Remove binary artifacts from git for OpenSSF Scorecard Binary-Artifacts check

.github/workflows/ci-network-tests.yml

@@ -45,6 +45,17 @@ jobs:
       - name: Compile libbpf
         run: ./.github/workflows/install-libbpf.sh
 
+      - name: Install bpftool
+        run: ./.github/workflows/install-bpftool.sh
+
+      - name: Generate vmlinux.h
+        run: make -C BPF kernel_headers
+        working-directory: KubeArmor
+
+      - name: Generate BPF files
+        run: go generate ./...
+        working-directory: KubeArmor
+
       - name: Setup a Kubernetes environment
         run: ./.github/workflows/install-k3s.sh
 

.github/workflows/ci-operator-release.yaml

@@ -90,6 +90,23 @@ jobs:
             core.setOutput('tag', tag);
             console.log(`Creating operator release with tag: ${tag}`);
 
+      - name: Install LLVM/Clang
+        run: ./.github/workflows/install-llvm.sh
+
+      - name: Install libbpf headers
+        run: sudo apt-get update && sudo apt-get install -y libbpf-dev
+
+      - name: Install bpftool
+        run: ./.github/workflows/install-bpftool.sh
+
+      - name: Generate vmlinux.h
+        run: make -C BPF kernel_headers
+        working-directory: KubeArmor
+
+      - name: Generate BPF files
+        run: go generate ./...
+        working-directory: KubeArmor
+
       - name: Build & Push KubeArmor Operator
         working-directory: ./pkg/KubeArmorOperator
         run: PLATFORM=$PLATFORM make docker-buildx TAG=${{ steps.vars.outputs.tag }} BUILD_MODE=--push

.github/workflows/ci-operator-ubi-release.yaml

@@ -30,7 +30,7 @@ env:
 jobs:
   kubearmor-operator-release:
     name: Build & Push KubeArmor Operator
-    if: github.repository == 'kubearmor/kubearmor'     
+    if: github.repository == 'kubearmor/kubearmor'
     runs-on: ubuntu-22.04
     permissions:
       id-token: write
@@ -40,7 +40,7 @@ jobs:
 
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version-file: 'KubeArmor/go.mod'
+          go-version-file: "KubeArmor/go.mod"
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2
@@ -54,15 +54,15 @@ jobs:
         uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_AUTHTOK }} 
+          password: ${{ secrets.DOCKER_AUTHTOK }}
 
       # - name: Set up AWS Credentials
       #   uses: aws-actions/configure-aws-credentials@v6
       #   with:
       #     aws-access-key-id: ${{ secrets.AWS_ECR_ACCESS_ID }}
       #     aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_ID }}
       #     aws-region: us-east-1
-  
+
       # - name: Login to AWS ECR
       #   run: |
       #     aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws/k9v9d5v2
@@ -90,11 +90,27 @@ jobs:
             core.setOutput('tag', tag);
             console.log(`Creating operator release with tag: ${tag}`);
 
+      - name: Install LLVM/Clang
+        run: ./.github/workflows/install-llvm.sh
+
+      - name: Install libbpf headers
+        run: sudo apt-get update && sudo apt-get install -y libbpf-dev
+
+      - name: Install bpftool
+        run: ./.github/workflows/install-bpftool.sh
+
+      - name: Generate vmlinux.h
+        run: make -C BPF kernel_headers
+        working-directory: KubeArmor
+
+      - name: Generate BPF files
+        run: go generate ./...
+        working-directory: KubeArmor
+
       - name: Build & Push KubeArmor Operator
         working-directory: ./pkg/KubeArmorOperator
         run: PLATFORM=$PLATFORM make docker-buildx-ubi TAG=${{ steps.vars.outputs.tag }} BUILD_MODE=--push
 
-
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # main
 
@@ -110,25 +126,24 @@ jobs:
           cosign sign -r kubearmor/kubearmor-operator-ubi@${{ steps.digest.outputs.operatordigest }} --yes
           cosign sign -r kubearmor/kubearmor-snitch-ubi@${{ steps.digest.outputs.snitchdigest }} --yes
 
