new(ci): added gha.

.circleci/config.yml

@@ -44,21 +44,21 @@ jobs:
             ./tools/deploy_prow.sh
 workflows:
   version: 2
-  build:
-    jobs:
-      - "test-infra/scan/terraform":
-          context: test-infra
-      - "test-infra/deploy/terraform":
-          requires:
-            - test-infra/scan/terraform
-          context: test-infra
-          filters:
-            branches:
-              only: master
-      - "test-infra/deploy/prow":
-          requires:
-            - test-infra/deploy/terraform
-          context: test-infra
-          filters:
-            branches:
-              only: master
+  # build:
+  #   jobs:
+      # - "test-infra/scan/terraform":
+      #     context: test-infra
+      # - "test-infra/deploy/terraform":
+      #     requires:
+      #       - test-infra/scan/terraform
+      #     context: test-infra
+      #     filters:
+      #       branches:
+      #         only: master
+      # - "test-infra/deploy/prow":
+      #     requires:
+      #       - test-infra/deploy/terraform
+      #     context: test-infra
+      #     filters:
+      #       branches:
+      #         only: master

.github/workflows/ci.yml

@@ -0,0 +1,47 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [master]
+
+# Checks if any concurrent jobs under the same pull request or branch are being executed
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  manifests-validation:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout test-infra ⤵️
+        uses: actions/checkout@v4
+
+      - name: Setup Kubeval ⛓️
+        uses: lra/[email protected]
+
+      - name: yaml config validation 🔍
+        run: kubeval --directories config/prow --ignore-missing-schemas
+
+  scan-terraform:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout test-infra ⤵️
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v1
+        with:
+          go-version: 1.19
+
+      - name: Install deps
+        run: |
+          curl -L "$(curl -Ls https://api.github.com/repos/accurics/terrascan/releases/latest | grep -o -E "https://.+?_Linux_x86_64.tar.gz")" > terrascan.tar.gz
+          tar -xf terrascan.tar.gz
+          install terrascan /usr/local/bin
+
+      - name: Scan terrafrom code
+        run: |
+          terrascan scan -i terraform -d config/clusters -v \
+              --skip-rules 'AC_AWS_0214,AC_AWS_0369,AC_AWS_0487,AC_AWS_078,AWS.CloudTrail.Logging.Medium.007,AC_AWS_0447,AC_AWS_0497,AC_AWS_0458,AC_AWS_0320'      
+

.github/workflows/master.yml

@@ -0,0 +1,44 @@
+name: Master CI - deploys terraform and prow
+
+on:
+  push:
+    branches: [master]
+
+concurrency:
+  group: master-CI
+  cancel-in-progress: false
+
+jobs:
+  deploy-terraform:
+    permissions:
+      id-token: write
+      contents: read
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Checkout test-infra ⤵️
+        uses: actions/checkout@v4
+
+      - name: Configure AWS credentials 🔧⚙️
+        uses: aws-actions/configure-aws-credentials@v2
+        with:
+          role-to-assume: "arn:aws:iam::292999226676:role/github_actions-test-infra-cluster"
+          aws-region: eu-west-1
+
+      - name: Deploy terraform
+        run: |
+          ./tools/deploy_terraform.sh
+          
+  deploy-prow:
+    runs-on: ubuntu-22.04
+    needs: deploy-terraform
+    steps:
+      - name: Checkout test-infra ⤵️
+        uses: actions/checkout@v4
+
+      - name: Deploy prow
+        env:
+          PROW_HMAC_TOKEN: ${{ secrets.PROW_HMAC_TOKEN }}
+          PROW_OAUTH_TOKEN: ${{ secrets.PROW_OAUTH_TOKEN }}
+          PROW_SERVICE_ACCOUNT_JSON: ${{ secrets.PROW_SERVICE_ACCOUNT_JSON }}
+        run: |
+          ./tools/deploy_prow.sh