Skip to content

Commit 41a3c8f

Browse files
stefanprodanstefanprodan
authored
Merge pull request #274 from fluxcd/backport-fix-release-v2.0.x
[release/v2.0.x] Fix release workflow
2 parents f279ada + 521ba8b commit 41a3c8f

File tree

8 files changed

+90
-143
lines changed

8 files changed

+90
-143
lines changed

‎.github/dependabot.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ version: 2
22

33
updates:
44
- package-ecosystem: "gomod"
5+
labels: ["dependencies"]
56
directory: "/"
67
schedule:
78
interval: "monthly"
@@ -20,6 +21,7 @@ updates:
2021
- dependency-name: "k8s.io/*"
2122
- dependency-name: "sigs.k8s.io/*"
2223
- package-ecosystem: "github-actions"
24+
labels: ["dependencies"]
2325
directory: "/"
2426
schedule:
2527
interval: "monthly"
@@ -28,6 +30,7 @@ updates:
2830
patterns:
2931
- "*"
3032
- package-ecosystem: "docker"
33+
labels: ["dependencies"]
3134
directory: "/"
3235
schedule:
3336
interval: "monthly"

‎.github/labels.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Configuration file to declaratively configure labels
2+
# Ref: https://github.com/EndBug/label-sync#Config-files
3+
4+
- name: area/generator
5+
description: Artifact generation related issues and pull requests
6+
color: '#00b140'
7+
- name: area/storage
8+
description: Artifact storage related issues and pull requests
9+
color: '#4b0082'
10+
- name: backport:release/v2.0.x
11+
description: To be backported to release/v2.0.x
12+
color: '#ffd700'
13+

‎.github/workflows/backport.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
name: backport
2+
on:
3+
pull_request_target:
4+
types: [closed, labeled]
5+
jobs:
6+
backport:
7+
permissions:
8+
contents: write # for reading and creating branches.
9+
pull-requests: write # for creating pull requests against release branches.
10+
uses: fluxcd/gha-workflows/.github/workflows/[email protected]
11+
secrets:
12+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/code-scan.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: code-scan
2+
on:
3+
push:
4+
branches: [ main ]
5+
pull_request:
6+
branches: [ main ]
7+
jobs:
8+
analyze:
9+
permissions:
10+
contents: read # for reading the repository code.
11+
security-events: write # for uploading the CodeQL analysis results.
12+
uses: fluxcd/gha-workflows/.github/workflows/[email protected]
13+
secrets:
14+
github-token: ${{ secrets.GITHUB_TOKEN }}
15+
fossa-token: ${{ secrets.FOSSA_TOKEN }}

‎.github/workflows/e2e.yaml‎

Lines changed: 4 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,36 +1,19 @@
11
name: e2e
2-
32
on:
43
pull_request:
54
push:
65
branches:
76
- main
8-
97
jobs:
108
kind:
119
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read # for reading the repository code.
1212
steps:
13-
- name: Checkout
14-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
15-
- name: Setup QEMU
16-
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
17-
- name: Setup Docker Buildx
18-
id: buildx
19-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
20-
- name: Setup Go
21-
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
13+
- name: Test suite setup
14+
uses: fluxcd/gha-workflows/.github/actions/[email protected]
2215
with:
2316
go-version: 1.25.x
24-
cache-dependency-path: |
25-
**/go.sum
26-
**/go.mod
27-
- name: Setup Kubernetes
28-
uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
29-
with:
30-
version: v0.30.0
31-
cluster_name: kind
32-
- name: Setup Kustomize
33-
uses: fluxcd/pkg/actions/kustomize@main
3417
- name: Run tests
3518
run: make test
3619
- name: Check if working tree is dirty

‎.github/workflows/labels-sync.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: sync-labels
2+
on:
3+
workflow_dispatch:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- .github/labels.yaml
9+
jobs:
10+
sync-labels:
11+
permissions:
12+
contents: read # for reading the labels file.
13+
issues: write # for creating and updating labels.
14+
uses: fluxcd/gha-workflows/.github/workflows/[email protected]
15+
secrets:
16+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release.yaml‎

