Skip to content

Commit 466f90e

Browse files
mallardduckmallardduck
authored
Merge pull request #264 from mallardduck/4x-backport-slsa
[v4.x] Sync GitHub Actions workflows
2 parents e2b949c + 56fe26f commit 466f90e

File tree

8 files changed

+244
-36
lines changed

8 files changed

+244
-36
lines changed

‎.github/renovate.json‎

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,29 @@
22
"extends": [
33
"github>rancher/renovate-config#release"
44
],
5-
"baseBranches": [
5+
"baseBranchPatterns": [
66
"main",
77
"/^release\\/v[0-9]+.x/"
88
],
99
"prHourlyLimit": 24,
1010
"packageRules": [
1111
{
1212
"description": "Using allowedVersions ensures that the upstream range does not block patch bumps.",
13-
"matchDepNames": ["kubernetes/kubernetes"],
13+
"matchDepNames": [
14+
"kubernetes/kubernetes"
15+
],
1416
"separateMinorPatch": true,
1517
"allowedVersions": ">=1.28.0"
1618
},
1719
{
1820
"description": "Disable major and minor updates",
19-
"matchDepNames": ["kubernetes/kubernetes"],
20-
"matchUpdateTypes": ["major", "minor"],
21+
"matchDepNames": [
22+
"kubernetes/kubernetes"
23+
],
24+
"matchUpdateTypes": [
25+
"major",
26+
"minor"
27+
],
2128
"enabled": false
2229
},
2330
{
@@ -45,8 +52,8 @@
4552
"customManagers": [
4653
{
4754
"customType": "regex",
48-
"fileMatch": [
49-
"deps.mk$"
55+
"managerFilePatterns": [
56+
"/deps.mk$/"
5057
],
5158
"matchStrings": [
5259
"KUBECTL\\d_VERSION :=\\s(?<currentValue>.*?)\\n"

‎.github/scripts/bump-kubectl-patch-versions‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
# If the first argument ($1) is provided and not empty, use it.
5+
# Otherwise, default to "kubectl-versions.txt".
6+
VERSIONS_FILE=${1:-"kubectl-versions.txt"}
7+
TEMP_FILE="${VERSIONS_FILE}.tmp"
8+
UPDATE_LOG_FILE="${VERSIONS_FILE}.log"
9+
10+
echo "Using versions file: $VERSIONS_FILE"
11+
echo "Temporary file will be: $TEMP_FILE"
12+
echo "Log file will be: $UPDATE_LOG_FILE"
13+
14+
# Check if the input file exists
15+
if [[ ! -f "$VERSIONS_FILE" ]]; then
16+
echo "Error: Input file '$VERSIONS_FILE' not found."
17+
exit 1
18+
fi
19+
20+
RELEASES=$(gh api graphql -F owner='kubernetes' -F name='kubernetes' -f query='query($name: String!, $owner: String!) {repository(owner: $owner, name: $name) {releases(first: 100) {nodes { tagName, isPrerelease }} }}' | jq -r '.data.repository.releases.nodes[] | select(.isPrerelease != true) | .tagName' | sort -V)
21+
22+
# Iterate over each line of the input file
23+
while IFS= read -r VERSION || [[ -n "$VERSION" ]]; do
24+
PREFIX=$(echo "$VERSION" | cut -d. -f1,2)
25+
echo "Checking version for $VERSION - using $PREFIX to search..."
26+
NEWEST_OPTION=$(echo "$RELEASES"| grep "$PREFIX" | sort -rV |head -1)
27+
if [ "$VERSION" == "$NEWEST_OPTION" ]; then
28+
echo "Nothing to update - $VERSION already newest patch for that Major.Minor"
29+
# If the version is the same, keep the original line
30+
echo "$VERSION" >> "$TEMP_FILE"
31+
continue
32+
fi
33+
echo "Found newer patch $NEWEST_OPTION to replace $VERSION"
34+
echo "$NEWEST_OPTION" >> "$TEMP_FILE"
35+
echo "$NEWEST_OPTION" >> "$UPDATE_LOG_FILE"
36+
done < "$VERSIONS_FILE"
37+
38+
# Check if the temporary file was created successfully
39+
if [[ -f "$TEMP_FILE" ]]; then
40+
# Replace the original file with the temporary file
41+
mv "$TEMP_FILE" "$VERSIONS_FILE"
42+
echo "File updated successfully: $VERSIONS_FILE"
43+
else
44+
echo "Error: Temporary file not created. No changes made."
45+
exit 1
46+
fi
47+
48+
echo "Remember the $UPDATE_LOG_FILE must be cleaned up after reading..."

