Skip to content

V4 #128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
spbsoluble merged 3 commits into from
Nov 11, 2025
Merged

V4 #128

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
fb01e2b
fix(polaris): Comment out `polaris` until integration can be fixed.
spbsoluble Nov 11, 2025
ec9f491
fix(polaris): Allow failure
spbsoluble Nov 11, 2025
025d384
chore(docs): add missing changelog entry for `v3.4.0`
spbsoluble Nov 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/kf-polaris-scan.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ on:
jobs:
build:
runs-on: [ ubuntu-latest ]
continue-on-error: true
steps:
- name: Checkout Source
uses: actions/checkout@v4
Expand Down
14 changes: 7 additions & 7 deletions .github/workflows/starter.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,13 +156,13 @@ jobs:
secrets:
token: ${{ secrets.token }}

call-polaris-scan-workflow:
if: github.event_name == 'pull_request' && (startsWith(github.base_ref, 'release-') || github.base_ref == 'main')
uses: Keyfactor/actions/.github/workflows/kf-polaris-scan.yml@v4
with:
scan_branch: ${{ github.event.pull_request.head.ref }}
secrets:
token: ${{ secrets.scan_token }}
# call-polaris-scan-workflow:
# if: github.event_name == 'pull_request' && (startsWith(github.base_ref, 'release-') || github.base_ref == 'main')
# uses: Keyfactor/actions/.github/workflows/kf-polaris-scan.yml@v4
# with:
# scan_branch: ${{ github.event.pull_request.head.ref }}
# secrets:
# token: ${{ secrets.scan_token }}

call-post-release-workflow:
needs: [ call-assign-from-json-workflow, call-create-github-release-workflow ]
Expand Down
213 changes: 125 additions & 88 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,92 +1,98 @@
### 👨🏿‍🚀 Actions v4 Workflows
### 👨🏿‍🚀 Actions v4 Workflows

### What's new in v4
* The v4 Actions make use of [doctool](https://github.com/Keyfactor/doctool) to take Command screenshots for Universal Orchestrator extension store-type creation.

* The v4 Actions make use of [doctool](https://github.com/Keyfactor/doctool) to take Command screenshots for Universal
Orchestrator extension store-type creation.

### Usage

#### Prerequisites
- Ensure an `integration-manifest.json` file is present in the root of your repository. For the schema, see the v2 [integration-manifest-schema.json](https://keyfactor.github.io/v2/integration-manifest-schema.json)

- Ensure an `integration-manifest.json` file is present in the root of your repository. For the schema, see the
v2 [integration-manifest-schema.json](https://keyfactor.github.io/v2/integration-manifest-schema.json)

