feat: initial release

.circleci/config.yml

@@ -1,87 +1,212 @@
 version: 2.1
 
+orbs:
+  prodsec: snyk/prodsec-orb@1
+  helm: circleci/helm@3
+  queue: eddiewebb/queue@3
+
+parameters:
+  kubectl-version:
+    type: string
+    default: "1.28"
+
 jobs:
   validate_charts:
     docker:
       - image: alpine/k8s:1.28.14
-    resource_class: medium
+    resource_class: small
+    parameters:
+      deployment-id:
+        type: env_var_name
+        default: DEPLOYMENT_ID
+      client-id:
+        type: env_var_name
+        default: CLIENT_ID
+      client-secret:
+        type: env_var_name
+        default: CLIENT_SECRET
+      my-ghe-token:
+        type: env_var_name
+        default: MY_GHE_TOKEN
+      snyk-token:
+        type: env_var_name
+        default: "SNYK_API_TOKEN"
     steps:
       - checkout
       - run:
           name: Helm dependencies
           command: helm dep up
-          working_directory: 
-            snyk-universal-broker
-
+          working_directory: snyk-universal-broker
       - run:
           name: Run helm unittest
           command: helm unittest .
-          working_directory: 
-            snyk-universal-broker
+          working_directory: snyk-universal-broker
+      - run:
+          name: Template to file
+          command: |
+            helm template \
+              -f values.yaml \
+              --set deploymentId=${<<parameters.deployment-id>>} \
+              --set clientId=${<<parameters.client-id>>} \
+              --set clientSecret=${<<parameters.client-secret>>} \
+              --set credentialReferences.MY_GHE_TOKEN=${<<parameters.my-ghe-token>>} \
+              . > template.yaml
+          working_directory: snyk-universal-broker
+      - run:
+          name: Kubeconform
+          command: |
+            kubeconform -ignore-missing-schemas template.yaml
+          working_directory: snyk-universal-broker
+      - persist_to_workspace:
+          root: snyk-universal-broker
+          paths:
+            - template.yaml
 
-  publish:
+  validate_documentation:
     docker:
-      - image: cimg/node:22.9 
+      - image: cimg/node:20.18.0
     resource_class: small
     steps:
       - checkout
       - run:
-          name: Install npm dependencies
-          command: npm ci
+          name: Run the readme generator
+          command: npx @bitnami/readme-generator-for-helm -v snyk-universal-broker/values.yaml -r README.md
+      - run:
+          name: Check if files in CI have changed
+          command: |
+            if [[ -n $(git diff --name-only README.md) ]]; then
+              echo "README content not synchronised with values.yaml"
+              exit 1
+            fi
 
+  deploy_and_test:
+    machine:
+      image: ubuntu-2204:current
+    resource_class: large
+    parameters:
+      deployment-id:
+        type: env_var_name
+        default: DEPLOYMENT_ID
+      client-id:
+        type: env_var_name
+        default: CLIENT_ID
+      client-secret:
+        type: env_var_name
+        default: CLIENT_SECRET
+      my-ghe-token:
+        type: env_var_name
+        default: MY_GHE_TOKEN
+      snyk-token:
+        type: env_var_name
+        default: "SNYK_API_TOKEN"
+    steps:
+      - checkout
+      - helm/install_helm_client
+      - helm/install_helm_plugin:
+          helm_plugin_url: https://github.com/helm-unittest/helm-unittest
       - run:
-          name: Set up Git
+          name: Install Pre-reqs
           command: |
-            git remote set-url origin [email protected]/snyk/snyk-universal-broker-helmchart.git
-
+            curl -s https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash
+            curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.29/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
+            echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v<<pipeline.parameters.kubectl-version>>/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list
+            sudo apt-get update
+            sudo apt-get install -y kubectl
       - run:
-          name: Install Helm
+          name: Deploy Universal Broker
           command: |
-            curl https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
+            helm dep up
+            k3d cluster create
+            helm install \
+              --debug \
+              --wait \
+              -f values.yaml \
+              --set region=dev \
+              --set deploymentId=${<<parameters.deployment-id>>} \
+              --set clientId=${<<parameters.client-id>>} \
+              --set clientSecret=${<<parameters.client-secret>>} \
+              --set credentialReferences.MY_GHE_TOKEN=${<<parameters.my-ghe-token>>} \
+              snyk-universal-broker \
+              .
+          working_directory: snyk-universal-broker
+      - run:
+          name: Test Import
+          command: |
+            LOG_LEVEL="debug" \
+              SNYK_TOKEN=${<<parameters.snyk-token>>} \
+              npx \
+              --yes \
+              tsx \
+              .circleci/scripts/testImport/testImport.ts \
+              ".circleci/snyk-import/snyk-import-ghe.json" \
+              "https://api.dev.snyk.io"
 