‎.github/scripts/check-semver‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
#!/usr/bin/env bash
2+
3+
# Usage:
4+
# ./check_tag.sh [tag]
5+
# If no tag is provided, it uses GITHUB_REF_NAME environment variable.
6+
7+
set -euo pipefail
8+
9+
# Input: tag
10+
tag="${1:-${GITHUB_REF_NAME:-}}"
11+
12+
if [[ -z "$tag" ]]; then
13+
echo "Error: No tag provided and GITHUB_REF_NAME is not set." >&2
14+
exit 1
15+
fi
16+
17+
# Strip leading 'v' if present
18+
if [[ "$tag" == v* ]]; then
19+
tag="${tag:1}"
20+
fi
21+
22+
# Function to detect prerelease (e.g. 1.2.3-beta)
23+
has_prerelease() {
24+
[[ "$1" =~ ^[0-9]+\.[0-9]+\.[0-9]+- ]]
25+
}
26+
27+
# Function to detect build metadata (e.g. 1.2.3+build.1)
28+
has_build_meta() {
29+
[[ "$1" =~ \+ ]]
30+
}
31+
32+
# Output results to stdout
33+
if has_prerelease "$tag"; then
34+
echo "HAS_PRERELEASE=true"
35+
else
36+
echo "HAS_PRERELEASE=false"
37+
fi
38+
39+
if has_build_meta "$tag"; then
40+
echo "HAS_BUILD_META=true"
41+
else
42+
echo "HAS_BUILD_META=false"
43+
fi

‎.github/workflows/ci.yml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,23 +26,30 @@ concurrency:
2626
group: ${{ github.workflow }}-${{ github.ref }}
2727
cancel-in-progress: true
2828

29-
permissions:
30-
contents: write # Upload artefacts to release.
31-
3229
env:
3330
PUBLIC_REGISTRY: ghcr.io
3431

3532
jobs:
3633
ci:
34+
permissions:
35+
contents: write # Upload artefacts to release.
36+
# write is needed for:
37+
# - OIDC for cosign's use in ecm-distro-tools/publish-image.
38+
# - Read vault secrets in rancher-eio/read-vault-secrets.
39+
id-token: write
40+
packages: write
41+
attestations: write
3742
runs-on: runs-on,runner=2cpu-linux-x64,run-id=${{ github.run_id }}
3843
steps:
44+
- name: Check out repository code
45+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
46+
3947
-
4048
# Add support for more platforms with QEMU (optional)
4149
# https://github.com/docker/setup-qemu-action
4250
name: Set up QEMU
4351
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
44-
- name: Check out repository code
45-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
52+
4653
- name: Basic CI
4754
run: make ci
4855
- name: Upload CI files to artifacts (on failure)

