@@ -21,8 +21,8 @@ and pushing their packages as part of their git workflow.
21
21
22
22
This guide provides step-by-step instructions for configuring automated
23
23
CI pipelines in GitHub Actions for pushing your Crossplane extensions to
24
- ` xpkg.crossplane.io ` and/or ` xpkg.upbound.io ` , which are two registries
25
- that the Crossplane community use today.
24
+ ` xpkg.crossplane.io ` , the main registry that the Crossplane community
25
+ uses today.
26
26
27
27
{{< hint "tip" >}}
28
28
For more information about Crossplane packages, review the
@@ -31,7 +31,8 @@ For more information about Crossplane packages, review the
31
31
32
32
## Typical workflow
33
33
34
- A typical GitHub workflow definition contains the following steps:
34
+ A typical GitHub workflow definition to build and release an extension
35
+ contains the following steps:
35
36
36
37
1 . Fetching the source repository
37
38
2 . Authenticating to a remote registry
@@ -87,76 +88,28 @@ file `publish-provider-package.yaml`.
87
88
3 . Commit the workflow file to the default branch of the GitHub repository.
88
89
4 . The workflow should now be available to trigger via the GitHub UI in the
89
90
` Actions ` tab.
91
+ 5 . Create a release branch with the ` release- ` prefix in the name in the GitHub UI. For example, ` release-0.1 ` .
92
+ 6 . Tag the desired commit on release branch with a valid semver release tag.
93
+ For example, ` v0.1.0 ` . By default, this is the inferred reference pushed to the registry.
94
+ 7 . Manually run the workflow in the GitHub UI, targeting the release branch from step 5.
90
95
91
- ### Optionally mirroring to ` xpkg.upbound.io `
92
-
93
- ` xpkg.upbound.io ` is the registry known as the [ Upbound Marketplace] .
94
-
95
- To optionally push (mirror) the same package to this registry, you need
96
- an Upbound account.
97
-
98
- 1 . [ Log in] ( https://accounts.upbound.io/login ) to Upbound.
99
- 2 . Create an [ access token] ( https://accounts.upbound.io/settings/tokens ) .
100
- 3 . Copy the token into a GitHub Actions secret, for example
101
- ` XPKG_UPBOUND_TOKEN ` .
102
- 4 . Reference the secret created in step 3 in the ` secrets ` block of the
103
- workflow YAML file. For example:
104
-
105
- ```yaml
106
- secrets:
107
- GHCR_PAT: ${{ secrets.GITHUB_TOKEN }}
108
- XPKG_UPBOUND_TOKEN: ${{ secrets.XPKG_UPBOUND_TOKEN }}
109
- ```
110
-
111
- {{< hint "warning" >}}
112
- The process for optionally pushing to the Upbound Marketplace in this quickstart
113
- is changing to be consistent with how other pipelines authenticate to
114
- the Upbound registry.
115
-
116
- See https://github.com/crossplane-contrib/provider-workflows/issues/14 for
117
- details.
118
- {{< /hint >}}
96
+ See [ branching conventions] ( #branching-conventions ) for more details on tagging
97
+ practices and optionally overriding the inferred git tag version.
119
98
120
99
## Quickstart: Releasing a Function to ` xpkg.crossplane.io `
121
100
122
101
The template repository for [ functions] provides a functional GitHub Action
123
102
YAML file that pushes to ` xpkg.crossplane.io ` without extra configuration.
124
103
125
- To optionally configure pushing to the Upbound Marketplace (` xpkg.upbound.io ` ):
126
-
127
- 1 . [ Log in] ( https://accounts.upbound.io/login ) to Upbound.
128
- 2 . Create a [ Repository] ( https://docs.upbound.io/build/repositories/store-configurations/#create-a-repository ) .
129
- 3 . Create a [ Robot] ( https://docs.upbound.io/operate/accounts/identity-management/robots/ )
130
- and a [ Team] ( https://docs.upbound.io/operate/accounts/identity-management/teams/ ) .
131
- 4 . Assign the Robot to the Team.
132
- 5 . Grant the team ` WRITE ` permission to the repository.
133
- 6 . Provision a token (key pair) for the Robot, and save the access ID and token
134
- as separate GitHub Actions secrets (for example ` XPKG_ACCESS_ID ` and ` XPKG_TOKEN ` ).
135
- 7 . Change the workflow YAML file to authenticate to ` xpkg.upbound.io ` :
136
-
137
- ``` yaml
138
- # In env: block
139
- XPKG : xpkg.upbound.io/${{ github.repository}}
140
- [...]
