Skip to content

Commit 7845d41

Browse files
nscuronscuro
authored
Merge pull request #157 from k3rnelpan1c-dev/fix/release-workflow
refactor: split of publish workflow
2 parents b74cadd + f580e2a commit 7845d41

File tree

5 files changed

+106
-70
lines changed

5 files changed

+106
-70
lines changed

‎.github/workflows/_meta-build.yaml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,11 @@ on:
1616
required: false
1717
default: "snapshot"
1818
description: "Set the version that should be set/used as tag for the container image"
19+
publish-container:
20+
type: boolean
21+
required: false
22+
default: false
23+
description: "Set if the container image gets publish and scan once its build"
1924
secrets:
2025
registry-0-usr:
2126
required: true
@@ -81,7 +86,7 @@ jobs:
8186

8287
- name: Login to Docker.io
8388
uses: docker/[email protected]
84-
if: ${{ github.ref == 'refs/heads/master' }}
89+
if: ${{ inputs.publish-container }}
8590
with:
8691
registry: docker.io
8792
username: ${{ secrets.registry-0-usr }}
@@ -105,12 +110,12 @@ jobs:
105110
APP_VERSION=${{ inputs.app-version }}
106111
COMMIT_SHA=${{ github.sha }}
107112
platforms: linux/amd64,linux/arm64
108-
push: ${{ github.ref == 'refs/heads/master' }}
113+
push: ${{ inputs.publish-container }}
109114
context: .
110115
file: docker/Dockerfile.alpine
111116

112117
- name: Run Trivy Vulnerability Scanner
113-
if: ${{ github.ref == 'refs/heads/master' }}
118+
if: ${{ inputs.publish-container }}
114119
uses: aquasecurity/[email protected]
115120
with:
116121
image-ref: docker.io/dependencytrack/frontend:${{ inputs.app-version }}
@@ -120,7 +125,7 @@ jobs:
120125
vuln-type: 'os'
121126

122127
- name: Upload Trivy Scan Results to GitHub Security Tab
123-
if: ${{ github.ref == 'refs/heads/master' }}
128+
if: ${{ inputs.publish-container }}
124129
uses: github/codeql-action/upload-sarif@v2
125130
with:
126131
sarif_file: 'trivy-results.sarif'

‎.github/workflows/ci-build.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ jobs:
1616
node-versions: '["14", "16"]'
1717
node-version-package: '16'
1818
app-version: 'snapshot'
19+
publish-container: ${{ github.ref == 'refs/heads/master' }}
1920
secrets:
2021
registry-0-usr: ${{ secrets.HUB_USERNAME }}
2122
registry-0-psw: ${{ secrets.HUB_ACCESS_TOKEN }}

‎.github/workflows/ci-publish.yaml‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
name: Publish CI
2+
3+
on:
4+
release:
5+
types:
6+
- released
7+
workflow_dispatch:
8+
9+
jobs:
10+
read-version:
11+
runs-on: ubuntu-latest
12+
outputs:
13+
version: ${{ steps.parse.outputs.version }}
14+
steps:
15+
- name: Assert ref type
16+
run: |-
17+
if [[ "$GITHUB_REF_TYPE" != "tag" ]]; then
18+
echo "::error::Publishing is only supported for tags!"
19+
exit 1
20+
fi
21+
22+
- name: Checkout Repository
23+
uses: actions/[email protected]
24+
25+
- name: Parse Version from package.json
26+
id: parse
27+
run: |-
28+
VERSION=`jq -r '.version' package.json`
29+
echo "::set-output name=version::${VERSION}"
30+
31+
call-build:
32+
needs:
33+
- read-version
34+
uses: ./.github/workflows/_meta-build.yaml
35+
with:
36+
app-version: ${{ needs.read-version.outputs.version }}
37+
publish-container: true
38+
secrets:
39+
registry-0-usr: ${{ secrets.HUB_USERNAME }}
40+
registry-0-psw: ${{ secrets.HUB_ACCESS_TOKEN }}
41+
42+
update-github-release:
43+
runs-on: ubuntu-latest
44+
needs:
45+
- read-version
46+
- call-build
47+
steps:
48+
- name: Checkout Repository
49+
uses: actions/[email protected]
50+
51+
- name: Download Artifacts
52+
uses: actions/[email protected]
53+
with:
54+
name: assembled-frontend-node16
55+
56+
- name: Create Checksums
57+
run: |-
58+
zip -qr frontend-dist.zip dist/*
59+
60+
echo "# SHA1" >> checksums.txt
61+
sha1sum frontend-dist.zip >> checksums.txt
62+
echo "# SHA256" >> checksums.txt
63+
sha256sum frontend-dist.zip >> checksums.txt
64+
echo "# SHA512" >> checksums.txt
65+
sha512sum frontend-dist.zip >> checksums.txt
66+
67+
- name: Update Release
68+
env:
69+
# or change it to a custom PAT that should be credited for the release
70+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
71+
run: |-
72+
cat << EOF >> .github/default-release-notes.md
73+
\`\`\`text
74+
$(cat checksums.txt)
75+
\`\`\`
76+
EOF
77+
78+
gh release edit ${{ needs.read-version.outputs.version }} \
79+
--notes-file ".github/default-release-notes.md"
80+
81+
gh release upload ${{ needs.read-version.outputs.version }} \
82+
--clobber \
83+
frontend-dist.zip \
84+
checksums.txt \
85+
bom.xml bom.json