‎.github/workflows/cleanup.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: Clean PR Branch
2+
3+
on:
4+
pull_request:
5+
types: [closed]
6+
7+
jobs:
8+
cleanup:
9+
runs-on: ubuntu-latest
10+
if: contains(github.event.pull_request.labels.*.name, 'status/auto-created')
11+
steps:
12+
- name: Checkout repository
13+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
14+
- name: Check PR branch exists
15+
id: check-branch
16+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
17+
with:
18+
script: |
19+
try {
20+
let {status: status} = await github.rest.git.getRef({
21+
owner: context.repo.owner,
22+
repo: context.repo.repo,
23+
ref: "heads/${{ github.event.pull_request.head.ref }}"
24+
})
25+
if (status == 200) {
26+
await core.summary
27+
.addHeading("PR Branch Found", 2)
28+
.addRaw("The PR branch was found and will be cleaned up.")
29+
.write();
30+
} else {
31+
32+
core.setFailed("Branch not found, nothing to clean. (failure can be ignored)");
33+
}
34+
}
35+
catch (err) {
36+
if (err.response && err.response.status === 404) {
37+
await core.summary
38+
.addHeading("PR Branch Not Found", 2)
39+
.addRaw("The PR branch didn't exist; the action failure can be ignored.")
40+
.write();
41+
core.setFailed("Branch not found, nothing to clean. (failure can be ignored)");
42+
} else {
43+
core.setFailed(`Action failed with error ${err}`);
44+
}
45+
}
46+
- name: Delete the PR branch
47+
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
48+
with:
49+
script: |
50+
try {
51+
let {status: status} = github.rest.git.deleteRef({
52+
owner: context.repo.owner,
53+
repo: context.repo.repo,
54+
ref: "heads/${{ github.event.pull_request.head.ref }}"
55+
})
56+
await core.summary
57+
.addHeading("PR Branch Deleted", 2)
58+
.addRaw("The PR's branch `${{ github.event.pull_request.head.ref }}` was deleted.")
59+
.write();
60+
}
61+
catch (err) {
62+
// setFailed logs the message and sets a failing exit code
63+
core.setFailed(`Action failed with error ${err}`);
64+
}

‎.github/workflows/e2e-ci.yaml‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -43,30 +43,33 @@ env:
4343
DEBUG: ${{ github.event.inputs.debug || false }}
4444
CLUSTER_NAME: 'e2e-ci-kuberlr-kubectl'
4545

46-
permissions:
47-
contents: write
48-
4946
jobs:
5047
e2e-kuberlr-kubectl:
48+
permissions:
49+
contents: write # Upload artefacts to release.
50+
# write is needed for:
51+
# - OIDC for cosign's use in ecm-distro-tools/publish-image.
52+
# - Read vault secrets in rancher-eio/read-vault-secrets.
53+
id-token: write
54+
packages: write
55+
attestations: write
5156
strategy:
5257
matrix:
5358
arch:
5459
- x64
5560
- arm64
5661
runs-on: ${{ github.repository == 'rancher/kuberlr-kubectl' && format('runs-on,image=ubuntu22-full-{1},runner=4cpu-linux-{1},run-id={0}', github.run_id, matrix.arch) || 'ubuntu-latest' }}
5762
steps:
63+
-
64+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
65+
with:
66+
fetch-depth: 0
67+
5868
-
5969
# Add support for more platforms with QEMU (optional)
6070
# https://github.com/docker/setup-qemu-action
6171
name: Set up QEMU
6272
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
63-
-
64-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
65-
with:
66-
fetch-depth: 0
67-
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
68-
with:
69-
go-version: '>=1.20.0'
7073
- uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4
7174
- name : Install helm
7275
uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4

‎.github/workflows/release.yml‎

Lines changed: 51 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -15,17 +15,15 @@ on:
1515
# - PUBLIC_REGISTRY_USERNAME
1616
# - PUBLIC_REGISTRY_PASSWORD
1717

18-
permissions:
19-
contents: write # Upload artefacts to release.
20-
2118
env:
2219
PUBLIC_REGISTRY: docker.io
20+
REPO: rancher
2321

2422
jobs:
2523

2624
publish-public:
2725
permissions:
28-
contents: read
26+
contents: write
2927
# write is needed for:
3028
# - OIDC for cosign's use in ecm-distro-tools/publish-image.
3129
# - Read vault secrets in rancher-eio/read-vault-secrets.
@@ -44,26 +42,71 @@ jobs:
4442
- name: Check out repository code
4543
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4644

