ct.yaml

.github/workflows/check-codeowners.yaml

@@ -0,0 +1,32 @@
+#
+# Checks if file .github/CODEOWNERS is up to date on a Pull Request.
+#
+name: Check CODEOWNERS
+
+on: pull_request
+
+jobs:
+  find-diffs:
+    runs-on: ubuntu-20.04
+    name: Check if CODEOWNERS file is up to date with maintainers from helm chart(s)
+
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0
+        name: Checkout
+
+      - name: install yq
+        run: |
+          sudo snap install yq
+      
+      - name: generate CODEOWNERS
+        run: |
+          ./scripts/check-codeowners.sh > .github/CODEOWNERS
+          cat .github/CODEOWNERS
+      
+      - name: check CODEOWNERS for modifications
+        run: |
+          git diff --exit-code || echo "::warning::There is at least one codeowner mismatch."

.github/workflows/detect_secrets.yaml

@@ -0,0 +1,24 @@
+#
+# Looks for potential secret values/sensitive data that MUST not be checked in on a Pull Request.
+# See https://github.com/reviewdog/action-detect-secrets#troubleshooting for whitelisting false positives.
+#
+name: Detect Secrets
+
+on: pull_request
+
+jobs:
+  detect-secrets:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0
+        name: Checkout
+
+      # https://github.com/reviewdog/action-detect-secrets - works for pull requests only
+      - name: detect-secrets
+        uses: reviewdog/action-detect-secrets@d248ce8b83ee2d3fdc01df94bc64312d428665ae # https://github.com/reviewdog/action-detect-secrets/releases/tag/v0.7.0
+        with:
+          github_token: ${{ secrets.github_token }}
+          # see https://github.com/Yelp/detect-secrets
+          # https://github.com/reviewdog/action-detect-secrets/issues/16
+          detect_secrets_flags: --force-use-all-plugins --exclude-files charts/standalone-quorum/templates/ --exclude-files charts/smartcontract/templates/configmap-code.yaml

.github/workflows/helm_unittests.yaml

@@ -0,0 +1,36 @@
+#
+# Runs Helm Unittests https://github.com/quintush/helm-unittest on a push and Pull Request.
+#
+name: Helm Unittests
+
+on: [push, pull_request]
+
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    name: Run Helm Unittest
+    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0
+        name: Checkout
+
+      # https://github.com/marketplace/actions/engineerd-configurator
+      - uses: engineerd/configurator@479197cb150e720c848c8dfbe12da101471258e3 # v0.0.8
+        name: Setup helm
+        with:
+          name: helm
+          url: https://get.helm.sh/helm-v3.7.1-linux-amd64.tar.gz
+          pathInArchive: linux-amd64/helm
+      - run: helm version
+
+      # https://github.com/quintush/helm-unittest
+      - name: Setup Helm Unittest
+        run: helm plugin install https://github.com/quintush/helm-unittest --version=v0.2.8
+
+      - name: Run Helm Unittest
+        run: helm unittest --helm3=true charts/*
+

.github/workflows/release.yaml

@@ -0,0 +1,43 @@
+#
+# Runs the "Chart Releaser" https://github.com/helm/chart-releaser-action on push to main branch (e.g. on a succesful merge from a Pull Request).
+# 1. The "Chart Releaser" creates a GitHub Release for each Chart that has changed
+# 2. and updates the "index.yaml" of the Helm Repository in branch "gh-pages" (GitHub Pages).
+#
+name: Release Charts
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0
+        name: Checkout
+        with:
+          fetch-depth: 0
+
+      - name: Configure Git
+        run: |
+          git config user.name "$GITHUB_ACTOR"
+          git config user.email "[email protected]"
+
+      # https://github.com/marketplace/actions/engineerd-configurator
+      - uses: engineerd/configurator@479197cb150e720c848c8dfbe12da101471258e3 # v0.0.8
+        name: Setup helm
+        with:
+          name: helm
+          url: https://get.helm.sh/helm-v3.7.1-linux-amd64.tar.gz
+          pathInArchive: linux-amd64/helm
+      - run: helm version
+
+      # https://github.com/helm/chart-releaser-action
+      - name: Run chart-releaser
+        uses: helm/chart-releaser-action@c25b74a986eb925b398320414b576227f375f946 # v1.2.1
+        with:
+          charts_dir: charts
+          #config: cr.yaml
+        env:
+          CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/validate_code.yaml

