chore(deps): update terraform cloudflare to v5

.github/workflows/badge.yaml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: setup tailscale
-        uses: tailscale/github-action@v2
+        uses: tailscale/github-action@v3
         with:
           oauth-client-id: ${{secrets.TAILSCALE_CLIENT_ID}}
           oauth-secret: ${{secrets.TAILSCALE_SECRET}}

.github/workflows/gen-namespace.yaml

@@ -18,8 +18,8 @@ jobs:
       - name: setup-go
         uses: actions/setup-go@v5
         with:
-          go-version-file: ".github/scripts/infrautil/go.mod"
-          cache-dependency-path: ".github/scripts/infrautil/go.sum"
+          go-version-file: "scripts/infrautil/go.mod"
+          cache-dependency-path: "scripts/infrautil/go.sum"
 
       - name: make namespace
         run: |

.github/workflows/snapshot-diff.yaml

@@ -15,8 +15,8 @@ jobs:
       - name: setup-go
         uses: actions/setup-go@v5
         with:
-          go-version-file: ".github/scripts/infrautil/go.mod"
-          cache-dependency-path: ".github/scripts/infrautil/go.sum"
+          go-version-file: "scripts/infrautil/go.mod"
+          cache-dependency-path: "scripts/infrautil/go.sum"
 
       - name: make snapshot
         run: |
@@ -31,7 +31,8 @@ jobs:
       - name: mv
         run: |
           mkdir /tmp/snapshots-main
-          mv k8s/argocdapps /tmp/snapshots-main/argocdapps
+          mv k8s/apps /tmp/snapshots-main/apps
+          mv k8s/helm /tmp/snapshots-main/helm
 
       - name: Upload folder
         uses: actions/upload-artifact@v4
@@ -51,21 +52,15 @@ jobs:
         with:
           name: manifests
 
-      - name: install dyff
-        run: |
-          wget https://github.com/homeport/dyff/releases/download/v1.8.0/dyff_1.8.0_linux_amd64.tar.gz
-          tar -xvf dyff_1.8.0_linux_amd64.tar.gz
-          chmod +x dyff
-
       - name: Build markdown comment with manifest diff
         run: |
-          echo "# Manifest diff
+          echo "# Manifest (k8s/apps) diff
 
           <details>
           <summary>Click to expand</summary>
 
           \`\`\`diff
-          $(for f in $(find snapshots-head -type f); do echo "## $f"; diff -u $f $(echo $f | sed 's/head/main/') | sed 's/^/  /'; done)
+          $(for f in $(find snapshots-head/apps -type f); do diff -u $(echo $f | sed 's/head/main/') $f; done)
           \`\`\`
           </details>" | tee /tmp/diff.md
 
@@ -79,25 +74,23 @@ jobs:
             https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.number }}/comments \
             -d @-
 
-      - name: Build markdown comment with manifest dyff
+      - name: Build markdown comment with helm diff
         run: |
-          echo "# Manifest dyff
+          echo "# Helm diff
 
           <details>
           <summary>Click to expand</summary>
 
           \`\`\`diff
-          # $(./dyff between manifests-base.yaml manifests-head.yaml)
-          $(for f in $(find snapshots-head -type f); do echo "## $f"; ./dyff between $f $(echo $f | sed 's/head/main/') | sed 's/^/  /'; done)
+          $(for f in $(find snapshots-head/helm -type f); do diff -u $(echo $f | sed 's/head/main/') $f; done)
           \`\`\`
-
-          </details>" | tee /tmp/dyff.md
+          </details>" | tee /tmp/diff.md
 
       # PRへのコメントだけど、issue commentのAPIを使うらしい
       - name: Comment manifest diff to GitHub PR
         continue-on-error: true
         run: |
-          cat /tmp/dyff.md | jq -Rs '{ "body": . }' | curl --fail \
+          cat /tmp/diff.md | jq -Rs '{ "body": . }' | curl --fail \
             -X POST -H 'Accept: application/vnd.github.v3+json' \
             --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' \
             https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.number }}/comments \

