From 32b40e3e2b95a5f6fe96d55a9cfa8005738814e3 Mon Sep 17 00:00:00 2001 From: csoceanu Date: Sun, 7 Sep 2025 11:22:28 +0300 Subject: [PATCH 01/12] Add docs-enhancer GitHub Action for testing --- .github/workflows/docs-enhancer.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/workflows/docs-enhancer.yml diff --git a/.github/workflows/docs-enhancer.yml b/.github/workflows/docs-enhancer.yml new file mode 100644 index 000000000..3b5e431f3 --- /dev/null +++ b/.github/workflows/docs-enhancer.yml @@ -0,0 +1,26 @@ +name: Auto-Update Documentation + +on: + issue_comment: + types: [created] + +jobs: + update-docs: + if: | + github.event.issue.pull_request && + contains(github.event.comment.body, '[update-docs]') + runs-on: ubuntu-latest + steps: + - name: Checkout PR branch + uses: actions/checkout@v4 + with: + token: ${{ secrets.GH_TOKEN }} + ref: ${{ github.event.pull_request.head.ref }} + fetch-depth: 0 + + - name: Update Documentation + uses: csoceanu/code-to-docs@v1.0.0 + with: + gemini-api-key: ${{ secrets.GEMINI_API_KEY }} + docs-repo-url: ${{ secrets.DOCS_REPO_URL }} + github-token: ${{ secrets.GH_TOKEN }} From 17284e4deb4352065975492acada77a63489b3a8 Mon Sep 17 00:00:00 2001 From: csoceanu Date: Sun, 7 Sep 2025 12:01:22 +0300 Subject: [PATCH 02/12] update --- config/default/kustomization.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml index 5dcbdc5e0..769251bb8 100644 --- a/config/default/kustomization.yaml +++ b/config/default/kustomization.yaml @@ -1,4 +1,5 @@ # Adds namespace to all resources. +# Updated configuration to support enhanced documentation automation namespace: build-service-system # Value of this field is prepended to the From 7478f4a84756a781e7c502d2f899c1c1e1e3a80c Mon Sep 17 00:00:00 2001 From: csoceanu Date: Sun, 7 Sep 2025 12:07:30 +0300 Subject: [PATCH 03/12] cleanup workflows --- .github/workflows/codecov-main.yaml | 20 ----------- .github/workflows/kube-linter.yaml | 55 ----------------------------- .github/workflows/pr.yaml | 52 --------------------------- 3 files changed, 127 deletions(-) delete mode 100644 .github/workflows/codecov-main.yaml delete mode 100644 .github/workflows/kube-linter.yaml delete mode 100644 .github/workflows/pr.yaml diff --git a/.github/workflows/codecov-main.yaml b/.github/workflows/codecov-main.yaml deleted file mode 100644 index 3843477ee..000000000 --- a/.github/workflows/codecov-main.yaml +++ /dev/null @@ -1,20 +0,0 @@ -name: Codecov report on push to the "main" branch -on: - push: - branches: [ main ] -jobs: - coverage: - name: Envtest and coverage report - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - uses: actions/setup-go@v3 - with: - go-version-file: './go.mod' - - name: Run tests - run: make test - - name: Codecov - uses: codecov/codecov-action@v4 - with: - token: ${{ secrets.CODECOV_TOKEN }} - verbose: true diff --git a/.github/workflows/kube-linter.yaml b/.github/workflows/kube-linter.yaml deleted file mode 100644 index 9442a93ef..000000000 --- a/.github/workflows/kube-linter.yaml +++ /dev/null @@ -1,55 +0,0 @@ -name: Check Kubernetes YAMLs with kube-linter - -on: - pull_request: - branches: [ main ] - paths: - - 'config/default/**.ya?ml' - - 'config/crd/**.ya?ml' - - 'config/rbac/**.ya?ml' - - 'config/manager/**.ya?ml' - - 'config/monitoring/prometheus/**.ya?ml' - - '.github/workflows/kube-linter.yaml' - -jobs: - kube-linter: - name: Kube linter - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v4 - - - name: Create ../kube-linter/ for deployment yaml files - shell: bash - run: mkdir -p ../kube-linter/ - - - name: Generate Build Service operator deployment configuration - shell: bash - run: kustomize build config/default/ > ../kube-linter/build-service.yaml - - - name: Scan yaml files with kube-linter - uses: stackrox/kube-linter-action@v1 - id: kube-linter-action-scan - with: - # Where to do scanning - directory: ../kube-linter/ - # Where to search for kube-linter config. Removing the setting make using the default config. - config: ./.github/.kube-linter-config.yaml - # The following two settings make kube-linter produce scan analysis in SARIF format - # which