ci: use release binary in release process

.github/workflows/release.yml

@@ -170,9 +170,23 @@ jobs:
         run: |
           nix run .#push-coordinator -- "$container_registry/nunki/coordinator"
           nix run .#push-initializer -- "$container_registry/nunki/initializer"
+      - name: Create portable coordinator resource definitions
+        run: |
+          mkdir -p workspace
+          nix run .#write-coordinator-yaml -- "${container_registry}/nunki/coordinator" > workspace/coordinator.yaml
+      - name: Update coordinator policy hash
+        run: |
+          yq < workspace/coordinator.yaml \
+            'select(.kind == "Deployment") | .spec.template.metadata.annotations["io.katacontainers.config.agent.policy"]' |
+            base64 -d | sha256sum | cut -d " " -f1 > cli/assets/coordinator-policy-hash
+
+          git config --global user.name "edgelessci"
+          git config --global user.email "[email protected]"
+          git add cli/assets/coordinator-policy-hash
+          git diff --staged --quiet || git commit -m "release: update coordinator policy hash"
       - name: Build CLI
         run: |
-          nix build .#cli
+          nix build .#cli-release
       - name: Create draft release
         uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
         with:
@@ -182,6 +196,7 @@ jobs:
           target_commitish: ${{ needs.process-inputs.outputs.WORKING_BRANCH }}
           files: |
             result-cli/bin/nunki
+            workspace/coordinator.yaml
       - name: Reset temporary changes
         run: |
           git reset --hard ${{ needs.process-inputs.outputs.WORKING_BRANCH }}

packages/default.nix

@@ -89,6 +89,7 @@ rec {
     copyToRoot = with dockerTools; [ caCertificates ];
     config = {
       Cmd = [ "${nunki.coordinator}/bin/coordinator" ];
+      Env = [ "PATH=/bin" ]; # This is only here for policy generation.
     };
   };
   initializer = dockerTools.buildImage {
@@ -97,6 +98,7 @@ rec {
     copyToRoot = with dockerTools; [ caCertificates ];
     config = {
       Cmd = [ "${nunki.initializer}/bin/initializer" ];
+      Env = [ "PATH=/bin" ]; # This is only here for policy generation.
     };
   };
 
@@ -106,6 +108,7 @@ rec {
     copyToRoot = [ openssl bash coreutils ncurses bashInteractive vim procps ];
     config = {
       Cmd = [ "bash" ];
+      Env = [ "PATH=/bin" ]; # This is only here for policy generation.
     };
   };
   port-forwarder = dockerTools.buildImage {
@@ -273,7 +276,7 @@ rec {
   # write-coordinator-yaml prints a Nunki Coordinator deployment including the default policy.
   # It's intended for two purposes: (1) releasing a portable coordinator.yaml and (2) updating the embedded policy hash.
   write-coordinator-yaml = writeShellApplication {
-    name = "print-coordinator-policy";
+    name = "write-coordinator-yaml";
     runtimeInputs = [
       yq-go
       genpolicy
@@ -289,8 +292,7 @@ rec {
         "del(.metadata.namespace) | (select(.kind == \"Deployment\") | .spec.template.spec.containers[0].image) = \"$imageRef\""
 
       pushd "$tmpdir" >/dev/null
-      # TODO(burgerdev): this should not be dev, but there are unknown env vars
-      cp ${genpolicy.settings-dev}/genpolicy-settings.json .
+      cp ${genpolicy.settings}/genpolicy-settings.json .
       cp ${genpolicy.rules-coordinator}/genpolicy-rules.rego rules.rego
       genpolicy < "$tmpdir/coordinator.yml"
       popd >/dev/null

packages/genpolicy_msft.nix

@@ -49,6 +49,7 @@ rustPlatform.buildRustPackage rec {
       postFetch = "install -D $downloadedFile $out/genpolicy-settings.json";
     };
 
+    # Settings that allow exec into CVM pods - not safe for production use!
     settings-dev = applyPatches {
       src = settings;
       patches = [ ./genpolicy_msft_settings_dev.patch ];