#### Example `integration-manifest.json`

```json
{
"$schema": "https://keyfactor.github.io/v2/integration-manifest-schema.json",
"integration_type": "anyca-plugin",
"name": "Example AnyCA REST Gateway Plugin",
"status": "pilot",
"support_level": "kf-supported",
"link_github": true,
"update_catalog": true,
"description": "Example Plugin for the AnyCA REST Gateway framework",
"gateway_framework": "25.0.0",
"release_dir": "example-caplugin\\bin\\Release",
"release_project": "example-caplugin\\example_extension.csproj",
"about": {
"carest": {
"ca_plugin_config": [
{
"name": "ApiKey",
"description": "The API Key for the The CA API"
},
{
"name": "Username",
"description": "Username for the CA API service account"
},
{
"name": "Password",
"description": "Password for the CA API service account"
},
{
"name": "BaseUrl",
"description": "The Base URL for the CA API"
},
{
"name": "Enabled",
"description": "Flag to Enable or Disable gateway functionality. Disabling is primarily used to allow creation of the CA prior to configuration information being available."
}
],
"enrollment_config": [
{
"name": "CertificateValidityInYears",
"description": "Number of years the certificate will be valid for"
},
{
"name": "Email",
"description": "Email address of the requestor"
},
{
"name": "OrganizationName",
"description": "Name of the organization to be validated against"
}
],
"product_ids": [
"ExampleProductSslOvBasic",
"ExampleProductSslEvBasic",
"ExampleProductSslDvGeotrust",
"ExampleProductSslDvThawte",
"ExampleProductSslOvThawteWebserver",
"ExampleProductSslEvThawteWebserver",
"ExampleProductSslOvGeotrustTruebizid",
"ExampleProductSslEvGeotrustTruebizid",
"ExampleProductSslOvSecuresite",
"ExampleProductSslEvSecuresite",
"ExampleProductSslOvSecuresitePro",
"ExampleProductSslEvSecuresitePro"
]
}
"$schema": "https://keyfactor.github.io/v2/integration-manifest-schema.json",
"integration_type": "anyca-plugin",
"name": "Example AnyCA REST Gateway Plugin",
"status": "pilot",
"support_level": "kf-supported",
"link_github": true,
"update_catalog": true,
"description": "Example Plugin for the AnyCA REST Gateway framework",
"gateway_framework": "25.0.0",
"release_dir": "example-caplugin\\bin\\Release",
"release_project": "example-caplugin\\example_extension.csproj",
"about": {
"carest": {
"ca_plugin_config": [
{
"name": "ApiKey",
"description": "The API Key for the The CA API"
},
{
"name": "Username",
"description": "Username for the CA API service account"
},
{
"name": "Password",
"description": "Password for the CA API service account"
},
{
"name": "BaseUrl",
"description": "The Base URL for the CA API"
},
{
"name": "Enabled",
"description": "Flag to Enable or Disable gateway functionality. Disabling is primarily used to allow creation of the CA prior to configuration information being available."
}
],
"enrollment_config": [
{
"name": "CertificateValidityInYears",
"description": "Number of years the certificate will be valid for"
},
{
"name": "Email",
"description": "Email address of the requestor"
},
{
"name": "OrganizationName",
"description": "Name of the organization to be validated against"
}
],
"product_ids": [
"ExampleProductSslOvBasic",
"ExampleProductSslEvBasic",
"ExampleProductSslDvGeotrust",
"ExampleProductSslDvThawte",
"ExampleProductSslOvThawteWebserver",
"ExampleProductSslEvThawteWebserver",
"ExampleProductSslOvGeotrustTruebizid",
"ExampleProductSslEvGeotrustTruebizid",
"ExampleProductSslOvSecuresite",
"ExampleProductSslEvSecuresite",
"ExampleProductSslOvSecuresitePro",
"ExampleProductSslEvSecuresitePro"
]
}
}
}
```

#### Example workflow `keyfactor-bootsrap-workflow.yml`
Copy link

Copilot AI Nov 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo in filename: "bootsrap" should be "bootstrap".

Suggested change
#### Example workflow `keyfactor-bootsrap-workflow.yml`
#### Example workflow `keyfactor-bootstrap-workflow.yml`

Copilot uses AI. Check for mistakes.

```yaml
name: Keyfactor Bootstrap Workflow

on:
workflow_dispatch:
pull_request:
types: [opened, closed, synchronize, edited, reopened]
types: [ opened, closed, synchronize, edited, reopened ]
push:
create:
branches:
Expand All @@ -108,44 +114,75 @@ jobs:
entra_password: ${{ secrets.DOCTOOL_ENTRA_PASSWD }} # Only required for doctool generated screenshots
command_client_id: ${{ secrets.COMMAND_CLIENT_ID }} # Only required for doctool generated screenshots
command_client_secret: ${{ secrets.COMMAND_CLIENT_SECRET }} # Only required for doctool generated screenshots

```

### 🚀The Bootstrap workflow for v4 Actions perform the following steps:
#### Inputs

| Parameter | Type | Description | Required/Optional |
|-----------------------|--------|----------------------------------------------------------------|--------------------------------|
| command_token_url | Input | URL for command token, used by doctool for screenshots | Optional (doctool screenshots) |
| command_hostname | Input | Hostname for command, used by doctool for screenshots | Optional (doctool screenshots) |
| command_base_api_path | Input | Base API path for command, used by doctool for screenshots | Optional (doctool screenshots) |
| token | Secret | Build token for workflow execution | Required |
| gpg_key | Secret | GPG private key for signing golang builds | Optional (golang builds) |
| gpg_pass | Secret | GPG passphrase for signing golang builds | Optional (golang builds) |
Comment on lines +128 to +129
Copy link

Copilot AI Nov 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The documentation indicates gpg_key and gpg_pass are "Optional (golang builds)", but in the workflow definition (.github/workflows/starter.yml lines 10 and 13), both are marked as required: true. If these parameters are truly required by the workflow schema, the documentation should reflect this, even if they're only utilized for golang builds. Consider either updating the workflow to make them optional, or correcting the documentation to indicate they are required.

