Skip to content

Commit a42a66d

Browse files
skyflow-vivekskyflow-vivek
authored
Merge pull request #222 from skyflowapi/skyflow-vivek/SK-2392-maintain-1.16.0-code-in-v1
SK-2392 Migrate code to V1 branch
2 parents aebc314 + 8b99ed9 commit a42a66d

File tree

16 files changed

+3469
-84
lines changed

16 files changed

+3469
-84
lines changed

‎.github/workflows/Gitleaks.yml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
name: Gitleaks secrets scan
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- v1
7+
8+
9+
permissions:
10+
issues: write
11+
pull-requests: write
12+
contents: read
13+
14+
jobs:
15+
gitleaks:
16+
runs-on: ubuntu-latest
17+
18+
steps:
19+
- name: Checkout code
20+
uses: actions/checkout@v4
21+
with:
22+
fetch-depth: 0 # Required to get full commit history for diffing
23+
24+
25+
- name: Get base and head commit SHAs
26+
run: |
27+
echo "BASE_SHA=${{ github.event.pull_request.base.sha }}" >> $GITHUB_ENV
28+
echo "HEAD_SHA=${{ github.event.pull_request.head.sha }}" >> $GITHUB_ENV
29+
30+
31+
- name: Run Gitleaks on PR changes via Docker
32+
run: |
33+
docker run --rm -v $(pwd):/repo -w /repo zricethezav/gitleaks:latest detect \
34+
--config="/repo/Rule/gitleaks.toml" \
35+
--log-opts="--no-merges $BASE_SHA..$HEAD_SHA" \
36+
--verbose \
37+
--exit-code=0 \
38+
--report-format=json \
39+
--report-path="/repo/gitleaks-report.json" \
40+
--redact
41+
42+
- name: Upload Gitleaks report
43+
uses: actions/upload-artifact@v4
44+
with:
45+
name: gitleaks-report
46+
path: gitleaks-report.json
47+
48+
- name: Format and comment findings on PR
49+
env:
50+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
51+
run: |
52+
if [ ! -f gitleaks-report.json ]; then
53+
echo "Report file not found!"
54+
exit 1
55+
fi
56+
57+
FINDINGS_JSON=$(cat gitleaks-report.json)
58+
COUNT=$(echo "$FINDINGS_JSON" | jq 'length')
59+
SHA="${{ github.event.pull_request.head.sha }}"
60+
REPO="${{ github.repository }}"
61+
PR_NUMBER="${{ github.event.pull_request.number }}"
62+
MAX=10
63+
64+
if [ "$COUNT" -gt 0 ]; then
65+
COMMENT="**🔐 Gitleaks Findings: $COUNT issue(s) detected**\n\n"
66+
i=0
67+
while [ "$i" -lt "$COUNT" ] && [ "$i" -lt "$MAX" ]; do
68+
ITEM=$(echo "$FINDINGS_JSON" | jq ".[$i]")
69+
RULE=$(echo "$ITEM" | jq -r '.RuleID')
70+
DESC=$(echo "$ITEM" | jq -r '.Description')
71+
FILE=$(echo "$ITEM" | jq -r '.File')
72+
LINE=$(echo "$ITEM" | jq -r '.Line')
73+
LINK="https://github.com/$REPO/blob/$SHA/$FILE#L$LINE"
74+
SECRET_MASKED="**********"
75+
COMMENT+="🔸 **Rule**: \`$RULE\`\n"
76+
COMMENT+="📄 **File**: \`$FILE:$LINE\`\n"
77+
COMMENT+="📝 **Description**: $DESC\n"
78+
COMMENT+="🔑 **Secret**: \`$SECRET_MASKED\`\n"
79+
COMMENT+="🔗 **Path**: [$FILE:$LINE]($LINK)\n\n"
80+
i=$((i + 1))
81+
done
82+
83+
if [ "$COUNT" -gt "$MAX" ]; then
84+
COMMENT+="...and more. Only showing first $MAX findings.\n"
85+
fi
86+
else
87+
COMMENT="✅ **Gitleaks Findings:** No secrets detected. Safe to proceed!"
88+
fi
89+
90+
# Escape newlines for GitHub API
91+
COMMENT=$(echo "$COMMENT" | sed ':a;N;$!ba;s/\n/\\n/g')
92+
93+
curl -X POST \
94+
-H "Authorization: token $GITHUB_TOKEN" \
95+
-H "Accept: application/vnd.github.v3+json" \
96+
-d "{\"body\":\"$COMMENT\"}" \
97+
"https://api.github.com/repos/${REPO}/issues/${PR_NUMBER}/comments"

