Skip to content

Commit a6abdc1

Browse files
matheuscscpmatheuscscp
committed
Add reusable controller-release workflow
Signed-off-by: Matheus Pimenta <[email protected]>
1 parent 0a51309 commit a6abdc1

File tree

2 files changed

+198
-0
lines changed

2 files changed

+198
-0
lines changed

‎.github/workflows/controller-release.yaml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
name: controller-release
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
controller:
7+
description: 'controller name'
8+
required: true
9+
type: string
10+
release-candidate-prefix:
11+
description: 'release candidate image tag prefix'
12+
required: true
13+
type: string
14+
secrets:
15+
github-token:
16+
description: 'GitHub token (for pushing to GHCR and creating GitHub releases)'
17+
required: true
18+
dockerhub-token:
19+
description: 'Docker Hub token'
20+
required: true
21+
outputs:
22+
hashes:
23+
description: 'Release artifacts digests compatible with SLSA'
24+
value: ${{ jobs.release.outputs.hashes }}
25+
image-url:
26+
description: 'Published image URL'
27+
value: ${{ jobs.release.outputs.image-url }}
28+
image-digest:
29+
description: 'Published image digest'
30+
value: ${{ jobs.release.outputs.image-digest }}
31+
32+
jobs:
33+
release:
34+
outputs:
35+
hashes: ${{ steps.slsa.outputs.hashes }}
36+
image-url: ${{ steps.slsa.outputs.image_url }}
37+
image-digest: ${{ steps.slsa.outputs.image_digest }}
38+
runs-on: ubuntu-latest
39+
permissions:
40+
contents: write # for creating the GitHub release.
41+
id-token: write # for creating OIDC tokens for signing.
42+
packages: write # for pushing and signing container images.
43+
steps:
44+
- name: Checkout
45+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
46+
- name: Setup Kustomize
47+
uses: fluxcd/pkg/actions/kustomize@main
48+
- name: Prepare
49+
id: prep
50+
env:
51+
GIT_REF: ${{ github.ref }}
52+
GIT_SHA: ${{ github.sha }}
53+
RELEASE_CANDIDATE_PREFIX: ${{ inputs.release-candidate-prefix }}
54+
run: |
55+
VERSION="${RELEASE_CANDIDATE_PREFIX}-${GIT_SHA::8}"
56+
if [[ $GIT_REF == refs/tags/* ]]; then
57+
VERSION=${GIT_REF/refs\/tags\//}
58+
fi
59+
echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
60+
echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
61+
- name: Setup QEMU
62+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
63+
- name: Setup Docker Buildx
64+
id: buildx
65+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
66+
- name: Login to GitHub Container Registry
67+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
68+
with:
69+
registry: ghcr.io
70+
username: fluxcdbot # not necessary for ghcr.io
71+
password: ${{ secrets.github-token }}
72+
- name: Login to Docker Hub
73+
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
74+
with:
75+
username: ${{ github.repository_owner == 'fluxcd' && 'fluxcdbot' || github.repository_owner }}
76+
password: ${{ secrets.dockerhub-token }}
77+
- name: Generate images meta
78+
id: meta
79+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
80+
with:
81+
images: |
82+
${{ github.repository_owner }}/${{ inputs.controller }}
83+
ghcr.io/${{ github.repository_owner }}/${{ inputs.controller }}
84+
tags: |
85+
type=raw,value=${{ steps.prep.outputs.VERSION }}
86+
- name: Publish images
87+
id: build-push
88+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
89+
with:
90+
sbom: true
91+
provenance: true
92+
push: true
93+
builder: ${{ steps.buildx.outputs.name }}
94+
context: .
95+
file: ./Dockerfile
96+
platforms: linux/amd64,linux/arm/v7,linux/arm64
97+
tags: ${{ steps.meta.outputs.tags }}
98+
labels: ${{ steps.meta.outputs.labels }}
99+
- uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
100+
- name: Sign images
101+
env:
102+
COSIGN_EXPERIMENTAL: 1
103+
CONTROLLER: ${{ inputs.controller }}
104+
DIGEST: ${{ steps.build-push.outputs.digest }}
105+
REPOSITORY_OWNER: ${{ github.repository_owner }}
106+
run: |
107+
cosign sign --yes ${REPOSITORY_OWNER}/${CONTROLLER}@${DIGEST}
108+
cosign sign --yes ghcr.io/${REPOSITORY_OWNER}/${CONTROLLER}@${DIGEST}
109+
- name: Generate release artifacts
110+
if: startsWith(github.ref, 'refs/tags/v')
111+
env:
112+
CONTROLLER: ${{ inputs.controller }}
113+
run: |
114+
mkdir -p config/release
115+
kustomize build ./config/crd > ./config/release/${CONTROLLER}.crds.yaml
116+
kustomize build ./config/manager > ./config/release/${CONTROLLER}.deployment.yaml
117+
- uses: anchore/sbom-action/download-syft@da167eac915b4e86f08b264dbdbc867b61be6f0c # v0.20.5
118+
- name: Create release and SBOM
119+
id: run-goreleaser
120+
if: startsWith(github.ref, 'refs/tags/v')
121+
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
122+
with:
123+
version: latest
124+
args: release --clean --skip=validate
125+
env:
126+
GITHUB_TOKEN: ${{ secrets.github-token }}
127+
- name: Generate SLSA metadata
128+
id: slsa
129+
env:
130+
ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
131+
CONTROLLER: ${{ inputs.controller }}
132+
VERSION: ${{ steps.prep.outputs.version }}
133+
BUILD_DIGEST: ${{ steps.build-push.outputs.digest }}
134+
REPOSITORY_OWNER: ${{ github.repository_owner }}
135+
run: |
136+
hashes=$(echo $ARTIFACTS | jq --raw-output '.[] | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {digest} + {name} | join(" ") | sub("^sha256:";"")' | base64 -w0)
137+
echo "hashes=$hashes" >> $GITHUB_OUTPUT
138+
139+
image_url=${REPOSITORY_OWNER}/${CONTROLLER}:${VERSION}
140+
echo "image_url=$image_url" >> $GITHUB_OUTPUT
141+
142+
image_digest=${BUILD_DIGEST}
143+
echo "image_digest=$image_digest" >> $GITHUB_OUTPUT