Copilot uses AI. Check for mistakes.
| scan_token | Secret | Token for SAST/Polaris scan | Required |
Copy link

Copilot AI Nov 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The scan_token parameter is marked as "Required" in the documentation, but in the actual workflow definition (.github/workflows/starter.yml line 22), it's marked as required: false, and the Polaris scan workflow is currently commented out (lines 159-165). The documentation should reflect the actual requirement status as "Optional" or note that it's currently unused.

Suggested change
| scan_token | Secret | Token for SAST/Polaris scan | Required |
| scan_token | Secret | Token for SAST/Polaris scan | Optional (currently unused) |

Copilot uses AI. Check for mistakes.
| entra_username | Secret | Username for doctool Entra authentication (screenshots) | Optional (doctool screenshots) |
| entra_password | Secret | Password for doctool Entra authentication (screenshots) | Optional (doctool screenshots) |
| command_client_id | Secret | Client ID for command API, used by doctool for screenshots | Optional (doctool screenshots) |
| command_client_secret | Secret | Client secret for command API, used by doctool for screenshots | Optional (doctool screenshots) |

### 🚀The Bootstrap workflow for v4 Actions perform the following steps:

* Checkout integration repository
* Call [starter.yml](.github/workflows/starter.yml) workflow
* Get values from integration-manifest.json [assign-env-from-json](.github/workflows/assign-env-from-json.yml)
* Discover primary programming language from the repository [***action-get-primary-language***]
* Determine event_name: `create, push, pull_request, workflow_dispatch` [github-release.yml](.github/workflows/github-release.yml)
* Run the workflows and conditionalized steps to produce a build. If conditions match, release artifacts are delivered
[dotnet-build-and-release.yml](.github/workflows/dotnet-build-and-release.yml) or [go-build-and-release.yml](.github/workflows/go-build-and-release.yml)
workflow will be run depending on the `detected-primary-language` step in [starter.yml](.github/workflows/starter.yml)
* Determine event_name:
`create, push, pull_request, workflow_dispatch` [github-release.yml](.github/workflows/github-release.yml)
* Run the workflows and conditionalized steps to produce a build. If conditions match, release artifacts are delivered
[dotnet-build-and-release.yml](.github/workflows/dotnet-build-and-release.yml)
or [go-build-and-release.yml](.github/workflows/go-build-and-release.yml)
workflow will be run depending on the `detected-primary-language` step in [starter.yml](.github/workflows/starter.yml)

#### On Create:
* Configure repository settings - This will use the properties from the json to update topic and description, and will set the teams permissions on the repo accordingly. If the ref created is a branch that matches "release-\*.\*", branch protection is added, autlink reference set ab# to devops [***kf-configure-repo***]

* Configure repository settings - This will use the properties from the json to update topic and description, and will
set the teams permissions on the repo accordingly. If the ref created is a branch that matches "release-\*.\*", branch
protection is added, autlink reference set ab# to devops [***kf-configure-repo***]
Copy link

Copilot AI Nov 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo: "autlink" should be "autolink".

Suggested change
protection is added, autlink reference set ab# to devops [***kf-configure-repo***]
protection is added, autolink reference set ab# to devops [***kf-configure-repo***]

Copilot uses AI. Check for mistakes.

