Agent readiness section

.github/dependabot.yml

@@ -65,6 +65,12 @@ updates:
     patterns:
       - "*"
 
+  - package-ecosystem: "docker"
+    directory: "/clomonitor-runner"
+    multi-ecosystem-group: "infra"
+    patterns:
+      - "*"
+
   - package-ecosystem: "docker"
     directory: "/clomonitor-tracker"
     multi-ecosystem-group: "infra"
@@ -83,6 +89,12 @@ updates:
     patterns:
       - "*"
 
+  - package-ecosystem: "npm"
+    directory: "/clomonitor-runner/afdocs"
+    multi-ecosystem-group: "backend"
+    patterns:
+      - "*"
+
   - package-ecosystem: "npm"
     directory: "/web"
     ignore:

.github/workflows/build-images.yml

@@ -13,6 +13,33 @@ env:
   OCI_CLI_USER: ${{ secrets.OCI_CLI_USER }}
 
 jobs:
+  build-runner-image:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v5
+      - name: Login to OCI Registry
+        id: login-ocir
+        uses: oracle-actions/login-ocir@v1.3.0
+        with:
+          auth_token: ${{ secrets.OCI_AUTH_TOKEN }}
+      - name: Get clomonitor runner OCIR repository
+        id: get-ocir-repository-runner
+        uses: oracle-actions/get-ocir-repository@v1.3.0
+        with:
+          name: clomonitor/runner
+          compartment: ${{ secrets.OCI_COMPARTMENT_OCID }}
+      - name: Build and push runner image
+        env:
+          OCIR_REPOSITORY: ${{ steps.get-ocir-repository-runner.outputs.repo_path }}
+        run: |
+          docker build \
+            -f clomonitor-runner/Dockerfile \
+            -t $OCIR_REPOSITORY:$GITHUB_SHA \
+            .
+          docker push $OCIR_REPOSITORY:$GITHUB_SHA
+
   build-dbmigrator-image:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest

Cargo.toml

@@ -7,6 +7,7 @@ members = [
     "clomonitor-linter",
     "clomonitor-notifier",
     "clomonitor-registrar",
+    "clomonitor-runner",
     "clomonitor-tracker",
 ]
 
@@ -50,6 +51,7 @@ predicates = "3.1.4"
 regex = "1.12.4"
 reqwest = { version = "0.13.4", features = ["json"] }
 resvg = "0.27.0" # do-not-upgrade
+rustix = { version = "1.1.4", features = ["process"] }
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.150"
 serde_yaml = "0.9.34"
@@ -66,6 +68,7 @@ time = { version = "0.3.53", features = [
 ] }
 tiny-skia = "0.8.4" # do-not-upgrade
 tokio = { version = "1.52.3", features = [
+    "io-util",
     "macros",
     "process",
     "rt-multi-thread",

README.md

@@ -1,3 +1,5 @@
+<!-- markdownlint-disable MD013 MD014 MD033 MD045 -->
+
 # CLOMonitor
 
 [![Gitpod Ready-to-Code](https://img.shields.io/badge/Gitpod-ready--to--code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/cncf/clomonitor)
@@ -38,7 +40,14 @@ The CLOMonitor's linter can also be run locally or from CI workflows. This can b
 
 CLOMonitor delegates some of the security checks to [OpenSSF Scorecard](https://github.com/ossf/scorecard). When building from the source, you'll need to [install it](https://github.com/ossf/scorecard#installation) before running `clomonitor-linter` locally. The container image already includes the `scorecard` binary, so if you opt for using it you are ready to go.
 
-Both CLOMonitor and Scorecard use the GitHub GraphQL API for some checks, which requires authentication. A GitHub token (with `public_repo` scope) **must** be provided via the `GITHUB_TOKEN` environment variable to authenticate those requests.
+CLOMonitor delegates the agent readiness checks to [AFDocs](https://afdocs.dev). When building from the source, you'll need to [install it](https://afdocs.dev) before running `clomonitor-linter` locally. The container image already includes the `afdocs` binary.
+
+Both CLOMonitor and Scorecard use the GitHub GraphQL API for some checks, which
+requires authentication. A GitHub token (with `public_repo` scope) **must** be
+provided via the `GITHUB_TOKEN` environment variable to authenticate those
+requests. When runners are used, the token is sent only to the Scorecard runner
+profile and is injected only into the scorecard subprocess. AFDocs does not
+receive a GitHub token and does not consume authenticated GitHub API quota.
 
