@@ -3,11 +3,19 @@ name: Image
33on :
44 push :
55 branches :
6- - master
6+ # We use skyscanner-internal/master as the base branch for integration
7+ # This branch contains our CI changes and is not meant for direct contributions.
8+ # Our internal development is to be merged into here.
9+ # The changes that are ready for contribution should be cherry-picked to skyscanner-contrib/master.
10+ - skyscanner-internal/master
11+ # Branches to be used for development and testing. They should be based on skyscanner-internal/master.
12+ - skyscanner-internal/develop/**
713 pull_request :
814 branches :
9- - master
10- types : [ labeled, unlabeled, opened, synchronize, reopened ]
15+ - skyscanner-internal/master
16+ # Cleaned up, ready for contribution PRs are to be cherry-picked here
17+ - skyscanner-contrib/master
18+ types : [labeled, unlabeled, opened, synchronize, reopened]
1119
1220concurrency :
1321 group : ${{ github.workflow }}-${{ github.ref }}
1927 set-vars :
2028 permissions :
2129 contents : read
22- if : github.repository == 'argoproj /argo-cd'
30+ if : github.repository == 'Skyscanner /argo-cd'
2331 runs-on : ubuntu-22.04
2432 outputs :
2533 image-tag : ${{ steps.image.outputs.tag}}
2836 - uses : actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
2937
3038 - name : Set image tag for ghcr
31- run : echo "tag=$(cat ./VERSION)-${GITHUB_SHA::8}" >> $GITHUB_OUTPUT
39+ run : |
40+ # Get the branch name
41+ BRANCH_NAME=${GITHUB_REF#refs/heads/}
42+ # Sanitize branch name for container registry compliance
43+ SANITIZED_BRANCH=$(echo "$BRANCH_NAME" | sed -e 's/\//-/g' | tr '[:upper:]' '[:lower:]')
44+ # Set the image tag with sanitized branch name
45+ echo "tag=$(cat ./VERSION)-${SANITIZED_BRANCH}-${GITHUB_SHA::8}" >> $GITHUB_OUTPUT
3246id : image
3347
3448 - name : Determine image platforms to use
3751 IMAGE_PLATFORMS=linux/amd64
3852 if [[ "${{ github.event_name }}" == "push" || "${{ contains(github.event.pull_request.labels.*.name, 'test-multi-image') }}" == "true" ]]
3953 then
40- IMAGE_PLATFORMS=linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
54+ IMAGE_PLATFORMS=linux/amd64,linux/arm64
4155 fi
4256 echo "Building image for platforms: $IMAGE_PLATFORMS"
4357 echo "platforms=$IMAGE_PLATFORMS" >> $GITHUB_OUTPUT
@@ -46,74 +60,76 @@ jobs:
4660 needs : [set-vars]
4761 permissions :
4862 contents : read
49- packages : write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
63+ packages : write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
5064 id-token : write # for creating OIDC tokens for signing.
51- if : ${{ github.repository == 'argoproj /argo-cd' && github.event_name != 'push' }}
65+ if : ${{ github.repository == 'Skyscanner /argo-cd' && github.event_name != 'push' }}
5266 uses : ./.github/workflows/image-reuse.yaml
5367 with :
5468 # Note: cannot use env variables to set go-version (https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations)
5569 # renovate: datasource=golang-version packageName=golang
56- go-version : 1.23.3
70+ go-version : 1.24.4
5771 platforms : ${{ needs.set-vars.outputs.platforms }}
5872 push : false
5973
6074 build-and-publish :
6175 needs : [set-vars]
6276 permissions :
6377 contents : read
64- packages : write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
78+ packages : write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
6579 id-token : write # for creating OIDC tokens for signing.
66- if : ${{ github.repository == 'argoproj /argo-cd' && github.event_name == 'push' }}
80+ if : ${{ github.repository == 'Skyscanner /argo-cd' && github.event_name == 'push' }}
6781 uses : ./.github/workflows/image-reuse.yaml
6882 with :
69- quay_image_name : quay.io/argoproj/argocd:latest
70- ghcr_image_name : ghcr.io/argoproj/argo-cd /argocd:${{ needs.set-vars.outputs.image-tag }}
83+ # quay_image_name: quay.io/argoproj/argocd:latest
84+ ghcr_image_name : ghcr.io/skyscanner /argocd:${{ needs.set-vars.outputs.image-tag }}
7185 # Note: cannot use env variables to set go-version (https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations)
7286 # renovate: datasource=golang-version packageName=golang
73- go-version : 1.23.3
87+ go-version : 1.24.4
7488 platforms : ${{ needs.set-vars.outputs.platforms }}
7589 push : true
7690 secrets :
77- quay_username : ${{ secrets.RELEASE_QUAY_USERNAME }}
78- quay_password : ${{ secrets.RELEASE_QUAY_TOKEN }}
91+ # quay_username: ${{ secrets.RELEASE_QUAY_USERNAME }}
92+ # quay_password: ${{ secrets.RELEASE_QUAY_TOKEN }}
7993 ghcr_username : ${{ github.actor }}
8094 ghcr_password : ${{ secrets.GITHUB_TOKEN }}
8195
82- build-and-publish-provenance : # Push attestations to GHCR, latest image is polluting quay.io
83- needs :
84- - build-and-publish
85- permissions :
86- actions : read # for detecting the Github Actions environment.
