mirror of
https://github.com/kubereboot/kured.git
synced 2026-08-18 02:46:17 +00:00
Jean-Philippe Evrard
e531f64b85
GoReleaser now builds the multi-arch images, publishes SBOM/provenance metadata, signs image digests, and attaches the generated combined Kubernetes manifest to tagged GitHub releases. This is to have goReleaser as a single point of work for release automation. With this, so tags and main commits follow one consistent image pipeline. We keep the CI and developer image builds intentionally local. PR, periodic, main, and tag scan jobs build only `kured:dev` and scan that local image with Trivy, which avoids pushing disposable images and keeps the tested image identical to the one used by kind-based e2e tests. Simplify the Makefile around the remaining artifact boundaries: `build` for a local GoReleaser binary build, `dev-image` for local Docker/e2e/scan use, and `release` for the GoReleaser publish path. Remove the old manual manifest target because the release manifest is now generated during the tagged release flow. To avoid a mess with all the configuration files, I move everything into a `.config` folder, for the tools supporting it. This also meant updating golangci-lint to a valid v2 config, and simplify the Dockerfile to the layout expected by GoReleaser `dockers_v2` using `TARGETPLATFORM`. Handle Prometheus client initialization errors explicitly so the stricter errcheck configuration keeps the existing fail-closed reboot-blocking behavior, to fix the golangci-lint issue that appeared. Signed-off-by: Jean-Philippe Evrard <open-source@a.spamming.party>
75 lines
2.2 KiB
YAML
75 lines
2.2 KiB
YAML
name: Push image of latest main
|
|
on:
|
|
push:
|
|
branches:
|
|
- main
|
|
|
|
env:
|
|
REGISTRY: ghcr.io
|
|
IMAGE_NAME: ${{ github.repository }}
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
tag-scan-and-push-final-image:
|
|
name: Build, scan, and publish main image
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
id-token: write
|
|
contents: read
|
|
packages: write
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4.1.0
|
|
with:
|
|
version: 2026.6.1
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
|
|
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
|
|
|
|
- name: Find current commit
|
|
id: version
|
|
run: echo "sha_short=$(git rev-parse --short HEAD)" >> "$GITHUB_OUTPUT"
|
|
|
|
- name: Build local image for scan
|
|
run: VERSION="${{ steps.version.outputs.sha_short }}" IMAGE_NAME="${{ github.repository }}" make dev-image
|
|
env:
|
|
IMAGE_NAME: ${{ github.repository }}
|
|
|
|
- name: Run Trivy vulnerability scanner
|
|
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
|
|
with:
|
|
image-ref: kured:dev
|
|
format: 'table'
|
|
exit-code: '1'
|
|
ignore-unfixed: true
|
|
vuln-type: 'os,library'
|
|
severity: 'CRITICAL,HIGH'
|
|
|
|
- name: Login to ghcr.io
|
|
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
|
|
with:
|
|
registry: ${{ env.REGISTRY }}
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Build, publish, SBOM, and sign image
|
|
run: make release
|
|
env:
|
|
DISABLE_GITHUB_RELEASE: "true"
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
GORELEASER_CURRENT_TAG: ${{ steps.version.outputs.sha_short }}
|
|
IMAGE_NAME: ${{ github.repository }}
|