Update release flow

.github/workflows/00-test.yaml

@@ -1,4 +1,4 @@
-name: test
+name: 00-test
 
 on:
   workflow_call:
@@ -12,7 +12,7 @@ on:
         required: true
         type: string
 jobs:
-  build:
+  basic-tests:
     name: Create cross-platform build
     runs-on: ${{ matrix.os }}
     env:
@@ -97,4 +97,33 @@ jobs:
           RELEASE: ${{ inputs.release }} 
           KUBESCAPE_SKIP_UPDATE_CHECK: "true"
         run: python3 smoke_testing/init.py ${PWD}/build/ubuntu-latest/kubescape
-        if: matrix.os == 'ubuntu-20.04'        
+        if: matrix.os == 'ubuntu-20.04'      
+
+      - name: golangci-lint
+        if: matrix.os == 'ubuntu-20.04'      
+        continue-on-error: true
+        uses: golangci/golangci-lint-action@v3
+        with:
+          # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
+          version: latest
+
+          # Optional: working directory, useful for monorepos
+          # working-directory: somedir
+
+          # Optional: golangci-lint command line arguments.
+          # args: --issues-exit-code=0
+          args: --timeout 10m --build-tags=static
+          #--new-from-rev dev
+
+          # Optional: show only new issues if it's a pull request. The default value is `false`.
+          only-new-issues: true
+
+          # Optional: if set to true then the all caching functionality will be complete disabled,
+          #           takes precedence over all other caching options.
+          # skip-cache: true
+
+          # Optional: if set to true then the action don't cache or restore ~/go/pkg.
+          # skip-pkg-cache: true
+
+          # Optional: if set to true then the action don't cache or restore ~/.cache/go-build.
+          # skip-build-cache: true

.github/workflows/01-create-release.yaml

@@ -1,4 +1,4 @@
-name: build
+name: 01-create-release
 
 on:
   workflow_call:
@@ -7,7 +7,7 @@ on:
         description: 'release'
         required: true
         type: string
-      tag_name:
+      tag:
         description: 'tag'
         required: true
         type: string
@@ -34,8 +34,8 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          tag_name: ${{ inputs.tag_name }}
           release_name: ${{ inputs.release_name }}
+          tag_name: ${{ inputs.tag }}
           draft: ${{ inputs.draft }}
           prerelease: false
-   
+   

.github/workflows/01-golang-lint.yaml

@@ -1,64 +0,0 @@
-name: golangci-lint
-on:
-  push:
-    branches:
-      - dev
-  pull_request:
-    types: [ edited, opened, synchronize, reopened ]
-    branches: 
-      - 'master'
-      - 'main'
-      - 'dev'
-    paths-ignore:
-      - '**.yaml'
-      - '**.md'
-      - '**.sh'
-      - 'website/*'
-      - 'examples/*'
-      - 'docs/*'
-      - 'build/*'
-      - '.github/*'
-permissions:
-  contents: read
-  # Optional: allow read access to pull request. Use with `only-new-issues` option.
-  pull-requests: read
-jobs:
-  golangci:
-    name: lint
-    runs-on: ubuntu-20.04
-    steps:
-      - uses: actions/setup-go@v3
-        with:
-          go-version: 1.19
-      - uses: actions/checkout@v3
-        with:
-          submodules: recursive
-      - name: Install libgit2
-        run: make libgit2
-      - name: golangci-lint
-        continue-on-error: true
-        uses: golangci/golangci-lint-action@v3
-        with:
-          # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version
-          version: latest
-
-          # Optional: working directory, useful for monorepos
-          # working-directory: somedir
-
-          # Optional: golangci-lint command line arguments.
-          # args: --issues-exit-code=0
-          args: --timeout 10m --build-tags=static
-          #--new-from-rev dev
-
-          # Optional: show only new issues if it's a pull request. The default value is `false`.
-          only-new-issues: true
-
-          # Optional: if set to true then the all caching functionality will be complete disabled,
-          #           takes precedence over all other caching options.
-          # skip-cache: true
-
-          # Optional: if set to true then the action don't cache or restore ~/go/pkg.
-          # skip-pkg-cache: true
-
-          # Optional: if set to true then the action don't cache or restore ~/.cache/go-build.
-          # skip-build-cache: true