Lines changed: 26 additions & 122 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
name: release
2-
32
on:
43
push:
54
tags:
@@ -10,153 +9,58 @@ on:
109
description: 'image tag prefix'
1110
default: 'rc'
1211
required: true
13-
14-
permissions:
15-
contents: read
16-
17-
env:
18-
CONTROLLER: ${{ github.event.repository.name }}
19-
2012
jobs:
2113
release:
22-
outputs:
23-
hashes: ${{ steps.hash.outputs.hashes }}
24-
image_url: ${{ steps.hash.outputs.image_url }}
25-
image_digest: ${{ steps.hash.outputs.image_digest }}
26-
runs-on: ubuntu-latest
2714
permissions:
28-
contents: write # needed to write releases
29-
id-token: write # needed for keyless signing
30-
packages: write # needed for ghcr access
31-
steps:
32-
- name: Checkout
33-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
34-
- name: Setup Kustomize
35-
uses: fluxcd/pkg/actions/kustomize@main
36-
- name: Prepare
37-
id: prep
38-
run: |
39-
VERSION="${{ github.event.inputs.tag }}-${GITHUB_SHA::8}"
40-
if [[ $GITHUB_REF == refs/tags/* ]]; then
41-
VERSION=${GITHUB_REF/refs\/tags\//}
42-
fi
43-
echo "version=${VERSION}" >> $GITHUB_OUTPUT
44-
- name: Setup Go
45-
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
46-
with:
47-
go-version: 1.25.x
48-
cache-dependency-path: |
49-
**/go.sum
50-
**/go.mod
51-
- uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
52-
- uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
53-
- uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
54-
- uses: anchore/sbom-action/download-syft@da167eac915b4e86f08b264dbdbc867b61be6f0c # v0.20.5
55-
- name: Docker login ghcr.io
56-
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
57-
with:
58-
registry: ghcr.io
59-
username: fluxcdbot
60-
password: ${{ secrets.GHCR_TOKEN }}
61-
- name: Docker login docker.io
62-
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
63-
with:
64-
username: fluxcdbot
65-
password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
66-
- name: Docker meta
67-
id: meta
68-
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
69-
with:
70-
images: |
71-
fluxcd/${{ env.CONTROLLER }}
72-
ghcr.io/fluxcd/${{ env.CONTROLLER }}
73-
tags: |
74-
type=raw,value=${{ steps.prep.outputs.version }}
75-
- name: Docker push
76-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
77-
id: build-push
78-
with:
79-
sbom: true
80-
provenance: true
81-
push: true
82-
builder: ${{ steps.buildx.outputs.name }}
83-
context: .
84-
file: ./Dockerfile
85-
platforms: linux/amd64,linux/arm/v7,linux/arm64
86-
tags: ${{ steps.meta.outputs.tags }}
87-
labels: ${{ steps.meta.outputs.labels }}
88-
- name: Sign images
89-
env:
90-
COSIGN_EXPERIMENTAL: 1
91-
run: |
92-
cosign sign --yes fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.version }}
93-
cosign sign --yes ghcr.io/fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.version }}
94-
- name: Generate release artifacts
95-
if: startsWith(github.ref, 'refs/tags/v')
96-
run: |
97-
mkdir -p config/release
98-
kustomize build ./config/crd > ./config/release/${{ env.CONTROLLER }}.crds.yaml
99-
kustomize build ./config/manager > ./config/release/${{ env.CONTROLLER }}.deployment.yaml
100-
- name: GoReleaser publish signed SBOM
101-
id: run-goreleaser
102-
if: startsWith(github.ref, 'refs/tags/v')
103-
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
104-
with:
105-
version: latest
106-
args: release --clean --skip=validate
107-
env:
108-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
109-
- name: Generate SLSA hashes
110-
id: hash
111-
env:
112-
ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
113-
run: |
114-
set -euo pipefail
115-
116-
hashes=$(echo $ARTIFACTS | jq --raw-output '.[] | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {digest} + {name} | join(" ") | sub("^sha256:";"")' | base64 -w0)
117-
echo "hashes=$hashes" >> $GITHUB_OUTPUT
118-
119-
