refactor(ci): consolidate kind, kubectl, dapr, helm, and oras installs into make targets#12251
Merged
Merged
Conversation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned Files
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR continues the CI tool installer hardening work by centralizing installation of commonly used CI binaries (kind, kubectl, dapr, helm, oras) behind pinned, checksum-verified make install-<tool> targets. It reduces duplicated workflow logic and removes reliance on third-party setup actions and unpinned install scripts, making CI and local developer setup more reproducible and auditable.
Changes:
- Added new no-sudo installer scripts under
build/scripts/for kind, kubectl, dapr, helm, and oras that validate SHA-256 checksums and (in GitHub Actions) append the install dir toGITHUB_PATH. - Extended
build/tools.mkto pin versions + per-platform checksums and exposemake install-kind|kubectl|dapr|helm|oras. - Updated workflows and the
create-kind-clustercomposite action to use the new Make targets instead of inlinecurl/wget | bashinstalls andazure/setup-helm/oras-project/setup-oras.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| build/tools.mk | Adds pinned versions + checksums and install-* targets for kind/kubectl/dapr/helm/oras. |
| build/scripts/install-kind.sh | New checksum-verified installer for kind (GitHub release assets). |
| build/scripts/install-kubectl.sh | New checksum-verified installer for kubectl (dl.k8s.io stable channel / versioned downloads). |
| build/scripts/install-dapr.sh | New checksum-verified installer for the Dapr CLI (GitHub release tarballs). |
| build/scripts/install-helm.sh | New checksum-verified installer for Helm (get.helm.sh tarballs; latest resolved via GitHub redirect). |
| build/scripts/install-oras.sh | New checksum-verified installer for oras (GitHub release tarballs + goreleaser checksums file). |
| .github/workflows/validate-installers.yaml | Replaces setup-oras usage with make install-oras in installer validation job. |
| .github/workflows/unit-tests.yaml | Replaces setup-helm with make install-helm for unit test workflow. |
| .github/workflows/lint.yaml | Replaces setup-helm with make install-helm for Helm linting. |
| .github/workflows/functional-test-noncloud.yaml | Removes per-workflow tool version env vars; installs helm/dapr via Make; relies on action for kind install. |
| .github/workflows/functional-test-cloud.yaml | Installs helm + kind via Make and removes inline kind download logic. |
| .github/workflows/copilot-setup-steps.yml | Uses `make install-helm |
| .github/workflows/build.yaml | Replaces setup-oras and setup-helm with make install-oras / make install-helm. |
| .github/actions/create-kind-cluster/action.yaml | Removes kind-version input and installs kind via make install-kind. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #12251 +/- ##
=======================================
Coverage 52.88% 52.88%
=======================================
Files 751 751
Lines 48353 48353
=======================================
Hits 25570 25570
Misses 20385 20385
Partials 2398 2398 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
- Created install-helm.sh to install the Helm CLI with versioning and checksum verification. - Created install-kind.sh to install the Kind tool for Kubernetes clusters with versioning and checksum verification. - Created install-kubectl.sh to install the kubectl CLI with versioning and checksum verification. - Created install-oras.sh to install the ORAS CLI with versioning and checksum verification. - Updated tools.mk to include installation rules and checksums for Helm, Kind, Kubectl, and ORAS. Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
…f only docs changed Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
DariuszPorowski
force-pushed
the
dp/unfortunate-rhinoceros-peach
branch
from
b228475 to
95316d5
Compare
Signed-off-by: Dariusz Porowski <3431813+DariuszPorowski@users.noreply.github.com>
Radius functional test overviewClick here to see the test run details
Test Status⌛ Building Radius and pushing container images for functional tests... |
brooke-hamilton
approved these changes
Jun 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Follow-up to #12248, which consolidated the
yqandbicepinstalls into pinned, checksum-verifiedmake install-<tool>targets. This PR applies the same pattern to the remaining CI tools — kind, kubectl, dapr, helm, and oras — replacing inlinecurl/wget | bashinstalls and the third-partyazure/setup-helmandoras-project/setup-orasactions.Each tool now has:
build/scripts/install-<tool>.shthat detects OS/arch, verifies the download against a SHA-256 checksum, installs into a user-owned dir, and adds it to$GITHUB_PATHfor later steps; andbuild/tools.mkblock that pins the version + per-platform checksums and exposes amake install-<tool>target.Versions pinned in this PR:
kindv0.32.0,kubectlv1.36.2,daprv1.18.0,helmv4.2.2,orasv1.3.2.Why
build/tools.mk, instead of versions scattered across workflowenv:blocks and step inputs.daprinstall.sh | bashpipe and thesetup-helm/setup-orasthird-party actions are removed.make install-<tool>runs on a contributor's machine and on the runner.Files
build/scripts/install-{kind,kubectl,dapr,helm,oras}.shbuild/tools.mk: new KIND / KUBECTL / DAPR / HELM / ORAS version + checksum blocks andinstall-*targetsmake install-<tool>(dropping the now-unused version env vars):build.yaml,lint.yaml,unit-tests.yaml,copilot-setup-steps.yml,functional-test-cloud.yaml,functional-test-noncloud.yaml,validate-installers.yaml,actions/create-kind-cluster/action.yamlType of change
Follow-up to #12248.
Contributor checklist
Please verify that the PR meets the following requirements, where applicable:
eng/design-notes/in this repository, if new APIs are being introduced.