Publish Patch Public Operator #328
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Publish Public Operator | |
| run-name: ${{ format('Publish {0} Public Operator', inputs.release_type) }} | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| release_type: | |
| type: choice | |
| description: The type of release | |
| options: | |
| - Snapshot | |
| - Patch | |
| - Minor | |
| - Major | |
| version_number_input: | |
| description: If set, the version number will not be incremented and the given number will be used. | |
| type: string | |
| default: '' | |
| vulnerability_severity: | |
| description: The severity to fail the workflow if such vulnerability is detected. DO NOT override it unless a Jira ticket is raised. | |
| type: choice | |
| options: | |
| - CRITICAL,HIGH | |
| - CRITICAL,HIGH,MEDIUM | |
| - CRITICAL (DO NOT use if JIRA ticket not raised) | |
| force_release: | |
| description: "Create a GitHub Release for this build. 'branch' (default) releases only Patch/Minor/Major builds on the default or a release branch; 'no' skips; 'yes' forces regardless of branch. NOTE: a Patch/Minor/Major dispatch on main commits a version bump + pushes the v<version> tag to main and publishes a public-operator-only pre-release (private-operator images for that version are not built here)." | |
| type: choice | |
| default: branch | |
| options: | |
| - branch | |
| - "no" | |
| - "yes" | |
| workflow_call: | |
| inputs: | |
| release_type: | |
| description: The type of version number to return. Must be one of [Snapshot, Patch, Minor or Major] | |
| required: true | |
| type: string | |
| version_number_input: | |
| description: If set, the version number will not be incremented and the given number will be used. | |
| type: string | |
| default: '' | |
| vulnerability_severity: | |
| description: The severity to fail the workflow if such vulnerability is detected. DO NOT override it unless a Jira ticket is raised. Must be one of ['CRITICAL', 'CRITICAL,HIGH' or 'CRITICAL,HIGH,MEDIUM'] (without space in between). | |
| type: string | |
| default: 'CRITICAL,HIGH' | |
| force_release: | |
| description: Whether the shared build should publish a GitHub Release. The parent publish-all-operators passes 'no' because it creates the combined Release itself. | |
| type: string | |
| default: 'no' | |
| outputs: | |
| image_tag: | |
| description: The tag used to describe the image in Docker | |
| value: ${{ jobs.Image.outputs.image_tag }} | |
| jobs: | |
| check_major: | |
| name: Check if major release | |
| runs-on: ubuntu-latest | |
| environment: ${{ inputs.release_type == 'Major' && 'publish-major' || '' }} | |
| steps: | |
| # check_branch_and_release_type sets IS_RELEASE=true unconditionally for | |
| # force_release='yes', with no release_type check — so without this guard | |
| # a Snapshot dispatch could be forced into a GitHub Release/tag, which the | |
| # rest of this PR's safety reasoning assumes is impossible. | |
| - name: Reject Snapshot + forced release | |
| if: ${{ inputs.release_type == 'Snapshot' && inputs.force_release == 'yes' }} | |
| run: | | |
| echo "::error::force_release=yes cannot be combined with release_type=Snapshot — this would publish a Snapshot GitHub Release/tag." | |
| exit 1 | |
| - run: echo "${{ inputs.release_type == 'Major' && 'Major release approved' || 'Skipped - not a Major release' }}" | |
| image: | |
| name: Image | |
| uses: IABTechLab/uid2-shared-actions/.github/workflows/shared-publish-java-to-docker-versioned.yaml@v3 | |
| needs: check_major | |
| # Job-level (not workflow-level) so the lock covers only this job's version | |
| # bump + tag push, not the e2e/artifact-collection jobs that follow — those | |
| # don't touch pom.xml/tags and shouldn't extend the hold time. Shares the | |
| # group with publish-all-operators' `start` job. cancel-in-progress is false | |
| # so an in-flight bump/release is queued rather than killed, though only one | |
| # waiter deep: a third concurrent trigger cancels the queued second one | |
| # (GitHub Actions concurrency semantics, not specific to this workflow) — | |
| # notifyFailure's cancelled() check in publish-all-operators.yaml is the | |
| # backstop if that happens. | |
| concurrency: | |
| group: operator-version-bump-${{ github.ref }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: write | |
| security-events: write | |
| packages: write | |
| pull-requests: write | |
| id-token: write | |
| attestations: write | |
| artifact-metadata: write | |
| with: | |
| release_type: ${{ inputs.release_type }} | |
| version_number_input: ${{ inputs.version_number_input }} | |
| force_release: ${{ inputs.force_release }} # Standalone dispatch: 'branch' default releases main builds. From publish-all-operators: 'no' (parent creates the combined Release). | |
| vulnerability_severity: ${{ inputs.vulnerability_severity }} | |
| java_version: 21 | |
| merge_environment: ${{ github.ref_protected && 'ci-auto-merge' || '' }} | |
| secrets: inherit | |
| e2e: | |
| name: E2E | |
| uses: ./.github/workflows/run-e2e-tests-on-operator.yaml | |
| needs: image | |
| with: | |
| operator_image_version: ${{ needs.image.outputs.image_tag }} | |
| secrets: inherit | |
| collectPublicArtifacts: | |
| name: Collect Public Artifacts | |
| runs-on: ubuntu-latest | |
| needs: [e2e,image] | |
| steps: | |
| - name: Collect artifacts | |
| run: | | |
| mkdir -p image-details | |
| IMAGE_TAG=${{ needs.image.outputs.image_tag }} | |
| IMAGE=$(jq -n --arg img "$IMAGE_TAG" '{image_tag: $img}') | |
| echo $IMAGE > image-details/public-image-$IMAGE_TAG.json | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: public-image-${{ needs.image.outputs.image_tag }} | |
| path: image-details/ |