From 7b61a748f82a55c0803f316c31736c4c24b5e652 Mon Sep 17 00:00:00 2001 From: MuneebAijaz Date: Fri, 2 Aug 2024 12:27:55 +0500 Subject: [PATCH] Manual release workflows --- .github/workflows/push.yaml | 170 ++++++++--------- .../{push_docs.yaml => push_docs.yamldisable} | 2 + .github/workflows/release.yaml | 172 +++++++++++++++++- .../kubernetes/manifests/deployment.yaml | 2 +- deployments/kubernetes/reloader.yaml | 6 +- renovate.json | 6 + 6 files changed, 251 insertions(+), 107 deletions(-) rename .github/workflows/{push_docs.yaml => push_docs.yamldisable} (87%) diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml index 3e9524c3..b29120e8 100644 --- a/.github/workflows/push.yaml +++ b/.github/workflows/push.yaml @@ -1,18 +1,11 @@ name: Push on: - push: + pull_request: + types: + - closed branches: - master - paths: - - '**' - - '!.markdownlint.yaml' - - '!.vale.ini' - - '!Dockerfile-docs' - - '!docs-nginx.conf' - - '!docs/**' - - '!theme_common' - - '!theme_override' env: DOCKER_FILE_PATH: Dockerfile @@ -25,7 +18,7 @@ env: jobs: build: name: Build - if: "! contains(toJSON(github.event.commits.*.message), '[skip-ci]')" + if: github.event.pull_request.merged == true runs-on: ubuntu-latest steps: @@ -81,15 +74,6 @@ jobs: - name: Test run: make test - - name: Generate Tag - id: generate_tag - uses: anothrNick/github-tag-action@1.70.0 - env: - GITHUB_TOKEN: ${{ secrets.STAKATER_GITHUB_TOKEN }} - WITH_V: true - DEFAULT_BUMP: patch - DRY_RUN: true - - name: Set up QEMU uses: docker/setup-qemu-action@v3 @@ -117,7 +101,7 @@ jobs: cache-to: type=inline platforms: linux/amd64,linux/arm,linux/arm64 tags: | - ${{ env.DOCKER_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.new_tag }} + ${{ env.DOCKER_IMAGE_REPOSITORY }}:merge-${{ github.event.number }} labels: | org.opencontainers.image.source=${{ github.event.repository.clone_url }} org.opencontainers.image.created=${{ steps.prep.outputs.created }} @@ -132,11 +116,11 @@ jobs: push: true build-args: | BUILD_PARAMETERS=${{ env.BUILD_PARAMETERS }} - BUILDER_IMAGE=${{ env.DOCKER_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.new_tag }} + BUILDER_IMAGE=${{ env.DOCKER_IMAGE_REPOSITORY }}:merge-${{ github.event.number }} cache-to: type=inline platforms: linux/amd64,linux/arm64 tags: | - ${{ env.DOCKER_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.new_tag }}-ubi + ${{ env.DOCKER_IMAGE_REPOSITORY }}:merge-${{ github.event.number }}-ubi labels: | org.opencontainers.image.source=${{ github.event.repository.clone_url }} org.opencontainers.image.created=${{ steps.prep.outputs.created }} @@ -164,7 +148,7 @@ jobs: cache-to: type=inline platforms: linux/amd64,linux/arm,linux/arm64 tags: | - ${{ env.GHCR_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.new_tag }} + ${{ env.GHCR_IMAGE_REPOSITORY }}:merge-${{ github.event.number }} labels: | org.opencontainers.image.source=${{ github.event.repository.clone_url }} org.opencontainers.image.created=${{ steps.prep.outputs.created }} @@ -179,11 +163,11 @@ jobs: push: true build-args: | BUILD_PARAMETERS=${{ env.BUILD_PARAMETERS }} - BUILDER_IMAGE=${{ env.GHCR_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.new_tag }} + BUILDER_IMAGE=${{ env.GHCR_IMAGE_REPOSITORY }}:merge-${{ github.event.number }} cache-to: type=inline platforms: linux/amd64,linux/arm64 tags: | - ${{ env.GHCR_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.new_tag }}-ubi + ${{ env.GHCR_IMAGE_REPOSITORY }}:merge-${{ github.event.number }}-ubi labels: | org.opencontainers.image.source=${{ github.event.repository.clone_url }} org.opencontainers.image.created=${{ steps.prep.outputs.created }} @@ -193,90 +177,78 @@ jobs: ## Add steps to generate required artifacts for a release here(helm chart, operator manifest etc.) ############################## - # Generate tag for operator without "v" - - name: Generate Operator Tag - id: generate_operator_tag - uses: anothrNick/github-tag-action@1.70.0 - env: - GITHUB_TOKEN: ${{ secrets.STAKATER_GITHUB_TOKEN }} - WITH_V: false - DEFAULT_BUMP: patch - DRY_RUN: true + # Skip pushing plain manifests till we decide what to do with them - # Update chart tag to the latest semver tag - - name: Update Chart Version - env: - VERSION: ${{ steps.generate_operator_tag.outputs.new_tag }} - run: make bump-chart - - - name: Helm Template - run: | - helm template reloader deployments/kubernetes/chart/reloader/ \ - --set reloader.deployment.resources.limits.cpu=150m \ - --set reloader.deployment.resources.limits.memory=512Mi \ - --set reloader.deployment.resources.requests.cpu=10m \ - --set reloader.deployment.resources.requests.memory=128Mi > deployments/kubernetes/reloader.yaml + # - name: Helm Template + # run: | + # helm template reloader deployments/kubernetes/chart/reloader/ \ + # --set reloader.deployment.resources.limits.cpu=150m \ + # --set reloader.deployment.resources.limits.memory=512Mi \ + # --set reloader.deployment.resources.requests.cpu=10m \ + # --set reloader.deployment.resources.requests.memory=128Mi > deployments/kubernetes/reloader.yaml - helm template reloader deployments/kubernetes/chart/reloader/ --output-dir deployments/kubernetes/manifests && mv deployments/kubernetes/manifests/reloader/templates/* deployments/kubernetes/manifests/ && rm -r deployments/kubernetes/manifests/reloader + # helm template reloader deployments/kubernetes/chart/reloader/ --output-dir deployments/kubernetes/manifests && mv deployments/kubernetes/manifests/reloader/templates/* deployments/kubernetes/manifests/ && rm -r deployments/kubernetes/manifests/reloader - - name: Remove labels and annotations from manifests - run: make remove-labels-annotations + # - name: Remove labels and annotations from manifests + # run: make remove-labels-annotations - # Publish helm chart - - name: Login to ghcr via helm - run: | - echo ${{secrets.GITHUB_TOKEN}} | helm registry login ghcr.io/stakater --username stakater-user --password-stdin + # Charts are to be pushed to a separate repo with a separate release cycle - - name: Publish Helm chart to ghcr.io - run: | - helm package ./deployments/kubernetes/chart/reloader --destination ./packaged-chart - helm push ./packaged-chart/*.tgz oci://ghcr.io/stakater/charts - rm -rf ./packaged-chart + # # Publish helm chart + # - name: Login to ghcr via helm + # run: | + # echo ${{secrets.GITHUB_TOKEN}} | helm registry login ghcr.io/stakater --username stakater-user --password-stdin - - name: Publish Helm chart to gh-pages - uses: stefanprodan/helm-gh-pages@master - with: - branch: master - repository: stakater-charts - target_dir: docs - token: ${{ secrets.STAKATER_GITHUB_TOKEN }} - charts_dir: deployments/kubernetes/chart/ - charts_url: ${{ env.HELM_REGISTRY_URL }} - owner: stakater - linting: on - commit_username: stakater-user - commit_email: stakater@gmail.com + # - name: Publish Helm chart to ghcr.io + # run: | + # helm package ./deployments/kubernetes/chart/reloader --destination ./packaged-chart + # helm push ./packaged-chart/*.tgz oci://ghcr.io/stakater/charts + # rm -rf ./packaged-chart - # Commit back changes - - name: Log info about `.git` directory permissions - run: | - # Debug logging - echo "Disk usage: " - df -H + # - name: Publish Helm chart to gh-pages + # uses: stefanprodan/helm-gh-pages@master + # with: + # branch: master + # repository: stakater-charts + # target_dir: docs + # token: ${{ secrets.STAKATER_GITHUB_TOKEN }} + # charts_dir: deployments/kubernetes/chart/ + # charts_url: ${{ env.HELM_REGISTRY_URL }} + # owner: stakater + # linting: on + # commit_username: stakater-user + # commit_email: stakater@gmail.com - echo ".git files not owned by current user or current group:" - find .git ! -user $(id -u) -o ! -group $(id -g) | xargs ls -lah + # # Commit back changes + # - name: Log info about `.git` directory permissions + # run: | + # # Debug logging + # echo "Disk usage: " + # df -H - - name: Commit files - run: | - git config --local user.email "stakater@gmail.com" - git config --local user.name "stakater-user" - git status - git add . - git commit -m "[skip-ci] Update artifacts" -a + # echo ".git files not owned by current user or current group:" + # find .git ! -user $(id -u) -o ! -group $(id -g) | xargs ls -lah - - name: Push changes - uses: ad-m/github-push-action@master - with: - github_token: ${{ secrets.STAKATER_GITHUB_TOKEN }} - branch: ${{ github.ref }} + # - name: Commit files + # run: | + # git config --local user.email "stakater@gmail.com" + # git config --local user.name "stakater-user" + # git status + # git add . + # git commit -m "[skip-ci] Update artifacts" -a - - name: Push Latest Tag - uses: anothrNick/github-tag-action@1.70.0 - env: - GITHUB_TOKEN: ${{ secrets.STAKATER_GITHUB_TOKEN }} - WITH_V: true - DEFAULT_BUMP: patch + # - name: Push changes + # uses: ad-m/github-push-action@master + # with: + # github_token: ${{ secrets.STAKATER_GITHUB_TOKEN }} + # branch: ${{ github.ref }} + + # - name: Push Latest Tag + # uses: anothrNick/github-tag-action@1.70.0 + # env: + # GITHUB_TOKEN: ${{ secrets.STAKATER_GITHUB_TOKEN }} + # WITH_V: true + # DEFAULT_BUMP: patch - name: Notify Slack uses: 8398a7/action-slack@v3 diff --git a/.github/workflows/push_docs.yaml b/.github/workflows/push_docs.yamldisable similarity index 87% rename from .github/workflows/push_docs.yaml rename to .github/workflows/push_docs.yamldisable index b778ed8f..78a74777 100644 --- a/.github/workflows/push_docs.yaml +++ b/.github/workflows/push_docs.yamldisable @@ -1,3 +1,5 @@ +# need changes in underlying workflow or to be merged with release workflow +# as to release docs images on PR name: Push Documentation Changes on: diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index a2b573e9..3b736bb2 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -3,7 +3,8 @@ name: Release Go project on: push: tags: - - "v*" + # restricting it to only Major Versions 0,1,2 + - 'v[012].[0-9]+.