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ jobs:
1010
- name: Check JIRA ID
1111
uses: gsactions/commit-message-checker@v1
1212
with:
13-
pattern: '\[?[A-Z]{1,5}-[1-9][0-9]*.+$'
13+
pattern: '(\[?[A-Z]{1,5}-[1-9][0-9]*)|(\[AUTOMATED\])|(Merge)|(Release).+$'
1414
flags: 'gm'
1515
excludeDescription: 'true'
1616
checkAllCommitMessages: 'true'
@@ -22,7 +22,7 @@ jobs:
2222
- uses: actions/checkout@v2
2323
- uses: actions/setup-python@v2
2424
with:
25-
python-version: '3.7'
25+
python-version: '3.8'
2626

2727
- name: create-json
2828
id: create-json

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ name: "CodeQL"
1313

1414
on:
1515
push:
16-
branches: [ main, '*']
16+
branches: [ v1, '*']
1717
pull_request:
1818
# The branches below must be a subset of the branches above
19-
branches: [ main ]
19+
branches: [ v1 ]
2020

2121
jobs:
2222
analyze:

‎.github/workflows/internal-release.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Internal Release
2+
3+
on:
4+
push:
5+
tags-ignore:
6+
- '*.*'
7+
paths-ignore:
8+
- "setup.py"
9+
- "*.yml"
10+
- "*.md"
11+
- "skyflow/version.py"
12+
- "samples/**"
13+
branches:
14+
- release/*
15+
16+
jobs:
17+
build-and-deploy:
18+
uses: ./.github/workflows/shared-build-and-deploy.yml
19+
with:
20+
ref: ${{ github.ref_name }}
21+
tag: 'internal'
22+
secrets: inherit

‎.github/workflows/main.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
name: main
1+
name: V1
22

33
on:
44
push:
55
branches:
6-
- main
6+
- v1
77

88
jobs:
99
Test:
@@ -12,7 +12,7 @@ jobs:
1212
- uses: actions/checkout@v2
1313
- uses: actions/setup-python@v2
1414
with:
15-
python-version: '3.7'
15+
python-version: '3.8'
1616

1717
- name: create-json
1818
id: create-json

‎.github/workflows/pull_request_template.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
Start with a concise summary of the PR. The first three sections are required. The questions present in each section is there to help you guide you what to add. They are meant to be overwritten by your comments.
2+
## Why
3+
- Why are you making the change?
4+
- What is the underlying issue that you are trying to case, in case of fix?
5+
- Why is it needed by the feature you are working on?
6+
- What is the intent behind making the change?
7+
8+
## Goal
9+
- What is the intended outcome?
10+
- What part of the feature should start working?
11+
- What are the non-goals or will be covered in future PR?
12+
13+
## Testing
14+
- How was the code tested?
15+
- If you haven't written unit tests, why?
16+
- What more testing is needed? Do you intend to manually test it after deployment?
17+
- Do you have any concerns if this changed is released to prod?
18+
19+
## Tech debt
20+
- Is the PR adding to tech debt in any way?
21+
- Are you addressing some Tech debt in this PR?
22+
- If both the above are false, feel free to remove this section.

‎.github/workflows/semgrep.yml‎

Lines changed: 47 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,64 @@
1-
name: Semgrep
1+
name: Semgrep Scan
22

3-
# Run workflow each time code is pushed to your repository.
43
on:
5-
push:
6-
branches:
7-
- main
84
pull_request:
95
branches:
10-
- main
6+
- v1
7+
118
jobs:
129
build:
1310
runs-on: ubuntu-latest
11+
permissions:
12+
pull-requests: write # Give write permission to PRs
13+
issues: write
1414
steps:
1515
- name: Checkout code
1616
uses: actions/checkout@v3
1717