+  publish:
+    docker:
+      - image: cimg/node:22.9
+    resource_class: small
+    parameters:
+      dockerhub-password:
+        type: env_var_name
+        default: DOCKERHUB_PASSWORD
+    steps:
+      - checkout
+      - run:
+          name: Install npm dependencies
+          command: npm ci
+      - helm/install_helm_client
       - run:
           name: Docker Login for OCI Push
           command: |
-           echo "$DOCKER_PASSWORD" | helm registry login -u snykdocker --password-stdin registry-1.docker.io
-
-
+            echo "${<<parameters.dockerhub-password>>}" | helm registry login -u snykdocker --password-stdin registry-1.docker.io
       - run:
           name: Run semantic-release
           command: npx semantic-release
-          environment:
-            DOCKER_USERNAME: $DOCKER_USERNAME
-            DOCKER_PASSWORD: $DOCKER_PASSWORD
-
-      - run:
-          name: Update Chart Version
-          command: |
-            CHART_DIR="snyk-universal-broker"
-            NEW_VERSION=$(git describe --tags --abbrev=0)
-            echo "Updating Chart.yaml to version $NEW_VERSION"
-            sed -i "s/^version: .*/version: $NEW_VERSION/" $CHART_DIR/Chart.yaml
+## Note - signing happens via GitHub Action to leverage OIDC. CircleCI doesn't support this directly, yet.
 
-      - run:
-          name: Package Helm Chart
-          command: |
-            helm dep up snyk-universal-broker
-            helm package snyk-universal-broker
-
-      - run:
-          name: Push Helm Chart to OCI Registry
-          command: |
-            helm push snyk-universal-broker-*.tgz oci://registry-1.docker.io/snyk
-          environment:
-            DOCKER_USERNAME: $DOCKER_USERNAME
-            DOCKER_PASSWORD: $DOCKER_PASSWORD
+  security_scans:
+    docker:
+      - image: cimg/base:stable
+    steps:
+      - checkout
+      - attach_workspace:
+          at: .
+      - prodsec/security_scans:
+          mode: auto
 
 workflows:
   validate_and_publish:
     jobs:
-      - validate_charts  
-      - publish:
+      - prodsec/secrets-scan:
+          name: Scan repository for secrets
+          context:
+            - snyk-bot-slack
+          channel: hybrid-alerts
+          trusted-branch: main
+      - validate_charts:
+          context:
+            - snyk-universal-broker-helm-chart
+      - security_scans:
+          context:
+            - team-hybrid-snyk
+          requires:
+            - validate_charts
+      - validate_documentation
+      - deploy_and_test:
+          context:
+            - snyk-universal-broker-helm-chart
           requires:
             - validate_charts
+            - security_scans
+            - Scan repository for secrets
+      - publish:
+          context:
+            - team-broker-docker-hub
+          requires:
+            - validate_documentation
+            - deploy_and_test
           filters:
             branches:
               only:
                 - main
+                - rc

.circleci/scripts/testImport/logger.ts

@@ -0,0 +1,36 @@
+// Set up some basic logging
+enum LogMessage {
+  INFO = "info",
+  WARN = "warn",
+  DEBUG = "debug",
+  ERROR = "error",
+}
+
+export default class makeLog {
+  info(message: string) {
+    console.log(
+      "\x1b[32m%s\x1b[0m",
+      `[${LogMessage.INFO.toUpperCase()}]: ${message}`
+    );
+  }
+  warn(message: string) {
+    console.log(
+      "\x1b[33m%s\x1b[0m",
+      `[${LogMessage.WARN.toUpperCase()}]: ${message}`
+    );
+  }
+  error(message: string) {
+    console.error(
+      "\x1b[31m%s\x1b[0m",
+      `[${LogMessage.ERROR.toUpperCase()}]: ${message}`
+    );
+  }
+  debug(message: string) {
+    if (process.env.LOG_LEVEL == LogMessage.DEBUG) {
+      console.log(
+        "\x1b[2m%s\x1b[0m",
+        `[${LogMessage.DEBUG.toUpperCase()}]: ${message}`
+      );
+    }
+  }
+}