chore(deps): upgrade troubleshoot to v0.134.0 and k8s libs to 1.37 (#… #3366
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release | |
| on: | |
| push: | |
| tags: | |
| - "v*.*.*" | |
| branches: | |
| - main | |
| permissions: | |
| contents: write | |
| jobs: | |
| generate-tag: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| tag: ${{ github.ref_type == 'branch' && steps.get_tag.outputs.GIT_TAG || github.ref_name }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Get tags | |
| id: get_tag | |
| uses: ./.github/actions/version-tag | |
| - name: Push tag | |
| if: github.ref_type == 'branch' | |
| env: | |
| GIT_TAG: ${{ steps.get_tag.outputs.GIT_TAG }} | |
| run: | | |
| git tag "$GIT_TAG" | |
| git push origin "$GIT_TAG" | |
| build-melange-packages: | |
| needs: [generate-tag] | |
| if: contains(needs.generate-tag.outputs.tag, '-') | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| runner: [ | |
| {name: ubuntu-latest, arch: amd64}, | |
| {name: arm64-runner-set, arch: arm64} | |
| ] | |
| runs-on: ${{ matrix.runner.name }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: ./.github/actions/build-securebuild-package-locally | |
| with: | |
| git-tag: ${{ needs.generate-tag.outputs.tag }} | |
| arch: ${{ matrix.runner.arch }} | |
| build-securebuild: | |
| needs: [generate-tag] | |
| if: github.ref_type == 'tag' && !contains(needs.generate-tag.outputs.tag, '-') | |
| uses: ./.github/workflows/publish-securebuild.yml | |
| with: | |
| version: ${{ needs.generate-tag.outputs.tag }} | |
| secrets: inherit | |
| build-migrations: | |
| runs-on: ubuntu-latest | |
| needs: [generate-tag, build-melange-packages, build-securebuild] | |
| if: ${{ !cancelled() && needs.generate-tag.result == 'success' && (needs.build-melange-packages.result == 'success' || needs.build-securebuild.result == 'success') }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - if: contains(needs.generate-tag.outputs.tag, '-') | |
| uses: ./.github/actions/build-securebuild-image-locally | |
| with: | |
| config: securebuild/image/apko-kotsadm-migrations.yaml | |
| image-name: index.docker.io/kotsadm/kotsadm-migrations:${{ needs.generate-tag.outputs.tag }} | |
| registry-username: ${{ secrets.DOCKERHUB_USER }} | |
| registry-password: ${{ secrets.DOCKERHUB_PASSWORD }} | |
| build-web: | |
| runs-on: ubuntu-latest | |
| needs: [generate-tag] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Setup Node.js environment | |
| uses: actions/setup-node@v7 | |
| with: | |
| node-version-file: ./web/.nvmrc | |
| - name: Build web | |
| env: | |
| GIT_TAG: ${{ needs.generate-tag.outputs.tag }} | |
| run: mapfile -t envs < <(grep -v '#.*' < .image.env) && export "${envs[@]}" && make -C web deps build-kotsadm | |
| - name: Upload web artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: web | |
| path: ./web/dist | |
| build-kurl-proxy: | |
| runs-on: ubuntu-latest | |
| needs: [generate-tag, build-melange-packages, build-securebuild] | |
| if: ${{ !cancelled() && needs.generate-tag.result == 'success' && (needs.build-melange-packages.result == 'success' || needs.build-securebuild.result == 'success') }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - if: contains(needs.generate-tag.outputs.tag, '-') | |
| uses: ./.github/actions/build-securebuild-image-locally | |
| with: | |
| config: securebuild/image/apko-kurl-proxy.yaml | |
| image-name: index.docker.io/kotsadm/kurl-proxy:${{ needs.generate-tag.outputs.tag }} | |
| registry-username: ${{ secrets.DOCKERHUB_USER }} | |
