Skip to content

Commit 85e5731

Browse files
andrpacandrpac
committed
feat: create release pipeline
1 parent 843009a commit 85e5731

File tree

9 files changed

+247
-253
lines changed

9 files changed

+247
-253
lines changed

‎.github/actions/certify-openshift-images/action.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ inputs:
1111
version:
1212
description: The version of the image to be certified
1313
required: true
14+
registry_username:
15+
description: The username to access the registry
16+
required: false
17+
default: "mongodb+mongodb_atlas_kubernetes"
1418
registry_password:
1519
description: The password to access the quay.io registry
1620
required: true
@@ -31,6 +35,7 @@ runs:
3135
REGISTRY: ${{ inputs.registry }}
3236
REPOSITORY: ${{ inputs.repository }}
3337
VERSION: ${{ inputs.version }}
38+
REGISTRY_USERNAME: ${{ inputs.registry_username }}
3439
REGISTRY_PASSWORD: ${{ inputs.registry_password }}
3540
RHCC_TOKEN: ${{ inputs.rhcc_token }}
3641
RHCC_PROJECT: ${{ inputs.rhcc_project }}

‎.github/actions/certify-openshift-images/entrypoint.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616

1717
set -eou pipefail
1818

19-
docker login -u mongodb+mongodb_atlas_kubernetes -p "${REGISTRY_PASSWORD}" "${REGISTRY}"
19+
echo "${REGISTRY_PASSWORD}" | docker login -u "${REGISTRY_USERNAME}" --password-stdin "${REGISTRY}"
2020

2121
submit_flag=--submit
2222
if [ "${SUBMIT}" == "false" ]; then
@@ -27,6 +27,6 @@ echo "Check and Submit result to RedHat Connect"
2727
# Send results to RedHat if preflight finished wthout errors
2828
preflight check container "${REGISTRY}/${REPOSITORY}:${VERSION}" \
2929
--pyxis-api-token="${RHCC_TOKEN}" \
30-
--certification-project-id="${RHCC_PROJECT}" \
30+
--certification-component-id="${RHCC_PROJECT}" \
3131
--docker-config="${HOME}/.docker/config.json" \
3232
${submit_flag}

‎.github/workflows/cloud-tests-filter.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@ jobs:
5555
ACTOR: ${{ github.actor }}
5656
run: |
5757
# Evaluate whether or not cloud tests should run
58-
RUN_CLOUD_TESTS='false'
58+
RUN_CLOUD_TESTS='true'
5959
# Scheduled runs on default branch always run all tests
6060
if [ "${EVENT}" == "schedule" ];then
6161
RUN_CLOUD_TESTS='true'

‎.github/workflows/cloud-tests.yml‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -21,23 +21,7 @@ jobs:
2121
- name: allowed message
2222
run: echo "Allowed to run"
2323

24-
int-tests:
25-
needs: allowed
26-
uses: ./.github/workflows/test-int.yml
27-
secrets: inherit
28-
2924
e2e-tests:
3025
needs: allowed
3126
uses: ./.github/workflows/test-e2e.yml
3227
secrets: inherit
33-
34-
test-e2e-gov:
35-
needs:
36-
- allowed
37-
uses: ./.github/workflows/test-e2e-gov.yml
38-
secrets: inherit
39-
40-
openshift-upgrade-test:
41-
needs: allowed
42-
uses: ./.github/workflows/openshift-upgrade-test.yaml
43-
secrets: inherit

‎.github/workflows/promote-image.yml‎

Lines changed: 14 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -21,43 +21,39 @@ jobs:
2121
- name: Checkout PR commit
2222
uses: actions/checkout@v4
2323

