Skip to content

Commit 37f6def

Browse files
aroberts87aroberts87
authored
ci(rh-shield-operator): enhance operator release pipeline (#2270)
1 parent eece320 commit 37f6def

File tree

1 file changed

+135
-15
lines changed

1 file changed

+135
-15
lines changed

‎.github/workflows/release-rh-shield-operator.yaml‎

Lines changed: 135 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,37 @@
1-
name: Release the Shield Operator
1+
name: Build and Push the Shield Operator
22

33
on:
4-
workflow_dispatch:
5-
inputs:
6-
release_version:
7-
description: 'The version of the operator to release'
8-
required: true
9-
type: string
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- 'rh-shield-operator/Makefile' # Updated by the release pipelines
9+
1010
jobs:
11-
build-and-push:
12-
name: Build and Push the Operator Images
11+
determine-operator-version:
12+
name: Determine the Operator Version
13+
runs-on: ubuntu-latest
14+
outputs:
15+
release_version: ${{ steps.get-operator-version.outputs.release_version }}
16+
steps:
17+
- name: Checkout charts repo
18+
uses: actions/checkout@v4
19+
with:
20+
fetch-depth: '1'
21+
22+
- name: Get Operator Version
23+
id: get-operator-version
24+
run: |
25+
VERSION=$(awk '/^VERSION/{print $3}' Makefile)
26+
echo "Discovered release version is $VERSION"
27+
echo "release_version=$VERSION" >> $GITHUB_OUTPUT
28+
working-directory: rh-shield-operator
29+
30+
build-operator:
31+
name: Build the Operator Image
1332
runs-on: ubuntu-latest
1433
steps:
15-
- name: Checkout
34+
- name: Checkout charts repo
1635
uses: actions/checkout@v4
1736
with:
1837
fetch-depth: '1'
@@ -24,10 +43,111 @@ jobs:
2443
username: ${{ secrets.QUAY_RH_SHIELD_OPERATOR_USERNAME }}
2544
password: ${{ secrets.QUAY_RH_SHIELD_OPERATOR_PASSWORD }}
2645