 ### Using Docker
 

chart/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: clomonitor
 description: CLOMonitor is a tool that periodically checks open source projects repositories to verify they meet certain project health best practices
 type: application
-version: 1.0.1-3
+version: 1.0.1-4
 appVersion: 1.0.0
 kubeVersion: ">= 1.19.0-0"
 keywords:

chart/templates/runner_deployment.yaml

@@ -0,0 +1,73 @@
+{{- $root := . -}}
+{{- $profiles := list (dict "name" "afdocs" "config" .Values.runner.afdocs "terminationGracePeriodSeconds" 260) (dict "name" "scorecard" "config" .Values.runner.scorecard "terminationGracePeriodSeconds" 500) -}}
+{{- range $profile := $profiles }}
+{{- $name := index $profile "name" -}}
+{{- $config := index $profile "config" -}}
+{{- if $config.enabled }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "chart.resourceNamePrefix" $root }}runner-{{ $name }}
+  labels:
+    app.kubernetes.io/component: runner-{{ $name }}
+    {{- include "chart.labels" $root | nindent 4 }}
+spec:
+  replicas: {{ $config.replicas }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: runner-{{ $name }}
+      {{- include "chart.selectorLabels" $root | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: runner-{{ $name }}
+        {{- include "chart.selectorLabels" $root | nindent 8 }}
+    spec:
+      automountServiceAccountToken: false
+      {{- with $root.Values.runner.podSecurityContext }}
+      securityContext:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $root.Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      terminationGracePeriodSeconds: {{ index $profile "terminationGracePeriodSeconds" }}
+      containers:
+        - name: runner
+          image: {{ $root.Values.runner.image.repository }}:{{ $root.Values.imageTag | default (printf "v%s" $root.Chart.AppVersion) }}
+          imagePullPolicy: {{ $root.Values.pullPolicy }}
+          {{- with $root.Values.runner.containerSecurityContext }}
+          securityContext:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          volumeMounts:
+            - name: runner-config
+              mountPath: {{ $root.Values.configDir | quote }}
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+          ports:
+            - name: http
+              containerPort: {{ $config.service.port }}
+              protocol: TCP
+          resources:
+            {{- toYaml $config.resources | nindent 12 }}
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: http
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: http
+          command: ['clomonitor-runner', '-c', '{{ $root.Values.configDir }}/runner.yaml']
+      volumes:
+        - name: runner-config
+          secret:
+            secretName: {{ include "chart.resourceNamePrefix" $root }}runner-{{ $name }}
+        - name: tmp
+          emptyDir: {}
+{{- end }}
+{{- end }}

chart/templates/runner_networkpolicy.yaml

@@ -0,0 +1,75 @@
+{{- $root := . -}}
+{{- $profiles := list (dict "name" "afdocs" "config" .Values.runner.afdocs "ports" (list 80 443)) (dict "name" "scorecard" "config" .Values.runner.scorecard "ports" (list 443)) -}}
+{{- range $profile := $profiles }}
+{{- $name := index $profile "name" -}}
+{{- $config := index $profile "config" -}}
+{{- if and $config.enabled $config.networkPolicy.enabled }}
+{{- $deniedV4 := list "10.0.0.0/8" "172.16.0.0/12" "192.168.0.0/16" "169.254.0.0/16" "100.64.0.0/10" "127.0.0.0/8" -}}
+{{- $deniedV6 := list "fc00::/7" "fe80::/10" "::1/128" -}}
+{{- range $config.networkPolicy.deniedCidrs }}
+{{- if contains ":" . }}
+{{- $deniedV6 = append $deniedV6 . }}
+{{- else }}
+{{- $deniedV4 = append $deniedV4 . }}
+{{- end }}
+{{- end }}
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: {{ include "chart.resourceNamePrefix" $root }}runner-{{ $name }}
+  labels:
+    app.kubernetes.io/component: runner-{{ $name }}
+    {{- include "chart.labels" $root | nindent 4 }}
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/component: runner-{{ $name }}
+      {{- include "chart.selectorLabels" $root | nindent 6 }}
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/component: tracker
+              {{- include "chart.selectorLabels" $root | nindent 14 }}
+      ports:
+        - port: {{ $config.service.port }}
+          protocol: TCP
+  egress:
+    - to:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: {{ $config.networkPolicy.dnsNamespace | quote }}
+          podSelector:
+            matchLabels:
+              {{- toYaml $config.networkPolicy.dnsPodSelector | nindent 14 }}
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    - to:
+        - ipBlock:
+            cidr: 0.0.0.0/0
+            except:
+              {{- toYaml $deniedV4 | nindent 14 }}
+      ports:
+        {{- range index $profile "ports" }}
+        - port: {{ . }}
+          protocol: TCP
+        {{- end }}
+    - to:
+        - ipBlock:
+            cidr: ::/0
+            except:
+              {{- toYaml $deniedV6 | nindent 14 }}
+      ports:
+        {{- range index $profile "ports" }}
+        - port: {{ . }}
+          protocol: TCP
+        {{- end }}
+{{- end }}
+{{- end }}

