Separate mutable env from userdata env #12
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Podplane <https://podplane.dev> | |
| # Copyright The Podplane Authors | |
| # SPDX-License-Identifier: Apache-2.0 | |
| # | |
| # Release workflow: builds + publishes vmconfig artifacts on tag push. | |
| # | |
| # For tag vX.Y.Z (or vX.Y.Z-rcN for pre-releases), this: | |
| # 1. Builds the four arch/kind tarballs via `make package VERSION=X.Y.Z`. | |
| # The Makefile bakes the version into each tarball's embedded | |
| # /opt/podplane/share/vmconfig-manifest.json. | |
| # 2. Generates four standalone dependency manifests under dist/ from the | |
| # versioned package manifests staged under dist/manifests/; they | |
| # additionally contain a .vmconfig.dependencies.vmconfig entry with | |
| # the URL + sha256 digest + size of the matching tarball — the | |
| # self-reference VMs need to fetch + verify vmconfig.tar.gz before | |
| # extraction. | |
| # 3. Writes vmconfig_<VERSION>_checksums.txt (sha512) covering all | |
| # eight artifacts and signs it keyless with cosign (Fulcio + Rekor | |
| # via GitHub OIDC), producing a single self-contained sigstore bundle | |
| # named vmconfig_<VERSION>_checksums.txt.bundle. | |
| # 4. Creates a GitHub Release with auto-generated notes and uploads: | |
| # - 4 tarballs | |
| # - 4 standalone .json manifests | |
| # - vmconfig_<VERSION>_checksums.txt | |
| # - vmconfig_<VERSION>_checksums.txt.bundle | |
| name: release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| permissions: | |
| contents: write # create releases + upload assets | |
| id-token: write # cosign keyless OIDC | |
| jobs: | |
| release: | |
| runs-on: ubuntu-latest | |
| environment: release | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Install shellcheck | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y shellcheck | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Derive VERSION and pre-release flag | |
| id: meta | |
| run: | | |
| VERSION="${GITHUB_REF_NAME#v}" | |
| echo "version=${VERSION}" >> "$GITHUB_OUTPUT" | |
| if [[ "$VERSION" == *-* ]]; then | |
| echo "prerelease=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "prerelease=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Lint | |
| run: make lint | |
| - name: Build & package | |
| run: make package VERSION=${{ steps.meta.outputs.version }} | |
| - name: Generate standalone dependency manifests (with tarball URL + digest) | |
| env: | |
| VERSION: ${{ steps.meta.outputs.version }} | |
| REPO: ${{ github.repository }} | |
| run: | | |
| set -euo pipefail | |
| for kind in knd knc; do | |
| for arch in amd64 arm64; do | |
| tarball="vmconfig_${VERSION}_${kind}_debian-13_${arch}.tar.gz" | |
| digest="sha256:$(sha256sum "dist/${tarball}" | awk '{print $1}')" | |
| size="$(stat -c%s "dist/${tarball}")" | |
| url="https://github.com/${REPO}/releases/download/v${VERSION}/${tarball}" | |
| jq \ | |
| --arg url "$url" \ | |
| --arg digest "$digest" \ | |
| --argjson size "$size" \ | |
| '.vmconfig.dependencies.vmconfig.url = $url | |
| | .vmconfig.dependencies.vmconfig.digest = $digest | |
| | .vmconfig.dependencies.vmconfig.size = $size' \ | |
| "dist/manifests/${kind}.debian-13.${arch}.json" \ | |
| > "dist/vmconfig_${VERSION}_${kind}_debian-13_${arch}.json" | |
| done | |
| done | |
| - name: Generate checksums file (sha512) | |
| working-directory: dist | |
| env: | |
| VERSION: ${{ steps.meta.outputs.version }} | |
| run: | | |
| sha512sum vmconfig_*.tar.gz vmconfig_*.json \ | |
| | sort -k2 > "vmconfig_${VERSION}_checksums.txt" | |
| cat "vmconfig_${VERSION}_checksums.txt" | |
| - name: Sign checksums file with cosign (keyless, sigstore bundle) | |
| working-directory: dist | |
| env: | |
| VERSION: ${{ steps.meta.outputs.version }} | |
| run: | | |
| cosign sign-blob \ | |
| --yes \ | |
| --bundle="vmconfig_${VERSION}_checksums.txt.bundle" \ | |
| "vmconfig_${VERSION}_checksums.txt" | |
| - name: Create GitHub Release | |
| uses: softprops/action-gh-release@v2 | |
| with: | |
| files: | | |
| dist/vmconfig_*.tar.gz | |
| dist/vmconfig_*.json | |
| dist/vmconfig_*_checksums.txt | |
| dist/vmconfig_*_checksums.txt.bundle | |
| generate_release_notes: true | |
| prerelease: ${{ steps.meta.outputs.prerelease }} | |
| fail_on_unmatched_files: true | |
| - name: Create deps app token | |
| id: deps-app | |
| uses: actions/create-github-app-token@v2 | |
| with: | |
| app-id: ${{ vars.PODPLANE_DEPS_APP_ID }} | |
| private-key: ${{ secrets.PODPLANE_DEPS_APP_PRIVATE_KEY }} | |
| owner: podplane | |
| repositories: deps | |
| - name: Trigger deps sync | |
| env: | |
| GH_TOKEN: ${{ steps.deps-app.outputs.token }} | |
| run: | | |
| gh workflow run sync.yml \ | |
| --repo podplane/deps \ | |
| --ref main \ | |
| -f source_repo="${GITHUB_REPOSITORY}" \ | |
| -f source_ref="${GITHUB_REF_NAME}" |