-
Notifications
You must be signed in to change notification settings - Fork 690
211 lines (205 loc) · 6.96 KB
/
gate.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
name: Gate
on:
push:
branches: [ 'master', '*', '!stabilization*', '!stable*' ]
pull_request:
branches: [ 'master', 'stabilization*' ]
jobs:
validate-centos7:
name: Build, Test on CentOS 7 (Container)
runs-on: ubuntu-latest
container:
image: centos:7
steps:
- name: Install Deps
run: yum install -y cmake make openscap-utils PyYAML libxslt xml-common python-jinja2 python-setuptools
- name: Checkout
uses: actions/checkout@v3
- name: Build
run: |-
./build_product \
alinux2 \
alinux3 \
anolis23 \
chromium \
fedora \
firefox \
rhcos4 \
rhel7 \
rhel8 \
rhel9 \
uos20 \
--derivatives
- name: Test
run: ctest -j2 --output-on-failure -E unique-stigids
working-directory: ./build
validate-suse:
name: Build, Test on OpenSUSE Leap 15 (Container)
runs-on: ubuntu-latest
container:
image: opensuse/leap:15
steps:
- name: Install Deps
run: zypper install -y git cmake make openscap-utils python3-PyYAML bats python3-pytest python3-pytest-cov python3-Jinja2 python3-setuptools libxslt-tools libxml2-tools ShellCheck
- name: Checkout
uses: actions/checkout@v3
- name: Build
run: ./build_product alinux2 alinux3 anolis23 chromium fedora firefox rhcos4 rhel7 rhel8 rhel9 sle12 sle15 ubuntu2004 ubuntu2204 uos20
- name: Test
run: ctest -j2 --output-on-failure -E unique-stigids
working-directory: ./build
validate-debian:
name: Build, Test on Debian 10 (Container)
runs-on: ubuntu-latest
container:
image: debian:buster
steps:
- name: Update the package repository
run: apt-get update
- name: Install Deps
run: apt-get install -y ansible-lint bats check cmake libopenscap8 libxml2-utils ninja-build python3-github python3-pip xsltproc
- name: Checkout
uses: actions/checkout@v3
- name: Install deps python
run: pip3 install -r requirements.txt -r test-requirements.txt
- name: Build
env:
ADDITIONAL_CMAKE_OPTIONS: "-DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED=ON"
run: |-
./build_product debian10 debian11
- name: Test
working-directory: ./build
run: ctest -j2 --output-on-failure -E unique-stigids
validate-ubuntu:
name: Build, Test on Ubuntu 20.04
runs-on: ubuntu-20.04
steps:
- name: Install Deps
run: sudo apt-get update && sudo apt-get install cmake ninja-build libopenscap8 libxml2-utils xsltproc python3-jinja2 python3-yaml python3-setuptools ansible-lint python3-github bats python3-pytest python3-pytest-cov shellcheck
- name: Checkout
uses: actions/checkout@v3
- name: Build
env:
ADDITIONAL_CMAKE_OPTIONS: "-DSSG_SCE_ENABLED:BOOL=ON"
run: |-
./build_product \
alinux2 \
alinux3 \
anolis23 \
chromium \
fedora \
firefox \
rhcos4 \
rhel7 \
rhel8 \
rhel9 \
sle12 \
sle15 \
ubuntu2004 \
ubuntu2204 \
uos20
- name: Test
run: ctest -j2 --output-on-failure -E unique-stigids
working-directory: ./build
validate-ubuntu-22-04:
name: Build, Test on Ubuntu 22.04
runs-on: ubuntu-22.04
steps:
- name: Install Deps
run: sudo apt-get update && sudo apt-get install cmake ninja-build libopenscap8 libxml2-utils xsltproc python3-jinja2 python3-yaml python3-setuptools ansible-lint python3-github bats python3-pytest python3-pytest-cov shellcheck
- name: Checkout
uses: actions/checkout@v3
- name: Build
env:
ADDITIONAL_CMAKE_OPTIONS: "-DSSG_SCE_ENABLED:BOOL=ON"
run: |-
./build_product \
ubuntu2004 \
ubuntu2204
- name: Test
run: ctest -j2 --output-on-failure -E unique-stigids
working-directory: ./build
validate-fedora:
name: Build, Test on Fedora Latest (Container)
runs-on: ubuntu-latest
container:
image: fedora:latest
steps:
- name: Install Deps
run: dnf install -y cmake make openscap-utils python3-pyyaml bats ansible python3-pip ShellCheck git
- name: Checkout
uses: actions/checkout@v3
- name: Install deps python
run: pip install -r requirements.txt -r test-requirements.txt
- name: Build
run: |-
./build_product \
alinux2 \
alinux3 \
anolis23 \
chromium \
fedora \
firefox \
rhcos4 \
rhel7 \
rhel8 \
rhel9 \
sle12 \
sle15 \
ubuntu2004 \
ubuntu2204 \
uos20 \
ocp4 \
eks
env:
ADDITIONAL_CMAKE_OPTIONS: "-DSSG_ANSIBLE_PLAYBOOKS_PER_RULE_ENABLED=ON"
- name: Test
run: ctest -j2 --output-on-failure -E unique-stigids
working-directory: ./build
- name: "Set git safe directory, ref: https://github.com/actions/checkout/issues/760"
run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
- name: Upload coverage to Code Climate # Requires: git package
if: ${{ github.repository == 'ComplianceAsCode/content' }}
uses: paambaati/codeclimate-action@v4.0.0
env:
CC_TEST_REPORTER_ID: e67e068471d32b63f8e9561dba8f6a3f84dcc76b05ebfd98e44ced1a91cff854
with:
coverageLocations: build/tests/coverage.xml:coverage.py
- name: Validate gitmailmap
run: grep -E "\S" .mailmap | grep -Ev '^#' | git check-mailmap --stdin
validate-fedora-rawhide:
name: Build, Test on Fedora Rawhide (Container)
runs-on: ubuntu-latest
container:
image: fedora:rawhide
steps:
- name: Run Updates
run: dnf update -y
- name: Install Deps
run: dnf install -y cmake make openscap-utils bats ansible python3-pip ShellCheck git
- name: Checkout
uses: actions/checkout@v3
- name: Install deps python
run: pip install -r requirements.txt -r test-requirements.txt
- name: Build
run: |-
./build_product \
alinux2 \
alinux3 \
anolis23 \
chromium \
fedora \
firefox \
rhcos4 \
rhel7 \
rhel8 \
rhel9 \
sle12 \
sle15 \
ubuntu2004 \
ubuntu2204 \
uos20 \
ocp4
- name: Test
run: ctest -j2 --output-on-failure -E unique-stigids
working-directory: ./build