chart/templates/runner_secret.yaml

@@ -0,0 +1,28 @@
+{{- $root := . -}}
+{{- $profiles := list (dict "name" "afdocs" "config" .Values.runner.afdocs) (dict "name" "scorecard" "config" .Values.runner.scorecard) -}}
+{{- range $profile := $profiles }}
+{{- $name := index $profile "name" -}}
+{{- $config := index $profile "config" -}}
+{{- if $config.enabled }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ include "chart.resourceNamePrefix" $root }}runner-{{ $name }}
+  labels:
+    app.kubernetes.io/component: runner-{{ $name }}
+    {{- include "chart.labels" $root | nindent 4 }}
+type: Opaque
+stringData:
+  runner.yaml: |-
+    runner:
+      addr: 0.0.0.0:{{ $config.service.port }}
+      tools:
+        - {{ $name }}
+      maxConcurrentRuns: {{ $root.Values.runner.maxConcurrentRuns }}
+      maxQueue: {{ $root.Values.runner.maxQueue }}
+      minBudgetMs: {{ $root.Values.runner.minBudgetMs }}
+    log:
+      format: {{ $root.Values.log.format }}
+{{- end }}
+{{- end }}

chart/templates/runner_service.yaml

@@ -0,0 +1,26 @@
+{{- $root := . -}}
+{{- $profiles := list (dict "name" "afdocs" "config" .Values.runner.afdocs) (dict "name" "scorecard" "config" .Values.runner.scorecard) -}}
+{{- range $profile := $profiles }}
+{{- $name := index $profile "name" -}}
+{{- $config := index $profile "config" -}}
+{{- if $config.enabled }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "chart.resourceNamePrefix" $root }}runner-{{ $name }}
+  labels:
+    app.kubernetes.io/component: runner-{{ $name }}
+    {{- include "chart.labels" $root | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: {{ $config.service.port }}
+      protocol: TCP
+      targetPort: http
+  selector:
+    app.kubernetes.io/component: runner-{{ $name }}
+    {{- include "chart.selectorLabels" $root | nindent 4 }}
+{{- end }}
+{{- end }}

chart/templates/tracker_cronjob.yaml

@@ -14,6 +14,10 @@ spec:
   jobTemplate:
     spec:
       template:
+        metadata:
+          labels:
+            app.kubernetes.io/component: tracker
+            {{- include "chart.selectorLabels" . | nindent 12 }}
         spec:
         {{- with .Values.tracker.cronjob.podSecurityContext }}
           securityContext:

chart/templates/tracker_secret.yaml

@@ -18,3 +18,12 @@ stringData:
       format: {{ .Values.log.format }}
     tracker:
       concurrency: {{ .Values.tracker.concurrency }}
+    {{- if or .Values.runner.afdocs.enabled .Values.runner.scorecard.enabled }}
+    runner:
+      {{- if .Values.runner.afdocs.enabled }}
+      afdocsUrl: http://{{ include "chart.resourceNamePrefix" . }}runner-afdocs:{{ .Values.runner.afdocs.service.port }}
+      {{- end }}
+      {{- if .Values.runner.scorecard.enabled }}
+      scorecardUrl: http://{{ include "chart.resourceNamePrefix" . }}runner-scorecard:{{ .Values.runner.scorecard.service.port }}
+      {{- end }}
+    {{- end }}