chore(deps): update all-ci-updates (major) #74
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Headlamp Plugin CI/CD | |
| on: | |
| push: | |
| branches: [main] | |
| tags: | |
| - 'v*' | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| test: | |
| name: Lint, Format, Test & Build | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24 | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Lint | |
| run: npx @kinvolk/headlamp-plugin lint . || npm run lint --if-present | |
| - name: Format check | |
| run: npx @kinvolk/headlamp-plugin format --check . || npm run format -- --check --if-present | |
| - name: Type check | |
| run: npx @kinvolk/headlamp-plugin tsc . || npm run tsc --if-present || echo "No type check configured" | |
| - name: Test | |
| run: npx @kinvolk/headlamp-plugin test . || npm test --if-present | |
| - name: Build | |
| run: npx @kinvolk/headlamp-plugin build . || npm run build | |
| release: | |
| name: Release to GitHub + Docker + Artifact Hub | |
| if: startsWith(github.ref, 'refs/tags/v') | |
| needs: test | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| attestations: write | |
| artifact-metadata: write | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository_owner }}/${{ github.event.repository.name }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 | |
| with: | |
| node-version: 24 | |
| cache: 'npm' | |
| - name: Install dependencies | |
| run: npm ci | |
| - name: Extract version from tag | |
| id: version | |
| run: | | |
| TAG="${{ github.ref_name }}" | |
| VERSION="${TAG#v}" | |
| echo "tag=$TAG" >> "$GITHUB_OUTPUT" | |
| echo "version=$VERSION" >> "$GITHUB_OUTPUT" | |
| - name: Build & Package | |
| id: package | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| npm version "$VERSION" --no-git-tag-version --allow-same-version | |
| npm run build | |
| npm run package | |
| TARBALL=$(ls -1 *.tar.gz | head -n1) | |
| echo "tarball=$TARBALL" >> "$GITHUB_OUTPUT" | |
| if [ -f "$TARBALL" ]; then | |
| CHECKSUM=$(sha256sum "$TARBALL" | awk '{print $1}') | |
| echo "checksum=$CHECKSUM" >> "$GITHUB_OUTPUT" | |
| echo "✅ Tarball: $TARBALL" | |
| echo "✅ Checksum: sha256:$CHECKSUM" | |
| else | |
| echo "❌ No tarball found!" | |
| exit 1 | |
| fi | |
| - name: Create GitHub Release + upload asset | |
| uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2 | |
| with: | |
| files: '*.tar.gz' | |
| tag_name: ${{ steps.version.outputs.tag }} | |
| name: Release ${{ steps.version.outputs.tag }} | |
| generate_release_notes: true | |
| - name: Publish Artifact Hub metadata branch | |
| run: | | |
| sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 | |
| sudo chmod +x /usr/local/bin/yq | |
| export VERSION="${{ steps.version.outputs.version }}" | |
| export TAG="${{ steps.version.outputs.tag }}" | |
| export TARBALL="${{ steps.package.outputs.tarball }}" | |
| export CHECKSUM="${{ steps.package.outputs.checksum }}" | |
| export ARCHIVE_URL="https://github.com/${{ github.repository }}/releases/download/${TAG}/${TARBALL}" | |
| export CREATED_AT="$(date -u +"%Y-%m-%dT%H:%M:%SZ")" | |
| WORKDIR="$(mktemp -d)" | |
| git clone --depth 1 --branch artifacthub \ | |
| "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git" \ | |
| "$WORKDIR" | |
| cd "$WORKDIR" | |
| PACKAGE_DIR="capsule" | |
| TEMPLATE_PKG="" | |
| if [ -f package.template ]; then | |
| TEMPLATE_PKG="package.template" | |
| fi | |
| if [ -z "$TEMPLATE_PKG" ] && [ -f "$PACKAGE_DIR/package.template" ]; then | |
| TEMPLATE_PKG="$PACKAGE_DIR/package.template" | |
| fi | |
| if [ -z "$TEMPLATE_PKG" ]; then | |
| TEMPLATE_PKG="$(find "$PACKAGE_DIR" -mindepth 2 -maxdepth 2 -name artifacthub-pkg.yml | sort -V | tail -n1)" | |
| fi | |
| test -n "$TEMPLATE_PKG" || { | |
| echo "❌ No artifacthub-pkg.yml template found on artifacthub branch" | |
| exit 1 | |
| } | |
| PACKAGE_VERSION_DIR="$PACKAGE_DIR/$VERSION" | |
| mkdir -p "$PACKAGE_VERSION_DIR" | |
| cp "$TEMPLATE_PKG" "$PACKAGE_VERSION_DIR/artifacthub-pkg.yml" | |
| cp "$GITHUB_WORKSPACE/README.md" "$PACKAGE_VERSION_DIR/README.md" | |
| yq -i '.version = strenv(VERSION)' "$PACKAGE_VERSION_DIR/artifacthub-pkg.yml" | |
| yq -i '.createdAt = strenv(CREATED_AT)' "$PACKAGE_VERSION_DIR/artifacthub-pkg.yml" | |
| yq -i '.annotations."headlamp/plugin/archive-url" = strenv(ARCHIVE_URL)' "$PACKAGE_VERSION_DIR/artifacthub-pkg.yml" | |
| yq -i '.annotations."headlamp/plugin/archive-checksum" = "sha256:" + strenv(CHECKSUM)' "$PACKAGE_VERSION_DIR/artifacthub-pkg.yml" | |
| rm -f artifacthub-pkg.yml | |
| rm -f "$PACKAGE_DIR/artifacthub-pkg.yml" | |
| echo "✅ Artifact Hub metadata published:" | |
| echo " version: $VERSION" | |
| echo " path: $PACKAGE_VERSION_DIR/artifacthub-pkg.yml" | |
| echo " archive-url: $ARCHIVE_URL" | |
| echo " checksum: sha256:$CHECKSUM" | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| git add -A | |
| git commit -m "chore(release): publish Artifact Hub metadata for $TAG" || echo "No changes to commit" | |
| git push origin artifacthub | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| - name: Build & push Docker image | |
| id: docker-build | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| context: . | |
| push: true | |
| tags: | | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.tag }} | |
| ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest | |
| - name: Sign container image | |
| env: | |
| DIGEST: ${{ steps.docker-build.outputs.digest }} | |
| IMAGE: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| TAG: ${{ steps.version.outputs.tag }} | |
| run: | | |
| cosign sign --yes \ | |
| "${IMAGE}:${TAG}@${DIGEST}" \ | |
| "${IMAGE}:latest@${DIGEST}" | |
| - name: Generate and push container image attestation | |
| uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1 | |
| with: | |
| subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| subject-digest: ${{ steps.docker-build.outputs.digest }} | |
| push-to-registry: true |