Skip to content

Commit c79be17

Browse files
divolgindivolgin
committed
Updating release to use SecureBuild
1 parent 956f64b commit c79be17

15 files changed

Lines changed: 447 additions & 441 deletions

File tree

‎.github/actions/build-custom-image-with-apko/action.yml‎

Lines changed: 16 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,8 @@
11
name: 'Build and push a custom image with apko'
2-
description: 'Composite action for building and pushing a custom image with apko'
2+
description: 'Composite action for building and pushing a custom image with apko from locally built packages'
33
inputs:
4-
context:
5-
description: 'Path to the context directory'
6-
required: true
7-
8-
component:
9-
description: 'Name of the component (e.g. kotsadm, kurl-proxy, etc...)'
10-
required: true
11-
12-
git-tag:
13-
description: 'Git tag'
4+
apko-config:
5+
description: 'Path to the apko config file'
146
required: true
157

168
image-name:
@@ -32,24 +24,31 @@ runs:
3224
steps:
3325
- uses: actions/download-artifact@v8
3426
with:
35-
pattern: ${{ inputs.component }}-melange-packages-*
27+
pattern: melange-packages-*
3628
path: ./packages/
3729
merge-multiple: true
3830

3931
- uses: actions/download-artifact@v8
4032
with:
41-
pattern: ${{ inputs.component }}-melange-rsa-pub-*
33+
pattern: melange-rsa-pub-*
4234
merge-multiple: true
4335

44-
- name: template apko config
36+
- name: Prepare apko config for local build
4537
shell: bash
4638
run: |
47-
export GIT_TAG=${{ inputs.git-tag }}
48-
envsubst '${GIT_TAG}' < ${{ inputs.context }}/apko.yaml.tmpl > ${{ inputs.context }}/apko.yaml
39+
# Install yq
40+
curl -sL https://github.com/mikefarah/yq/releases/latest/download/yq_linux_"$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')" -o /tmp/yq
41+
sudo mv /tmp/yq /usr/local/bin/yq
42+
sudo chmod +x /usr/local/bin/yq
43+
44+
# Copy the apko config and add local packages repository and keyring
45+
cp ${{ inputs.apko-config }} apko-local.yaml
46+
yq -i '.contents.repositories += ["./packages/"]' apko-local.yaml
47+
yq -i '.contents.keyring += ["./melange-amd64.rsa.pub", "./melange-arm64.rsa.pub"]' apko-local.yaml
4948
5049
- uses: chainguard-images/actions/apko-publish@v1.0.37
5150
with:
52-
config: ${{ inputs.context }}/apko.yaml
51+
config: apko-local.yaml
5352
archs: amd64,arm64
5453
tag: ${{ inputs.image-name }}
5554
vcs-url: true

‎.github/actions/build-custom-melange-package/action.yml‎

Lines changed: 29 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,19 @@
1-
name: 'Build a custom melange package'
2-
description: 'Composite action for building a custom melange package'
1+
name: 'Build melange packages locally'
2+
description: 'Composite action for building all melange packages locally for pre-release builds'
33
inputs:
4-
context:
5-
description: 'Path to the context directory'
6-
required: true
7-
8-
component:
9-
description: 'Name of the component (e.g. kotsadm, kurl-proxy, etc...)'
10-
required: true
11-
12-
git-tag:
13-
description: 'Git tag'
4+
melange-config:
5+
description: 'Path to the melange config file'
146
required: true
157

