Attention Iron Bank Customers: On March 27, 2025, we are moving SBOM artifacts from the Anchore Scan job to the Build job to streamline the container hardening pipeline. If you currently download SBOMs from the Anchore Scan job, you can still get them from the Build job and from other sources, including IBFE and image attestations.
### See [bb MR testing](./docs/test-package-against-bb.md) for details regarding testing changes against bigbang umbrella chart.
There are certain integrations within the bigbang ecosystem and this package that require additional testing outside of the specific package tests ran during CI. This is a requirement when files within those integrations are changed, as to avoid causing breaks up through the bigbang umbrella. Currently, these include changes to the istio implementation within gitlab-runner (see: [istio templates](./chart/templates/bigbang/istio/), [network policy templates](./chart/templates/bigbang/networkpolicies/), [service entry templates](./chart/templates/bigbang/serviceentries/)), and kyverno (see: [kyverno custom entries](./chart/templates/bigbang/kyverno/).
Be sure to also test against monitoring locally as it is integrated by default with these high-impact service control packages, and needs to be validated using the necessary chart values beneath `istio.hardened` block with `monitoring.enabled` set to true as part of your dev-overrides.yaml
# How to upgrade the Gitlab Runner Package chart
BigBang makes modifications to the upstream helm chart. The full list of changes is at the end of this document.
1. Renovate may have already made changes in the development branch. If that is the case then just verify that the changes are correct as you go through these steps.
# Testing your Package Branch against Bigbang before Package Merge
These instructions right now are written for istio changes, but the same is probably true for kyverno and possibly for others. CODEOWNERS reviewing Merge Requests (MRs) should enforce this.
## Run Bigbang Tests Against your Branch
As part of your MR that modifies gitlab-runner you will need to run bigbang tests against your branch. To do this, at a minimum, you will need to complete the following:
1. Create a new branch on bigbang off of master `git checkout master && git pull && git checkout -b my-bigbang-branch-for-testing.`
1. Modify the [test values](https://repo1.dso.mil/big-bang/bigbang/-/blob/master/tests/test-values.yaml?ref_type=heads). Yours will be different for your package, you may need more than this.
```yaml
gitlabRunner:
git:
tag:null
branch:my-package-branch-that-needs-testing
values:
istio:
hardened:
enabled:true
```
1. Stage your changes `git add -A.`
1. Commit your changes `git commit -m "prepping for test."`
1. Push your changes `git push -u origin my-bigbang-branch-for-testing.`
1. Create the bigbang MR as a draft with `TEST ONLY DO NOT MERGE` in the title, and add the label of the package to test (e.g., `monitoring`).
1. Wait for tests to finish, and do fixes on your package branch as needed until they pass.
1. Close the bigbang MR by deleting the bigbang branch `git push -d origin my-bigbang-branch-for-testing.`
1. Link the bigbang MR on your package MR as evidence of your package working in bigbang.
