[StepSecurity] Apply security best practices #36
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: kubernetes-test | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths-ignore: | |
| - '**.md' | |
| pull_request: | |
| branches: | |
| - main | |
| paths-ignore: | |
| - '**.md' | |
| permissions: read-all | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 240 | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1 | |
| - name: cleanup disk space | |
| run: | | |
| df -H | |
| docker system prune -a -f | |
| sudo rm -rf /usr/share/dotnet | |
| sudo rm -rf /opt/ghc | |
| sudo rm -rf "/usr/local/share/boost" | |
| sudo rm -rf "$AGENT_TOOLSDIRECTORY" | |
| df -H | |
| # need containerd image store for testing local images | |
| - uses: crazy-max/ghaction-setup-docker@69b561f709cbd934060981d481ccfc316cfb77b7 # v2.2.0 | |
| with: | |
| daemon-config: | | |
| { | |
| "debug": true, | |
| "features": { | |
| "containerd-snapshotter": true | |
| } | |
| } | |
| - uses: crazy-max/ghaction-github-runtime@b3a9207c0e1ef41f4cf215303c976869d0c2c1c4 # v3.0.0 | |
| - name: build aikit | |
| run: | | |
| docker buildx build . -t aikit:test \ | |
| --load --progress plain \ | |
| --cache-from=type=gha,scope=aikit \ | |
| --cache-to=type=gha,scope=aikit,mode=max | |
| - name: build test model | |
| run: | | |
| docker buildx build . -t testmodel:test \ | |
| -f test/aikitfile.yaml \ | |
| --load --progress plain \ | |
| --cache-from=type=gha,scope=testmodel \ | |
| --cache-to=type=gha,scope=testmodel,mode=max | |
| - name: list images | |
| run: docker images | |
| - name: install e2e dependencies | |
| run: make test-e2e-dependencies | |
| - name: create kind cluster | |
| run: kind create cluster --wait 5m | |
| - name: load test model image into kind cluster | |
| run: kind load docker-image testmodel:test | |
| - name: deploy test model | |
| run: | | |
| kubectl create deployment test-model-deployment --image=testmodel:test --replicas 1 | |
| kubectl rollout status deployment test-model-deployment | |
| kubectl expose deployment test-model-deployment --port=8080 --target-port=8080 --name=test-model-service | |
| kubectl port-forward service/test-model-service 8080:8080 & | |
| - name: run test | |
| run: | | |
| curl http://127.0.0.1:8080/v1/chat/completions -H "Content-Type: application/json" -d '{"model": "llama-2-7b-chat", "messages": [{"role": "user", "content": "explain kubernetes in a sentence"}]}' | |
| - name: save logs | |
| if: always() | |
| run: | | |
| echo "KIND_LOGS_PATH=$(kind export logs)" >> $GITHUB_ENV | |
| - name: publish logs | |
| if: always() | |
| uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 | |
| with: | |
| name: kind-logs | |
| path: ${KIND_LOGS_PATH} |