From 0006d7d8e7609c74aff923c0952d2db602e5906f Mon Sep 17 00:00:00 2001 From: David Wertenteil Date: Sun, 15 Jan 2023 11:11:29 +0200 Subject: [PATCH] Update release flow --- .github/workflows/{test.yaml => 00-test.yaml} | 35 +++++++++- .../{release.yaml => 01-create-release.yaml} | 8 +-- .github/workflows/01-golang-lint.yaml | 64 ------------------- .../{build.yaml => 02-publish-artifacts.yaml} | 64 ++++++------------- ...build-image.yaml => 03-publish-image.yaml} | 2 +- .github/workflows/README.md | 45 +++++++++++++ .../{pr_checks.yaml => a-pr-check.yaml} | 4 +- .github/workflows/build_dev.yaml | 31 --------- .github/workflows/c-release.yaml | 47 ++++++++++++++ ...{post-release.yaml => d-post-release.yaml} | 0 ...-issues.yaml => z-close-typos-issues.yaml} | 0 11 files changed, 150 insertions(+), 150 deletions(-) rename .github/workflows/{test.yaml => 00-test.yaml} (68%) rename .github/workflows/{release.yaml => 01-create-release.yaml} (92%) delete mode 100644 .github/workflows/01-golang-lint.yaml rename .github/workflows/{build.yaml => 02-publish-artifacts.yaml} (66%) rename .github/workflows/{build-image.yaml => 03-publish-image.yaml} (99%) create mode 100644 .github/workflows/README.md rename .github/workflows/{pr_checks.yaml => a-pr-check.yaml} (80%) delete mode 100644 .github/workflows/build_dev.yaml create mode 100644 .github/workflows/c-release.yaml rename .github/workflows/{post-release.yaml => d-post-release.yaml} (100%) rename .github/workflows/{close-typos-issues.yaml => z-close-typos-issues.yaml} (100%) diff --git a/.github/workflows/test.yaml b/.github/workflows/00-test.yaml similarity index 68% rename from .github/workflows/test.yaml rename to .github/workflows/00-test.yaml index 9129adea..06abc0d2 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/00-test.yaml @@ -1,4 +1,4 @@ -name: test +name: 00-test on: workflow_call: @@ -12,7 +12,7 @@ on: required: true type: string jobs: - build: + basic-tests: name: Create cross-platform build runs-on: ${{ matrix.os }} env: @@ -97,4 +97,33 @@ jobs: RELEASE: ${{ inputs.release }} KUBESCAPE_SKIP_UPDATE_CHECK: "true" run: python3 smoke_testing/init.py ${PWD}/build/ubuntu-latest/kubescape - if: matrix.os == 'ubuntu-20.04' + if: matrix.os == 'ubuntu-20.04' + + - name: golangci-lint + if: matrix.os == 'ubuntu-20.04' + continue-on-error: true + uses: golangci/golangci-lint-action@v3 + with: + # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version + version: latest + + # Optional: working directory, useful for monorepos + # working-directory: somedir + + # Optional: golangci-lint command line arguments. + # args: --issues-exit-code=0 + args: --timeout 10m --build-tags=static + #--new-from-rev dev + + # Optional: show only new issues if it's a pull request. The default value is `false`. + only-new-issues: true + + # Optional: if set to true then the all caching functionality will be complete disabled, + # takes precedence over all other caching options. + # skip-cache: true + + # Optional: if set to true then the action don't cache or restore ~/go/pkg. + # skip-pkg-cache: true + + # Optional: if set to true then the action don't cache or restore ~/.cache/go-build. + # skip-build-cache: true diff --git a/.github/workflows/release.yaml b/.github/workflows/01-create-release.yaml similarity index 92% rename from .github/workflows/release.yaml rename to .github/workflows/01-create-release.yaml index 76d1e74a..da9d9e1a 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/01-create-release.yaml @@ -1,4 +1,4 @@ -name: build +name: 01-create-release on: workflow_call: @@ -7,7 +7,7 @@ on: description: 'release' required: true type: string - tag_name: + tag: description: 'tag' required: true type: string @@ -34,8 +34,8 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: - tag_name: ${{ inputs.tag_name }} release_name: ${{ inputs.release_name }} + tag_name: ${{ inputs.tag }} draft: ${{ inputs.draft }} prerelease: false - + \ No newline at end of file diff --git a/.github/workflows/01-golang-lint.yaml b/.github/workflows/01-golang-lint.yaml deleted file mode 100644 index e81902ee..00000000 --- a/.github/workflows/01-golang-lint.yaml +++ /dev/null @@ -1,64 +0,0 @@ -name: golangci-lint -on: - push: - branches: - - dev - pull_request: - types: [ edited, opened, synchronize, reopened ] - branches: - - 'master' - - 'main' - - 'dev' - paths-ignore: - - '**.yaml' - - '**.md' - - '**.sh' - - 'website/*' - - 'examples/*' - - 'docs/*' - - 'build/*' - - '.github/*' -permissions: - contents: read - # Optional: allow read access to pull request. Use with `only-new-issues` option. - pull-requests: read -jobs: - golangci: - name: lint - runs-on: ubuntu-20.04 - steps: - - uses: actions/setup-go@v3 - with: - go-version: 