| registry-password: ${{ secrets.DOCKERHUB_PASSWORD }} | |
| build-kots: | |
| runs-on: ubuntu-latest | |
| needs: [build-web, generate-tag] | |
| # The runner's /etc/containers/registries.conf is v1 format, which | |
| # podman/image v5+ rejects. Override with a v2 config via env var. | |
| env: | |
| CONTAINERS_REGISTRIES_CONF: /tmp/registries-v2.conf | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| - name: Cache Go modules | |
| uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ~/.cache/go-build | |
| ~/go/pkg/mod | |
| key: ${{ runner.os }}-go-kots-${{ hashFiles('**/go.sum') }} | |
| restore-keys: | | |
| ${{ runner.os }}-go-kots- | |
| - name: Download web artifact | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: web | |
| path: ./web/dist | |
| - name: Write v2 registries config | |
| run: echo 'unqualified-search-registries = ["docker.io", "quay.io"]' > "$CONTAINERS_REGISTRIES_CONF" | |
| - name: Build KOTS | |
| env: | |
| GIT_TAG: ${{ needs.generate-tag.outputs.tag }} | |
| SCOPE_DSN_PUBLIC: "" | |
| run: mapfile -t envs < <(grep -v '#.*' < .image.env) && export "${envs[@]}" && make ci-test kots | |
| - name: Upload Go API artifact | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: kots | |
| path: ./bin/kots | |
| build-kotsadm: | |
| runs-on: ubuntu-latest | |
| needs: [generate-tag, build-melange-packages, build-securebuild] | |
| if: ${{ !cancelled() && needs.generate-tag.result == 'success' && (needs.build-melange-packages.result == 'success' || needs.build-securebuild.result == 'success') }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - if: contains(needs.generate-tag.outputs.tag, '-') | |
| uses: ./.github/actions/build-securebuild-image-locally | |
| with: | |
| config: securebuild/image/apko-kotsadm.yaml | |
| image-name: index.docker.io/kotsadm/kotsadm:${{ needs.generate-tag.outputs.tag }} | |
| registry-username: ${{ secrets.DOCKERHUB_USER }} | |
| registry-password: ${{ secrets.DOCKERHUB_PASSWORD }} | |
| build-kotsadm-bundle: | |
| runs-on: ubuntu-latest | |
| needs: [generate-tag, build-migrations, build-kotsadm] | |
| if: ${{ !cancelled() && needs.generate-tag.result == 'success' && needs.build-migrations.result == 'success' && needs.build-kotsadm.result == 'success' }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| - name: Run bundle registry | |
| run: | | |
| mkdir -p kotsadm-bundle/images | |
| mkdir -p kotsadm-bundle-nominio/images | |
| docker run -d -p 5000:5000 --restart=always --name registry -v "$(pwd)/kotsadm-bundle/images":/var/lib/registry registry:2 | |
| docker run -d -p 5001:5000 --restart=always --name registry-nominio -v "$(pwd)/kotsadm-bundle-nominio/images":/var/lib/registry registry:2 | |
| - name: Build kotsadm bundle | |
| env: | |
| BUNDLE_DIR: kotsadm-bundle | |
| BUNDLE_REGISTRY: localhost:5000 | |
| GIT_TAG: ${{ needs.generate-tag.outputs.tag }} | |
| run: mapfile -t envs < <(grep -v '#.*' < .image.env) && export "${envs[@]}" && make kotsadm-bundle | |
| - name: Build kotsadm bundle without minio | |
| env: | |
| BUNDLE_DIR: kotsadm-bundle-nominio | |
| BUNDLE_REGISTRY: localhost:5001 | |
| GIT_TAG: ${{ needs.generate-tag.outputs.tag }} | |
| run: mapfile -t envs < <(grep -v '#.*' < .image.env) && export "${envs[@]}" && make kotsadm-bundle-nominio | |
| - name: Upload kotsadm bundle | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: kotsadm-bundle | |
| path: kotsadm-bundle | |
| - name: Upload kotsadm bundle without minio | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: kotsadm-bundle-nominio | |