@@ -0,0 +1,49 @@
+name: Validate code
+on: [push, pull_request]
+jobs:
+  pre-commit:
+    runs-on: ubuntu-latest
+    name: Run Pre-Commit and linter
+    # Use the Bash shell regardless whether the GitHub Actions runner is ubuntu-latest, macos-latest, or windows-latest
+    defaults:
+      run:
+        shell: bash
+
+    steps:
+      - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0
+        name: Checkout
+
+      # https://github.com/marketplace/actions/engineerd-configurator
+      - uses: engineerd/configurator@479197cb150e720c848c8dfbe12da101471258e3 # v0.0.8
+        name: Setup helm
+        with:
+          name: helm
+          url: https://get.helm.sh/helm-v3.7.1-linux-amd64.tar.gz
+          pathInArchive: linux-amd64/helm
+      - run: helm version
+
+      # https://github.com/marketplace/actions/engineerd-configurator
+      - uses: engineerd/configurator@479197cb150e720c848c8dfbe12da101471258e3 # v0.0.8
+        name: Setup helm-docs
+        with:
+          name: helm-docs
+          url: https://github.com/norwoodj/helm-docs/releases/download/v1.5.0/helm-docs_1.5.0_Linux_x86_64.tar.gz
+          pathInArchive: helm-docs
+      - run: helm-docs --version
+
+      - name: Helm Lint
+        run: helm lint ./charts/* --strict
+
+      - uses: pre-commit/action@9b88afc9cd57fd75b655d5c71bd38146d07135fe # v2.0.3
+        name: Run pre-commit
+
+# ToDo: Implement Checkov for Helm charts in order to follow unified good practices.
+  # checkov:
+  #   runs-on: ubuntu-latest
+
+  #   steps:
+  #     - uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 # v2.4.0
+  #       name: Checkout
+
+  #     - uses: bridgecrewio/checkov-action@00cc657f4d415593e5c8897bc87f490497ccb5f9 # v12.641.0
+  #       name: Run Checkov action

.pre-commit-config.yaml

@@ -0,0 +1,22 @@
+repos:
+- repo: https://github.com/norwoodj/helm-docs
+  rev: v1.5.0
+  hooks:
+    - id: helm-docs
+      args:
+        # Make the tool search for charts under the `charts` directory
+        - --chart-search-root=charts
+
+# - repo: https://github.com/bridgecrewio/checkov.git
+#   rev: 'd9269af517a85a62d8010e17fa09b34e1a3b17ed' # 2.0.1054 ff217a56ee70b9b0c6d82174a9a816d52663187a = 
+#   hooks:
+#     - id: checkov
+#       files: ^charts/
+#       args:
+#         - -d 
+#         - charts/
+#         - --framework 
+#         - helm
+#         - --quiet
+#         - --compact
+# #        - --soft-fail

README.md

@@ -1 +1,16 @@
 # Helm charts
+
+## Development
+
+1. We use [GitHub Flow](https://docs.github.com/en/get-started/quickstart/github-flow).
+    1. Create a branch derived from branch `master`.
+    2. Make your changes and test them.
+    3. Create a Pull Request.
+    4. Verify that all checks pass. If not, fix the issues on your branch and push them again.
+    5. Wait for your Pull Request to be reviewed.
+    6. After successful Review, your Pull Request will be merged.
+2. Several checks run on a Pull Request. They all need to pass, otherwise your changes will not be accepted.
+3. In case you are doing changes on a helm chart
+    1. bump the version in `Chart.yaml`,
+    2. Run `pre-commit run -a` to update the documentation.
+4. After your Pull Request has been accepted and has been merged to `master` branch, an automated process will create a new Release of the modified helm charts.

charts/ethereum-adapter/templates/demo-configmap.yaml → _old_charts/ethereum-adapter/templates/demo-configmap.yaml

@@ -3,7 +3,7 @@ kind: ConfigMap
 metadata:
   name: genesis-config-demo
   labels:
-    name: genesis-config-demo
+    name: "genesis-config-demo"
 data:
   load-genesis.json: |-
     {{- $genesis := .Files.Get "common.json" | fromJson }}

charts/dummy/.helmignore

@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/

charts/dummy/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: dummy
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

charts/dummy/templates/NOTES.txt

@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+  {{- range .paths }}
+  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+  {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+  export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "dummy.fullname" . }})
+  export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+  echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+     NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+           You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "dummy.fullname" . }}'
+  export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "dummy.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+  echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+  export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "dummy.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+  export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+  echo "Visit http://127.0.0.1:8080 to use your application"
+  kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}