7
7
inputs :
8
8
tag :
9
9
description : ' image tag prefix'
10
- default : ' preview '
10
+ default : ' rc '
11
11
required : true
12
-
13
- permissions :
14
- contents : read
15
-
16
- env :
17
- CONTROLLER : ${{ github.event.repository.name }}
18
-
19
12
jobs :
20
13
release :
21
- outputs :
22
- hashes : ${{ steps.slsa.outputs.hashes }}
23
- image_url : ${{ steps.slsa.outputs.image_url }}
24
- image_digest : ${{ steps.slsa.outputs.image_digest }}
25
- runs-on : ubuntu-latest
26
14
permissions :
27
15
contents : write # for creating the GitHub release.
28
16
id-token : write # for creating OIDC tokens for signing.
29
17
packages : write # for pushing and signing container images.
30
- steps :
31
- - name : Checkout
32
- uses : actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
33
- - name : Setup Kustomize
34
- uses : fluxcd/pkg/actions/kustomize@main
35
- - name : Prepare
36
- id : prep
37
- run : |
38
- VERSION="${{ github.event.inputs.tag }}-${GITHUB_SHA::8}"
39
- if [[ $GITHUB_REF == refs/tags/* ]]; then
40
- VERSION=${GITHUB_REF/refs\/tags\//}
41
- fi
42
- echo "BUILD_DATE=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
43
- echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
44
- - name : Setup QEMU
45
- uses : docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
46
- - name : Setup Docker Buildx
47
- id : buildx
48
- uses : docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
49
- - name : Login to GitHub Container Registry
50
- uses : docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
51
- with :
52
- registry : ghcr.io
53
- username : fluxcdbot
54
- password : ${{ secrets.GHCR_TOKEN }}
55
- - name : Login to Docker Hub
56
- uses : docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
57
- with :
58
- username : fluxcdbot
59
- password : ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
60
- - name : Generate images meta
61
- id : meta
62
- uses : docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
63
- with :
64
- images : |
65
- fluxcd/${{ env.CONTROLLER }}
66
- ghcr.io/fluxcd/${{ env.CONTROLLER }}
67
- tags : |
68
- type=raw,value=${{ steps.prep.outputs.VERSION }}
69
- - name : Publish images
70
- id : build-push
71
- uses : docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
72
- with :
73
- sbom : true
74
- provenance : true
75
- push : true
76
- builder : ${{ steps.buildx.outputs.name }}
77
- context : .
78
- file : ./Dockerfile
79
- platforms : linux/amd64,linux/arm/v7,linux/arm64
80
- tags : ${{ steps.meta.outputs.tags }}
81
- labels : ${{ steps.meta.outputs.labels }}
82
- - uses : sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
83
- - name : Sign images
84
- env :
85
- COSIGN_EXPERIMENTAL : 1
86
- run : |
87
- cosign sign --yes fluxcd/${{ env.CONTROLLER }}@${{ steps.build-push.outputs.digest }}
88
- cosign sign --yes ghcr.io/fluxcd/${{ env.CONTROLLER }}@${{ steps.build-push.outputs.digest }}
89
- - name : Generate release artifacts
90
- if : startsWith(github.ref, 'refs/tags/v')
91
- run : |
92
- mkdir -p config/release
93
- kustomize build ./config/crd > ./config/release/${{ env.CONTROLLER }}.crds.yaml
94
- kustomize build ./config/manager > ./config/release/${{ env.CONTROLLER }}.deployment.yaml
95
- - uses : anchore/sbom-action/download-syft@da167eac915b4e86f08b264dbdbc867b61be6f0c # v0.20.5
96
- - name : Create release and SBOM
97
- id : run-goreleaser
98
- if : startsWith(github.ref, 'refs/tags/v')
99
- uses : goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
100
- with :
101
- version : latest
102
- args : release --clean --skip=validate
103
- env :
104
- GITHUB_TOKEN : ${{ secrets.GITHUB_TOKEN }}
105
- - name : Generate SLSA metadata
106
- id : slsa
107
- env :
108
- ARTIFACTS : " ${{ steps.run-goreleaser.outputs.artifacts }}"
109
- run : |
110
- hashes=$(echo -E $ARTIFACTS | jq --raw-output '.[] | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {digest} + {name} | join(" ") | sub("^sha256:";"")' | base64 -w0)
111
- echo "hashes=$hashes" >> $GITHUB_OUTPUT
112
-
113
- image_url=fluxcd/${{ env.CONTROLLER }}:${{ steps.prep.outputs.version }}
114
- echo "image_url=$image_url" >> $GITHUB_OUTPUT
115
-
116
- image_digest=${{ steps.build-push.outputs.digest }}
117
- echo "image_digest=$image_digest" >> $GITHUB_OUTPUT
118
-
18
+ uses :
fluxcd/gha-workflows/.github/workflows/[email protected]
19
+ with :
20
+ controller : ${{ github.event.repository.name }}
21
+ release-candidate-prefix : ${{ github.event.inputs.tag }}
22
+ secrets :
23
+ github-token : ${{ secrets.GITHUB_TOKEN }}
24
+ dockerhub-token : ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
119
25
release-provenance :
120
26
needs : [release]
121
27
permissions :
@@ -128,10 +34,10 @@ jobs:
128
34
provenance-name : " provenance.intoto.jsonl"
129
35
base64-subjects : " ${{ needs.release.outputs.hashes }}"
130
36
upload-assets : true
131
-
132
37
dockerhub-provenance :
133
38
needs : [release]
134
39
permissions :
40
+ contents : read # for reading the repository code.
135
41
actions : read # for detecting the Github Actions environment.
136
42
id-token : write # for creating OIDC tokens for signing.
137
43
packages : write # for uploading attestations.
@@ -143,10 +49,10 @@ jobs:
143
49
registry-username : fluxcdbot
144
50
secrets :
145
51
registry-password : ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
146
-
147
52
ghcr-provenance :
148
53
needs : [release]
149
54
permissions :
55
+ contents : read # for reading the repository code.
150
56
actions : read # for detecting the Github Actions environment.
151
57
id-token : write # for creating OIDC tokens for signing.
152
58
packages : write # for uploading attestations.
0 commit comments