|
1 | | -name: Cut Release |
| 1 | +name: Release |
2 | 2 |
|
3 | 3 | on: |
4 | 4 | push: |
5 | 5 | tags: |
6 | 6 | - "v*" |
7 | 7 |
|
8 | | -concurrency: cut-release |
9 | | - |
10 | | -permissions: |
11 | | - contents: write # needed to write releases |
12 | | - id-token: write # needed for keyless signing |
13 | | - packages: write # needed for pushing the images to ghcr.io |
14 | | - |
15 | 8 | jobs: |
16 | 9 | release: |
17 | | - outputs: |
18 | | - hashes: ${{ steps.hash.outputs.hashes }} |
19 | | - tag_name: ${{ steps.tag.outputs.tag_name }} |
20 | 10 | runs-on: ubuntu-latest |
| 11 | + permissions: |
| 12 | + attestations: write |
| 13 | + contents: write |
| 14 | + id-token: write |
| 15 | + packages: write |
| 16 | + env: |
| 17 | + KO_DOCKER_REPO: ghcr.io/github/policy-controller-webhook |
| 18 | + KOCACHE: /tmp/ko |
21 | 19 | steps: |
22 | | - - uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1 |
| 20 | + - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5 |
23 | 21 | with: |
24 | | - android: true |
25 | | - dotnet: true |
26 | | - haskell: true |
27 | | - large-packages: true |
28 | | - docker-images: true |
29 | | - swap-storage: true |
30 | | - |
31 | | - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 |
32 | | - with: |
33 | | - fetch-depth: 0 |
34 | | - |
35 | | - - uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # v5.2.0 |
| 22 | + ref: "release" |
| 23 | + - uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1 |
36 | 24 | with: |
37 | | - go-version-file: './go.mod' |
| 25 | + go-version-file: "./go.mod" |
38 | 26 | check-latest: true |
39 | | - |
40 | | - - uses: sigstore/cosign-installer@dc72c7d5c4d10cd6bcb8cf6e3fd625a9e5e537da |
41 | | - |
42 | | - - uses: anchore/sbom-action/download-syft@df80a981bc6edbc4e220a492d3cbe9f5547a6e75 # v0.17.9 |
43 | | - |
44 | | - - uses: ko-build/setup-ko@3aebd0597dc1e9d1a26bcfdb7cbeb19c131d3037 # v0.7 |
45 | | - |
46 | | - - name: Set up Cloud SDK |
47 | | - uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2.1.7 |
48 | | - with: |
49 | | - workload_identity_provider: 'projects/498091336538/locations/global/workloadIdentityPools/githubactions/providers/sigstore-policy-controller' |
50 | | - service_account: '[email protected]' |
51 | | - |
52 | | - - name: 'Set up Cloud SDK' |
53 | | - uses: google-github-actions/setup-gcloud@6189d56e4096ee891640bb02ac264be376592d6a # v2.1.2 |
54 | | - |
55 | | - - name: creds |
56 | | - run: gcloud auth configure-docker --quiet |
57 | | - |
58 | | - - name: Set LDFLAGS |
59 | | - id: ldflags |
| 27 | + - uses: ko-build/setup-ko@ace48d793556083a76f1e3e6068850c1f4a369aa # v0.6 |
| 28 | + - name: Build and publish webhook to GHCR |
| 29 | + id: build |
60 | 30 | run: | |
61 | | - source ./release/ldflags.sh |
62 | | - goflags=$(ldflags) |
63 | | - echo "GO_FLAGS="${goflags}"" >> "$GITHUB_ENV" |
64 | | -
|
65 | | - - name: Set tag output |
66 | | - id: tag |
67 | | - run: echo "tag_name=${GITHUB_REF#refs/*/}" >> "$GITHUB_OUTPUT" |
68 | | - |
69 | | - - name: Run GoReleaser |
70 | | - id: run-goreleaser |
71 | | - uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0 |
| 31 | + export GIT_HASH=`git rev-parse HEAD` |
| 32 | + export GIT_VERSION=`git describe --tags --always --dirty` |
| 33 | + export BUILD_DATE=`date +%Y-%m-%dT%H:%M:%SZ` |
| 34 | + export LDFLAGS="-buildid= -X sigs.k8s.io/release-utils/version.gitVersion=$GIT_VERSION -X sigs.k8s.io/release-utils/version.gitCommit=$GIT_HASH -X sigs.k8s.io/release-utils/version.buildDate=$BUILD_DATE" |
| 35 | +
|
| 36 | + mkdir -p ${{ env.KOCACHE }} |
| 37 | + # ko build should print ghcr.io/github/policy-controller-webhook@sha256:<digest> |
| 38 | + # to standard out. Capture the image digest for the build provenance step |
| 39 | + IMAGE_DIGEST=$(ko build --bare --tags $GIT_VERSION --tags $GIT_HASH --platform=linux/amd64 github.com/sigstore/policy-controller/cmd/webhook | cut -d'@' -f2) |
| 40 | + echo "image_digest=$IMAGE_DIGEST" >> $GITHUB_OUTPUT |
| 41 | + - name: Attest |
| 42 | + uses: actions/attest-build-provenance@951c0c5f8e375ad4efad33405ab77f7ded2358e4 # v1.1.1 |
| 43 | + id: attest |
72 | 44 | with: |
73 | | - version: latest |
74 | | - args: release --clean --timeout 120m --parallelism 1 |
75 | | - env: |
76 | | - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
77 | | - LDFLAGS: ${{ env.GO_FLAGS }} |
78 | | - |
79 | | - - name: Generate subject |
80 | | - id: hash |
81 | | - env: |
82 | | - ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}" |
83 | | - run: | |
84 | | - set -euo pipefail |
85 | | - checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path') |
86 | | - echo "hashes=$(cat $checksum_file | base64 -w0)" >> "$GITHUB_OUTPUT" |
87 | | -
|
88 | | - - name: build images |
89 | | - run: | |
90 | | - make build-sign-release-images |
91 | | - env: |
92 | | - LDFLAGS: ${{ env.GO_FLAGS }} |
93 | | - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
94 | | - |
95 | | - - name: copy-signed-release-to-ghcr |
96 | | - run: make copy-signed-release-to-ghcr || true |
97 | | - env: |
98 | | - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
99 | | - |
100 | | - provenance: |
101 | | - needs: [release] |
102 | | - permissions: |
103 | | - actions: read # To read the workflow path. |
104 | | - id-token: write # To sign the provenance. |
105 | | - contents: write # To add assets to a release. |
106 | | - uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected] |
107 | | - with: |
108 | | - base64-subjects: "${{ needs.release.outputs.hashes }}" |
109 | | - upload-assets: true # upload to a new release |
110 | | - upload-tag-name: "${{ needs.release.outputs.tag_name }}" |
| 45 | + subject-name: ${{ env.KO_DOCKER_REPO }} |
| 46 | + subject-digest: ${{ steps.build.outputs.image_digest }} |
| 47 | + push-to-registry: true |
0 commit comments