would then be made available in GitHub UI via upload-sarif action below. - format: sarif - output-file: ../kube-linter/kube-linter.sarif - # The following line prevents aborting the workflow immediately in case your files fail kube-linter checks. - # This allows the following upload-sarif action to still upload the results to your GitHub repo. - continue-on-error: true - - - name: Upload SARIF report files to GitHub - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: ../kube-linter/kube-linter.sarif - - # Ensure the workflow eventually fails if files did not pass kube-linter checks. - - name: Verify kube-linter-action succeeded - shell: bash - run: | - echo "If this step fails, kube-linter found issues. Check the output of the scan step above." - [[ "${{ steps.kube-linter-action-scan.outcome }}" == "success" ]] diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml deleted file mode 100644 index 2e42e28ff..000000000 --- a/.github/workflows/pr.yaml +++ /dev/null @@ -1,52 +0,0 @@ -name: Validate PR -on: - pull_request: - branches: [ main ] -jobs: - lint: - name: Lint - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - uses: actions/setup-go@v3 - with: - go-version-file: './go.mod' - - name: golangci-lint - uses: golangci/golangci-lint-action@v3 - with: - args: --timeout=5m - - security_scan: - name: Security scan - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - uses: actions/setup-go@v3 - with: - go-version-file: './go.mod' - - # https://github.com/securego/gosec/blob/12be14859bc7d4b956b71bef0b443694aa519d8a/README.md#integrating-with-code-scanning - - name: Run Gosec Security Scanner - # pin gosec to use v2.21.0 temporarily, once upstream issue https://github.com/securego/gosec/issues/1214 is fixed, revert it to use master - uses: securego/gosec@v2.21.0 - with: - # we let the report trigger content trigger a failure using the GitHub Security features. - args: '-no-fail -fmt sarif -out results.sarif ./...' - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@v3 - with: - # Path to SARIF file relative to the root of the repository - sarif_file: results.sarif - - envtest: - name: Envtest - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v3 - - uses: actions/setup-go@v3 - with: - go-version-file: './go.mod' - - name: Run tests - run: make test - - name: Upload to Codecov - uses: codecov/codecov-action@v3.1.1 From d9d9cfb393034954994c44517735024d94bbfedd Mon Sep 17 00:00:00 2001 From: csoceanu Date: Sun, 7 Sep 2025 12:46:20 +0300 Subject: [PATCH 04/12] Enable webhook and cert-manager for enhanced security features --- config/default/kustomization.yaml | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml index 769251bb8..4d5ce1526 100644 --- a/config/default/kustomization.yaml +++ b/config/default/kustomization.yaml @@ -1,5 +1,6 @@ # Adds namespace to all resources. # Updated configuration to support enhanced documentation automation +# FEATURE: Added enhanced monitoring and webhook support for better observability namespace: build-service-system # Value of this field is prepended to the @@ -10,10 +11,13 @@ namespace: build-service-system namePrefix: build-service- # Labels to add to all resources and selectors. -#labels: -#- includeSelectors: true -# pairs: -# someName: someValue +# NEW: Enable standardized labeling for resource identification and monitoring +labels: +- includeSelectors: true + pairs: + app.kubernetes.io/name: build-service + app.kubernetes.io/component: controller + monitoring: enabled resources: #- ../crd @@ -21,9 +25,11 @@ resources: - ../manager # [WEBHOOK] To enable webhook, uncomment all the sections with [WEBHOOK] prefix including the one in # crd/kustomization.yaml -#- ../webhook +# ENABLED: Webhook server for validation and mutation +- ../webhook # [CERTMANAGER] To enable cert-manager, uncomment all sections with 'CERTMANAGER'. 