168
arch:
179
description: 'Architecture to build for'
1810
required: true
1911

12+
git-tag:
13+
description: 'Git tag to set as package version (e.g. v1.123.0-alpha.1)'
14+
required: false
15+
default: ''
16+
2017
runs:
2118
using: "composite"
2219
steps:
@@ -38,31 +35,41 @@ runs:
3835
SHIM
3936
sudo chmod +x /usr/local/bin/systemctl
4037
41-
# build the melange package
42-
43-
- name: template melange config
38+
- name: Prepare melange config for local build
4439
shell: bash
4540
run: |
46-
export GIT_TAG=${{ inputs.git-tag }}
47-
envsubst '${GIT_TAG}' < ${{ inputs.context }}/melange.yaml.tmpl > ${{ inputs.context }}/melange.yaml
41+
# Install yq
42+
curl -sL https://github.com/mikefarah/yq/releases/latest/download/yq_linux_"$(uname -m | sed 's/x86_64/amd64/; s/aarch64/arm64/')" -o /tmp/yq
43+
sudo mv /tmp/yq /usr/local/bin/yq
44+
sudo chmod +x /usr/local/bin/yq
45+
46+
# Copy the melange config and strip git-checkout so local files are used via --source-dir
47+
cp ${{ inputs.melange-config }} melange-local.yaml
48+
yq -i 'del(.pipeline[] | select(.uses == "git-checkout"))' melange-local.yaml
49+
50+
# Set VERSION and GIT_TAG env vars in the melange config so the build script
51+
# uses the real git tag for ldflags. package.version stays as valid semver (0.0.1)
52+
# since melange rejects non-semver versions like nightly tags.
53+
if [ -n "${{ inputs.git-tag }}" ]; then
54+
yq -i ".environment.environment.VERSION = \"${{ inputs.git-tag }}\"" melange-local.yaml
55+
yq -i ".environment.environment.GIT_TAG = \"${{ inputs.git-tag }}\"" melange-local.yaml
56+
fi
4857
4958
- uses: chainguard-dev/actions/melange-build@v1.6.28
5059
with:
51-
config: ${{ inputs.context }}/melange.yaml
60+
config: melange-local.yaml
5261
archs: ${{ inputs.arch }}
5362
git-commit: ${{ github.sha }}
5463
git-repo-url: ${{ github.server_url }}/${{ github.repository }}
5564
sign-with-temporary-key: true
5665
signing-key-path: ./melange-${{ inputs.arch }}.rsa
5766

58-
# upload artifacts generated by the melange build so they can later be used by apko
59-
6067
- uses: actions/upload-artifact@v7
6168
with:
62-
name: ${{ inputs.component }}-melange-packages-${{ inputs.arch }}
69+
name: melange-packages-${{ inputs.arch }}
6370
path: ./packages
6471

6572
- uses: actions/upload-artifact@v7
6673
with:
67-
name: ${{ inputs.component }}-melange-rsa-pub-${{ inputs.arch }}
74+
name: melange-rsa-pub-${{ inputs.arch }}
6875
path: ./melange-${{ inputs.arch }}.rsa.pub

‎.github/workflows/alpha.yaml‎

Lines changed: 8 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
uses: ./.github/actions/version-tag
2020

2121

22-
build-migrations-melange-packages:
22+
build-melange-packages:
2323
needs: [generate-tag]
2424
strategy:
2525
fail-fast: true
@@ -33,89 +33,42 @@ jobs:
3333
- uses: actions/checkout@v7
3434
- uses: ./.github/actions/build-custom-melange-package
3535
with:
36-
context: migrations/deploy
37-
component: kotsadm-migrations
36+
melange-config: deploy/melange.yaml
3837
git-tag: ${{ needs.generate-tag.outputs.tag }}
3938
arch: ${{ matrix.runner.arch }}
4039

4140
build-migrations:
4241
runs-on: ubuntu-latest
43-
needs: [generate-tag, build-migrations-melange-packages]
42+
needs: [generate-tag, build-melange-packages]
4443
steps:
4544
- uses: actions/checkout@v7
4645
- uses: ./.github/actions/build-custom-image-with-apko
4746
with:
48-
context: migrations/deploy
49-
component: kotsadm-migrations
50-
git-tag: ${{ needs.generate-tag.outputs.tag }}
47+
apko-config: migrations/deploy/apko.yaml
5148
image-name: index.docker.io/kotsadm/kotsadm-migrations:alpha
5249
registry-username: ${{ secrets.DOCKERHUB_USER }}
5350
registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}
5451