18-
- name: Install Semgrep
19-
run: pip install semgrep
18+
- name: Install Semgrep and jq
19+
run: |
20+
sudo apt install python3-venv jq
21+
python3 -m venv .venv
22+
.venv/bin/pip install semgrep
2023
2124
- name: Run Semgrep
2225
run: |
23-
semgrep --config .semgreprules/customRule.yml --config auto --severity ERROR --sarif . > results.sarif
26+
source .venv/bin/activate
27+
semgrep --config auto --severity ERROR --json-output=results.json --no-error
28+
cat results.json | jq .results > pretty-results.json
2429
25-
- name: Upload SARIF file
26-
uses: github/codeql-action/upload-sarif@v3
30+
- name: Display Raw Semgrep JSON Output
31+
run: |
32+
echo "Displaying raw Semgrep results..."
33+
cat pretty-results.json
34+
35+
- name: Add comment on PR if findings are found
36+
uses: actions/github-script@v6
2737
with:
28-
# Path to SARIF file relative to the root of the repository
29-
sarif_file: results.sarif
38+
script: |
39+
// Ensure the context has a pull_request
40+
if (context.payload.pull_request) {
41+
const prNumber = context.payload.pull_request.number;
42+
const fs = require('fs');
43+
const results = JSON.parse(fs.readFileSync('pretty-results.json', 'utf8'));
44+
const highFindings = results.filter(result => result.extra && result.extra.severity === 'ERROR');
3045
31-
- name: Upload results
32-
uses: actions/upload-artifact@v4
33-
with:
34-
name: semgrep-results
35-
path: results.sarif
46+
// Comment if findings exist
47+
if (highFindings.length > 0) {
48+
const comment = `**Semgrep Findings:** Issues with Error level severity are found (Error is Highest severity in Semgrep), Please resolve the issues before merging.`;
49+
await github.rest.issues.createComment({
50+
...context.repo,
51+
issue_number: prNumber,
52+
body: comment
53+
});
54+
} else {
55+
const noIssuesComment = "**Semgrep findings:** No issues found, Good to merge.";
56+
await github.rest.issues.createComment({
57+
...context.repo,
58+
issue_number: prNumber,
59+
body: noIssuesComment
60+
});
61+
}
62+
} else {
63+
console.log("This workflow wasn't triggered by a pull request, so no comment will be added.");
64+
}

‎.github/workflows/shared-build-and-deploy.yml‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
name: Shared Build and Deploy
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
ref:
7+
description: 'Git reference to use (e.g., v1 or branch name)'
8+
required: true
9+
type: string
10+
11+
tag:
12+
description: 'Release Tag'
13+
required: true
14+
type: string
15+
16+
jobs:
17+
build-and-deploy:
18+
runs-on: ubuntu-latest
19+
steps:
20+
- uses: actions/checkout@v2
21+
with:
22+
fetch-depth: 0
23+
24+
- uses: actions/setup-python@v2
25+
- name: Install dependencies
26+
run: |
27+
python -m pip install --upgrade pip
28+
pip install setuptools wheel twine
29+
- name: Resolve Branch for the Tagged Commit
30+
id: resolve-branch
31+
if: ${{ inputs.tag == 'beta' || inputs.tag == 'public' }}
32+
run: |
33+
TAG_COMMIT=$(git rev-list -n 1 ${{ github.ref_name }})
34+
BRANCH_NAME=$(git branch -r --contains $TAG_COMMIT | grep -o 'origin/.*' | sed 's|origin/||' | head -n 1)
35+
if [ -z "$BRANCH_NAME" ]; then
36+
echo "Error: Could not resolve branch for the tag."
37+
exit 1
38+
fi
39+
echo "Resolved Branch Name: $BRANCH_NAME"
40+
echo "branch_name=$BRANCH_NAME" >> $GITHUB_ENV
41+
- name: Get Previous tag
42+
id: previoustag
43+
uses: WyriHaximus/github-action-get-previous-tag@v1
44+
with:
45+
fallback: 1.0.0
46+
47+
- name: Bump Version
48+
run: |
49+
chmod +x ./ci-scripts/bump_version.sh
50+
if ${{ inputs.tag == 'internal' }}; then
51+
./ci-scripts/bump_version.sh "${{ steps.previoustag.outputs.tag }}" "$(git rev-parse --short "$GITHUB_SHA")"
52+
else
53+
./ci-scripts/bump_version.sh "${{ steps.previoustag.outputs.tag }}"
54+
fi
55+
- name: Commit changes
56+
run: |
57+
git config user.name "${{ github.actor }}"
58+
git config user.email "${{ github.actor }}@users.noreply.github.com"
59+
git add setup.py
60+
git add skyflow/version.py
61+
if [[ "${{ inputs.tag }}" == "internal" ]]; then
62+
VERSION="${{ steps.previoustag.outputs.tag }}.dev0+$(git rev-parse --short $GITHUB_SHA)"
63+
COMMIT_MESSAGE="[AUTOMATED] Private Release $VERSION"
64+
git commit -m "$COMMIT_MESSAGE"
65+
git push origin ${{ github.ref_name }} -f
66+
fi
67+
- name: Build and Publish to JFrog Artifactory
68+
if: ${{ inputs.tag == 'internal' }}
69+
env:
70+
TWINE_USERNAME: ${{ secrets.JFROG_USERNAME }}
71+
TWINE_PASSWORD: ${{ secrets.JFROG_PASSWORD }}
72+
run: |
73+
python setup.py sdist bdist_wheel
74+
twine upload --repository-url https://prekarilabs.jfrog.io/artifactory/api/pypi/skyflow-python/ dist/*

‎.semgreprules/customRule.yml‎

Lines changed: 0 additions & 30 deletions
This file was deleted.

0 commit comments

Comments
 (0)