mirror of
https://github.com/docker/cli.git
synced 2026-11-15 09:12:51 -04:00
Sebastiaan van Stijn
18958e4c02
Replace the CODECOV_TOKEN secret with GitHub Actions OIDC authentication. Codecov supports tokenless uploads for public repositories, but authenticated uploads are still needed to protect coverage results on protected branches from unauthorized uploads. Grant `id-token: write` at the job level to allow Codecov to request a short-lived OIDC token. This permission does not grant repository write access, and scoping it to the job avoids granting it to other jobs added to the workflow in the future. Coverage uploads from forked pull requests continue to use Codecov's tokenless upload mechanism. See https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
87 lines
2.5 KiB
YAML
87 lines
2.5 KiB
YAML
name: e2e
|
|
|
|
# Default to 'contents: read', which grants actions to read commits.
|
|
#
|
|
# If any permission is set, any permission not included in the list is
|
|
# implicitly set to "none".
|
|
#
|
|
# see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#permissions
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- 'master'
|
|
- '[0-9]+.[0-9]+'
|
|
- '[0-9]+.x'
|
|
tags:
|
|
- 'v*'
|
|
pull_request:
|
|
|
|
jobs:
|
|
tests:
|
|
permissions:
|
|
contents: read
|
|
id-token: write # needed for CodeCov; https://github.com/codecov/codecov-action/blob/v7.1.1/README.md#using-oidc
|
|
runs-on: ubuntu-26.04
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
target:
|
|
- local
|
|
- connhelper-ssh
|
|
base:
|
|
- alpine
|
|
- debian
|
|
engine-version:
|
|
- master # moby/moby-bin:master
|
|
- rc # latest rc
|
|
- 29 # latest
|
|
- 28 # latest - 1
|
|
- 25 # mirantis lts
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
-
|
|
name: Update daemon.json
|
|
run: |
|
|
if [ ! -f /etc/docker/daemon.json ]; then
|
|
# ubuntu runners no longer have a default daemon.json present
|
|
sudo mkdir -p /etc/docker/
|
|
echo '{"experimental": true}' | sudo tee /etc/docker/daemon.json
|
|
else
|
|
# but if there is one; let's patch it to keep other options that may be set.
|
|
sudo jq '.experimental = true' < /etc/docker/daemon.json > /tmp/docker.json
|
|
sudo mv /tmp/docker.json /etc/docker/daemon.json
|
|
fi
|
|
sudo cat /etc/docker/daemon.json
|
|
sudo service docker restart
|
|
docker version
|
|
docker info
|
|
-
|
|
name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
|
|
-
|
|
name: Run ${{ matrix.target }}
|
|
run: |
|
|
make -f docker.Makefile test-e2e-${{ matrix.target }}
|
|
env:
|
|
BASE_VARIANT: ${{ matrix.base }}
|
|
ENGINE_VERSION: ${{ matrix.engine-version }}
|
|
TESTFLAGS: -coverprofile=/tmp/coverage/coverage.txt
|
|
-
|
|
name: Send to Codecov
|
|
uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
|
|
with:
|
|
files: ./build/coverage/coverage.txt
|
|
use_oidc: true
|