Prepare for v1.0.0-rc.2 release #51
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Image CI Releases | |
| on: | |
| push: | |
| tags: | |
| - v* | |
| - test* | |
| paths-ignore: | |
| - 'docs/**' | |
| permissions: | |
| # To be able to access the repository with `actions/checkout` and upload release artifacts | |
| contents: write | |
| # Required to generate OIDC tokens for `sigstore/cosign-installer` authentication | |
| id-token: write | |
| jobs: | |
| build-and-push: | |
| environment: release | |
| runs-on: ubuntu-20.04 | |
| strategy: | |
| matrix: | |
| include: | |
| - name: tetragon | |
| dockerfile: ./Dockerfile | |
| - name: tetragon-operator | |
| dockerfile: ./Dockerfile.operator | |
| steps: | |
| # https://github.com/docker/setup-qemu-action | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@68827325e0b33c7199eb31dd4e31fbe9023e06e3 # v3.0.0 | |
| with: | |
| platforms: arm64 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 | |
| - name: Login to quay.io | |
| uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 | |
| with: | |
| registry: quay.io | |
| username: ${{ secrets.QUAY_USERNAME_RELEASE_USERNAME }} | |
| password: ${{ secrets.QUAY_PASSWORD_RELEASE_PASSWORD }} | |
| - name: Getting image tag | |
| id: tag | |
| run: | | |
| echo "tag=${GITHUB_REF##*/}" >> $GITHUB_OUTPUT | |
| - name: Checkout Source Code | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| - name: Get version | |
| run: | | |
| echo "TETRAGON_VERSION=$(make version)" >> $GITHUB_ENV | |
| - name: Release Build ${{ matrix.name }} | |
| uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 # v5.0.0 | |
| id: docker_build_release | |
| with: | |
| provenance: false | |
| context: . | |
| file: ${{ matrix.dockerfile }} | |
| push: ${{ startsWith(steps.tag.outputs.tag, 'v') }} | |
| platforms: linux/amd64,linux/arm64 | |
| target: release | |
| build-args: | | |
| TETRAGON_VERSION=${{ env.TETRAGON_VERSION }} | |
| tags: | | |
| quay.io/${{ github.repository_owner }}/${{ matrix.name }}:${{ steps.tag.outputs.tag }} | |
| quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${{ github.sha }} | |
| - name: Install Cosign | |
| if: ${{ startsWith(steps.tag.outputs.tag, 'v') }} | |
| uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # v3.0.5 | |
| - name: Sign Container Image | |
| if: ${{ startsWith(steps.tag.outputs.tag, 'v') }} | |
| env: | |
| COSIGN_EXPERIMENTAL: "true" | |
| run: | | |
| cosign sign quay.io/${{ github.repository_owner }}/${{ matrix.name }}@${{ steps.docker_build_release.outputs.digest }} | |
| cosign sign quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci@${{ steps.docker_build_release.outputs.digest }} | |
| - name: Install Go | |
| uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 | |
| with: | |
| go-version-file: 'go.mod' | |
| - name: Install Bom | |
| if: ${{ startsWith(steps.tag.outputs.tag, 'v') }} | |
| shell: bash | |
| env: | |
| # renovate: datasource=github-releases depName=kubernetes-sigs/bom | |
| BOM_VERSION: v0.5.1 | |
| run: | | |
| go install sigs.k8s.io/bom/cmd/bom@${{ env.BOM_VERSION }} | |
| - name: Generate SBOM | |
| if: ${{ startsWith(steps.tag.outputs.tag, 'v') }} | |
| shell: bash | |
| # To-Do: Format SBOM output to JSON after a new version of cosign is released after v1.13.1. Ref: https://github.com/sigstore/cosign/pull/2479 | |
| run: | | |
| bom generate -o sbom_${{ matrix.name }}_${{ steps.tag.outputs.tag }}.spdx \ | |
| --dirs= . \ | |
| --image=quay.io/${{ github.repository_owner }}/${{ matrix.name }}:${{ steps.tag.outputs.tag }} | |
| - name: Attach SBOM to container image | |
| if: ${{ startsWith(steps.tag.outputs.tag, 'v') }} | |
| run: | | |
| cosign attach sbom --sbom sbom_${{ matrix.name }}_${{ steps.tag.outputs.tag }}.spdx quay.io/${{ github.repository_owner }}/${{ matrix.name }}@${{ steps.docker_build_release.outputs.digest }} | |
| cosign attach sbom --sbom sbom_${{ matrix.name }}_${{ steps.tag.outputs.tag }}.spdx quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci@${{ steps.docker_build_release.outputs.digest }} | |
| - name: Sign SBOM Image | |
| if: ${{ startsWith(steps.tag.outputs.tag, 'v') }} | |
| env: | |
| COSIGN_EXPERIMENTAL: "true" | |
| run: | | |
| docker_build_release_digest="${{ steps.docker_build_release.outputs.digest }}" | |
| image_name="quay.io/${{ github.repository_owner }}/${{ matrix.name }}:${docker_build_release_digest/:/-}.sbom" | |
| docker_build_release_sbom_digest="sha256:$(docker buildx imagetools inspect --raw ${image_name} | sha256sum | head -c 64)" | |