141
-
142
- # extra login step in the job
143
- - name : Login to Upbound
144
- uses : docker/login-action@v3
145
- if : env.XPKG_ACCESS_ID != ''
146
- with :
147
- registry : xpkg.upbound.io
148
- username : ${{ secrets.XPKG_ACCESS_ID }}
149
- password : ${{ secrets.XPKG_TOKEN }}
150
- ` ` `
104
+ To build and push a new release to the registry:
151
105
152
- 8. Change the workflow YAML file to push to ` xpkg.upbound.io`:
106
+ 1 . Cut a release branch with the ` release- ` prefix in the name in the GitHub UI. For example, ` release-0.1 ` .
107
+ 2 . Tag the desired commit on release branch with a valid semver release tag.
108
+ For example, ` v0.1.0 ` . By default, this is the inferred reference pushed to the registry.
109
+ 3 . Manually run the workflow in the GitHub UI, targeting the release branch from step 1.
153
110
154
- ` ` ` yaml
155
- # after login step above
156
- - name: Push Multi-Platform Package to Upbound
157
- if: env.XPKG_ACCESS_ID != ''
158
- run: "./crossplane --verbose xpkg push --package-files $(echo *.xpkg|tr ' ' ,) ${{ env.XPKG }}:${{ env.XPKG_VERSION }}"
159
- ` ` `
111
+ See [ branching conventions] ( #branching-conventions ) for more details on tagging
112
+ practices and optionally overriding the inferred git tag version.
160
113
161
114
## Common Configuration
162
115
@@ -196,13 +149,12 @@ For other registries, it's still best practice to reference credentials as
196
149
custom Secret variables. For example :
197
150
198
151
` ` ` yaml
199
- - name: Login to Upbound
152
+ - name: Login to Another Registry
200
153
uses: docker/login-action@v3
201
- if: env.XPKG_ACCESS_ID != ''
202
154
with:
203
- registry: xpkg.upbound .io
204
- username: ${{ env.XPKG_ACCESS_ID }}
205
- password: ${{ secrets.XPKG_TOKEN }}
155
+ registry: my-registry .io
156
+ username: ${{ env.REGISTRY_USER }}
157
+ password: ${{ secrets.REGISTRY_PASSWORD }}
206
158
` ` `
207
159
208
160
# # Branching conventions
@@ -290,15 +242,15 @@ Edit the following variables to define the target registry:
290
242
291
243
1. `XPKG_REG_ORGS` - a space-delimited list of target repositories.
292
244
2. `XPKG_REG_ORGS_NO_PROMOTE` - for registries that don't use or infer
293
- channel tags, such as `xpkg.upbound.io` .
245
+ channel tags.
294
246
295
- For example, the following dual-pushes to `xpkg.upbound .io` as well as
247
+ For example, the following dual-pushes to `xpkg.crossplane .io` as well as
296
248
`index.docker.io` :
297
249
298
250
` ` ` make
299
- XPKG_REG_ORGS ?= xpkg.upbound .io/crossplane-contrib index.docker.io/crossplanecontrib
251
+ XPKG_REG_ORGS ?= xpkg.crossplane .io/crossplane-contrib index.docker.io/crossplanecontrib
300
252
301
- XPKG_REG_ORGS_NO_PROMOTE ?= xpkg.upbound .io/crossplane-contrib
253
+ XPKG_REG_ORGS_NO_PROMOTE ?= xpkg.crossplane .io/crossplane-contrib
302
254
` ` `
303
255
304
256
# # Reusable workflows
@@ -307,8 +259,7 @@ The [crossplane-contrib/provider-workflows] repository provide reusable
307
259
workflow definitions that are callable from a custom CI pipeline.
308
260
309
261
For example, the following snippet references the callable workflow to
310
- build and push the `provider-kubernetes` package to both `ghcr.io` and
311
- `xpkg.upbound.io` :
262
+ build and push the `provider-kubernetes` package to `xpkg.crossplane.io` :
312
263
313
264
` ` ` yaml
314
265
jobs:
@@ -321,7 +272,6 @@ jobs:
321
272
cleanup-disk: true
322
273
secrets:
323
274
GHCR_PAT: ${{ secrets.GITHUB_TOKEN }}
324
- XPKG_UPBOUND_TOKEN: ${{ secrets.XPKG_UPBOUND_TOKEN }}
325
275
` ` `
326
276
327
277
{{< hint "tip" >}}
@@ -349,4 +299,3 @@ what's configured in GitHub.
349
299
[GitHub Actions Secrets] : https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions
350
300
[build submodule] : https://github.com/crossplane/build
351
301
[crossplane-contrib/provider-workflows] : https://github.com/crossplane-contrib/provider-workflows/blob/main/.github/workflows
352
- [Upbound Marketplace] : https://marketplace.upbound.io
0 commit comments