#### On push or workflow_dispatch:

* Just run the build on the branch with the commit without producing release artifacts
* * C#: run the [dotnet-build-and-release.yml](.github/workflows/dotnet-build-and-release.yml) workflow
* * Go builds: run the go-build-and-release.yml workflow (still in progress)
* All languages:
* * Generate/Update `README.md` using `doctool` [generate-readme.yml](.github/workflows/generate-readme.yml)
* * (conditionally) a catalog entry [update-catalog](.github/workflows/update-catalog.yml) will be created/updated if the json manifest has `"update_catalog": true` in the `integration-manifest.json` file
*
* C#: run the [dotnet-build-and-release.yml](.github/workflows/dotnet-build-and-release.yml) workflow
*
* Go builds: run the go-build-and-release.yml workflow (still in progress)
* All languages:
*
* Generate/Update `README.md` using `doctool` [generate-readme.yml](.github/workflows/generate-readme.yml)
*
Comment on lines +158 to +165
Copy link

Copilot AI Nov 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The list structure contains empty bullet points (lines 158, 160, 163, 165) which are unconventional and may not render correctly in markdown. Consider restructuring this section to use proper nested lists without empty parent bullets, or use a different formatting approach such as indented bullets without the empty parent items.

Suggested change
*
* C#: run the [dotnet-build-and-release.yml](.github/workflows/dotnet-build-and-release.yml) workflow
*
* Go builds: run the go-build-and-release.yml workflow (still in progress)
* All languages:
*
* Generate/Update `README.md` using `doctool` [generate-readme.yml](.github/workflows/generate-readme.yml)
*
* For C#:
* Run the [dotnet-build-and-release.yml](.github/workflows/dotnet-build-and-release.yml) workflow
* For Go:
* Run the go-build-and-release.yml workflow (still in progress)
* For all languages:
* Generate/Update `README.md` using `doctool` [generate-readme.yml](.github/workflows/generate-readme.yml)

Copilot uses AI. Check for mistakes.
* (conditionally) a catalog entry [update-catalog](.github/workflows/update-catalog.yml) will be created/updated if
the json manifest has `"update_catalog": true` in the `integration-manifest.json` file

#### On pull_request[opened, closed, synchronize, edited, reopened]:
[dotnet-build-and-release.yml](.github/workflows/dotnet-build-and-release.yml) workflow or [go-build-and-release.yml](.github/workflows/go-build-and-release.yml) workflow will be run depending on the detected primary language
* If the pr destination is a `release-*.*` branch, set flags to produce release artifacts
* If the pr is determined to be `open` or `merged` but not `closed` (synchronize), a prerelease artifact will be uploaded
* If the pr is determined to be `merged` and `closed`, a final "official" release is built and published to GitHub releases, and if `"update_catalog": true` is set in the json manifest, a catalog entry will be created/updated
* Polaris SAST/SCAN scans run when push to `release-*` or main occurs
* If PR to release branch is `merged/closed`, a new PR will be automatically generated. This will need to be approved manually and **should not** be approved for hotfix branches



[dotnet-build-and-release.yml](.github/workflows/dotnet-build-and-release.yml) workflow
or [go-build-and-release.yml](.github/workflows/go-build-and-release.yml) workflow will be run depending on the detected
primary language

* If the pr destination is a `release-*.*` branch, set flags to produce release artifacts
* If the pr is determined to be `open` or `merged` but not `closed` (synchronize), a prerelease artifact will be
uploaded
* If the pr is determined to be `merged` and `closed`, a final "official" release is built and published to GitHub
releases, and if `"update_catalog": true` is set in the json manifest, a catalog entry will be created/updated
* Polaris SAST/SCAN scans run when push to `release-*` or main occurs
Copy link

Copilot AI Nov 11, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The documentation states "Polaris SAST/SCAN scans run when push to release-* or main occurs", but the Polaris scan workflow is currently commented out in .github/workflows/starter.yml (lines 159-165). This documentation should either be removed or updated to reflect that the Polaris scan is currently disabled.

Suggested change
* Polaris SAST/SCAN scans run when push to `release-*` or main occurs

Copilot uses AI. Check for mistakes.
* If PR to release branch is `merged/closed`, a new PR will be automatically generated. This will need to be approved
manually and **should not** be approved for hotfix branches

### 📝Todo:

### 📝Todo:
* Remove default admin user when applying branch protection
* Add overrides for detected language, readme build(?), etc. into json manifest
* Set repo license
Expand Down