1.19 - - uses: actions/checkout@v3 - with: - submodules: recursive - - name: Install libgit2 - run: make libgit2 - - name: golangci-lint - continue-on-error: true - uses: golangci/golangci-lint-action@v3 - with: - # Optional: version of golangci-lint to use in form of v1.2 or v1.2.3 or `latest` to use the latest version - version: latest - - # Optional: working directory, useful for monorepos - # working-directory: somedir - - # Optional: golangci-lint command line arguments. - # args: --issues-exit-code=0 - args: --timeout 10m --build-tags=static - #--new-from-rev dev - - # Optional: show only new issues if it's a pull request. The default value is `false`. - only-new-issues: true - - # Optional: if set to true then the all caching functionality will be complete disabled, - # takes precedence over all other caching options. - # skip-cache: true - - # Optional: if set to true then the action don't cache or restore ~/go/pkg. - # skip-pkg-cache: true - - # Optional: if set to true then the action don't cache or restore ~/.cache/go-build. - # skip-build-cache: true diff --git a/.github/workflows/build.yaml b/.github/workflows/02-publish-artifacts.yaml similarity index 66% rename from .github/workflows/build.yaml rename to .github/workflows/02-publish-artifacts.yaml index a9ea2728..e71edcfd 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/02-publish-artifacts.yaml @@ -1,37 +1,20 @@ -name: build +name: publish-artifacts on: - push: - branches: - - 'master' - - 'main' - paths-ignore: - - '**.yaml' - - '**.md' - - '**.sh' - - 'website/*' - - 'examples/*' - - 'docs/*' - - 'build/*' - - '.github/*' + workflow_call: + inputs: + upload_url: + description: 'upload url' + required: true + type: string + release: + description: 'release tag' + required: true + type: string + jobs: - test: - uses: ./.github/workflows/test.yaml - with: - release: "v2.0.${{ github.run_number }}" - client: test - - create-release: - uses: ./.github/workflows/release.yaml - needs: test - with: - release_name: "Release v2.0.${{ github.run_number }}" - tag_name: "v2.0.${{ github.run_number }}" - secrets: inherit - publish-artifacts: name: Build and publish artifacts - needs: create-release runs-on: ${{ matrix.os }} env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} @@ -59,7 +42,7 @@ jobs: - name: Build env: - RELEASE: v2.0.${{ github.run_number }} + RELEASE: ${{ inputs.release }} CLIENT: release CGO_ENABLED: 1 run: python3 --version && python3 build.py @@ -70,7 +53,7 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: - upload_url: ${{ needs.create-release.outputs.upload_url }} + upload_url: ${{ inputs.upload_url }} asset_path: build/${{ matrix.os }}/kubescape asset_name: kubescape-${{ matrix.os }} asset_content_type: application/octet-stream @@ -82,7 +65,7 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: - upload_url: ${{ needs.create-release.outputs.upload_url }} + upload_url: ${{ inputs.upload_url }} asset_path: build/ubuntu-latest/kubescape asset_name: kubescape-ubuntu-latest asset_content_type: application/octet-stream @@ -94,7 +77,7 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: - upload_url: ${{ needs.create-release.outputs.upload_url }} + upload_url: ${{ inputs.upload_url }} asset_path: build/${{ matrix.os }}/kubescape.sha256 asset_name: kubescape-${{ matrix.os }}-sha256 asset_content_type: application/octet-stream @@ -106,19 +89,10 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: - upload_url: ${{ needs.create-release.outputs.upload_url }} + upload_url: ${{ inputs.upload_url }} asset_path: build/ubuntu-latest/kubescape.sha256 asset_name: kubescape-ubuntu-latest-sha256 asset_content_type: application/octet-stream if: matrix.os == 'ubuntu-20.04' - - publish-image: - uses: ./.github/workflows/build-image.yaml - needs: create-release - with: - client: "image-release" - image_name: "quay.io/${{ github.repository_owner }}/kubescape" - image_tag: "v2.0.${{ github.run_number }}" - support_platforms: true - cosign: true - secrets: inherit + + \ No newline at end of file diff --git a/.github/workflows/build-image.yaml b/.github/workflows/03-publish-image.yaml similarity index 99% rename from .github/workflows/build-image.yaml rename to .github/workflows/03-publish-image.yaml index c0e31102..884a14a3 100644 --- a/.github/workflows/build-image.yaml +++ b/.github/workflows/03-publish-image.yaml @@ -1,4 +1,4 @@ -name: build +name: 03-publish-image on: workflow_call: diff --git a/.github/workflows/README.md b/.github/workflows/README.md new file mode 100644 index 00000000..d4f1a746 --- /dev/null +++ b/.github/workflows/README.md @@ -0,0 +1,45 @@ +# Kubescape workflows + +Tag terminology: `v..