‎README.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,61 @@ This repository contains reusable GitHub Workflows shared across the Flux contro
77

88
## Workflows
99

10+
### Release Flux controllers
11+
12+
The [controller-release](.github/workflows/controller-release.yaml) workflow automates the release of
13+
Flux controllers by building and publishing container images to GitHub Container Registry (GHCR) and Docker Hub,
14+
and creating a GitHub release with the changelog.
15+
16+
Example usage:
17+
18+
```yaml
19+
name: release
20+
21+
on:
22+
push:
23+
tags:
24+
- 'v*'
25+
workflow_dispatch:
26+
inputs:
27+
tag:
28+
description: 'image tag prefix'
29+
default: 'rc'
30+
required: false
31+
32+
jobs:
33+
release:
34+
permissions:
35+
contents: write # for creating the GitHub release.
36+
id-token: write # for creating OIDC tokens for signing.
37+
packages: write # for pushing and signing container images.
38+
uses: fluxcd/gha-workflows/.github/workflows/[email protected]
39+
with:
40+
controller: ${{ github.event.repository.name }}
41+
release-candidate-prefix: ${{ github.event.inputs.tag }}
42+
secrets:
43+
github-token: ${{ secrets.GITHUB_TOKEN }}
44+
dockerhub-token: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
45+
```
46+
47+
3rd-party actions used:
48+
49+
- [actions/checkout](https://github.com/actions/checkout)
50+
- [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action)
51+
- [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action)
52+
- [docker/login-action](https://github.com/docker/login-action)
53+
- [docker/metadata-action](https://github.com/docker/metadata-action)
54+
- [docker/build-push-action](https://github.com/docker/build-push-action)
55+
- [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer)
56+
- [anchore/sbom-action](https://github.com/anchore/sbom-action)
57+
- [goreleaser/goreleaser-action](https://github.com/goreleaser/goreleaser-action)
58+
59+
Outputs:
60+
61+
- `hashes`: Release artifacts digests compatible with SLSA
62+
- `image-url`: Published image URL
63+
- `image-digest`: Published image digest
64+
1065
### Backport to Release Branches
1166

1267
The [backport](.github/workflows/backport.yaml) workflow automates the backporting of merged pull

0 commit comments

Comments
 (0)