55-
56-
build-kotsadm-melange-packages:
57-
needs: [generate-tag]
58-
strategy:
59-
fail-fast: true
60-
matrix:
61-
runner: [
62-
{name: ubuntu-latest, arch: amd64},
63-
{name: arm64-runner-set, arch: arm64}
64-
]
65-
runs-on: ${{ matrix.runner.name }}
66-
steps:
67-
- uses: actions/checkout@v7
68-
- uses: ./.github/actions/build-custom-melange-package
69-
with:
70-
context: deploy
71-
component: kotsadm
72-
git-tag: ${{ needs.generate-tag.outputs.tag }}
73-
arch: ${{ matrix.runner.arch }}
74-
7552
build-kotsadm:
7653
runs-on: ubuntu-latest
77-
needs: [generate-tag, build-kotsadm-melange-packages]
54+
needs: [generate-tag, build-melange-packages]
7855
steps:
7956
- uses: actions/checkout@v7
8057
- uses: ./.github/actions/build-custom-image-with-apko
8158
with:
82-
context: deploy
83-
component: kotsadm
84-
git-tag: ${{ needs.generate-tag.outputs.tag }}
59+
apko-config: deploy/apko.yaml
8560
image-name: index.docker.io/kotsadm/kotsadm:alpha
8661
registry-username: ${{ secrets.DOCKERHUB_USER }}
8762
registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}
8863

89-
90-
build-kurl-proxy-melange-packages:
91-
needs: [generate-tag]
92-
strategy:
93-
fail-fast: true
94-
matrix:
95-
runner: [
96-
{name: ubuntu-latest, arch: amd64},
97-
{name: arm64-runner-set, arch: arm64}
98-
]
99-
runs-on: ${{ matrix.runner.name }}
100-
steps:
101-
- uses: actions/checkout@v7
102-
- uses: ./.github/actions/build-custom-melange-package
103-
with:
104-
context: kurl_proxy/deploy
105-
component: kurl-proxy
106-
git-tag: ${{ needs.generate-tag.outputs.tag }}
107-
arch: ${{ matrix.runner.arch }}
108-
10964
build-kurl-proxy:
11065
runs-on: ubuntu-latest
111-
needs: [generate-tag, build-kurl-proxy-melange-packages]
66+
needs: [generate-tag, build-melange-packages]
11267
steps:
11368
- uses: actions/checkout@v7
11469
- uses: ./.github/actions/build-custom-image-with-apko
11570
with:
116-
context: kurl_proxy/deploy
117-
component: kurl-proxy
118-
git-tag: ${{ needs.generate-tag.outputs.tag }}
71+
apko-config: kurl_proxy/deploy/apko.yaml
11972
image-name: index.docker.io/kotsadm/kurl-proxy:alpha
12073
registry-username: ${{ secrets.DOCKERHUB_USER }}
12174
registry-password: ${{ secrets.DOCKERHUB_PASSWORD }}

‎.github/workflows/build-test.yaml‎

Lines changed: 8 additions & 59 deletions
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,7 @@ jobs:
247247
path: ./bin/kots
248248

249249

250-
build-kotsadm-melange-packages:
250+
build-melange-packages:
251251
needs: [ can-run-ci, generate-tag ]
252252
strategy:
253253
fail-fast: false
@@ -264,24 +264,21 @@ jobs:
264264
repository: ${{github.event.pull_request.head.repo.full_name}}
265265
- uses: ./.github/actions/build-custom-melange-package
266266
with:
267-
context: deploy
268-
component: kotsadm
267+
melange-config: deploy/melange.yaml
269268
git-tag: ${{ needs.generate-tag.outputs.tag }}
270269
arch: ${{ matrix.runner.arch }}
271270

272271
build-kotsadm:
273272
runs-on: ubuntu-24.04
274-
needs: [ can-run-ci, generate-tag, build-kotsadm-melange-packages ]
273+
needs: [ can-run-ci, generate-tag, build-melange-packages ]
275274
steps:
276275
- uses: actions/checkout@v7
277276
with:
278277
ref: ${{github.event.pull_request.head.ref}}
279278
repository: ${{github.event.pull_request.head.repo.full_name}}
280279
- uses: ./.github/actions/build-custom-image-with-apko
281280
with:
282-
context: deploy
283-
component: kotsadm
284-
git-tag: ${{ needs.generate-tag.outputs.tag }}
281+
apko-config: deploy/apko.yaml
285282
image-name: ttl.sh/automated-${{ github.run_id }}/kotsadm:24h
286283