[0-9]+' jobs: build: @@ -14,15 +15,178 @@ jobs: - name: Check out code uses: actions/checkout@v4 with: - fetch-depth: 0 # See: https://goreleaser.com/ci/actions/ + token: ${{ secrets.STAKATER_GITHUB_TOKEN }} + fetch-depth: 0 # otherwise, you will fail to push refs to dest repo + + # Setting up helm binary + - name: Set up Helm + uses: azure/setup-helm@v4 + with: + version: v3.11.3 - name: Set up Go uses: actions/setup-go@v5 with: - go-version-file: "go.mod" + go-version-file: 'go.mod' check-latest: true cache: true + - name: Install Dependencies + run: | + make install + + - name: Run golangci-lint + uses: golangci/golangci-lint-action@v5 + with: + version: latest + only-new-issues: false + args: --timeout 10m + + - name: Install kubectl + run: | + curl -LO "https://storage.googleapis.com/kubernetes-release/release/v${KUBERNETES_VERSION}/bin/linux/amd64/kubectl" + sudo install ./kubectl /usr/local/bin/ && rm kubectl + kubectl version --short --client + kubectl version --short --client | grep -q ${KUBERNETES_VERSION} + + - name: Install Kind + run: | + curl -L -o kind https://github.com/kubernetes-sigs/kind/releases/download/v${KIND_VERSION}/kind-linux-amd64 + sudo install ./kind /usr/local/bin && rm kind + kind version + kind version | grep -q ${KIND_VERSION} + + - name: Create Kind Cluster + run: | + kind create cluster + kubectl cluster-info + + - name: Test + run: make test + + - name: Get Tag from Github Ref + id: generate_tag + run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Login to Docker Registry + uses: docker/login-action@v3 + with: + username: ${{ secrets.STAKATER_DOCKERHUB_USERNAME }} + password: ${{ secrets.STAKATER_DOCKERHUB_PASSWORD }} + + - name: Generate image repository path for Docker registry + run: | + echo DOCKER_IMAGE_REPOSITORY=$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]') >> $GITHUB_ENV + + - name: Build and Push Docker Image to Docker registry + uses: docker/build-push-action@v5 + with: + context: . + file: ${{ env.DOCKER_FILE_PATH }} + pull: true + push: true + build-args: BUILD_PARAMETERS=${{ env.BUILD_PARAMETERS }} + cache-to: type=inline + platforms: linux/amd64,linux/arm,linux/arm64 + tags: | + ${{ env.DOCKER_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.RELEASE_VERSION }} + labels: | + org.opencontainers.image.source=${{ github.event.repository.clone_url }} + org.opencontainers.image.created=${{ steps.prep.outputs.created }} + org.opencontainers.image.revision=${{ github.sha }} + + - name: Build and Push Docker UBI Image to Docker registry + uses: docker/build-push-action@v5 + with: + context: . + file: ${{ env.DOCKER_UBI_FILE_PATH }} + pull: true + push: true + build-args: | + BUILD_PARAMETERS=${{ env.BUILD_PARAMETERS }} + BUILDER_IMAGE=${{ env.DOCKER_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.RELEASE_VERSION }} + cache-to: type=inline + platforms: linux/amd64,linux/arm64 + tags: | + ${{ env.DOCKER_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.RELEASE_VERSION }}-ubi + labels: | + org.opencontainers.image.source=${{ github.event.repository.clone_url }} + org.opencontainers.image.created=${{ steps.prep.outputs.created }} + org.opencontainers.image.revision=${{ github.sha }} + + - name: Login to ghcr registry + uses: docker/login-action@v3 + with: + registry: ${{env.REGISTRY}} + username: stakater-user + password: ${{secrets.GITHUB_TOKEN}} + + - name: Generate image repository path for ghcr registry + run: | + echo GHCR_IMAGE_REPOSITORY=${{env.REGISTRY}}/$(echo ${{ github.repository }} | tr '[:upper:]' '[:lower:]') >> $GITHUB_ENV + + - name: Build and Push Docker Image to ghcr registry + uses: docker/build-push-action@v5 + with: + context: . + file: ${{ env.DOCKER_FILE_PATH }} + pull: true + push: true + build-args: BUILD_PARAMETERS=${{ env.BUILD_PARAMETERS }} + cache-to: type=inline + platforms: linux/amd64,linux/arm,linux/arm64 + tags: | + ${{ env.GHCR_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.RELEASE_VERSION }} + labels: | + org.opencontainers.image.source=${{ github.event.repository.clone_url }} + org.opencontainers.image.created=${{ steps.prep.outputs.created }} + org.opencontainers.image.revision=${{ github.sha }} + + - name: Build and Push Docker UBI Image to ghcr registry + uses: docker/build-push-action@v5 + with: + context: . + file: ${{ env.DOCKER_UBI_FILE_PATH }} + pull: true + push: true + build-args: | + BUILD_PARAMETERS=${{ env.BUILD_PARAMETERS }} + BUILDER_IMAGE=${{ env.GHCR_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.RELEASE_VERSION }} + cache-to: type=inline + platforms: linux/amd64,linux/arm64 + tags: | + ${{ env.GHCR_IMAGE_REPOSITORY }}:${{ steps.generate_tag.outputs.RELEASE_VERSION }}-ubi + labels: | + org.opencontainers.image.source=${{ github.event.repository.clone_url }} + org.opencontainers.image.created=${{ steps.prep.outputs.created }} + org.opencontainers.image.revision=${{ github.sha }} + + ############################## + ## Add steps to generate required artifacts for a release here(helm chart, operator manifest etc.) + ############################## + + # # Generate tag for operator without "v" + # - name: Generate Operator Tag + # id: generate_operator_tag + # uses: anothrNick/github-tag-action@1.70.0 + # env: + # GITHUB_TOKEN: ${{ secrets.STAKATER_GITHUB_TOKEN }} + # WITH_V: false + # DEFAULT_BUMP: patch + # DRY_RUN: true + + # # Update chart tag to the latest semver tag + # - name: Update Chart Version + # env: + # VERSION: ${{ steps.generate_operator_tag.outputs.RELEASE_VERSION }} + # run: make bump-chart + - name: Run GoReleaser uses: goreleaser/goreleaser-action@master with: @@ -33,7 +197,7 @@ jobs: - name: Notify Slack uses: 8398a7/action-slack@v3 - if: always() + if: always() # Pick up events even if the job fails or is canceled. with: status: ${{ job.status }} fields: repo,author,action,eventName,ref,workflow diff --git a/deployments/kubernetes/manifests/deployment.yaml b/deployments/kubernetes/manifests/deployment.yaml index 422da504..404f7c9a 100644 --- a/deployments/kubernetes/manifests/deployment.yaml +++ b/deployments/kubernetes/manifests/deployment.yaml @@ -17,7 +17,7 @@ spec: app: reloader-reloader spec: containers: - - image: "ghcr.io/stakater/reloader:v1.0.119" + - image: "ghcr.io/stakater/reloader:latest" imagePullPolicy: IfNotPresent name: reloader-reloader ports: diff --git a/deployments/kubernetes/reloader.yaml b/deployments/kubernetes/reloader.yaml index c2dc20a1..a3f21aa8 100644 --- a/deployments/kubernetes/reloader.yaml +++ b/deployments/kubernetes/reloader.yaml @@ -121,7 +121,7 @@ metadata: app.kubernetes.io/managed-by: "Helm" group: com.stakater.platform provider: stakater - version: v1.0.119 + version: latest name: reloader-reloader namespace: default spec: @@ -141,10 +141,10 @@ spec: app.kubernetes.io/managed-by: "Helm" group: com.stakater.platform provider: stakater - version: v1.0.119 + version: latest spec: containers: - - image: "ghcr.io/stakater/reloader:v1.0.119" + - image: "ghcr.io/stakater/reloader:latest" imagePullPolicy: IfNotPresent name: reloader-reloader diff --git a/renovate.json b/renovate.json index 39e38959..3fa360ab 100644 --- a/renovate.json +++ b/renovate.json @@ -6,6 +6,12 @@ "labels": [ "dependencies" ], + "rebaseWhen": "never", + "vulnerabilityAlerts": { + "enabled": true, + "labels": ["security"] + }, + "customManagers": [ { "customType": "regex",