24-
# Note, we have to be careful how we retrive the image. The event that pushed
25-
# the image to the ghcr.io repo was mainly a push/schedule that passed all the
26-
# tests. This event has access to github.ref_name. However, the workflow_run
27-
# event does not have access github.ref_name set up.
28-
#
29-
# Therefore, we need to manually specify the branch as main
30-
- name: Prepare image tag
31-
id: set_tag
32-
uses: ./.github/actions/set-tag
33-
with:
34-
branch_name: ${{ github.event.workflow_run.head_branch }}
35-
commit_sha: ${{ github.event.workflow_run.head_sha }}
36-
3724
- name: Log in to the GitHub Container Registry
3825
uses: docker/login-action@v3
3926
with:
4027
registry: ghcr.io
4128
username: ${{ github.actor }}
4229
password: ${{ secrets.GITHUB_TOKEN }}
4330

44-
- name: Pull unofficial image from GitHub Container Registry
45-
run: |
46-
docker pull ${{ env.GHCR_REPO }}:${{ steps.set_tag.outputs.tag }}
47-
4831
- name: Login to Docker registry
4932
uses: docker/login-action@v3
5033
with:
5134
registry: docker.io
5235
username: ${{ secrets.DOCKER_USERNAME }}
5336
password: ${{ secrets.DOCKER_PASSWORD }}
54-
37+
5538
- name: Log in to Quay registry
5639
uses: docker/login-action@v3
5740
with:
5841
registry: quay.io
5942
username: ${{ secrets.QUAY_USERNAME }}
6043
password: ${{ secrets.QUAY_PASSWORD }}
44+
45+
# Note, we have to be careful how we retrive the image. The event that pushed
46+
# the image to the ghcr.io repo was mainly a push/schedule that passed all the
47+
# tests. This event has access to github.ref_name. However, the workflow_run
48+
# event does not have access github.ref_name set up.
49+
#
50+
# Therefore, we need to manually specify the branch as main
51+
- name: Prepare image tag
52+
id: set_tag
53+
uses: ./.github/actions/set-tag
54+
with:
55+
branch_name: ${{ github.event.workflow_run.head_branch }}
56+
commit_sha: ${{ github.event.workflow_run.head_sha }}
6157