.github/workflows/02-publish-artifacts.yaml

@@ -1,37 +1,20 @@
-name: build
+name: publish-artifacts
 
 on:
-  push:
-    branches: 
-      - 'master'
-      - 'main'
-    paths-ignore:
-      - '**.yaml'
-      - '**.md'
-      - '**.sh'
-      - 'website/*'
-      - 'examples/*'
-      - 'docs/*'
-      - 'build/*'
-      - '.github/*'
+  workflow_call:
+    inputs:
+      upload_url:
+        description: 'upload url'
+        required: true
+        type: string
+      release:
+        description: 'release tag'
+        required: true
+        type: string
+
 jobs:
-  test:
-    uses: ./.github/workflows/test.yaml
-    with:
-      release: "v2.0.${{ github.run_number }}"
-      client: test
-
-  create-release:
-    uses: ./.github/workflows/release.yaml
-    needs: test
-    with:
-      release_name: "Release v2.0.${{ github.run_number }}"
-      tag_name: "v2.0.${{ github.run_number }}"
-    secrets: inherit
-
   publish-artifacts:
     name: Build and publish artifacts
-    needs: create-release
     runs-on: ${{ matrix.os }}
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -59,7 +42,7 @@ jobs:
 
       - name: Build
         env:
-          RELEASE: v2.0.${{ github.run_number }}
+          RELEASE: ${{ inputs.release }}
           CLIENT: release
           CGO_ENABLED: 1
         run: python3 --version && python3 build.py
@@ -70,7 +53,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          upload_url: ${{ needs.create-release.outputs.upload_url }}
+          upload_url: ${{ inputs.upload_url }}
           asset_path: build/${{ matrix.os }}/kubescape
           asset_name: kubescape-${{ matrix.os }}
           asset_content_type: application/octet-stream
@@ -82,7 +65,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          upload_url: ${{ needs.create-release.outputs.upload_url }}
+          upload_url: ${{ inputs.upload_url }}
           asset_path: build/ubuntu-latest/kubescape
           asset_name: kubescape-ubuntu-latest
           asset_content_type: application/octet-stream
@@ -94,7 +77,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          upload_url: ${{ needs.create-release.outputs.upload_url }}
+          upload_url: ${{ inputs.upload_url }}
           asset_path: build/${{ matrix.os }}/kubescape.sha256
           asset_name: kubescape-${{ matrix.os }}-sha256
           asset_content_type: application/octet-stream
@@ -106,19 +89,10 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          upload_url: ${{ needs.create-release.outputs.upload_url }}
+          upload_url: ${{ inputs.upload_url }}
           asset_path: build/ubuntu-latest/kubescape.sha256
           asset_name: kubescape-ubuntu-latest-sha256
           asset_content_type: application/octet-stream     
         if: matrix.os == 'ubuntu-20.04'
-
-  publish-image:
-    uses: ./.github/workflows/build-image.yaml
-    needs: create-release
-    with:
-      client: "image-release"
-      image_name: "quay.io/${{ github.repository_owner }}/kubescape"
-      image_tag: "v2.0.${{ github.run_number }}"
-      support_platforms: true
-      cosign: true
-    secrets: inherit
+   
+   

.github/workflows/03-publish-image.yaml

@@ -1,4 +1,4 @@
-name: build
+name: 03-publish-image
 
 on:
   workflow_call:

