stackrox · davdhacs · May 2, 2026 · May 2, 2026 · May 2, 2026 · May 2, 2026
@@ -0,0 +1,111 @@
+name: Connect to infra-provisioned cluster
+description: Connect to a GKE or OCP cluster provisioned via infractl
+
+inputs:
+  cluster-name:
+    description: Cluster name (infractl ID)
+    required: true
+  infra-token:
+    description: INFRA_TOKEN secret
+    required: true
+  wait-timeout:
+    description: Timeout for infractl wait in minutes (default 25 for GKE, use 60 for OCP)
+    required: false
+    default: "25"
+  gcp-credentials:
+    description: GCP service account JSON (required for GKE infra clusters)
+    required: false
+    default: ""
+
+runs:
+  using: composite
+  steps:
+    - name: Install infractl
+      uses: stackrox/actions/infra/install-infractl@9238e423c3ae1ac4eb0f254cbb98da9daae24d86 # ratchet:stackrox/actions/infra/install-infractl@v1
+
+    - name: Wait for cluster and get artifacts
+      shell: bash
+      env:
+        INFRA_TOKEN: ${{ inputs.infra-token }}
+      run: |
+        timeout "${{ inputs.wait-timeout }}m" infractl wait "${{ inputs.cluster-name }}"
+        mkdir -p artifacts
+        infractl artifacts "${{ inputs.cluster-name }}" --download-dir artifacts > /dev/null
+        echo "KUBECONFIG=$(pwd)/artifacts/kubeconfig" >> "$GITHUB_ENV"
+
+    - name: Check if GKE auth needed
+      id: gke-check
+      shell: bash
+      run: |
+        if grep -q "gke-gcloud-auth-plugin" artifacts/kubeconfig 2>/dev/null; then
+          echo "gke=true" >> "$GITHUB_OUTPUT"
+        fi
+
+    - name: GCP auth for GKE cluster
+      if: steps.gke-check.outputs.gke && inputs.gcp-credentials
+      uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # ratchet:google-github-actions/auth@v2
+      with:
+        credentials_json: ${{ inputs.gcp-credentials }}
+
+    - name: Install gke-gcloud-auth-plugin
+      if: steps.gke-check.outputs.gke
+      uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # ratchet:google-github-actions/setup-gcloud@v3
+      with:
+        install_components: "gke-gcloud-auth-plugin"
+
+    - name: Refresh OpenShift token if needed
+      shell: bash
+      run: |
+        # Check if kubeconfig uses a token (ROSA HCP, etc.) vs certificate (OCP)
+        if ! grep -q "token: sha256~" artifacts/kubeconfig 2>/dev/null; then
+          echo "Certificate-based auth, no refresh needed"
+          exit 0
+        fi
+
+        # Test if current token works
+        if kubectl cluster-info &>/dev/null; then
+          echo "Token still valid"
+          exit 0
+        fi
+
+        echo "Token expired — refreshing via OAuth"
+
+        # Get API endpoint and console credentials from artifacts
+        API_URL=$(grep "server:" artifacts/kubeconfig | awk '{print $2}')
+        CONSOLE_USER=$(cat artifacts/cluster-console-username 2>/dev/null)
+        CONSOLE_PASS=$(cat artifacts/cluster-console-password 2>/dev/null)
+
+        if [ -z "$CONSOLE_USER" ] || [ -z "$CONSOLE_PASS" ]; then
+          echo "::error::No console credentials in artifacts — cannot refresh token"
+          exit 1
+        fi
+
+        # Discover OAuth server
+        OAUTH_URL=$(curl -sk "$API_URL/.well-known/oauth-authorization-server" | jq -r '.authorization_endpoint // empty')
+        if [ -z "$OAUTH_URL" ]; then
+          echo "::error::Cannot discover OAuth endpoint"
+          exit 1
+        fi
+
+        # Get fresh token
+        echo "::add-mask::${CONSOLE_PASS}"
+        LOCATION=$(curl -sk -u "${CONSOLE_USER}:${CONSOLE_PASS}" \
+          "${OAUTH_URL}?response_type=token&client_id=openshift-challenging-client" \
+          -H "X-CSRF-Token: 1" \
+          -D - -o /dev/null | grep -i "^Location:" | tr -d '\r')
+        NEW_TOKEN=$(echo "$LOCATION" | grep -oE 'access_token=[^&]+' | cut -d= -f2)
+
+        if [ -z "$NEW_TOKEN" ]; then
+          echo "::error::Failed to obtain fresh token"
+          exit 1
+        fi
+
+        echo "::add-mask::${NEW_TOKEN}"
+        sed -i "s|token: sha256~.*|token: ${NEW_TOKEN}|" artifacts/kubeconfig
+        echo "Token refreshed successfully"
+
+    - name: Verify cluster access
+      shell: bash
+      run: |
+        kubectl cluster-info
+        kubectl get nodes
@@ -19,6 +19,9 @@ inputs:
   spot:
     description: Use spot (preemptible) VMs for cost savings
     default: "true"
+  auto-cleanup:
+    description: Auto-delete cluster when job ends (disable for multi-job workflows)
+    default: "true"
 
