diff --git a/.github/linters/.checkov.yaml b/.github/linters/.checkov.yaml new file mode 100644 index 00000000..80450ad9 --- /dev/null +++ b/.github/linters/.checkov.yaml @@ -0,0 +1,6 @@ +--- +quiet: true +# Only the four upstream Valkey resources that inherit the Helm release namespace. +# Chart install tests supply a dedicated namespace. Other namespace checks remain enabled. +baseline: .github/linters/checkov-baseline.json +output-baseline-as-skipped: true diff --git a/.github/linters/.jscpd.json b/.github/linters/.jscpd.json index 2de59f4e..418f8c3e 100644 --- a/.github/linters/.jscpd.json +++ b/.github/linters/.jscpd.json @@ -1,4 +1,11 @@ { "threshold": 5, - "ignore": ["**/tests/**", "**/node_modules/**"] + "ignore": [ + "**/tests/**", + ".github/workflows/__test-*.yml", + "**/node_modules/**", + "**/package-lock.json", + "actions/**/README.md", + ".github/workflows/*.md" + ] } diff --git a/.github/linters/checkov-baseline.json b/.github/linters/checkov-baseline.json new file mode 100644 index 00000000..bde908bf --- /dev/null +++ b/.github/linters/checkov-baseline.json @@ -0,0 +1,40 @@ +{ + "failed_checks": [ + { + "file": "/tests/charts/umbrella-application/test-umbrella-application/charts/database/templates/deploy_valkey.yaml", + "findings": [ + { + "resource": "Deployment.default.database", + "check_ids": ["CKV_K8S_21"] + } + ] + }, + { + "file": "/tests/charts/umbrella-application/test-umbrella-application/charts/database/templates/service.yaml", + "findings": [ + { + "resource": "Service.default.database", + "check_ids": ["CKV_K8S_21"] + } + ] + }, + { + "file": "/tests/charts/umbrella-application/test-umbrella-application/charts/database/templates/serviceaccount.yaml", + "findings": [ + { + "resource": "ServiceAccount.default.database", + "check_ids": ["CKV_K8S_21"] + } + ] + }, + { + "file": "/tests/charts/umbrella-application/test-umbrella-application/charts/database/templates/init_config.yaml", + "findings": [ + { + "resource": "ConfigMap.default.database-init-scripts", + "check_ids": ["CKV_K8S_21"] + } + ] + } + ] +} diff --git a/.trivyignore.yaml b/.trivyignore.yaml index 63755ed2..c4df20f5 100644 --- a/.trivyignore.yaml +++ b/.trivyignore.yaml @@ -1,30 +1,6 @@ --- misconfigurations: - - id: KSV-0011 - paths: - - "tests/charts/umbrella-application/charts/database/**" - statement: "Helm dependency alias path (database) is virtual and not a real workspace file." - - id: KSV-0015 - paths: - - "tests/charts/umbrella-application/charts/database/**" - statement: "Helm dependency alias path (database) is virtual and not a real workspace file." - - id: KSV-0016 - paths: - - "tests/charts/umbrella-application/charts/database/**" - statement: "Helm dependency alias path (database) is virtual and not a real workspace file." - - id: KSV-0018 - paths: - - "tests/charts/umbrella-application/charts/database/**" - statement: "Helm dependency alias path (database) is virtual and not a real workspace file." - - id: KSV-0020 - paths: - - "tests/charts/umbrella-application/charts/database/**" - statement: "Helm dependency alias path (database) is virtual and not a real workspace file." - - id: KSV-0021 - paths: - - "tests/charts/umbrella-application/charts/database/**" - statement: "Helm dependency alias path (database) is virtual and not a real workspace file." - id: KSV-0110 paths: - "tests/charts/umbrella-application/charts/database/**" - statement: "Helm