` + +## Developing process + +Kubescape's main branch is `main`, any PR will be opened against the main branch. + +### Opening a PR: + +When a user opens a PR, this will trigger some basic tests (units, license, etc.) + +### Reviewing a PR: + +The reviewer/maintainer of a PR will decide whether the PR introduces changes that require running the E2E system tests. If so, the reviewer will add the `trigger-integration-test` label. + +### Approving a PR: + +Once a maintainer approves the PR, if the `trigger-integration-test` label was added to the PR, the GitHub actions will trigger the system test. The PR will be merged only after the system tests passed successfully. If the label was not added, the PR can be merged. + +### Merging a PR: + +Code is merged, no other actions is needed + + +## Release process + +Every two weeks, we will create a new tag by bumping the minor version, this will create the release and publish the artifacts. +If we are introducing breaking changes, we will update the `major` version instead. + +When we wish to push a hot-fix/feature within the two weeks, we will bump the `patch`. + +### Creating new tag +Every two weeks or upon the decision of the maintainers, a maintainer can create a tag. + +The tag should look as follows: `v..-rc.D` (release candidate). + +When creating a tag, GitHub will trigger the following actions: +1. Basic tests - unit tests, license, etc. +2. System tests (integration tests). If the tests failed, the actions will stop here. +3. Create a new tag: `v..` (same tag just without the `rc` suffix) +4. Create a release +5. Publish artifacts +6. Build and publish the docker image (this is meanwhile, until we separate the microservice code from the LCI codebase) + \ No newline at end of file diff --git a/.github/workflows/pr_checks.yaml b/.github/workflows/a-pr-check.yaml similarity index 80% rename from .github/workflows/pr_checks.yaml rename to .github/workflows/a-pr-check.yaml index 58d21392..b1234718 100644 --- a/.github/workflows/pr_checks.yaml +++ b/.github/workflows/a-pr-check.yaml @@ -18,7 +18,7 @@ on: - '.github/*' jobs: test: - uses: ./.github/workflows/test.yaml + uses: ./.github/workflows/00-test.yaml with: - release: "v2.0.${{ github.run_number }}" + release: ${{ github.ref_name}} client: test diff --git a/.github/workflows/build_dev.yaml b/.github/workflows/build_dev.yaml deleted file mode 100644 index d80d0dca..00000000 --- a/.github/workflows/build_dev.yaml +++ /dev/null @@ -1,31 +0,0 @@ -name: build-dev - -on: - push: - branches: [ dev ] - paths-ignore: - - '**.yaml' - - '**.md' - - '**.sh' - - 'website/*' - - 'examples/*' - - 'docs/*' - - 'build/*' - - '.github/*' -jobs: - test: - uses: ./.github/workflows/test.yaml - with: - release: "v2.0.${{ github.run_number }}" - client: test - - # publish-dev-image: - # uses: ./.github/workflows/build-image.yaml - # needs: test - # with: - # client: "image-dev" - # image_name: "quay.io/${{ github.repository_owner }}/kubescape" - # image_tag: "dev-v2.0.${{ github.run_number }}" - # support_platforms: true - # cosign: true - # secrets: inherit diff --git a/.github/workflows/c-release.yaml b/.github/workflows/c-release.yaml new file mode 100644 index 00000000..36dc4e55 --- /dev/null +++ b/.github/workflows/c-release.yaml @@ -0,0 +1,47 @@ +name: release + +on: + push: + tags: + # - 'v*.*.*-rc.*' # Comment out since the re-tagging process is not yet implemented + - 'v*.*.*' +jobs: + test: + uses: ./.github/workflows/00-test.yaml + with: + release: ${{ github.ref_name}} + client: test + + # integration-test: + # if: ${{ label == e2e-tests }} + + # re-tag: + # # if tests passed, create new tag without `rc` + + create-release: + uses: ./.github/workflows/01-create-release.yaml + needs: test + with: + release_name: "Release ${{ github.ref_name}}" + tag: ${{ github.ref_name}} + secrets: inherit + + publish-artifacts: + uses: ./.github/workflows/02-publish-artifacts.yaml + needs: create-release + with: + upload_url: ${{ needs.create-release.outputs.upload_url }} + release: "${{ github.ref_name}}" + secrets: inherit + + + publish-image: + uses: ./.github/workflows/03-publish-image.yaml + needs: create-release + with: + client: "image-release" + image_name: "quay.io/${{ github.repository_owner }}/kubescape" + image_tag: "${{ github.ref_name}}" + support_platforms: true + cosign: true + secrets: inherit diff --git a/.github/workflows/post-release.yaml b/.github/workflows/d-post-release.yaml similarity index 100% rename from .github/workflows/post-release.yaml rename to .github/workflows/d-post-release.yaml diff --git a/.github/workflows/close-typos-issues.yaml b/.github/workflows/z-close-typos-issues.yaml similarity index 100% rename from .github/workflows/close-typos-issues.yaml rename to .github/workflows/z-close-typos-issues.yaml