Security and Code Quality Audit Report

.coveragerc

@@ -0,0 +1,22 @@
+[run]
+source = .
+omit =
+    tests/*
+    examples/*
+    scripts/*
+    */__pycache__/*
+    */site-packages/*
+    setup.py
+
+[report]
+exclude_lines =
+    pragma: no cover
+    def __repr__
+    raise AssertionError
+    raise NotImplementedError
+    if __name__ == .__main__.:
+    if TYPE_CHECKING:
+    @abstractmethod
+
+[html]
+directory = htmlcov

.flake8

@@ -0,0 +1,14 @@
+[flake8]
+max-line-length = 127
+max-complexity = 15
+exclude =
+    .git,
+    __pycache__,
+    build,
+    dist,
+    .venv,
+    venv,
+    scripts/
+ignore = E203, W503
+per-file-ignores =
+    __init__.py:F401

.github/workflows/build-dockerfiles.yml → .github/workflows/build-containerfiles.yml

@@ -1,4 +1,4 @@
-name: Build All Dockerfiles
+name: Build All Containerfiles
 
 on:
   push:
@@ -23,18 +23,18 @@ env:
   REGISTRY: ghcr.io
 
 jobs:
-  build-dockerfiles:
-    name: Build Docker Images
+  build-containerfiles:
+    name: Build Container Images
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        dockerfile:
-          - Dockerfile
-          - Dockerfile.ipxe
+        containerfile:
+          - Containerfile
+          - Containerfile.ipxe
         include:
-          - dockerfile: Dockerfile
+          - containerfile: Containerfile
             image_postfix: ""
-          - dockerfile: Dockerfile.ipxe
+          - containerfile: Containerfile.ipxe
             image_postfix: "-ipxe"
 
     permissions:
@@ -62,11 +62,11 @@ jobs:
         images: ${{ env.REGISTRY }}/${{ github.repository }}${{ matrix.image_postfix }}
         tags: ${{ inputs.tag_pattern }}
 
-    - name: Build and push Docker image
+    - name: Build and push container image
       uses: docker/build-push-action@v5
       with:
         context: .
-        file: ${{ matrix.dockerfile }}
+        file: ${{ matrix.containerfile }}
         platforms: linux/amd64,linux/arm64
         push: true
         tags: ${{ steps.meta.outputs.tags }}
@@ -85,7 +85,7 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v4
 
-    - name: Run Trivy vulnerability scanner on all Dockerfiles
+    - name: Run Trivy vulnerability scanner on all Containerfiles
       uses: aquasecurity/trivy-action@master
       with:
         scan-type: 'config'

.github/workflows/ci.yml

@@ -32,7 +32,7 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         pip install -r requirements.txt
-        pip install pytest pytest-asyncio black flake8
+        pip install -r requirements-dev.txt
 
     - name: Lint with flake8
       run: |
@@ -44,15 +44,22 @@ jobs:
     - name: Check formatting with black
       run: |
         black --check --diff .
-
-    # - name: Test with pytest
-    #   run: |
-    #     pytest -v
 
-  build-dockerfiles:
-    name: Build All Docker Images
+    - name: Run unit tests
+      run: |
+        pytest tests/ -v --cov --cov-report=term-missing --cov-report=xml -m "not integration and not e2e"
+
+    - name: Upload coverage reports
+      uses: codecov/codecov-action@v3
+      with:
+        files: ./coverage.xml
+        flags: unittests
+        name: codecov-nio
+
+  build-containerfiles:
+    name: Build All Container Images
     needs: test
-    uses: ./.github/workflows/build-dockerfiles.yml
+    uses: ./.github/workflows/build-containerfiles.yml
     with:
       tag_pattern: |
         type=ref,event=branch
@@ -78,8 +85,8 @@ jobs:
 
   #   - name: Deploy to test cluster
   #     run: |
-  #       # Здесь можно добавить команды для деплоя в тестовый кластер
-  #       # Например, с использованием kind или minikube
+  #       # Add commands here for deploying to test cluster
+  #       # For example, using kind or minikube
   #       echo "Deploying to test environment..."
   #       # kubectl apply -f crds/
   #       # kubectl apply -f deployment.yaml

.github/workflows/nightly.yml

@@ -2,18 +2,18 @@ name: Nightly Build
 
 on:
   schedule:
-    # Запускается каждый день в 2:00 UTC
+    # Runs every day at 2:00 UTC
     - cron: '0 2 * * *'
-  workflow_dispatch:  # Позволяет запускать вручную
+  workflow_dispatch:  # Allows manual triggering
 
 env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
-  build-dockerfiles:
-    name: Build All Docker Images for Nightly
-    uses: ./.github/workflows/build-dockerfiles.yml
+  build-containerfiles:
+    name: Build All Container Images for Nightly
+    uses: ./.github/workflows/build-containerfiles.yml
     with:
       tag_pattern: |
         nightly
@@ -48,7 +48,7 @@ jobs:
 
   #   - name: Run integration tests
   #     run: |
-  #       # Здесь можно добавить интеграционные тесты с Kind
+  #       # Add integration tests with Kind here
   #       echo "Running integration tests..."
   #       # kind create cluster --config kind-config.yaml
   #       # kubectl apply -f crds/
@@ -87,18 +87,18 @@ jobs:
   notify:
     name: Notify Status
     runs-on: ubuntu-latest
-    needs: [build-dockerfiles, integration-tests, security-scan]
+    needs: [build-containerfiles, security-scan]
     if: always()
 
     steps:
     - name: Notify on success
-      if: needs.build-dockerfiles.result == 'success' && needs.integration-tests.result == 'success'
+      if: needs.build-containerfiles.result == 'success' && needs.security-scan.result == 'success'
       run: |
         echo "Nightly build completed successfully!"
-        # Здесь можно добавить уведомления (Slack, Discord, etc.)
+        # Add notifications here (Slack, Discord, etc.)
 