dependency alias path (database) is virtual and not a real workspace file." + statement: "The upstream Valkey chart inherits the Helm release namespace; chart install tests set a dedicated namespace." diff --git a/Dockerfile b/Dockerfile index 5d40b826..7fc7d9bb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM ghcr.io/hoverkraft-tech/docker-base-images/super-linter:0.4.0 +FROM ghcr.io/hoverkraft-tech/docker-base-images/super-linter:0.4.3 HEALTHCHECK --interval=5m --timeout=10s --start-period=30s --retries=3 CMD ["/bin/sh","-c","test -d /github/home"] ARG UID=1000 diff --git a/actions/helm/generate-docs/action.yml b/actions/helm/generate-docs/action.yml index 1242a8a1..c35ca59f 100644 --- a/actions/helm/generate-docs/action.yml +++ b/actions/helm/generate-docs/action.yml @@ -248,6 +248,8 @@ runs: with: client-id: ${{ inputs.github-app-client-id }} private-key: ${{ inputs.github-app-key }} + permission-contents: write + permission-pull-requests: write - uses: hoverkraft-tech/ci-github-common/actions/create-and-merge-pull-request@3a27d31e9ccefbe9609cc9165017ed100ff34a22 # 0.38.0 id: create-and-merge-pull-request diff --git a/actions/helm/generate-docs/package-lock.json b/actions/helm/generate-docs/package-lock.json index 96071ebc..a71deea0 100644 --- a/actions/helm/generate-docs/package-lock.json +++ b/actions/helm/generate-docs/package-lock.json @@ -772,12 +772,12 @@ "license": "MIT" }, "node_modules/entities": { - "version": "4.5.0", - "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz", - "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==", + "version": "8.1.0", + "resolved": "https://registry.npmjs.org/entities/-/entities-8.1.0.tgz", + "integrity": "sha512-kxL7msIffSuh9aaFAMD7rxAIuTRMAHMeBtgHW2yUdWw732ZNh4MehkF2gdjvtdmikkaIP9bFDDJOPlsvm7avrA==", "license": "BSD-2-Clause", "engines": { - "node": ">=0.12" + "node": ">=20.19.0" }, "funding": { "url": "https://github.com/fb55/entities?sponsor=1" @@ -852,9 +852,9 @@ "license": "BSD-3-Clause" }, "node_modules/fastq": { - "version": "1.20.1", - "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz", - "integrity": "sha512-GGToxJ/w1x32s/D2EKND7kTil4n8OVk/9mycTc4VDza13lOvpUZTGX3mFSCtV9ksdGBVzvsyAVLM6mHFThxXxw==", + "version": "1.20.3", + "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.3.tgz", + "integrity": "sha512-XKv5nnLs6nLF71NgiKJLIZFLkPyIEuOselLG7ujZnGrRfQK8HpvY+WqKhAJUAdLomwVHErVS4LfxFlPq0/FTAw==", "license": "ISC", "dependencies": { "reusify": "^1.0.4" @@ -973,15 +973,16 @@ } }, "node_modules/globby": { - "version": "16.2.2", - "resolved": "https://registry.npmjs.org/globby/-/globby-16.2.2.tgz", - "integrity": "sha512-NLvV9ubZ6NDsJaOpKPy3cQeJpKi9DcWiyCiFUpJPA0YihRqiE6RWaLUmgNNPr8MgPpLZjnBjSmou7uZBRJv9wA==", + "version": "16.2.4", + "resolved": "https://registry.npmjs.org/globby/-/globby-16.2.4.tgz", + "integrity": "sha512-c8B/VNLmxRcmqqenRA9t+9IyOjf9+V6lTxPaUJLqOCONdQkWZ0ETYgX0qbtJqPsgCNusT9MZ5Jeidw8Eb9tn2g==", "license": "MIT", "dependencies": { "@sindresorhus/merge-streams": "^4.0.0", "fast-glob": "^3.3.3", "ignore": "^7.0.5", "is-path-inside": "^4.0.0", + "micromatch": "^4.0.8", "slash": "^5.1.0", "unicorn-magic": "^0.4.0" }, @@ -1029,9 +1030,9 @@ "license": "ISC" }, "node_modules/ignore": { - "version": "7.0.6", - "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.6.tgz", - "integrity": "sha512-BAg6QkE8W+TuQLrrw0Ugr7HegXduRuuj8/ti2kSOc+jz1dmx8/WNcjr6XGnq5YpDWxFwwaavqD0+jIUOKelTsw==", + "version": "7.0.10", + "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.10.tgz", + "integrity": "sha512-HpbUakT7xp5miBUywCHf36ZEuAJNklBJDDsGpUIjMzOSmM8ELSfA9Sa/QDPeNeqeoN31u+UTCkL4klCOVvRm4Q==", "license": "MIT", "engines": { "node": ">= 4" @@ -1166,9 +1167,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "5.2.2", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.2.tgz", - "integrity": "sha512-dayzUzKkJ1MkuUtZglSebU43utNXH0OWQByK9rKOOuYIO8M5TV1y+n8ALMdG0rdzBnfNkOmZEqrURepb0ejqBw==", + "version": "5.4.1", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.1.tgz", + "integrity": "sha512-28R/k+NAjeuf7+CKlTxWZVExJGwVVLwY06DgEnOMz2gEpfNkDcD7QvyiVPT0xy0XXhU8vHsd4Ot42OOPdJG7dQ==", "funding": [ { "type": "github", @@ -1259,9 +1260,9 @@ } }, "node_modules/linkify-it": { - "version": "5.0.2", - "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.2.tgz", - "integrity": "sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==", + "version": "6.1.0", + "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-6.1.0.tgz", + "integrity": "sha512-wJ/TwpSDTLepCrQoYWYIExIKg5Zchex2Nn5yk2mFnB+6PtdkHtyLx742md9csRjjOnGkKIS/RrbY7l8D6gT9Vw==", "funding": [ { "type": "github", @@ -1274,7 +1275,7 @@ ], "license": "MIT", "dependencies": { - "uc.micro": "^2.0.0" + "uc.micro": "^3.0.0" } }, "node_modules/lodash": { @@ -1309,9 +1310,9 @@ } }, "node_modules/markdown-it": { - "version": "14.3.0", - "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.0.tgz", - "integrity": "sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw==", + "version": "15.0.1", + "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-15.0.1.tgz", + "integrity": "sha512-9/7gE95FNPkfUWrjJIoHZza2iLmuJlPD0UNMxPi7bxUrbCR525YZY0r+zyfes0dZI5ZZ/uNIXUJca0pJvtw41g==", "funding": [ { "type": "github", @@ -1324,17 +1325,33 @@ ], "license": "MIT", "dependencies": { - "argparse": "^2.0.1", - "entities": "^4.5.0", - "linkify-it": "^5.0.2", - "mdurl": "^2.0.0", + "argparse": "^3.0.0", + "entities": "^8.0.0", + "linkify-it": "^6.0.0", + "mdurl": "^2.1.0", "punycode.js": "^2.3.1", - "uc.micro": "^2.1.0" + "uc.micro": "^3.0.0" }, "bin": { "markdown-it": "bin/markdown-it.mjs" } }, + "node_modules/markdown-it/node_modules/argparse": { + "version": "3.0.2", + "resolved": "https://registry.npmjs.org/argparse/-/argparse-3.0.2.tgz", + "integrity": "sha512-mFdDM6WqWKraGLsVb+C9CahPnzTXOefAOLq3jYcca2YZ8bEWpr++Tzj+zSaKW9+X9L5uSxcm1AZ3Y6aZJ09OhQ==", + "funding": [ + { + "type": "github", + "url": "https://github.com/sponsors/puzrin" + }, + { + "type": "github", + "url": "https://github.com/sponsors/nodeca" + } + ], + "license": "PSF-2.0" + }, "node_modules/markdown-table": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/markdown-table/-/markdown-table-2.0.0.tgz", @@ -1372,20 +1389,20 @@ } }, "node_modules/markdownlint-cli2": { - "version": "0.23.2", - "resolved": "https://registry.npmjs.org/markdownlint-cli2/-/markdownlint-cli2-0.23.2.tgz", - "integrity": "sha512-eUhcnkSpzURo/o4htSqc7LPDszgOOTknhU4eY/sPHvMCLxnTCYscv1gw1/js/idmaZPisv9ECVEIORcllqjTUw==", + "version": "0.23.3", + "resolved": "https://registry.npmjs.org/markdownlint-cli2/-/markdownlint-cli2-0.23.3.tgz", + "integrity": "sha512-xAr5o/TGpC3v6lE6cKIW4b5eOFRrRX5u7Vtjae9ix3RALv8nNOd94XMkD/1OXXBtpMcJ4uQGbpSo3hv5UqS4uQ==", "license": "MIT", "dependencies": { - "globby": "16.2.2", - "js-yaml": "5.2.2", + "globby": "16.2.4", + "js-yaml": "5.4.1", "jsonc-parser": "3.3.1", "jsonpointer": "5.0.1", - "markdown-it": "14.3.0", + "markdown-it": "15.0.1", "markdownlint": "0.41.1", "markdownlint-cli2-formatter-default": "0.0.6", "micromatch": "4.0.8", - "smol-toml": "1.7.0" + "smol-toml": "1.8.0" }, "bin": { "markdownlint-cli2": "markdownlint-cli2-bin.mjs" @@ -3553,9 +3570,9 @@ } }, "node_modules/smol-toml": { - "version": "1.7.0", - "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.7.0.tgz", - "integrity": "sha512-aqVvWoyO21L23mb+drl4RmMXbf6N7FdHjAhTRA9ZBL7apWBgfWC16KjrASI+1p9GAroljyMHj6fK67i0UiTNvQ==", + "version": "1.8.0", + "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.8.0.tgz", + "integrity": "sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ==", "license": "BSD-3-Clause", "engines": { "node": ">= 18" @@ -3820,15 +3837,15 @@ } }, "node_modules/uc.micro": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-2.1.0.tgz", - "integrity": "sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A==", + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-3.0.0.tgz", + "integrity": "sha512-U3PppEkleoTnIfi8BozMx3yju3qc/L6SwqWo2Sw+54PX+PX0q9I+r1Um5HCmqD7n9VDX5/v3vQH/AjA6deDdtw==", "license": "MIT" }, "node_modules/unicorn-magic": { - "version": "0.4.0", - "resolved": "https://registry.npmjs.org/unicorn-magic/-/unicorn-magic-0.4.0.tgz", - "integrity": "sha512-wH590V9VNgYH9g3lH9wWjTrUoKsjLF6sGLjhR4sH1LWpLmCOH0Zf7PukhDA8BiS7KHe4oPNkcTHqYkj7SOGUOw==", + "version": "0.4.1", + "resolved": "https://registry.npmjs.org/unicorn-magic/-/unicorn-magic-0.4.1.tgz", + "integrity": "sha512-lzlXPoVB0Uy/FvTaUgX39RbixYiSKoc3JSoSf01+0c2B6FR3qdYIPN7Qjo/AV7n6sqLCk0509cT3LRj1oSZ1+A==", "license": "MIT", "engines": { "node": ">=20" diff --git a/biome.json b/biome.json index 7d7460e6..21da3ca0 100644 --- a/biome.json +++ b/biome.json @@ -3,6 +3,8 @@ "includes": [ "**", "!.devcontainer/devcontainer-lock.json", + "!.github/logo.svg", + "!.github/social-preview.svg", "!**/node_modules" ] } diff --git a/tests/charts/umbrella-application/values.yaml b/tests/charts/umbrella-application/values.yaml index e1921f54..0384f9c9 100644 --- a/tests/charts/umbrella-application/values.yaml +++ b/tests/charts/umbrella-application/values.yaml @@ -15,32 +15,51 @@ database: enabled: true fullnameOverride: database namespaceOverride: app-system - architecture: standalone existingConfigmap: database-custom-config auth: enabled: false image: pullPolicy: Always - primary: - podSecurityContext: - enabled: true - fsGroup: 10001 - containerSecurityContext: - enabled: true - runAsUser: 10001 - runAsGroup: 10001 - runAsNonRoot: true - allowPrivilegeEscalation: false - readOnlyRootFilesystem: true - capabilities: - drop: - - ALL - seccompProfile: - type: RuntimeDefault - resources: - requests: - cpu: 100m - memory: 128Mi - limits: - cpu: 200m - memory: 256Mi + tag: "9.1.2@sha256:418652cfb58ef879d4978c33553735d7147016032d5aefaa14c828e611eb9dfd" + podSecurityContext: + fsGroup: 10001 + runAsUser: 10001 + runAsGroup: 10001 + seccompProfile: + type: RuntimeDefault + securityContext: + runAsUser: 10001 + runAsGroup: 10001 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 256Mi + initResources: + requests: + cpu: 100m + memory: 128Mi + limits: + cpu: 200m + memory: 256Mi + readinessProbe: + enabled: true + networkPolicy: + ingress: + - from: + - podSelector: + matchLabels: + app.kubernetes.io/name: app + ports: + - protocol: TCP + port: 6379