 runs:
   using: composite
@@ -49,7 +52,7 @@ runs:
         provision_gke_cluster "${CLUSTER_ID}"
 
     - name: Register GKE cluster cleanup
-      if: always()
+      if: always() && inputs.auto-cleanup == 'true'
       uses: gacts/run-and-post-run@598d7a875d5620e0457490555b5e18e46082aa47 # v1.4.0
       with:
         shell: bash

@@ -0,0 +1,76 @@
+name: Create KinD cluster with images
+description: >
+  Creates a KinD cluster and pre-pulls container images via ctr.
+  Runs in the background — returns immediately. The cluster and images
+  become available asynchronously. Callers can start dependent actions
+  immediately; they should retry kubectl commands until the cluster is ready.
+
+  File-based outputs:
+    /tmp/kind-ready     — touched when KinD cluster + central-db image ready
+
+inputs:
+  cluster-name:
+    description: Unique cluster name
+    required: true
+  tag:
+    description: Image tag
+    required: true
+  registry:
+    description: Image registry
+    default: quay.io/rhacs-eng
+  memory-limit:
+    description: Docker container memory cap
+    default: 6g
+  quay-user:
+    description: Quay.io username
+    required: true
+  quay-pass:
+    description: Quay.io password
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Create KinD cluster (background)
+      shell: bash
+      run: |
+        set +x
+        echo "${{ inputs.quay-pass }}" | docker login -u "${{ inputs.quay-user }}" --password-stdin quay.io
+        set -x
+
+        SCANNER_TAG=$(cat SCANNER_VERSION)
+
+        (
+          NODE="${{ inputs.cluster-name }}-control-plane"
+          # Store credentials once — never trace them
+          CTR_AUTH="${{ inputs.quay-user }}:${{ inputs.quay-pass }}"
+
+          kind create cluster --name "${{ inputs.cluster-name }}"
+
+          docker update --memory "${{ inputs.memory-limit }}" \
+            --memory-swap "${{ inputs.memory-limit }}" "$NODE"
+
+          # Pull central-db first (wait) — eliminates kubelet backoff.
+          # Other images pull in background.
+          # set +x around ctr pull to prevent --user credentials in trace
+          set +x
+          docker exec "$NODE" ctr -n k8s.io images pull \
+            --user "$CTR_AUTH" --platform linux/amd64 \
+            "${{ inputs.registry }}/central-db:${{ inputs.tag }}" &
+          PID_CDB=$!
+          docker exec "$NODE" ctr -n k8s.io images pull \
+            --user "$CTR_AUTH" --platform linux/amd64 \
+            "${{ inputs.registry }}/main:${{ inputs.tag }}" &
+          docker exec "$NODE" ctr -n k8s.io images pull \
+            --user "$CTR_AUTH" --platform linux/amd64 \
+            "${{ inputs.registry }}/scanner:${SCANNER_TAG}" &
+          docker exec "$NODE" ctr -n k8s.io images pull \
+            --user "$CTR_AUTH" --platform linux/amd64 \
+            "${{ inputs.registry }}/scanner-db:${SCANNER_TAG}" &
+          set -x
+
+          wait $PID_CDB
+          touch /tmp/kind-ready
+        ) > /tmp/kind-create.log 2>&1 &
+
+        echo "KinD cluster creation started in background"