87- id-token : write # for creating OIDC tokens for signing.
88- packages : write # for uploading attestations. (https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#known-issues)
89- if : ${{ github.repository == 'argoproj/argo-cd' && github.event_name == 'push' }}
90- # Must be refernced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
91- uses : slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
92- with :
93- image : ghcr.io/argoproj/argo-cd/argocd
94- digest : ${{ needs.build-and-publish.outputs.image-digest }}
95- registry-username : ${{ github.actor }}
96- secrets :
97- registry-password : ${{ secrets.GITHUB_TOKEN }}
98-
99- Deploy :
100- needs :
101- - build-and-publish
102- - set-vars
103- permissions :
104- contents : write # for git to push upgrade commit if not already deployed
105- packages : write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
106- if : ${{ github.repository == 'argoproj/argo-cd' && github.event_name == 'push' }}
107- runs-on : ubuntu-22.04
108- steps :
109- - uses : actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
110- - run : git clone "https://$TOKEN@github.com/argoproj/argoproj-deployments"
111- env :
112- TOKEN : ${{ secrets.TOKEN }}
113- - run : |
114- docker run -u $(id -u):$(id -g) -v $(pwd):/src -w /src --rm -t ghcr.io/argoproj/argo-cd/argocd:${{ needs.set-vars.outputs.image-tag }} kustomize edit set image quay.io/argoproj/argocd=ghcr.io/argoproj/argo-cd/argocd:${{ needs.set-vars.outputs.image-tag }}
115- git config --global user.email 'ci@argoproj.com'
116- git config --global user.name 'CI'
117- git diff --exit-code && echo 'Already deployed' || (git commit -am 'Upgrade argocd to ${{ needs.set-vars.outputs.image-tag }}' && git push)
118- working-directory: argoproj-deployments/argocd
96+ # TODO: Needs allowlisting
97+ # build-and-publish-provenance: # Push attestations to GHCR, latest image is polluting quay.io
98+ # needs:
99+ # - build-and-publish
100+ # permissions:
101+ # actions: read # for detecting the Github Actions environment.
102+ # id-token: write # for creating OIDC tokens for signing.
103+ # packages: write # for uploading attestations. (https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#known-issues)
104+ # if: ${{ github.repository == 'Skyscanner/argo-cd' && github.event_name == 'push' }}
105+ # # Must be refernced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
106+ # uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
107+ # with:
108+ # image: ghcr.io/argoproj/argo-cd/argocd
109+ # digest: ${{ needs.build-and-publish.outputs.image-digest }}
110+ # registry-username: ${{ github.actor }}
111+ # secrets:
112+ # registry-password: ${{ secrets.GITHUB_TOKEN }}
119113
114+ # TODO: We would need to fork this repo as well and repoint it to our argocd-deployments repo.
115+ # Do we want this?
116+ # Deploy:
117+ # needs:
118+ # - build-and-publish
119+ # - set-vars
120+ # permissions:
121+ # contents: write # for git to push upgrade commit if not already deployed
122+ # packages: write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
123+ # if: ${{ github.repository == 'Skyscanner/argo-cd' && github.event_name == 'push' }}
124+ # runs-on: ubuntu-22.04
125+ # steps:
126+ # - uses: actions/checkout@8410ad0602e1e429cee44a835ae9f77f654a6694 # v4.0.0
127+ # - run: git clone "https://$TOKEN@github.com/argoproj/argoproj-deployments"
128+ # env:
129+ # TOKEN: ${{ secrets.TOKEN }}
130+ # - run: |
131+ # docker run -u $(id -u):$(id -g) -v $(pwd):/src -w /src --rm -t ghcr.io/argoproj/argo-cd/argocd:${{ needs.set-vars.outputs.image-tag }} kustomize edit set image quay.io/argoproj/argocd=ghcr.io/argoproj/argo-cd/argocd:${{ needs.set-vars.outputs.image-tag }}
132+ # git config --global user.email 'ci@argoproj.com'
133+ # git config --global user.name 'CI'
134+ # git diff --exit-code && echo 'Already deployed' || (git commit -am 'Upgrade argocd to ${{ needs.set-vars.outputs.image-tag }}' && git push)
135+ # working-directory: argoproj-deployments/argocd
0 commit comments