| path: kotsadm-bundle-nominio | |
| goreleaser: | |
| runs-on: ubuntu-latest | |
| if: github.ref_type != 'branch' | |
| needs: [generate-tag, build-web] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Free up disk space | |
| uses: jlumbroso/free-disk-space@main | |
| with: | |
| tool-cache: false | |
| android: true | |
| dotnet: true | |
| haskell: true | |
| large-packages: true | |
| docker-images: true | |
| swap-storage: true | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| - name: Cache Go modules | |
| uses: actions/cache@v6 | |
| with: | |
| path: | | |
| ~/.cache/go-build | |
| ~/go/pkg/mod | |
| key: ${{ runner.os }}-go-goreleaser-${{ hashFiles('**/go.sum') }} | |
| restore-keys: | | |
| ${{ runner.os }}-go-goreleaser- | |
| - name: Unshallow | |
| run: git fetch --prune --unshallow | |
| - run: sudo apt-get update -y | |
| - run: sudo apt-get -qq -y install gnupg2 libdevmapper-dev libgpgme-dev libc6-dev-i386 btrfs-progs libbtrfs-dev pkg-config | |
| - name: set previous release tag for goreleaser | |
| run: | | |
| TAG="$(curl --silent "https://api.github.com/repos/replicatedhq/kots/releases/latest" | grep -Po '"tag_name": "\K.*?(?=")')" | |
| export TAG | |
| echo "GORELEASER_PREVIOUS_TAG=${TAG}" >> "$GITHUB_ENV" | |
| - uses: sigstore/cosign-installer@v4.1.2 | |
| - name: Get Cosign Key | |
| run: | | |
| echo "$COSIGN_KEY" | base64 -d > ./cosign.key | |
| env: | |
| COSIGN_KEY: ${{ secrets.COSIGN_KEY }} | |
| - name: Download web artifact | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: web | |
| path: ./web/dist | |
| - name: Generate SBOM | |
| run: | | |
| set -x | |
| make sbom | |
| env: | |
| COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} | |
| - name: Run GoReleaser | |
| uses: goreleaser/goreleaser-action@v7 | |
| with: | |
| version: "v1.2.5" | |
| args: release --rm-dist --config deploy/.goreleaser.yaml | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GORELEASER_CURRENT_TAG: ${{ needs.generate-tag.outputs.tag }} | |
| publish-pact-contracts: | |
| runs-on: ubuntu-latest | |
| needs: [ generate-tag, goreleaser ] | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| - uses: replicatedhq/action-install-pact@main | |
| - name: Publish pact contracts | |
| env: | |
| PACT_BROKER_BASE_URL: ${{ vars.PACT_BROKER_BASE_URL }} | |
| PACT_BROKER_TOKEN: ${{ secrets.PACT_BROKER_TOKEN }} | |
| PACT_PUBLISH_CONTRACT: true | |
| PACT_VERSION: ${{ github.sha }} | |
| GIT_TAG: ${{ needs.generate-tag.outputs.tag }} | |
| run: | | |
| set -x | |
| make pact-consumer | |
| generate-kurl-addon: | |
| runs-on: ubuntu-latest | |
| needs: [ generate-tag, build-kurl-proxy, build-kots, build-kotsadm-bundle ] | |
| if: ${{ !cancelled() && needs.generate-tag.result == 'success' && needs.build-kurl-proxy.result == 'success' && needs.build-kots.result == 'success' && needs.build-kotsadm-bundle.result == 'success' }} | |
| outputs: | |
| addon_package_url: ${{ steps.addon-generate.outputs.addon_package_url }} | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.KURL_ADDONS_AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.KURL_ADDONS_AWS_SECRET_ACCESS_KEY }} | |
| AWS_DEFAULT_REGION: us-east-1 | |
| CONTAINERS_REGISTRIES_CONF: /tmp/registries-v2.conf | |
| steps: | |
| - name: checkout | |
| uses: actions/checkout@v7 | |
| - name: set outputs | |
| id: vars | |
| run: | | |
| addon_version=${{ needs.generate-tag.outputs.tag }} | |
| echo "addon_version=${addon_version#v}" >> "$GITHUB_OUTPUT" | |