| cosign sign "quay.io/${{ github.repository_owner }}/${{ matrix.name }}@${docker_build_release_sbom_digest}" | |
| image_name="quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci:${docker_build_release_digest/:/-}.sbom" | |
| docker_build_release_sbom_digest="sha256:$(docker buildx imagetools inspect --raw ${image_name} | sha256sum | head -c 64)" | |
| cosign sign "quay.io/${{ github.repository_owner }}/${{ matrix.name }}-ci@${docker_build_release_sbom_digest}" | |
| - name: Image Release Digest | |
| shell: bash | |
| run: | | |
| mkdir -p image-digest/ | |
| job_name=${{ matrix.name }} | |
| job_name_capital=${job_name^^} | |
| job_name_underscored=${job_name_capital//-/_} | |
| echo "${job_name_underscored}_DIGEST := \"${{ steps.docker_build_release.outputs.digest }}\"" > image-digest/makefile-digest.txt | |
| echo "### ${{ matrix.name }}" > image-digest/${{ matrix.name }}.txt | |
| echo "" >> image-digest/${{ matrix.name }}.txt | |
| echo "\`quay.io/${{ github.repository_owner }}/${{ matrix.name }}:${{ steps.tag.outputs.tag }}@${{ steps.docker_build_release.outputs.digest }}\`" >> image-digest/${{ matrix.name }}.txt | |
| echo "" >> image-digest/${{ matrix.name }}.txt | |
| # Upload artifact digests | |
| - name: Upload artifact digests | |
| uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 | |
| with: | |
| name: image-digest ${{ matrix.name }} | |
| path: image-digest | |
| retention-days: 1 | |
| image-digests: | |
| if: ${{ github.repository == 'cilium/tetragon' }} | |
| name: Display Digests | |
| runs-on: ubuntu-20.04 | |
| needs: build-and-push | |
| steps: | |
| - name: Downloading Image Digests | |
| shell: bash | |
| run: | | |
| mkdir -p image-digest/ | |
| - name: Download digests of all images built | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| path: image-digest/ | |
| - name: Image Digests Output | |
| shell: bash | |
| run: | | |
| cd image-digest/ | |
| find -type f | sort | xargs -d '\n' cat | |
| tarball-release: | |
| name: Create Tetragon Tarball Releases | |
| runs-on: ${{ matrix.os }} | |
| strategy: | |
| matrix: | |
| include: | |
| # We use the native arch build | |
| - os: ubuntu-22.04 | |
| arch: amd64 | |
| - os: buildjet-2vcpu-ubuntu-2204-arm | |
| arch: arm64 | |
| steps: | |
| # https://github.com/docker/setup-buildx-action | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0 | |
| - name: Checkout Source Code | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 | |
| with: | |
| persist-credentials: false | |
| fetch-depth: 0 | |
| submodules: true | |
| - name: Getting version tag | |
| id: tag | |
| run: echo "tag=$(make version)" >> $GITHUB_OUTPUT | |
| - name: Login to Docker Hub | |
| uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0 | |
| with: | |
| username: ${{ secrets.DOCKER_HUB_USERNAME_CI }} | |
| password: ${{ secrets.DOCKER_HUB_PASSWORD_CI }} | |
| - name: Generate Tetragon Tarball | |
| run: make tarball-release | |
| # Cache tarball releases for later | |
| - name: Save tetragon-${{ steps.tag.outputs.tag }}-${{ matrix.arch }}.tar.gz Tarball | |
| uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3 | |
| with: | |
| name: tetragon-${{ steps.tag.outputs.tag }}-${{ matrix.arch }} | |
| path: release/ | |
| retention-days: 1 | |
| draft-github-release: | |
| name: Create Release | |
| if: github.repository == 'cilium/tetragon' | |
| environment: release | |
| runs-on: ubuntu-20.04 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0 | |
| - name: Set up Go | |
| uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0 | |
| - name: Getting version tag | |
| id: tag | |
| run: echo "tag=$(make version)" >> $GITHUB_OUTPUT | |
| - name: Generate tetra CLI artifacts | |
| run: make cli-release | |
| - name: Retrieve tetragon-${{ steps.tag.outputs.tag }}-amd64.tar.gz | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: tetragon-${{ steps.tag.outputs.tag }}-amd64 | |
| path: release | |
| - name: Retrieve tetragon-${{ steps.tag.outputs.tag }}-arm64.tar.gz | |
| uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2 | |
| with: | |
| name: tetragon-${{ steps.tag.outputs.tag }}-arm64 | |
| path: release | |
| - name: Create Release | |
| id: create_release | |
| uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v1 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| tag_name: ${{ github.ref }} | |
| name: Release ${{ github.ref }} | |
| draft: true | |
| prerelease: false | |
| body: | | |
| Note for maintainers:: Please update the description with the actual release notes (see RELEASE.md for instructions). | |
| files: | | |
| release/* |