Joshua Hoblitt
d4162c3917
Nothing verified that the commit being tagged for a release actually
carries the intended version. Tagging a release branch before the version
update PR is merged publishes images and manifests that reference the
previous release. Add build/release/validate-tag.sh to check that the tree
is clean and that deploy/examples/images.txt and the helm chart values
match the tag, run it from the release build workflow before any artifact
is published, and document it in the tagging steps. Alpha tags are exempt
as they only mark the creation of a release branch.
Signed-off-by: Joshua Hoblitt <josh@hoblitt.com>
(cherry picked from commit adda6b17d3)
# Conflicts:
# .github/workflows/push-build.yaml
108 lines
3.3 KiB
YAML
108 lines
3.3 KiB
YAML
name: Push Image Build
|
|
on:
|
|
push:
|
|
branches:
|
|
- master
|
|
- release-*
|
|
tags:
|
|
- v*
|
|
|
|
defaults:
|
|
run:
|
|
# reference: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#using-a-specific-shell
|
|
shell: bash --noprofile --norc -eo pipefail -x {0}
|
|
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write # for cosign OIDC keyless signing
|
|
|
|
jobs:
|
|
push-image-to-container-registry:
|
|
runs-on: ubuntu-22.04
|
|
if: github.repository == 'rook/rook'
|
|
steps:
|
|
- name: checkout
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: validate release version
|
|
if: startsWith(github.ref, 'refs/tags/v')
|
|
env:
|
|
TAG_NAME: ${{ github.ref_name }}
|
|
run: build/release/validate-tag.sh "$TAG_NAME"
|
|
|
|
- uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
|
|
with:
|
|
go-version: "1.26"
|
|
|
|
# docker/setup-qemu action installs QEMU static binaries, which are used to run builders for architectures other than the host.
|
|
- name: set up QEMU
|
|
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # master
|
|
with:
|
|
platforms: all
|
|
|
|
- name: Install cosign
|
|
uses: sigstore/cosign-installer@v4.1.1 # v3.10.0
|
|
|
|
- name: log in to container registry
|
|
uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 # v4.0.0
|
|
with:
|
|
username: ${{ secrets.DOCKER_USERNAME }}
|
|
password: ${{ secrets.DOCKER_PASSWORD }}
|
|
|
|
- name: Login to Quay.io
|
|
uses: docker/login-action@v4
|
|
with:
|
|
registry: quay.io
|
|
username: ${{ secrets.QUAY_USERNAME }}
|
|
password: ${{ secrets.QUAY_ROBOT_TOKEN }}
|
|
|
|
- name: Login to GitHub Container Registry
|
|
uses: docker/login-action@v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Configure AWS Credentials
|
|
uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
|
|
with:
|
|
aws-access-key-id: ${{ secrets.AWS_USR }}
|
|
aws-secret-access-key: ${{ secrets.AWS_PSW }}
|
|
aws-region: us-east-1
|
|
|
|
# creating custom env var
|
|
- name: set env
|
|
run: |
|
|
echo "BRANCH_NAME=${GITHUB_REF##*/}" >> "$GITHUB_ENV"
|
|
echo "GITHUB_REF=${GITHUB_REF}" >> "$GITHUB_ENV"
|
|
|
|
- uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
|
|
with:
|
|
python-version: 3.13
|
|
|
|
- name: Install dependencies
|
|
run: |
|
|
python3 -m pip install --upgrade pip setuptools wheel
|
|
sudo apt-get -q update
|
|
sudo apt-get -q install -y python3-pygit2
|
|
|
|
- name: Configure git user
|
|
run: |
|
|
# Use our Rook "service account"
|
|
git config user.name Rook
|
|
git config user.email "cncf-rook-info@lists.cncf.io"
|
|
|
|
- name: build and release
|
|
env:
|
|
GIT_API_TOKEN: ${{ secrets.GIT_API_TOKEN }}
|
|
BRANCH_NAME: ${{ env.BRANCH_NAME }}
|
|
AWS_USR: ${{ secrets.AWS_USR }}
|
|
AWS_PSW: ${{ secrets.AWS_PSW }}
|
|
GITHUB_REF: ${{ env.GITHUB_REF }}
|
|
run: |
|
|
tests/scripts/build-release.sh
|