| - name: download kots binary | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: kots | |
| path: bin/ | |
| - name: prepare kots binary executable | |
| run: | | |
| echo 'unqualified-search-registries = ["docker.io", "quay.io"]' > "$CONTAINERS_REGISTRIES_CONF" | |
| chmod +x bin/* | |
| tar -C bin/ -czvf bin/kots.tar.gz kots | |
| - uses: ./.github/actions/kurl-addon-kots-generate | |
| id: addon-generate | |
| with: | |
| addon_version: ${{ steps.vars.outputs.addon_version }} | |
| s3_prefix: "${{ github.ref_type != 'branch' && '' || 'test/' }}" | |
| kotsadm_binary_override: bin/kots.tar.gz | |
| # only run validate-kurl-addon if changes to "deploy/kurl/kotsadm/template/**" | |
| kurl-addon-changes-filter: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| ok-to-test: ${{ steps.filter.outputs.kurl-addon }} | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - uses: dorny/paths-filter@v4 | |
| id: filter | |
| with: | |
| filters: | | |
| kurl-addon: | |
| - 'deploy/kurl/kotsadm/template/**' | |
| - 'deploy/kurl/kotsadm/testgrid-os-spec.yaml' | |
| validate-kurl-addon: | |
| runs-on: ubuntu-latest | |
| if: ${{ !cancelled() && needs.generate-tag.result == 'success' && needs.generate-kurl-addon.result == 'success' && needs.kurl-addon-changes-filter.result == 'success' && (github.ref_type != 'branch' || needs.kurl-addon-changes-filter.outputs.ok-to-test == 'true') }} | |
| needs: [ generate-tag, generate-kurl-addon, kurl-addon-changes-filter ] | |
| steps: | |
| - name: checkout | |
| uses: actions/checkout@v7 | |
| - name: set outputs | |
| id: vars | |
| run: | | |
| addon_version=${{ needs.generate-tag.outputs.tag }} | |
| echo "addon_version=${addon_version#v}" >> "$GITHUB_OUTPUT" | |
| - uses: ./.github/actions/kurl-addon-kots-test | |
| with: | |
| addon_version: ${{ steps.vars.outputs.addon_version }} | |
| addon_package_url: "${{ needs.generate-kurl-addon.outputs.addon_package_url }}" | |
| priority: ${{ github.ref_type != 'branch' && '1' || '0' }} | |
| testgrid_api_token: ${{ secrets.TESTGRID_PROD_API_TOKEN }} | |
| publish-kurl-addon: | |
| runs-on: ubuntu-latest | |
| if: ${{ !cancelled() && github.ref_type != 'branch' && needs.generate-tag.result == 'success' && needs.generate-kurl-addon.result == 'success' }} | |
| needs: [ generate-tag, generate-kurl-addon ] | |
| env: | |
| AWS_ACCESS_KEY_ID: ${{ secrets.KURL_ADDONS_AWS_ACCESS_KEY_ID }} | |
| AWS_SECRET_ACCESS_KEY: ${{ secrets.KURL_ADDONS_AWS_SECRET_ACCESS_KEY }} | |
| AWS_DEFAULT_REGION: us-east-1 | |
| steps: | |
| - name: checkout | |
| uses: actions/checkout@v7 | |
| - name: set outputs | |
| id: vars | |
| run: | | |
| addon_version=${{ needs.generate-tag.outputs.tag }} | |
| echo "addon_version=${addon_version#v}" >> "$GITHUB_OUTPUT" | |
| - uses: ./.github/actions/kurl-addon-kots-publisher | |
| with: | |
| ADDON_VERSION: ${{ steps.vars.outputs.addon_version }} | |
| ADDON_PACKAGE_URL: ${{ needs.generate-kurl-addon.outputs.addon_package_url }} | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - run: aws s3 cp ./deploy/kurl/versions.json s3://kots-kurl-addons-production-1658439274 | |
| generate-kots-release-notes-pr: | |
| runs-on: ubuntu-latest | |
| needs: [generate-tag] | |
| if: github.ref_type != 'branch' | |
| steps: | |
| - name: Setup Depot CLI | |
| uses: depot/setup-action@v1 | |
| - name: Generate KOTS Release Notes PR | |
| env: | |
| GIT_TAG: ${{ needs.generate-tag.outputs.tag }} | |
| DEPOT_CI_DISPATCH_TOKEN: ${{ secrets.DEPOT_CI_DISPATCH_TOKEN }} | |
