Release run by bleggett #181
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release Binaries and Images | |
| run-name: 'Release run by ${{ github.actor }}' | |
| on: | |
| # Release unstable from HEAD on every merge | |
| push: | |
| branches: | |
| - main | |
| # Run manually to release unstable from HEAD | |
| workflow_dispatch: | |
| inputs: | |
| protect_ref: | |
| description: 'Edera commit/branch/tag' | |
| default: '' | |
| # Nightly build from HEAD | |
| schedule: | |
| - cron: "0 9 * * *" | |
| # Official stable versioned release | |
| release: | |
| types: | |
| - published | |
| permissions: | |
| contents: read | |
| jobs: | |
| # Implementing a gate like this isn't great since the workflow will still | |
| # run on release events. Github Actions does not have a way to filter on | |
| # tags for a release event yet so we are stuck with this. The other option | |
| # was to use the push event and filter on tags but since we're using push | |
| # events to publish unstable tags on main, it is cleaner to use release | |
| # events to trigger a true release of stable artifacts. | |
| release-gate: | |
| name: 'Check if this is the correct GitHub release event' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| outputs: | |
| should_run: ${{ steps.check.outputs.should_run }} | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2 | |
| with: | |
| egress-policy: audit | |
| - name: 'Check event' | |
| id: check | |
| run: | | |
| echo "Since GitHub doesn't have a way to filter for specific tags in the release event we need to implement this dumb check" | |
| run=true | |
| if [[ '${{ github.event_name }}' == 'release' ]] && [[ '${{ github.ref_name }}' =~ 'chart-*' ]]; then | |
| run=false | |
| fi | |
| echo "Workflow should run: ${run}" | |
| echo "should_run=${run}" >> ${GITHUB_OUTPUT} | |
| oci: | |
| name: 'Build and publish ${{ matrix.component }} images' | |
| # Check if this is the proper release event. | |
| # TODO: remove this when actions has a better answer | |
| if: ${{ needs.release-gate.outputs.should_run == 'true' }} | |
| needs: [release-gate] | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| component: | |
| - edera-check | |
| permissions: | |
| contents: read | |
| id-token: write | |
| packages: write | |
| steps: | |
| - name: 'Harden runner' | |
| uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2 | |
| with: | |
| egress-policy: audit | |
| - name: 'Checkout repository' | |
| uses: actions/checkout@6b42224f41ee5dfe5395e27c8b2746f1f9955030 # v4.2.0 | |
| with: | |
| submodules: recursive | |
| persist-credentials: false | |
| - name: 'Setup docker buildx' | |
| uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 | |
| with: | |
| cache-binary: false | |
| - name: 'Login to ghcr' | |
| uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0 | |
| with: | |
| registry: ghcr.io | |
| username: '${{ github.actor }}' | |
| password: '${{ github.token }}' | |
| - name: Docker meta | |
| uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0 | |
| id: meta | |
| with: | |
| images: | | |
| ghcr.io/edera-dev/${{ matrix.component }} | |
| tags: | | |
| # Tag with branch on push | |
| type=ref,event=branch | |
| # Tag with short sha on all events | |
| type=sha,prefix= | |
| # Tag version and stable on tag push | |
| type=semver,pattern={{raw}} | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern=stable | |
| # Tag nightly on schedule event | |
| type=schedule,pattern=nightly | |
| - name: 'Docker build and push ${{ matrix.component }}' | |
| uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 | |
| id: push | |
| with: | |
| file: images/Containerfile.edera-check | |
| platforms: linux/amd64 | |
| tags: '${{ steps.meta.outputs.tags }}' | |
| push: true | |
| - name: 'Install cosign' | |
| uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 | |
| - name: 'Cosign sign all images' | |
| shell: bash | |
| run: | | |
| images="" | |
| for tag in ${TAGS}; do | |
| pullstring="${tag}@${DIGEST}" | |
| echo "Signing ${pullstring}" | |
| cosign sign --yes "${pullstring}" | |
| done | |
| env: | |
| TAGS: '${{ steps.meta.outputs.tags }}' | |
| DIGEST: '${{ steps.push.outputs.digest }}' |