'WEBHOOK' components are required. -#- ../certmanager +# ENABLED: Certificate manager for automated TLS certificate management +- ../certmanager # [METRICS] Expose the controller manager metrics service. - metrics_service.yaml @@ -31,7 +37,8 @@ resources: # Only Pod(s) running a namespace labeled with 'metrics: enabled' will be able to gather the metrics. # Only CR(s) which requires webhooks and are applied on namespaces labeled with 'webhooks: enabled' will # be able to communicate with the Webhook Server. -#- ../network-policy +# ENABLED: Network policies for enhanced security posture +- ../network-policy # Uncomment the patches line if you enable Metrics, and/or are using webhooks and cert-manager patches: From 428bd8cb3d131dde8be7c25d37183ac13c40968c Mon Sep 17 00:00:00 2001 From: csoceanu Date: Sun, 7 Sep 2025 12:52:11 +0300 Subject: [PATCH 05/12] Update to v1.0.5 with fixed PR detection --- .github/workflows/docs-enhancer.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs-enhancer.yml b/.github/workflows/docs-enhancer.yml index 3b5e431f3..7e194790f 100644 --- a/.github/workflows/docs-enhancer.yml +++ b/.github/workflows/docs-enhancer.yml @@ -19,7 +19,7 @@ jobs: fetch-depth: 0 - name: Update Documentation - uses: csoceanu/code-to-docs@v1.0.0 + uses: csoceanu/code-to-docs@v1.0.5 with: gemini-api-key: ${{ secrets.GEMINI_API_KEY }} docs-repo-url: ${{ secrets.DOCS_REPO_URL }} From ffc879f24efe7688d6e73df0d471044c8b66cf41 Mon Sep 17 00:00:00 2001 From: csoceanu Date: Sun, 7 Sep 2025 13:06:57 +0300 Subject: [PATCH 06/12] Fix PR checkout - use proven pattern with proper head_repo and head_ref extraction --- .github/workflows/docs-enhancer.yml | 35 +++++++++++++++++++++++++---- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/.github/workflows/docs-enhancer.yml b/.github/workflows/docs-enhancer.yml index 7e194790f..57dce926f 100644 --- a/.github/workflows/docs-enhancer.yml +++ b/.github/workflows/docs-enhancer.yml @@ -4,19 +4,46 @@ on: issue_comment: types: [created] +permissions: + contents: read + issues: read + pull-requests: read + jobs: update-docs: + runs-on: ubuntu-latest if: | github.event.issue.pull_request && contains(github.event.comment.body, '[update-docs]') - runs-on: ubuntu-latest steps: - - name: Checkout PR branch + - name: Get PR information + id: pr_info + if: github.event.issue.pull_request + env: + GH_TOKEN: ${{ secrets.GH_TOKEN }} + run: | + PR_NUMBER=${{ github.event.issue.number }} + echo "Extracting PR information for PR #$PR_NUMBER" + PR_DATA=$(gh api repos/${{ github.repository }}/pulls/$PR_NUMBER) + + HEAD_REF=$(echo "$PR_DATA" | jq -r '.head.ref') + HEAD_REPO=$(echo "$PR_DATA" | jq -r '.head.repo.full_name') + BASE_REF=$(echo "$PR_DATA" | jq -r '.base.ref') + + echo "head_ref=$HEAD_REF" >> $GITHUB_OUTPUT + echo "head_repo=$HEAD_REPO" >> $GITHUB_OUTPUT + echo "base_ref=$BASE_REF" >> $GITHUB_OUTPUT + echo "pr_number=$PR_NUMBER" >> $GITHUB_OUTPUT + + echo "PR info extracted: #$PR_NUMBER, base: $BASE_REF, head: $HEAD_REF" + + - name: Checkout PR Code uses: actions/checkout@v4 with: - token: ${{ secrets.GH_TOKEN }} - ref: ${{ github.event.pull_request.head.ref }} + repository: ${{ steps.pr_info.outputs.head_repo || github.repository }} + ref: ${{ steps.pr_info.outputs.head_ref || github.ref }} fetch-depth: 0 + token: ${{ secrets.GH_TOKEN }} - name: Update Documentation uses: csoceanu/code-to-docs@v1.0.5 From c7285ff814a6d4a8176c07e627cc27e617281ae3 Mon Sep 17 00:00:00 2001 From: csoceanu Date: Sun, 7 Sep 2025 13:51:04 +0300 Subject: [PATCH 07/12] Update to v1.0.7 with git diff fix using PR_HEAD_SHA --- .github/workflows/docs-enhancer.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docs-enhancer.yml b/.github/workflows/docs-enhancer.yml index 57dce926f..07951e838 100644 --- a/.github/workflows/docs-enhancer.yml +++ b/.github/workflows/docs-enhancer.yml @@ -46,8 +46,11 @@ jobs: token: ${{ secrets.GH_TOKEN }} - name: Update Documentation - uses: csoceanu/code-to-docs@v1.0.5 + uses: csoceanu/code-to-docs@v1.0.7 with: gemini-api-key: ${{ secrets.GEMINI_API_KEY }} docs-repo-url: ${{ secrets.DOCS_REPO_URL }} github-token: ${{ secrets.GH_TOKEN }} + pr-number: ${{ github.event.issue.number }} + pr-base: origin/${{ steps.pr_info.outputs.base_ref || 'main' }} + pr-head-sha: ${{ steps.pr_info.outputs.head_ref }} From c854c01ce26093c1cdf901508db966a16ccd3834 Mon Sep 17 00:00:00 2001 From: csoceanu Date: Sun, 7 Sep 2025 15:52:24 +0300 Subject: [PATCH 08/12] Update to v1.0.8 with git debugging --- .github/workflows/docs-enhancer.