-
       - name: Install regctl
         run: |
           curl -L https://github.com/regclient/regclient/releases/latest/download/regctl-linux-amd64 -o regctl
           chmod 755 regctl
           mv regctl /usr/local/bin
-  
+
       - name: Check install
         run: regctl version
-        
+
       # - name: Generate the tag version of Operator and Snitch in ECR
       #   run: |
       #     regctl image copy kubearmor/kubearmor-operator-ubi:${{ steps.vars.outputs.tag }} public.ecr.aws/k9v9d5v2/kubearmor/kubearmor-operator-ubi:${{ steps.vars.outputs.tag }} --digest-tags
       #     regctl image copy kubearmor/kubearmor-snitch-ubi:${{ steps.vars.outputs.tag }} public.ecr.aws/k9v9d5v2/kubearmor/kubearmor-snitch-ubi:${{ steps.vars.outputs.tag }} --digest-tags
-          
+
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: main
-      
+
       - name: Get and Match Stable Tag
         id: stable
         run: |
@@ -152,4 +167,3 @@ jobs:
       #     STABLE_VERSION=`cat STABLE-RELEASE`
       #     regctl image copy kubearmor/kubearmor-operator-ubi:$STABLE_VERSION public.ecr.aws/k9v9d5v2/kubearmor/kubearmor-operator-ubi:stable --digest-tags
       #     regctl image copy kubearmor/kubearmor-snitch-ubi:$STABLE_VERSION public.ecr.aws/k9v9d5v2/kubearmor/kubearmor-snitch-ubi:stable --digest-tags
-

.github/workflows/ci-test-ebpf.yml

@@ -16,15 +16,15 @@ jobs:
 
       - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          go-version-file: 'KubeArmor/go.mod'
+          go-version-file: "KubeArmor/go.mod"
 
       - name: Install necessary dependencies
         run: |
           sudo apt-get update
           sudo apt-get -y install build-essential libelf-dev pkg-config net-tools linux-headers-$(uname -r) linux-tools-$(uname -r) libbpf-dev unzip protobuf-compiler
-          
-          go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
-          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
+
+          go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.11
+          go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.6.1
 
           export arch=$(uname -m)
           export bpftool_version=v7.2.0
@@ -49,4 +49,4 @@ jobs:
 
       - name: Load eBPF Bytecode
         working-directory: KubeArmor/monitor
-        run: sudo -E go run ci_load.go
+        run: sudo -E go run ci_load.go

.github/workflows/ci-test-ginkgo.yml

@@ -42,6 +42,17 @@ jobs:
       - name: Compile libbpf
         run: ./.github/workflows/install-libbpf.sh
 
+      - name: Install bpftool
+        run: ./.github/workflows/install-bpftool.sh
+
+      - name: Generate vmlinux.h
+        run: make -C BPF kernel_headers
+        working-directory: KubeArmor
+
+      - name: Generate BPF files
+        run: go generate ./...
+        working-directory: KubeArmor
+
       - name: Setup a Kubernetes environment
         run: ./.github/workflows/install-k3s.sh
 

.github/workflows/ci-test-go.yml

@@ -57,6 +57,24 @@ jobs:
         with:
           go-version-file: "KubeArmor/go.mod"
 
+      - name: Install LLVM/Clang
+        run: ./.github/workflows/install-llvm.sh
+
+      - name: Install libbpf headers
+        run: sudo apt-get update && sudo apt-get install -y libbpf-dev
+
+      # Install BPF tool
+      - name: Install bpftool
+        run: ./.github/workflows/install-bpftool.sh
+
+      - name: Generate vmlinux.h
+        run: make -C BPF kernel_headers
+        working-directory: KubeArmor
+
+      - name: Generate BPF files
+        run: go generate ./...
+        working-directory: KubeArmor
+
       - name: Run Gosec Security Scanner
         run: make gosec
         working-directory: KubeArmor
@@ -70,6 +88,23 @@ jobs:
         with:
           go-version-file: "KubeArmor/go.mod"
 
+      - name: Install LLVM/Clang
+        run: ./.github/workflows/install-llvm.sh
+
+      - name: Install libbpf headers
+        run: sudo apt-get update && sudo apt-get install -y libbpf-dev
+
+      - name: Install bpftool
+        run: ./.github/workflows/install-bpftool.sh
+
+      - name: Generate vmlinux.h
+        run: make -C BPF kernel_headers
+        working-directory: KubeArmor
+
+      - name: Generate BPF files
+        run: go generate ./...
+        working-directory: KubeArmor
+
       - name: Run govulncheck
         run: make scan
         working-directory: KubeArmor
@@ -83,6 +118,23 @@ jobs:
         with:
           go-version-file: "KubeArmor/go.mod"
 
+      - name: Install LLVM/Clang
+        run: ./.github/workflows/install-llvm.sh
+
+      - name: Install libbpf headers
+        run: sudo apt-get update && sudo apt-get install -y libbpf-dev
+
+      - name: Install bpftool
+        run: ./.github/workflows/install-bpftool.sh
+
+      - name: Generate vmlinux.h
+        run: make -C BPF kernel_headers
+        working-directory: KubeArmor
+
+      - name: Generate BPF files
+        run: go generate ./...
+        working-directory: KubeArmor
+
       - name: Run go test on the KubeArmor/KubeArmor directory
         run: go test ./...
         working-directory: KubeArmor

.github/workflows/ci-test-lvh-matrix.yml

@@ -50,6 +50,23 @@ jobs:
         with:
           go-version-file: 'KubeArmor/go.mod'
 