image_url=fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.version }}
120-
image_digest=${{ steps.build-push.outputs.digest }}
121-
echo "image_url=$image_url" >> $GITHUB_OUTPUT
122-
echo "image_digest=$image_digest" >> $GITHUB_OUTPUT
123-
15+
contents: write # for creating the GitHub release.
16+
id-token: write # for creating OIDC tokens for signing.
17+
packages: write # for pushing and signing container images.
18+
uses: fluxcd/gha-workflows/.github/workflows/[email protected]
19+
with:
20+
controller: ${{ github.event.repository.name }}
21+
release-candidate-prefix: ${{ github.event.inputs.tag }}
22+
secrets:
23+
github-token: ${{ secrets.GITHUB_TOKEN }}
24+
dockerhub-token: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
12425
release-provenance:
12526
needs: [release]
12627
permissions:
127-
actions: read # To read the workflow path.
128-
id-token: write # To sign the provenance.
129-
contents: write # To add assets to the release.
28+
actions: read # for detecting the Github Actions environment.
29+
id-token: write # for creating OIDC tokens for signing.
30+
contents: write # for uploading attestations to GitHub releases.
31+
if: startsWith(github.ref, 'refs/tags/v')
13032
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
13133
with:
13234
provenance-name: "provenance.intoto.jsonl"
133-
base64-subjects: "${{ needs.release.outputs.hashes }}"
35+
base64-subjects: "${{ needs.release.outputs.release-digests }}"
13436
upload-assets: true
135-
13637
dockerhub-provenance:
13738
needs: [release]
13839
permissions:
40+
contents: read # for reading the repository code.
13941
actions: read # for detecting the Github Actions environment.
14042
id-token: write # for creating OIDC tokens for signing.
14143
packages: write # for uploading attestations.
44+
if: startsWith(github.ref, 'refs/tags/v')
14245
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
14346
with:
144-
image: ${{ needs.release.outputs.image_url }}
145-
digest: ${{ needs.release.outputs.image_digest }}
146-
registry-username: fluxcdbot
47+
image: ${{ needs.release.outputs.image-name }}
48+
digest: ${{ needs.release.outputs.image-digest }}
49+
registry-username: ${{ github.repository_owner == 'fluxcd' && 'fluxcdbot' || github.repository_owner }}
14750
secrets:
14851
registry-password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
149-
15052
ghcr-provenance:
15153
needs: [release]
15254
permissions:
55+
contents: read # for reading the repository code.
15356
actions: read # for detecting the Github Actions environment.
15457
id-token: write # for creating OIDC tokens for signing.
15558
packages: write # for uploading attestations.
59+
if: startsWith(github.ref, 'refs/tags/v')
15660
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
15761
with:
158-
image: ghcr.io/${{ needs.release.outputs.image_url }}
159-
digest: ${{ needs.release.outputs.image_digest }}
160-
registry-username: fluxcdbot
62+
image: ghcr.io/${{ needs.release.outputs.image-name }}
63+
digest: ${{ needs.release.outputs.image-digest }}
64+
registry-username: fluxcdbot # not necessary for ghcr.io
16165
secrets:
162-
registry-password: ${{ secrets.GHCR_TOKEN }}
66+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
# source-watcher
22

3+
[![fossa](https://app.fossa.com/api/projects/custom%2B162%2Fgithub.com%2Ffluxcd%2Fsource-watcher.svg?type=small)](https://app.fossa.com/projects/custom%2B162%2Fgithub.com%2Ffluxcd%2Fsource-watcher?ref=badge_small)
34
[![test](https://github.com/fluxcd/source-watcher/workflows/e2e/badge.svg)](https://github.com/fluxcd/source-watcher/actions)
45
[![report](https://goreportcard.com/badge/github.com/fluxcd/source-watcher)](https://goreportcard.com/report/github.com/fluxcd/source-watcher)
56
[![license](https://img.shields.io/github/license/fluxcd/source-watcher.svg)](https://github.com/fluxcd/source-watcher/blob/main/LICENSE)

0 commit comments

Comments
 (0)