161 lines
6.3 KiB
YAML
161 lines
6.3 KiB
YAML
name: release
|
|
on:
|
|
push:
|
|
tags:
|
|
- 'v*'
|
|
workflow_dispatch:
|
|
inputs:
|
|
tag:
|
|
description: 'image tag prefix'
|
|
default: 'preview'
|
|
required: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
CONTROLLER: ${{ github.event.repository.name }}
|
|
|
|
jobs:
|
|
release:
|
|
outputs:
|
|
hashes: ${{ steps.slsa.outputs.hashes }}
|
|
image_url: ${{ steps.slsa.outputs.image_url }}
|
|
image_digest: ${{ steps.slsa.outputs.image_digest }}
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: write # for creating the GitHub release.
|
|
id-token: write # for creating OIDC tokens for signing.
|
|
packages: write # for pushing and signing container images.
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
|
|
- name: Setup Kustomize
|
|
uses: fluxcd/pkg/actions/kustomize@main
|
|
- name: Prepare
|
|
id: prep
|
|
run: |
|
|
VERSION="${{ github.event.inputs.tag }}-${GITHUB_SHA::8}"
|
|
if [[ $GITHUB_REF == refs/tags/* ]]; then
|
|
VERSION=${GITHUB_REF/refs\/tags\//}
|
|
fi
|
|
echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
|
|
echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
|
|
- name: Setup QEMU
|
|
uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0
|
|
- name: Setup Docker Buildx
|
|
id: buildx
|
|
uses: docker/setup-buildx-action@d70bba72b1f3fd22344832f00baa16ece964efeb # v3.3.0
|
|
- name: Login to GitHub Container Registry
|
|
uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: fluxcdbot
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
|
- name: Login to Docker Hub
|
|
uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
|
|
with:
|
|
username: fluxcdbot
|
|
password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
|
|
- name: Generate images meta
|
|
id: meta
|
|
uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
|
|
with:
|
|
images: |
|
|
fluxcd/${{ env.CONTROLLER }}
|
|
ghcr.io/fluxcd/${{ env.CONTROLLER }}
|
|
tags: |
|
|
type=raw,value=${{ steps.prep.outputs.VERSION }}
|
|
- name: Publish images
|
|
id: build-push
|
|
uses: docker/build-push-action@2cdde995de11925a030ce8070c3d77a52ffcf1c0 # v5.3.0
|
|
with:
|
|
sbom: true
|
|
provenance: true
|
|
push: true
|
|
builder: ${{ steps.buildx.outputs.name }}
|
|
context: .
|
|
file: ./Dockerfile
|
|
platforms: linux/amd64,linux/arm/v7,linux/arm64
|
|
tags: ${{ steps.meta.outputs.tags }}
|
|
labels: ${{ steps.meta.outputs.labels }}
|
|
- uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
|
|
- name: Sign images
|
|
env:
|
|
COSIGN_EXPERIMENTAL: 1
|
|
run: |
|
|
cosign sign --yes fluxcd/${{ env.CONTROLLER }}@${{ steps.build-push.outputs.digest }}
|
|
cosign sign --yes ghcr.io/fluxcd/${{ env.CONTROLLER }}@${{ steps.build-push.outputs.digest }}
|
|
- name: Generate release artifacts
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
run: |
|
|
mkdir -p config/release
|
|
kustomize build ./config/crd > ./config/release/${{ env.CONTROLLER }}.crds.yaml
|
|
kustomize build ./config/manager > ./config/release/${{ env.CONTROLLER }}.deployment.yaml
|
|
- uses: anchore/sbom-action/download-syft@ab5d7b5f48981941c4c5d6bf33aeb98fe3bae38c # v0.15.10
|
|
- name: Create release and SBOM
|
|
id: run-goreleaser
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
|
|
with:
|
|
version: latest
|
|
args: release --clean --skip-validate
|
|
env:
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
- name: Generate SLSA metadata
|
|
id: slsa
|
|
env:
|
|
ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
|
|
run: |
|
|
hashes=$(echo -E $ARTIFACTS | jq --raw-output '.[] | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {digest} + {name} | join(" ") | sub("^sha256:";"")' | base64 -w0)
|
|
echo "hashes=$hashes" >> $GITHUB_OUTPUT
|
|
|
|
image_url=fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.version }}
|
|
echo "image_url=$image_url" >> $GITHUB_OUTPUT
|
|
|
|
image_digest=${{ steps.build-push.outputs.digest }}
|
|
echo "image_digest=$image_digest" >> $GITHUB_OUTPUT
|
|
|
|
release-provenance:
|
|
needs: [release]
|
|
permissions:
|
|
actions: read # for detecting the Github Actions environment.
|
|
id-token: write # for creating OIDC tokens for signing.
|
|
contents: write # for uploading attestations to GitHub releases.
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
|
|
with:
|
|
provenance-name: "provenance.intoto.jsonl"
|
|
base64-subjects: "${{ needs.release.outputs.hashes }}"
|
|
upload-assets: true
|
|
|
|
dockerhub-provenance:
|
|
needs: [release]
|
|
permissions:
|
|
actions: read # for detecting the Github Actions environment.
|
|
id-token: write # for creating OIDC tokens for signing.
|
|
packages: write # for uploading attestations.
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
|
|
with:
|
|
image: ${{ needs.release.outputs.image_url }}
|
|
digest: ${{ needs.release.outputs.image_digest }}
|
|
registry-username: fluxcdbot
|
|
secrets:
|
|
registry-password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
|
|
|
|
ghcr-provenance:
|
|
needs: [release]
|
|
permissions:
|
|
actions: read # for detecting the Github Actions environment.
|
|
id-token: write # for creating OIDC tokens for signing.
|
|
packages: write # for uploading attestations.
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
|
|
with:
|
|
image: ghcr.io/${{ needs.release.outputs.image_url }}
|
|
digest: ${{ needs.release.outputs.image_digest }}
|
|
registry-username: fluxcdbot
|
|
secrets:
|
|
registry-password: ${{ secrets.GHCR_TOKEN }}
|