| run: | | |
| depot ci dispatch \ | |
| --repo replicatedhq/replicated-docs \ | |
| --workflow release-notes.yml \ | |
| --ref main \ | |
| --input event_type=app-manager-release-notes \ | |
| --input version="$GIT_TAG" \ | |
| --input dry_run=false \ | |
| --token "$DEPOT_CI_DISPATCH_TOKEN" | |
| build-airgap: | |
| runs-on: ubuntu-latest | |
| if: ${{ !cancelled() && github.ref_type != 'branch' && needs.goreleaser.result == 'success' && needs.generate-tag.result == 'success' && needs.build-kotsadm-bundle.result == 'success' }} | |
| needs: [goreleaser, generate-tag, build-kotsadm-bundle] | |
| steps: | |
| - name: Download kotsadm bundle | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: kotsadm-bundle | |
| path: kotsadm-bundle | |
| - name: Download kotsadm bundle without minio | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: kotsadm-bundle-nominio | |
| path: kotsadm-bundle-nominio | |
| - name: Make kotsadm airgap archive | |
| working-directory: kotsadm-bundle | |
| run: tar -czvf ../kotsadm.tar.gz -- * | |
| - name: Make kotsadm airgap archive without minio | |
| working-directory: kotsadm-bundle-nominio | |
| run: tar -czvf ../kotsadm-nominio.tar.gz -- * | |
| - name: Upload airgap archive | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: ${{ needs.generate-tag.outputs.tag }} | |
| files: ./kotsadm.tar.gz | |
| - name: Upload airgap archive without minio | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: ${{ needs.generate-tag.outputs.tag }} | |
| files: ./kotsadm-nominio.tar.gz | |
| regression-test-setup: | |
| name: Run regression testing | |
| if: github.ref_type == 'branch' | |
| runs-on: ubuntu-latest | |
| needs: [ generate-tag ] | |
| outputs: | |
| last_release_tag: ${{ steps.get_latest_release_tag.outputs.release }} | |
| automation_id: ${{ steps.get_id.outputs.id }} | |
| steps: | |
| - name: Get latest release tag | |
| id: get_latest_release_tag | |
| uses: actions/github-script@v9 | |
| with: | |
| script: | | |
| const { | |
| data: { tag_name }, | |
| } = await github.rest.repos.getLatestRelease({ | |
| ...context.repo, | |
| }); | |
| core.setOutput("release", tag_name); | |
| - id: get_id | |
| run: | | |
| id=${{ github.sha }} | |
| echo "id=${id:0:7}" >> "$GITHUB_OUTPUT" | |
| regression-test: | |
| if: github.ref_type == 'branch' | |
| needs: [ regression-test-setup, generate-tag, build-kots, generate-kurl-addon, build-kotsadm-bundle ] | |
| uses: ./.github/workflows/regression.yaml | |
| with: | |
| version_tag_old: ${{ needs.regression-test-setup.outputs.last_release_tag }} | |
| version_tag_new: ${{ needs.generate-tag.outputs.tag }} | |
| addon_package_url: ${{ needs.generate-kurl-addon.outputs.addon_package_url }} | |
| id: ${{ needs.regression-test-setup.outputs.automation_id }} | |
| secrets: | |
| E2E_TESTIM_AWS_ACCESS_KEY_ID: ${{ secrets.E2E_TESTIM_AWS_ACCESS_KEY_ID }} | |
| E2E_TESTIM_AWS_SECRET_ACCESS_KEY: ${{ secrets.E2E_TESTIM_AWS_SECRET_ACCESS_KEY }} | |
| TESTIM_ACCESS_TOKEN: ${{ secrets.TESTIM_ACCESS_TOKEN }} | |
| REPLICATED_QA_API_TOKEN: ${{ secrets.REPLICATED_QA_API_TOKEN }} | |
| IDENTITY_SERVICE_OKTA_PASSWORD: ${{ secrets.IDENTITY_SERVICE_OKTA_PASSWORD }} | |
| IDENTITY_SERVICE_OKTA_CLIENT_SECRET: ${{ secrets.IDENTITY_SERVICE_OKTA_CLIENT_SECRET }} | |
| IDENTITY_SERVICE_OKTA_ACCESS_TOKEN: ${{ secrets.IDENTITY_SERVICE_OKTA_ACCESS_TOKEN }} | |
| E2E_GH_PAT: ${{ secrets.E2E_GH_PAT }} | |
| KOTS_BUILD_STATUS_SLACK_WEBHOOK_URL: ${{ secrets.KOTS_BUILD_STATUS_SLACK_WEBHOOK_URL }} |