     - name: Notify on failure
-      if: needs.build-dockerfiles.result == 'failure' || needs.integration-tests.result == 'failure'
+      if: needs.build-containerfiles.result == 'failure' || needs.security-scan.result == 'failure'
       run: |
         echo "Nightly build failed! Check the logs."
-        # Здесь можно добавить уведомления об ошибках
+        # Add failure notifications here

.github/workflows/release.yml

@@ -12,9 +12,9 @@ env:
   IMAGE_NAME: ${{ github.repository }}
 
 jobs:
-  build-dockerfiles:
-    name: Build All Docker Images for Release
-    uses: ./.github/workflows/build-dockerfiles.yml
+  build-containerfiles:
+    name: Build All Container Images for Release
+    uses: ./.github/workflows/build-containerfiles.yml
     with:
       tag_pattern: |
         type=semver,pattern={{version}}
@@ -26,7 +26,7 @@ jobs:
   generate-manifests:
     name: Generate Release Manifests
     runs-on: ubuntu-latest
-    needs: build-dockerfiles
+    needs: build-containerfiles
     permissions:
       contents: read
 
@@ -36,11 +36,11 @@ jobs:
 
     - name: Generate deployment manifests
       run: |
-        # Создаем версионированные манифесты для релиза
+        # Create versioned manifests for release
         mkdir -p manifests/release
         cp deployment.yaml manifests/release/
-        
-        # Обновляем версию образа в манифесте для всех Dockerfiles
+
+        # Update image version in manifest for all Containerfiles
         # Main image
         sed -i "s|nixos-operator:latest|${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${GITHUB_REF_NAME}|g" manifests/release/deployment.yaml
         # iPXE image (if used in deployment)
@@ -88,7 +88,7 @@ jobs:
 
     - name: Update version in README
       run: |
-        # Обновляем версию в README если нужно
+        # Update version in README if needed
         VERSION=${{ github.event.release.tag_name }}
         echo "Updating documentation for version $VERSION"
-        # Здесь можно добавить логику обновления документации
+        # Add documentation update logic here

.github/workflows/test-e2e.yml

@@ -0,0 +1,72 @@
+name: E2E Tests
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  test-e2e:
+    name: End-to-End Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Set up Python 3.11
+      uses: actions/setup-python@v4
+      with:
+        python-version: 3.11
+        cache: 'pip'
+
+    - name: Install dependencies
+      run: |
+        python -m pip install --upgrade pip
+        pip install -r requirements.txt
+        pip install -r requirements-dev.txt
+
+    - name: Install kind
+      run: |
+        curl -Lo ./kind https://kind.sigs.k8s.io/dl/latest/kind-linux-amd64
+        chmod +x ./kind
+        sudo mv ./kind /usr/local/bin/kind
+        kind version
+
+    - name: Create kind cluster
+      run: |
+        kind create cluster --name nio-e2e --wait 5m
+        kubectl cluster-info
+        kubectl wait --for=condition=Ready nodes --all --timeout=5m
+
+    - name: Build operator image
+      run: |
+        podman build -t nio-operator:test .
+
+    - name: Load image into kind
+      run: |
+        podman save nio-operator:test | kind load image-archive /dev/stdin --name nio-e2e
+
+    - name: Install CRDs
+      run: |
+        kubectl apply -f crds/
+
+    - name: Run E2E tests
+      run: |
+        # Run only E2E marked tests
+        pytest tests/ -v -m e2e --maxfail=5
+
+    - name: Collect logs on failure
+      if: failure()
+      run: |
+        kubectl get all -A
+        kubectl describe pods -A
+        kubectl logs -l app=nio-operator -n nixos-operator-system --tail=100 || true
+
+    - name: Cleanup
+      if: always()
+      run: |
+        kind delete cluster --name nio-e2e || true

.markdownlint.yaml

@@ -0,0 +1,23 @@
+# Markdownlint configuration for NIO documentation
+#
+# Technical documentation often requires longer lines for:
+# - Command examples with long paths
+# - URLs and links
+# - Code examples
+# - Configuration snippets
+#
+# This config disables overly restrictive rules while maintaining quality.
+
+# Disable line length limit - technical docs have long commands/URLs
+MD013: false
+
+# Allow bare URLs in documentation for readability
+MD034: false
+
+# Allow lists and code blocks without surrounding blank lines
+# for better readability in technical documentation
+MD031: false
+MD032: false
+
+# All other rules enabled with default settings
+default: true

.yamllint

@@ -0,0 +1,27 @@
+# yamllint configuration for Kubernetes manifests
+#
+# Kubernetes YAML uses 2-space indentation and often has long
+# description fields for alerts and annotations.
+
+extends: default
+
+rules:
+  # Disable document start requirement (optional in Kubernetes)
+  document-start: disable
+
+  # Kubernetes standard is 2-space indentation
+  # Allow consistent 2-space indent for all levels
+  indentation:
+    spaces: 2
+    indent-sequences: consistent
+
+  # Allow longer lines for descriptions and annotations
+  # Alert descriptions can be long - increase to 200
+  line-length:
+    max: 200
+    allow-non-breakable-words: true
+    allow-non-breakable-inline-mappings: true
+
+  # Allow truthy values (on, off, yes, no) - common in Kubernetes
+  truthy:
+    allowed-values: ['true', 'false', 'on', 'off', 'yes', 'no']