‎.github/workflows/ci-release.yaml‎

Lines changed: 10 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,6 @@ on:
1919
jobs:
2020
prepare-release:
2121
runs-on: ubuntu-latest
22-
outputs:
23-
version: ${{ steps.variables.outputs.version }}
2422
steps:
2523
- name: Checkout Repository
2624
uses: actions/[email protected]
@@ -31,82 +29,29 @@ jobs:
3129
node-version: '16'
3230
cache: 'npm'
3331

34-
- name: Setup Environment
35-
id: variables
32+
- name: Bump version and tag via NodeJS
33+
# if you use a bot-user to create the release in the next step
34+
# then it might be a solid idea to change the git config values below to the bot-user's name + email
3635
run: |-
3736
git config user.name "github-actions[bot]"
3837
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
3938
4039
npm version ${{ github.event.inputs.version-to-bump }} -m "prepare-release: set version to %s"
4140
42-
git push --tags origin "HEAD:refs/heads/master"
43-
APP_VERSION=`jq -r '.version' package.json`
44-
echo "::set-output name=version::${APP_VERSION}"
45-
46-
call-build:
47-
needs:
48-
- prepare-release
49-
uses: ./.github/workflows/_meta-build.yaml
50-
with:
51-
app-version: ${{ needs.prepare-release.outputs.version }}
52-
secrets:
53-
registry-0-usr: ${{ secrets.HUB_USERNAME }}
54-
registry-0-psw: ${{ secrets.HUB_ACCESS_TOKEN }}
55-
56-
create-release:
57-
runs-on: ubuntu-latest
58-
needs:
59-
- prepare-release
60-
- call-build
61-
62-
env:
63-
VERSION: ${{ needs.prepare-release.outputs.version }}
64-
65-
steps:
66-
- name: Checkout Repository
67-
uses: actions/[email protected]
68-
69-
- name: Set up NodeJs
70-
uses: actions/[email protected]
71-
with:
72-
node-version: '16'
73-
cache: 'npm'
74-
75-
- name: Download Artifacts
76-
uses: actions/[email protected]
77-
with:
78-
name: assembled-frontend-node16
79-
80-
- name: Create Checksums
81-
run: |-
82-
zip -qr frontend-dist.zip dist/*
83-
84-
echo "# SHA1" >> checksums.txt
85-
sha1sum frontend-dist.zip >> checksums.txt
86-
echo "# SHA256" >> checksums.txt
87-
sha256sum frontend-dist.zip >> checksums.txt
88-
echo "# SHA512" >> checksums.txt
89-
sha512sum frontend-dist.zip >> checksums.txt
41+
git push origin "HEAD:refs/heads/master"
9042
9143
- name: Create GitHub Release
9244
env:
45+
# or change it to a custom PAT that should be credited for the release
9346
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
9447
GH_OPTS: ""
9548
run: |-
96-
cat << EOF >> .github/default-release-notes.md
97-
\`\`\`text
98-
$(cat checksums.txt)
99-
\`\`\`
100-
EOF
49+
VERSION=`jq -r '.version' package.json`
10150
10251
if [[ "${{ contains(github.event.inputs.version-to-bump, 'pre') }}" == "true" ]]; then
103-
GH_OPTS="--prerelease "
52+
GH_OPTS="--prerelease"
10453
fi
10554
106-
gh release create "${{ needs.prepare-release.outputs.version }}" \
107-
--title "${{ needs.prepare-release.outputs.version }}" \
108-
--notes-file ".github/default-release-notes.md" \
109-
--generate-notes ${GH_OPTS}\
110-
frontend-dist.zip \
111-
checksums.txt \
112-
bom.xml bom.json
55+
gh release create "${VERSION}" ${GH_OPTS} \
56+
--title "${VERSION}" \
57+
--notes-file ".github/default-release-notes.md"

‎docker/Dockerfile.alpine‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM nginxinc/nginx-unprivileged:1.21.6-alpine@sha256:c754b5ff17e6cd39e786855ee31d4eeac21276d26119bf37385cbb3dcc3a9d29
1+
FROM nginxinc/nginx-unprivileged:1.22.0-alpine@sha256:a7f1327503df0b1a4181f84ec1cb93438d701719b3f6e4a9d882494ccae9e8a8
22

33
# Arguments that can be passed at build time
44
ARG COMMIT_SHA=unknown

0 commit comments

Comments
 (0)