287284

@@ -345,79 +342,31 @@ jobs:
345342
path: e2e/bin/
346343

347344

348-
build-kurl-proxy-melange-packages:
349-
needs: [ can-run-ci, generate-tag ]
350-
strategy:
351-
fail-fast: true
352-
matrix:
353-
runner: [
354-
{name: ubuntu-24.04, arch: amd64},
355-
{name: arm64-runner-set, arch: arm64}
356-
]
357-
runs-on: ${{ matrix.runner.name }}
358-
steps:
359-
- uses: actions/checkout@v7
360-
with:
361-
ref: ${{github.event.pull_request.head.ref}}
362-
repository: ${{github.event.pull_request.head.repo.full_name}}
363-
- uses: ./.github/actions/build-custom-melange-package
364-
with:
365-
context: kurl_proxy/deploy
366-
component: kurl-proxy
367-
git-tag: ${{ needs.generate-tag.outputs.tag }}
368-
arch: ${{ matrix.runner.arch }}
369-
370345
build-kurl-proxy:
371346
runs-on: ubuntu-24.04
372-
needs: [ can-run-ci, generate-tag, build-kurl-proxy-melange-packages ]
347+
needs: [ can-run-ci, generate-tag, build-melange-packages ]
373348
steps:
374349
- uses: actions/checkout@v7
375350
with:
376351
ref: ${{github.event.pull_request.head.ref}}
377352
repository: ${{github.event.pull_request.head.repo.full_name}}
378353
- uses: ./.github/actions/build-custom-image-with-apko
379354
with:
380-
context: kurl_proxy/deploy
381-
component: kurl-proxy
382-
git-tag: ${{ needs.generate-tag.outputs.tag }}
355+
apko-config: kurl_proxy/deploy/apko.yaml
383356
image-name: ttl.sh/automated-${{ github.run_id }}/kurl-proxy:24h
384357

385358

386-
build-migrations-melange-packages:
387-
needs: [ can-run-ci, generate-tag ]
388-
strategy:
389-
fail-fast: true
390-
matrix:
391-
runner: [
392-
{name: ubuntu-24.04, arch: amd64},
393-
{name: arm64-runner-set, arch: arm64}
394-
]
395-
runs-on: ${{ matrix.runner.name }}
396-
steps:
397-
- uses: actions/checkout@v7
398-
with:
399-
ref: ${{github.event.pull_request.head.ref}}
400-
repository: ${{github.event.pull_request.head.repo.full_name}}
401-
- uses: ./.github/actions/build-custom-melange-package
402-
with:
403-
context: migrations/deploy
404-
component: kotsadm-migrations
405-
git-tag: ${{ needs.generate-tag.outputs.tag }}
406-
arch: ${{ matrix.runner.arch }}
407-
408359
build-migrations:
409360
runs-on: ubuntu-24.04
410-
needs: [ can-run-ci, generate-tag, build-migrations-melange-packages ]
361+
needs: [ can-run-ci, generate-tag, build-melange-packages ]
411362
steps:
412363
- uses: actions/checkout@v7
413364
with:
414365
ref: ${{github.event.pull_request.head.ref}}
415366
repository: ${{github.event.pull_request.head.repo.full_name}}
416367
- uses: ./.github/actions/build-custom-image-with-apko
417368
with:
418-
context: migrations/deploy
419-
component: kotsadm-migrations
420-
git-tag: ${{ needs.generate-tag.outputs.tag }}
369+
apko-config: migrations/deploy/apko.yaml
421370
image-name: ttl.sh/automated-${{ github.run_id }}/kotsadm-migrations:24h
422371

423372
push-minio:

0 commit comments

Comments
 (0)