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs-enhancer.yml b/.github/workflows/docs-enhancer.yml index 07951e838..a76b5c723 100644 --- a/.github/workflows/docs-enhancer.yml +++ b/.github/workflows/docs-enhancer.yml @@ -46,7 +46,7 @@ jobs: token: ${{ secrets.GH_TOKEN }} - name: Update Documentation - uses: csoceanu/code-to-docs@v1.0.7 + uses: csoceanu/code-to-docs@v1.0.8 with: gemini-api-key: ${{ secrets.GEMINI_API_KEY }} docs-repo-url: ${{ secrets.DOCS_REPO_URL }} From 42292d66e64885a27fc62092cc79e9527d901bc5 Mon Sep 17 00:00:00 2001 From: csoceanu Date: Sun, 7 Sep 2025 16:06:41 +0300 Subject: [PATCH 09/12] Update to v1.0.9 with Git ownership fix --- .github/workflows/docs-enhancer.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs-enhancer.yml b/.github/workflows/docs-enhancer.yml index a76b5c723..fd5458e14 100644 --- a/.github/workflows/docs-enhancer.yml +++ b/.github/workflows/docs-enhancer.yml @@ -46,7 +46,7 @@ jobs: token: ${{ secrets.GH_TOKEN }} - name: Update Documentation - uses: csoceanu/code-to-docs@v1.0.8 + uses: csoceanu/code-to-docs@v1.0.9 with: gemini-api-key: ${{ secrets.GEMINI_API_KEY }} docs-repo-url: ${{ secrets.DOCS_REPO_URL }} From fea4040e56a812fc2f70e864b139fa5e74c93961 Mon Sep 17 00:00:00 2001 From: csoceanu Date: Sun, 7 Sep 2025 16:19:37 +0300 Subject: [PATCH 10/12] Update test branch to v1.0.10 with Git user configuration fix --- .github/workflows/docs-enhancer.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs-enhancer.yml b/.github/workflows/docs-enhancer.yml index fd5458e14..4de56ffc1 100644 --- a/.github/workflows/docs-enhancer.yml +++ b/.github/workflows/docs-enhancer.yml @@ -46,7 +46,7 @@ jobs: token: ${{ secrets.GH_TOKEN }} - name: Update Documentation - uses: csoceanu/code-to-docs@v1.0.9 + uses: csoceanu/code-to-docs@v1.0.10 with: gemini-api-key: ${{ secrets.GEMINI_API_KEY }} docs-repo-url: ${{ secrets.DOCS_REPO_URL }} From 17f22eb588d19fdc29736c954ef89b710d17faa9 Mon Sep 17 00:00:00 2001 From: csoceanu Date: Mon, 8 Sep 2025 10:00:38 +0300 Subject: [PATCH 11/12] Update to code-to-docs v1.0.11 with simplified filtering --- .github/workflows/docs-enhancer.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/docs-enhancer.yml b/.github/workflows/docs-enhancer.yml index 4de56ffc1..f025f8910 100644 --- a/.github/workflows/docs-enhancer.yml +++ b/.github/workflows/docs-enhancer.yml @@ -46,7 +46,7 @@ jobs: token: ${{ secrets.GH_TOKEN }} - name: Update Documentation - uses: csoceanu/code-to-docs@v1.0.10 + uses: csoceanu/code-to-docs@v1.0.11 with: gemini-api-key: ${{ secrets.GEMINI_API_KEY }} docs-repo-url: ${{ secrets.DOCS_REPO_URL }} From a0dc743eba4e9c7430ddb8b579b3add8f5a40f18 Mon Sep 17 00:00:00 2001 From: csoceanu Date: Mon, 8 Sep 2025 10:13:19 +0300 Subject: [PATCH 12/12] Test filtering: Update workflow to v1.0.12 and add debugging note to config --- .github/workflows/docs-enhancer.yml | 2 +- config/default/kustomization.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/docs-enhancer.yml b/.github/workflows/docs-enhancer.yml index f025f8910..93a267ca3 100644 --- a/.github/workflows/docs-enhancer.yml +++ b/.github/workflows/docs-enhancer.yml @@ -46,7 +46,7 @@ jobs: token: ${{ secrets.GH_TOKEN }} - name: Update Documentation - uses: csoceanu/code-to-docs@v1.0.11 + uses: csoceanu/code-to-docs@v1.0.12 with: gemini-api-key: ${{ secrets.GEMINI_API_KEY }} docs-repo-url: ${{ secrets.DOCS_REPO_URL }} diff --git a/config/default/kustomization.yaml b/config/default/kustomization.yaml index 4d5ce1526..585389bd5 100644 --- a/config/default/kustomization.yaml +++ b/config/default/kustomization.yaml @@ -1,6 +1,6 @@ # Adds namespace to all resources. # Updated configuration to support enhanced documentation automation -# FEATURE: Added enhanced monitoring and webhook support for better observability +# FEATURE: Added enhanced monitoring and webhook support for better observability and debugging namespace: build-service-system # Value of this field is prepended to the