45+
- name : Make test helm chart
46+
env:
47+
TAG_NAME: ${{ github.ref_name }}
48+
run: TAG=$TAG_NAME make package-helm
49+
- name: Add test helm chart to release
50+
env:
51+
TAG_NAME: ${{ github.ref_name }}
52+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
53+
run: |
54+
gh release upload "${TAG_NAME}" "./build/charts/rancher-kubectl-test-${TAG_NAME#v}.tgz"
55+
4756
- name: Load Secrets from Vault
4857
uses: rancher-eio/read-vault-secrets@main
4958
with:
5059
secrets: |
5160
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
5261
secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD ;
62+
secret/data/github/repo/${{ github.repository }}/rancher-prime-stg-registry/credentials registry | PRIME_STG_REGISTRY ;
63+
secret/data/github/repo/${{ github.repository }}/rancher-prime-stg-registry/credentials username | PRIME_STG_REGISTRY_USERNAME ;
64+
secret/data/github/repo/${{ github.repository }}/rancher-prime-stg-registry/credentials password | PRIME_STG_REGISTRY_PASSWORD ;
5365
54-
- name: Build and push all platforms
66+
- name: Build and push kuberlr-kubectl image (dockerhub and prime stg)
5567
uses: rancher/ecm-distro-tools/actions/publish-image@master
5668
with:
5769
image: ${{ vars.IMAGE_NAME || 'kuberlr-kubectl' }}
5870
tag: ${{ github.ref_name }}
59-
platforms: "linux/amd64,linux/arm64"
6071

6172
public-registry: ${{ env.PUBLIC_REGISTRY }}
62-
public-repo: ${{ vars.REPO || github.repository_owner }}
73+
public-repo: ${{ vars.REPO || env.REPO || github.repository_owner }}
6374
public-username: ${{ env.DOCKER_USERNAME || vars.DOCKER_USERNAME || github.repository_owner }}
6475
public-password: ${{ env.DOCKER_PASSWORD || secrets.DOCKER_PASSWORD }}
6576

66-
push-to-prime: false
77+
push-to-prime: true
78+
prime-registry: ${{ env.PRIME_STG_REGISTRY }}
79+
prime-repo: rancher
80+
prime-username: ${{ env.PRIME_STG_REGISTRY_USERNAME }}
81+
prime-password: ${{ env.PRIME_STG_REGISTRY_PASSWORD }}
82+
83+
- name: Check SemVer Characteristics
84+
id: semver_check
85+
run: bash ./.github/scripts/check-semver "${{ github.ref_name }}" >> "$GITHUB_OUTPUT"
86+
87+
- name: Load Secrets from Vault
88+
if: ${{ steps.semver_check.outputs.HAS_PRERELEASE == 'false' }}
89+
uses: rancher-eio/read-vault-secrets@main
90+
with:
91+
secrets: |
92+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials registry | PRIME_REGISTRY ;
93+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials username | PRIME_REGISTRY_USERNAME ;
94+
secret/data/github/repo/${{ github.repository }}/rancher-prime-registry/credentials password | PRIME_REGISTRY_PASSWORD ;
95+
96+
- name: Build and push kuberlr-kubectl image (prime prod)
97+
if: ${{ steps.semver_check.outputs.HAS_PRERELEASE == 'false' }}
98+
uses: rancher/ecm-distro-tools/actions/publish-image@master
99+
with:
100+
image: ${{ vars.IMAGE_NAME || 'kuberlr-kubectl' }}
101+
tag: ${{ github.ref_name }}
102+
103+
push-to-public: false
104+
105+
push-to-prime: true
106+
prime-registry: ${{ env.PRIME_REGISTRY }}
107+
prime-repo: rancher
108+
prime-username: ${{ env.PRIME_REGISTRY_USERNAME }}
109+
prime-password: ${{ env.PRIME_REGISTRY_PASSWORD }}
67110

68111
-
69112
name: Login to GitHub Container Registry

‎scripts/version‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,13 +15,6 @@ else
1515
VERSION="${COMMIT}${DIRTY}"
1616
fi
1717

18-
ARCH=$TARGET_ARCH
19-
if [ -z "$ARCH" ]; then
20-
ARCH=$(go env GOHOSTARCH)
21-
fi
22-
23-
SUFFIX="-${ARCH}"
24-
2518
TAG=${TAG:-${BRANCH_TAG:-${VERSION}}}
2619
REPO=${REPO:-rancher}
2720

0 commit comments

Comments
 (0)