.github/workflows/README.md

@@ -0,0 +1,45 @@
+# Kubescape workflows
+
+Tag terminology: `v<major>.<minor>.<patch>`
+
+## Developing process
+
+Kubescape's main branch is `main`, any PR will be opened against the main branch.
+
+### Opening a PR:
+
+When a user opens a PR, this will trigger some basic tests (units, license, etc.)
+
+### Reviewing a PR:
+
+The reviewer/maintainer of a PR will decide whether the PR introduces changes that require running the E2E system tests. If so, the reviewer will add the `trigger-integration-test` label.
+
+### Approving a PR:
+
+Once a maintainer approves the PR, if the `trigger-integration-test` label was added to the PR, the GitHub actions will trigger the system test. The PR will be merged only after the system tests passed successfully. If the label was not added, the PR can be merged. 
+
+### Merging a PR:
+
+Code is merged, no other actions is needed
+
+
+## Release process
+
+Every two weeks, we will create a new tag by bumping the minor version, this will create the release and publish the artifacts. 
+If we are introducing breaking changes, we will update the `major` version instead.
+
+When we wish to push a hot-fix/feature within the two weeks, we will bump the `patch`.
+
+### Creating new tag
+Every two weeks or upon the decision of the maintainers, a maintainer can create a tag.
+
+The tag should look as follows: `v<A>.<B>.<C>-rc.D` (release candidate). 
+
+When creating a tag, GitHub will trigger the following actions:
+1. Basic tests - unit tests, license, etc.
+2. System tests (integration tests). If the tests failed, the actions will stop here.
+3. Create a new tag: `v<A>.<B>.<C>` (same tag just without the `rc` suffix)
+4. Create a release
+5. Publish artifacts
+6. Build and publish the docker image (this is meanwhile, until we separate the microservice code from the LCI codebase)
+ 

.github/workflows/a-pr-check.yaml

@@ -18,7 +18,7 @@ on:
       - '.github/*'
 jobs:
   test:
-    uses: ./.github/workflows/test.yaml
+    uses: ./.github/workflows/00-test.yaml
     with:
-      release: "v2.0.${{ github.run_number }}"
+      release: ${{ github.ref_name}}
       client: test

.github/workflows/build_dev.yaml

@@ -1,31 +0,0 @@
-name: build-dev
-
-on:
-  push:
-    branches: [ dev ]
-    paths-ignore:
-      - '**.yaml'
-      - '**.md'
-      - '**.sh'
-      - 'website/*'
-      - 'examples/*'
-      - 'docs/*'
-      - 'build/*'
-      - '.github/*'
-jobs:
-  test:
-    uses: ./.github/workflows/test.yaml
-    with:
-      release: "v2.0.${{ github.run_number }}"
-      client: test
- 
-  # publish-dev-image:
-  #   uses: ./.github/workflows/build-image.yaml
-  #   needs: test
-  #   with:
-  #     client: "image-dev"
-  #     image_name: "quay.io/${{ github.repository_owner }}/kubescape"
-  #     image_tag: "dev-v2.0.${{ github.run_number }}"
-  #     support_platforms: true
-  #     cosign: true
-  #   secrets: inherit

.github/workflows/c-release.yaml

@@ -0,0 +1,47 @@
+name: release
+
+on:
+  push:
+    tags:
+    # - 'v*.*.*-rc.*' # Comment out since the re-tagging process is not yet implemented
+    - 'v*.*.*'
+jobs:
+  test:
+    uses: ./.github/workflows/00-test.yaml
+    with:
+      release: ${{ github.ref_name}}
+      client: test
+  
+  # integration-test:
+  #   if: ${{ label == e2e-tests }}
+
+  # re-tag:
+  #   # if tests passed, create new tag without `rc`
+    
+  create-release:
+    uses: ./.github/workflows/01-create-release.yaml
+    needs: test
+    with:
+      release_name: "Release ${{ github.ref_name}}"
+      tag: ${{ github.ref_name}}
+    secrets: inherit
+
+  publish-artifacts:
+    uses: ./.github/workflows/02-publish-artifacts.yaml
+    needs: create-release
+    with:
+      upload_url: ${{ needs.create-release.outputs.upload_url }}
+      release: "${{ github.ref_name}}"
+    secrets: inherit
+       
+
+  publish-image:
+    uses: ./.github/workflows/03-publish-image.yaml
+    needs: create-release
+    with:
+      client: "image-release"
+      image_name: "quay.io/${{ github.repository_owner }}/kubescape"
+      image_tag: "${{ github.ref_name}}"
+      support_platforms: true
+      cosign: true
+    secrets: inherit