6258
- name: Prepare tag for promoted image
6359
id: promoted_tag

‎.github/workflows/release-image.yml‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
name: Release Image
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
description: "Release version (e.g., 1.2.3)"
8+
required: true
9+
type: string
10+
authors:
11+
description: "Comma-separated list of the release authors' emails"
12+
required: true
13+
type: string
14+
commit_sha:
15+
description: "Commit SHA to use for the image (e.g. 7c2a91 or latest)"
16+
required: false
17+
default: "latest"
18+
type: string
19+
push:
20+
branches:
21+
- '**'
22+
23+
permissions:
24+
contents: write
25+
pull-requests: write
26+
27+
jobs:
28+
release-image:
29+
runs-on: ubuntu-latest
30+
environment: release
31+
env:
32+
VERSION: test-0.0.1
33+
AUTHORS: [email protected]
34+
COMMIT_SHA: 99511c
35+
36+
DOCKER_RELEASE_REPO: docker.io/andrpac/mongodb-atlas-kubernetes-operator
37+
DOCKER_PRERELEASE_REPO: docker.io/andrpac/mongodb-atlas-kubernetes-operator-prerelease
38+
DOCKER_SIGNATURE_REPO: docker.io/andrpac/signatures
39+
QUAY_RELEASE_REPO: quay.io/andrpac/mongodb-atlas-kubernetes-operator
40+
QUAY_PRERELEASE_REPO: quay.io/andrpac/mongodb-atlas-kubernetes-operator-prerelease
41+
42+
steps:
43+
- name: Checkout code
44+
uses: actions/checkout@v4
45+
with:
46+
fetch-depth: 0
47+
48+
- name: Generate GitHub App Token
49+
id: generate_token
50+
uses: mongodb/apix-action/token@v8
51+
with:
52+
app-id: ${{ secrets.AKO_RELEASER_APP_ID }}
53+
private-key: ${{ secrets.AKO_RELEASER_RSA_KEY }}
54+
55+
# Login in into all registries
56+
- name: Log in to Docker registry
57+
uses: docker/login-action@v3
58+
with:
59+
registry: docker.io
60+
username: ${{ secrets.ANDRPAC_DOCKER_USERNAME }}
61+
password: ${{ secrets.ANDRPAC_DOCKER_PASSWORD }}
62+
63+
- name: Log in to Quay registry
64+
uses: docker/login-action@v3
65+
with:
66+
registry: quay.io
67+
username: ${{ secrets.ANDRPAC_QUAY_USERNAME }}
68+
password: ${{ secrets.ANDRPAC_QUAY_PASSWORD }}
69+
70+
- name: Log in to Artifactory
71+
uses: docker/login-action@v3
72+
with:
73+
registry: artifactory.corp.mongodb.com
74+
username: ${{ secrets.MDB_ARTIFACTORY_USERNAME }}
75+
password: ${{ secrets.MDB_ARTIFACTORY_PASSWORD }}
76+
77+
- name: Install devbox
78+
uses: jetify-com/[email protected]
79+
80+
- name: Resolve commit SHA and tags
81+
id: tags
82+
run: |
83+
if [ "${{ env.COMMIT_SHA }}" = "latest" ]; then
84+
git fetch origin main
85+
sha=$(git rev-parse origin/main)
86+
else
87+
sha="${{ env.COMMIT_SHA }}"
88+
fi
89+
90+
short_sha="${sha:0:6}"
91+
promoted_tag="promoted-${short_sha}"
92+
release_tag="${{ env.VERSION }}"
93+
certified_tag="certified-${release_tag}"
94+
95+
docker_image_url="${{ env.DOCKER_RELEASE_REPO }}:${release_tag}"
96+
quay_image_url="${{ env.QUAY_RELEASE_REPO }}:${release_tag}"
97+
quay_certified_image_url="${{ env.QUAY_RELEASE_REPO }}:${certified_tag}"
98+
99+
echo "promoted_tag=${promoted_tag}" >> "$GITHUB_OUTPUT"
100+
echo "release_tag=${release_tag}" >> "$GITHUB_OUTPUT"
101+
echo "certified_tag=${certified_tag}" >> "$GITHUB_OUTPUT"
102+
echo "docker_image_url=${docker_image_url}" >> "$GITHUB_OUTPUT"
103+
echo "quay_image_url=${quay_image_url}" >> "$GITHUB_OUTPUT"
104+
echo "quay_certified_image_url=${quay_certified_image_url}" >> "$GITHUB_OUTPUT"
105+
106+
# Move prerelease images to official release registries in Docker Hub and Quay
107+
- name: Promote Docker prerelease image
108+
run: devbox run -- ./scripts/move-image.sh
109+
env:
110+
IMAGE_SRC_REPO: ${{ env.DOCKER_PRERELEASE_REPO }}
111+
IMAGE_DEST_REPO: ${{ env.DOCKER_RELEASE_REPO }}
112+
IMAGE_SRC_TAG: ${{ steps.tags.outputs.promoted_tag }}
113+
IMAGE_DEST_TAG: ${{ steps.tags.outputs.release_tag }}
114+
115+
- name: Promote Quay prerelease image
116+
run: devbox run -- ./scripts/move-image.sh
117+
env:
118+
IMAGE_SRC_REPO: ${{ env.QUAY_PRERELEASE_REPO }}