.github/workflows/snapshot.yaml

@@ -1,6 +1,10 @@
 name: Snapshot Auto Generation
 on:
   push:
+    branches:
+      - "**"
+      - "!snapshot"
+  pull_request:
     branches:
       - main
   workflow_dispatch:
@@ -30,19 +34,30 @@ jobs:
       - name: setup-go
         uses: actions/setup-go@v5
         with:
-          go-version-file: ".github/scripts/infrautil/go.mod"
-          cache-dependency-path: ".github/scripts/infrautil/go.sum"
+          go-version-file: "scripts/infrautil/go.mod"
+          cache-dependency-path: "scripts/infrautil/go.sum"
 
       - name: make snapshot
         run: |
           make snapshot
 
+      - name: Upload folder
+        uses: actions/upload-artifact@v4
+        with:
+          if-no-files-found: error
+          name: snapshots
+          path: |
+            k8s/snapshots
+
       - name: mv snapshot
+        if: ${{ github.ref_name == 'main' }}
         run: |
-          rm -rf k8s/argocdapps
-          mv k8s/snapshots/argocdapps k8s/argocdapps
+          rm -rf k8s/apps
+          mv k8s/snapshots/apps k8s/apps
+          mv k8s/snapshots/helm k8s/helm
 
       - name: push
+        if: ${{ github.ref_name == 'main' }}
         run: |
           git config user.name  "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
@@ -52,14 +67,15 @@ jobs:
 
   scan:
     runs-on: ubuntu-latest
+    if: ${{ github.ref_name == 'main' }}
     needs: snapshot
     steps:
       - uses: actions/checkout@v4
         with:
           ref: snapshot
 
       - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@0.28.0
+        uses: aquasecurity/trivy-action@0.29.0
         with:
           scan-type: "config"
           format: "sarif"
@@ -76,11 +92,20 @@ jobs:
     runs-on: ubuntu-latest
     needs: snapshot
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
         with:
-          ref: snapshot
+          name: snapshots
 
       - name: Lint manifest with kubeconform
         uses: docker://ghcr.io/yannh/kubeconform:latest
         with:
-          args: "-ignore-missing-schemas -strict -summary k8s/argocdapps"
+          args: "-ignore-missing-schemas -strict -summary apps"
+
+  # auto merge用
+  # auto megeはskipもsuccessとみなす
+  status-check:
+    runs-on: ubuntu-latest
+    needs: [lint]
+    if: failure()
+    steps:
+      - run: exit 1

.trivyignore.yaml

@@ -1,9 +1,23 @@
 misconfigurations:
 - id: KSV017
   paths:
-  - "k8s/argocdapps/machine-status-api/deployment.yaml"
-  statement: Accept Privileged
+  - "k8s/apps/machine-status-api/deployment.yaml"
+  statement: 特定のコンテナはPrivilegedを許可する
 - id: KSV023
   paths:
-  - "k8s/argocdapps/samba/deployment.yaml"
-  statement: accept hostpath
+  - "k8s/apps/samba/deployment.yaml"
+  statement: 特定のコンテナはホストマウントを許可する
+- id: AVD-KSV-0109
+  statement: Disable "ConfigMap with secrets" as there are many false positives.
+- id: AVD-KSV-01010
+  statement: Disable "ConfigMap with sensitive content" as there are many false positives.
+- id: KSV022
+  paths:
+  - "k8s/helm/cilium-helm.yaml"
+  statement: accept capabilities.add in cilium
+- id: AVD-KSV-0022
+  statement: "`NET_BIND_SERVICE` should be added to the capabilities.add list in the securityContext"
+- id: AVD-KSV-0020
+  statement: runAsUserのチェックは要らない
+- id: AVD-KSV-0021
+  statement: runAsGroupのチェックは要らない