+      - name: Install the latest LLVM toolchain
+        run: ./.github/workflows/install-llvm.sh
+
+      - name: Install libbpf headers
+        run: sudo apt-get update && sudo apt-get install -y libbpf-dev
+
+      - name: Install bpftool
+        run: ./.github/workflows/install-bpftool.sh
+
+      - name: Generate vmlinux.h
+        run: make -C BPF kernel_headers
+        working-directory: KubeArmor
+
+      - name: Generate BPF files
+        run: go generate ./...
+        working-directory: KubeArmor
+
       - name: Build system monitor loader binary
         working-directory: KubeArmor/monitor
         run: go build ci_load.go

.github/workflows/ci-test-operator.yaml

@@ -22,5 +22,25 @@ jobs:
           # working-directory only takes effect for "run"
           go-version-file: 'KubeArmor/go.mod'
 
+      - name: Install LLVM/Clang
+        run: ./.github/workflows/install-llvm.sh
+        working-directory: .
+
+      - name: Install libbpf headers
+        run: sudo apt-get update && sudo apt-get install -y libbpf-dev
+        working-directory: .
+
+      - name: Install bpftool
+        run: ./.github/workflows/install-bpftool.sh
+        working-directory: .
+
+      - name: Generate vmlinux.h
+        run: make -C BPF kernel_headers
+        working-directory: KubeArmor
+
+      - name: Generate BPF files
+        run: go generate ./...
+        working-directory: KubeArmor
+
       - name: Build kubearmor operator
         run: make docker-build TAG=latest

.github/workflows/ci-test-ubi-image.yml

@@ -44,6 +44,17 @@ jobs:
       - name: Compile libbpf
         run: ./.github/workflows/install-libbpf.sh
 
+      - name: Install bpftool
+        run: ./.github/workflows/install-bpftool.sh
+
+      - name: Generate vmlinux.h
+        run: make -C BPF kernel_headers
+        working-directory: KubeArmor
+
+      - name: Generate BPF files
+        run: go generate ./...
+        working-directory: KubeArmor
+
       - name: Setup a Kubernetes environment
         run: ./.github/workflows/install-k3s.sh
 

.github/workflows/ci-trivy-scan-ubi.yaml

@@ -56,6 +56,17 @@ jobs:
       - name: Compile libbpf
         run: ./.github/workflows/install-libbpf.sh
 
+      - name: Install bpftool
+        run: ./.github/workflows/install-bpftool.sh
+
+      - name: Generate vmlinux.h
+        run: make -C BPF kernel_headers
+        working-directory: KubeArmor
+
+      - name: Generate BPF files
+        run: go generate ./...
+        working-directory: KubeArmor
+
       - name: Set up Docker
         uses: docker/setup-docker-action@e43656e248c0bd0647d3f5c195d116aacf6fcaf4 # v4
         with:

.github/workflows/ci-trivy-scan.yaml

@@ -56,6 +56,17 @@ jobs:
       - name: Compile libbpf
         run: ./.github/workflows/install-libbpf.sh
 
+      - name: Install bpftool
+        run: ./.github/workflows/install-bpftool.sh
+
+      - name: Generate vmlinux.h
+        run: make -C BPF kernel_headers
+        working-directory: KubeArmor
+
+      - name: Generate BPF files
+        run: go generate ./...
+        working-directory: KubeArmor
+
       - name: Set up Docker
         uses: docker/setup-docker-action@e43656e248c0bd0647d3f5c195d116aacf6fcaf4 # v4
         with:

.github/workflows/install-bpftool.sh

@@ -0,0 +1,18 @@
+#!/bin/bash
+# SPDX-License-Identifier: Apache-2.0
+# Copyright 2026 Authors of KubeArmor
+set -euo pipefail
+
+BPFTOOL_VERSION="v7.3.0"
+arch=$(uname -m)
+if [[ "$arch" == "aarch64" ]]; then
+  arch=arm64
+elif [[ "$arch" == "x86_64" ]]; then
+  arch=amd64
+fi
+
+curl -LO "https://github.com/libbpf/bpftool/releases/download/${BPFTOOL_VERSION}/bpftool-${BPFTOOL_VERSION}-${arch}.tar.gz"
+sudo tar -xzf "bpftool-${BPFTOOL_VERSION}-${arch}.tar.gz" -C /usr/local/bin
+sudo chmod +x /usr/local/bin/bpftool
+rm "bpftool-${BPFTOOL_VERSION}-${arch}.tar.gz"
+bpftool version

.github/workflows/install-libbpf.sh

@@ -4,3 +4,4 @@
 
 cd KubeArmor/BPF
 make -C libbpf/src
+sudo make -C libbpf/src install_headers PREFIX=/usr