Skip to content

Withdraw packages

Withdraw packages #104

name: Withdraw packages
on:
workflow_dispatch:
# Don't withdraw during builds, to prevent out of sync signatures.
concurrency: build
jobs:
withdraw:
name: Withdraw packages
runs-on: ubuntu-latest
permissions:
id-token: write
contents: read
steps:
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0
- name: "Install wolfictl onto PATH"
run: |
# Copy wolfictl out of the wolfictl image and onto PATH
TMP=$(mktemp -d)
docker run --rm -i -v $TMP:/out --entrypoint /bin/sh ghcr.io/wolfi-dev/sdk:latest@sha256:b12a8487dee8521e8c3144604930a882ca101f78bc0ad21cba2db1de2431bb79 -c "cp /usr/bin/wolfictl /out"
echo "$TMP" >> $GITHUB_PATH
- name: 'Authenticate to Google Cloud'
id: auth
uses: google-github-actions/auth@35b0e87d162680511bf346c299f71c9c5c379033 # v1.1.1
with:
workload_identity_provider: "projects/618116202522/locations/global/workloadIdentityPools/prod-shared-e350/providers/prod-shared-gha"
service_account: "prod-images-ci@prod-images-c6e5.iam.gserviceaccount.com"
- uses: google-github-actions/setup-gcloud@e30db14379863a8c79331b04a9969f4c1e225e0b # v1.1.1
with:
project_id: "prod-images-c6e5"
- run: echo "${{ secrets.MELANGE_RSA }}" > ./wolfi-signing.rsa
- run: |
sudo mkdir -p /etc/apk/keys
sudo cp ./wolfi-signing.rsa.pub /etc/apk/keys/wolfi-signing.rsa.pub
- name: Withdraw from index
run: |
set -euo pipefail
for arch in x86_64 aarch64; do
mkdir -p $arch
curl https://packages.wolfi.dev/os/$arch/APKINDEX.tar.gz | wolfictl withdraw $(grep -v '\#' withdrawn-packages.txt) --signing-key="${{ github.workspace }}/wolfi-signing.rsa" > $arch/APKINDEX.tar.gz
done
- name: Delete withdrawn packages
run: |
set -euo pipefail
for arch in x86_64 aarch64; do
for pkg in $(grep -v '\#' withdrawn-packages.txt); do
echo "=> $pkg"
gsutil -m rm -f gs://wolfi-production-registry-destination/os/$arch/$pkg || true
done
done
- name: Upload modified index
run: |
set -euxo pipefail
for arch in x86_64 aarch64; do
gsutil -h "Cache-Control:no-store" cp $arch/APKINDEX.tar.gz gs://wolfi-production-registry-destination/os/$arch/APKINDEX.tar.gz || true
done
- uses: rtCamp/action-slack-notify@v2.2.1
if: failure()
env:
SLACK_ICON: http://github.com/chainguard-dev.png?size=48
SLACK_USERNAME: guardian
SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
SLACK_CHANNEL: chainguard-images-alerts
SLACK_COLOR: '#8E1600'
MSG_MINIMAL: 'true'
SLACK_TITLE: '[withdraw-packages] failure: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'
SLACK_MESSAGE: |
https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}