119+
IMAGE_DEST_REPO: ${{ env.QUAY_RELEASE_REPO }}
120+
IMAGE_SRC_TAG: ${{ steps.tags.outputs.promoted_tag }}
121+
IMAGE_DEST_TAG: ${{ steps.tags.outputs.release_tag }}
122+
123+
# Create Openshift certified images
124+
- name: Create OpenShift certified image on Quay
125+
run: devbox run -- ./scripts/move-image.sh
126+
env:
127+
IMAGE_SRC_REPO: ${{ env.QUAY_PRERELEASE_REPO }}
128+
IMAGE_DEST_REPO: ${{ env.QUAY_RELEASE_REPO }}
129+
IMAGE_SRC_TAG: ${{ steps.tags.outputs.promoted_tag }}
130+
IMAGE_DEST_TAG: ${{ steps.tags.outputs.certified_tag }}
131+
132+
# Link updates to pr: all-in-one.yml, helm-updates, sdlc requirements
133+
- name: Generate deployment configurations
134+
uses: ./.github/actions/gen-install-scripts
135+
with:
136+
ENV: prod
137+
IMAGE_URL: ${{ steps.tags.outputs.docker_image_url }}
138+
139+
- name: Bump Helm chart version
140+
run: devbox run -- ./scripts/bump-helm-chart-version.sh
141+
142+
# Prepare SDLC requirement: signatures, sboms, compliance reports
143+
# Note, signed images will live in mongodb/release and mongodb/signature repos
144+
- name: Sign released images
145+
run: |
146+
devbox run -- make sign IMG="${{ steps.tags.outputs.docker_image_url }}" SIGNATURE_REPO="${{ env.DOCKER_RELEASE_REPO }}"
147+
devbox run -- make sign IMG="${{ steps.tags.outputs.quay_image_url }}" SIGNATURE_REPO="${{ env.QUAY_RELEASE_REPO }}"
148+
devbox run -- make sign IMG="${{ steps.tags.outputs.docker_image_url }}" SIGNATURE_REPO="${{ env.DOCKER_SIGNATURE_REPO }}"
149+
devbox run -- make sign IMG="${{ steps.tags.outputs.quay_certified_image_url }}" SIGNATURE_REPO="${{ env.QUAY_RELEASE_REPO }}"
150+
devbox run -- make sign IMG="${{ steps.tags.outputs.quay_certified_image_url }}" SIGNATURE_REPO="${{ env.DOCKER_SIGNATURE_REPO }}"
151+
env:
152+
PKCS11_URI: ${{ secrets.PKCS11_URI }}
153+
GRS_USERNAME: ${{ secrets.GRS_USERNAME }}
154+
GRS_PASSWORD: ${{ secrets.GRS_PASSWORD }}
155+
156+
- name: Generate SBOMs
157+
run: devbox run -- make generate-sboms
158+
env:
159+
RELEASED_OPERATOR_IMAGE: ${{ env.DOCKER_RELEASE_REPO }}
160+
161+
- name: Generate SDLC report
162+
run: devbox run -- make gen-sdlc-checklist
163+
164+
# Create pr with all updates
165+
- name: Create pull request for release changes
166+
uses: peter-evans/create-pull-request@v6
167+
with:
168+
token: ${{ steps.generate_token.outputs.token }}
169+
commit-message: "chore(release): updates from new release v${{ env.VERSION }}"
170+
title: "Release v${{ env.VERSION }}"
171+
body: |
172+
This PR was automatically generated by the **release-image** workflow.
173+
174+
Version: `${{ env.VERSION }}`
175+
Authors: ${{ env.AUTHORS }}
176+
base: main
177+
branch: "new-release/${{ env.VERSION }}" # This should avoid for now running all tests till we fix cloud-test-filter.yml
178+
delete-branch: true
179+
draft: true
180+
181+
# Create release assets on GitHub
182+
- name: Create configuration package
183+
run: |
184+
devbox run -- 'set -x'
185+
devbox run -- 'tar czvf atlas-operator-all-in-one-${{ env.VERSION }}.tar.gz -C deploy all-in-one.yaml'
186+
187+
- name: Create Release
188+
id: create_release
189+
uses: actions/create-release@v1
190+
env:
191+
GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
192+
with:
193+
tag_name: ${{ env.VERSION }}
194+
release_name: ${{ env.VERSION }}
195+
body_path: docs/release-notes/release-notes-template.md
196+
draft: true
197+
prerelease: false
198+
199+
- name: Upload Release Asset
200+
id: upload-release-asset
201+
uses: actions/upload-release-asset@v1
202+
env:
203+
GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
204+
with:
205+
upload_url: ${{ steps.create_release.outputs.upload_url }}
206+
asset_path: ./atlas-operator-all-in-one-${{ env.VERSION }}.tar.gz
207+
asset_name: atlas-operator-all-in-one-${{ env.VERSION }}.tar.gz
208+
asset_content_type: application/tgz

0 commit comments

Comments
 (0)