27-
- name: Build and Push Operator and Bundle Images
28-
env:
29-
IMAGE_TAG_BASE: ${{ secrets.QUAY_RH_SHIELD_OPERATOR_IMAGE_TAG_BASE }}
30-
VERSION: ${{ github.event.inputs.release_version }}
46+
- name: Build and Push Operator Image
47+
id: build-operator
3148
run: |
32-
make docker-build docker-push bundle-build bundle-push
49+
make docker-build docker-push
50+
working-directory: rh-shield-operator
51+
52+
build-operator-bundle:
53+
name: Build the Operator Bundle
54+
runs-on: ubuntu-latest
55+
needs:
56+
- build-operator
57+
- determine-operator-version
58+
steps:
59+
- name: Checkout charts repo
60+
uses: actions/checkout@v4
61+
with:
62+
fetch-depth: '1'
63+
64+
- name: Login to Docker registry
65+
uses: docker/login-action@v3
66+
with:
67+
registry: quay.io
68+
username: ${{ secrets.QUAY_RH_SHIELD_OPERATOR_USERNAME }}
69+
password: ${{ secrets.QUAY_RH_SHIELD_OPERATOR_PASSWORD }}
70+
71+
- name: Generate Bundle Content
72+
# When using 'USE_IMAGE_DIGEST', the 'make bundle' command inspects the live operator image from the registry
73+
# to generate the image digest. As a result, this step must be after the operator image has been
74+
# generated and pushed to the registry.
75+
run: |
76+
USE_IMAGE_DIGESTS=true make bundle
77+
working-directory: rh-shield-operator
78+
79+
- name: Set Labels and Annotations required for Certification on the Bundle
80+
uses: mikefarah/yq@v4
81+
with:
82+
cmd: |
83+
yq e -i '.metadata.name |= sub("rh-shield-operator", "sysdig-shield-operator")' rh-shield-operator/bundle/manifests/rh-shield-operator.clusterserviceversion.yaml
84+
yq e -i '.annotations."operators.operatorframework.io.bundle.package.v1" |= sub("rh-shield-operator", "sysdig-shield-operator")' rh-shield-operator/bundle/metadata/annotations.yaml
85+
yq e -i '.metadata.annotations.containerImage = (.spec.relatedImages[] | select(.name == "manager").image)' rh-shield-operator/bundle/manifests/rh-shield-operator.clusterserviceversion.yaml
86+
yq e -i '.metadata.annotations += {
87+
"features.operators.openshift.io/cnf": "false",
88+
"features.operators.openshift.io/cni": "false",
89+
"features.operators.openshift.io/csi": "false",
90+
"features.operators.openshift.io/disconnected": "false",
91+
"features.operators.openshift.io/fips-compliant": "false",
92+
"features.operators.openshift.io/proxy-aware": "false",
93+
"features.operators.openshift.io/tls-profiles": "false",
94+
"features.operators.openshift.io/token-auth-aws": "false",
95+
"features.operators.openshift.io/token-auth-azure": "false",
96+
"features.operators.openshift.io/token-auth-gcp": "false"
97+
}' rh-shield-operator/bundle/manifests/rh-shield-operator.clusterserviceversion.yaml
98+
yq e -i '.annotations."com.redhat.openshift.versions" = "v4.8-v4.17"' rh-shield-operator/bundle/metadata/annotations.yaml
99+
100+
- name: Open Pull Request for Bundle update
101+
uses: peter-evans/create-pull-request@v7
102+
id: open-pr
103+
with:
104+
token: ${{ secrets.TOOLS_JENKINS_ADMIN_ACCESS_GITHUB_TOKEN }}
105+
commit-message: |
106+
"chore(rh-shield-operator): update bundle for rh-shield-operator:v${{ steps.determine-operator-version.outputs.release_version }}"
107+
title: |
108+
"chore(rh-shield-operator): update bundle for rh-shield-operator:v${{ steps.determine-operator-version.outputs.release_version }}"
109+
body: |
110+
This is an automated pull request that is generated as a part of the rh-shield-operator release pipeline.
111+
The changes here update the bundle metadata using the newly published Operator image to generate the
112+
image checksum, as well as adjusting some metadata that is required for certification.
113+
114+
- name: Wait for Pull Request to be merged
115+
uses: Wandalen/[email protected]
116+
with:
117+
command: gh pr view ${{ steps.open-pr.outputs.pull-request-number }} --json state -q .state | grep MERGED
118+
attempt_limit: 240 # Results in 2 hours of waiting
119+
attempt_delay: 30000 # 30 seconds
120+
121+
- name: Build and Push Bundle Image
122+
run: |
123+
make bundle-build bundle-push
124+
working-directory: rh-shield-operator
125+
126+
certify-operator-image:
127+
name: Certify the Operator Image with Preflight
128+
runs-on: ubuntu-latest
129+
needs:
130+
- build-operator
131+
- determine-operator-version
132+
steps:
133+
- name: Checkout charts repo
134+
uses: actions/checkout@v4
135+
with:
136+
fetch-depth: '1'
137+
138+
- name: Install Preflight
139+
uses: redhat-actions/openshift-tools-installer@v1
140+
with:
141+
source: "github"
142+
preflight: "latest"
143+
github_pat: ${{ secrets.GITHUB_TOKEN }}
144+
145+
- name: Run Preflight checks
146+
run: |
147+
IMAGE_TAG_BASE=$(awk '/^IMAGE_TAG_BASE/{print $3}' Makefile)
148+
149+
preflight check container \
150+
$IMAGE_TAG_BASE:v${{ needs.determine-operator-version.outputs.release_version }} \
151+
--pyxis-api-token ${{ secrets.RH_SHIELD_OPERATOR_PYXIS_API_TOKEN }} \
152+
--certification-project-id ${{ secrets.RH_SHIELD_OPERATOR_CERTIFICATION_PROJECT_ID }}
33153
working-directory: rh-shield-operator

0 commit comments

Comments
 (0)