From fb82fef6e00b243743e617105fc8c1d0a37142fc Mon Sep 17 00:00:00 2001 From: Dmitriy Ivolgin Date: Wed, 19 Aug 2026 09:38:49 -0700 Subject: [PATCH] Add securebuild release jobs (#2114) --- .github/workflows/publish-securebuild.yml | 96 ++++++++++++++++++ .github/workflows/release.yaml | 8 ++ securebuild/image/apko.yaml | 51 ++++++++++ securebuild/package/melange.yaml | 114 ++++++++++++++++++++++ 4 files changed, 269 insertions(+) create mode 100644 .github/workflows/publish-securebuild.yml create mode 100644 securebuild/image/apko.yaml create mode 100644 securebuild/package/melange.yaml diff --git a/.github/workflows/publish-securebuild.yml b/.github/workflows/publish-securebuild.yml new file mode 100644 index 00000000..1a19509d --- /dev/null +++ b/.github/workflows/publish-securebuild.yml @@ -0,0 +1,96 @@ +name: publish-securebuild + +env: + SECUREBUILD_CLI_VERSION: v0.0.496 + SECUREBUILD_CLI_SHA256: af016db0fa16d51f68f443dea31a63152ad23504bb296137b01f270102011f79 + +on: + workflow_call: + inputs: + version: + description: Stable version tag to build (for example, v0.130.0) + required: true + type: string + secrets: + SECUREBUILD_API_TOKEN: + required: true + workflow_dispatch: + inputs: + version: + description: Stable version tag to build (for example, v0.130.0) + required: true + type: string + +jobs: + validate-version: + runs-on: ubuntu-22.04 + steps: + - name: Require a stable release version + env: + VERSION: ${{ inputs.version }} + run: | + if ! [[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + echo "SecureBuild only supports stable release versions (for example, v0.130.0): $VERSION" + exit 1 + fi + + build-package: + needs: validate-version + runs-on: ubuntu-22.04 + continue-on-error: true + outputs: + version: ${{ steps.version.outputs.version }} + steps: + - name: Set version + id: version + env: + VERSION: ${{ inputs.version }} + run: echo "version=$VERSION" >> "$GITHUB_OUTPUT" + + - name: Install SecureBuild CLI + run: | + curl --fail --silent --show-error --location \ + "https://github.com/securebuildhq/securebuild/releases/download/${SECUREBUILD_CLI_VERSION}/securebuild-cli-linux-amd64" \ + --output securebuild + echo "${SECUREBUILD_CLI_SHA256} securebuild" | sha256sum --check --strict + chmod +x securebuild + + - name: Build package + env: + SECUREBUILD_API_TOKEN: ${{ secrets.SECUREBUILD_API_TOKEN }} + VERSION: ${{ steps.version.outputs.version }} + run: | + ./securebuild build package \ + --package-family-name troubleshoot \ + --tag "$VERSION" \ + --api-token "$SECUREBUILD_API_TOKEN" + + build-image: + needs: build-package + if: ${{ !cancelled() && needs.build-package.result == 'success' }} + runs-on: ubuntu-22.04 + continue-on-error: true + strategy: + matrix: + image-name: + - troubleshoot + - preflight + steps: + - name: Install SecureBuild CLI + run: | + curl --fail --silent --show-error --location \ + "https://github.com/securebuildhq/securebuild/releases/download/${SECUREBUILD_CLI_VERSION}/securebuild-cli-linux-amd64" \ + --output securebuild + echo "${SECUREBUILD_CLI_SHA256} securebuild" | sha256sum --check --strict + chmod +x securebuild + + - name: Build image + env: + IMAGE_NAME: ${{ matrix.image-name }} + SECUREBUILD_API_TOKEN: ${{ secrets.SECUREBUILD_API_TOKEN }} + VERSION: ${{ needs.build-package.outputs.version }} + run: | + ./securebuild build image \ + --image-name "$IMAGE_NAME" \ + --tag "$VERSION" \ + --api-token "$SECUREBUILD_API_TOKEN" diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index b0f4a843..6990677c 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -59,6 +59,14 @@ jobs: with: krew_template_file: deploy/krew/support-bundle.yaml + securebuild: + if: ${{ !contains(github.ref_name, '-') }} + uses: ./.github/workflows/publish-securebuild.yml + with: + version: ${{ github.ref_name }} + secrets: + SECUREBUILD_API_TOKEN: ${{ secrets.SECUREBUILD_API_TOKEN }} + notify: if: ${{ !contains(github.ref_name, '-') }} uses: replicatedhq/reusable-workflows/.github/workflows/notify-release.yml@0432fb838fc83852b78be97a150b35991a85d56f diff --git a/securebuild/image/apko.yaml b/securebuild/image/apko.yaml new file mode 100644 index 00000000..3996274e --- /dev/null +++ b/securebuild/image/apko.yaml @@ -0,0 +1,51 @@ +contents: + repositories: + - https://apk.cve0.io + keyring: + - https://apk.cve0.io/key/cve0-signing.rsa.pub + packages: + - troubleshoot + - bash + - kmod + - ca-certificates-bundle + - securebuild-baselayout + - busybox + +cmd: bash + +work-dir: / + +archs: + - x86_64 + - aarch64 + +environment: + PATH: /troubleshoot:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin + +paths: + - path: /troubleshoot + type: directory + uid: 0 + gid: 0 + permissions: 0o755 + + - path: /troubleshoot/support-bundle + type: symlink + source: /usr/bin/support-bundle + permissions: 0o755 + + - path: /troubleshoot/preflight + type: symlink + source: /usr/bin/preflight + permissions: 0o755 + + - path: /troubleshoot/collect + type: symlink + source: /usr/bin/collect + permissions: 0o755 + +annotations: + org.opencontainers.image.title: Troubleshoot (SecureBuild) + org.opencontainers.image.description: Troubleshoot tools for collecting and analyzing Kubernetes cluster diagnostics + org.opencontainers.image.source: https://github.com/replicatedhq/troubleshoot + org.opencontainers.image.vendor: SecureBuild diff --git a/securebuild/package/melange.yaml b/securebuild/package/melange.yaml new file mode 100644 index 00000000..f64be2cc --- /dev/null +++ b/securebuild/package/melange.yaml @@ -0,0 +1,114 @@ +package: + name: troubleshoot-head + version: "1000.0.0" + epoch: 0 + description: Troubleshoot tools for collecting and analyzing Kubernetes cluster diagnostics + copyright: + - license: Apache-2.0 + attestation: "SecureBuild (https://securebuild.com)" + dependencies: + runtime: + - ${{package.name}}-support-bundle=${{package.full-version}} + - ${{package.name}}-preflight=${{package.full-version}} + - ${{package.name}}-collect=${{package.full-version}} + provides: + - troubleshoot=${{package.full-version}} + +var-transforms: + - from: ${{package.version}} + match: ^(\d+\.\d+)\.\d+$ + replace: "$1" + to: major-minor-version + +environment: + contents: + repositories: + - https://apk.cve0.io + keyring: + - https://apk.cve0.io/key/cve0-signing.rsa.pub + packages: + - busybox + - build-base + - ca-certificates-bundle + - go + - git + - bash + environment: + CGO_ENABLED: "0" + GOPROXY: https://proxy.golang.org,direct + GOSUMDB: sum.golang.org + +pipeline: + - uses: git-checkout + with: + repository: https://github.com/replicatedhq/troubleshoot + tag: v${{package.version}} + depth: 1 + + - name: Build troubleshoot binaries + runs: | + export PATH="/usr/bin:$PATH" + export VERSION="v${{package.version}}" + make -j bin/support-bundle bin/preflight bin/collect + +subpackages: + - name: ${{package.name}}-support-bundle + description: Support bundle collector for Kubernetes cluster diagnostics + dependencies: + provides: + - troubleshoot-support-bundle=${{package.full-version}} + pipeline: + - runs: | + mkdir -p ${{targets.subpkgdir}}/usr/bin + cp bin/support-bundle ${{targets.subpkgdir}}/usr/bin/support-bundle + - uses: strip + test: + pipeline: + - runs: /usr/bin/support-bundle --help + + - name: ${{package.name}}-preflight + description: Preflight checker for Kubernetes cluster requirements + dependencies: + provides: + - troubleshoot-preflight=${{package.full-version}} + pipeline: + - runs: | + mkdir -p ${{targets.subpkgdir}}/usr/bin + cp bin/preflight ${{targets.subpkgdir}}/usr/bin/preflight + - uses: strip + test: + pipeline: + - runs: /usr/bin/preflight --help + + - name: ${{package.name}}-collect + description: Collector for Kubernetes cluster data + dependencies: + provides: + - troubleshoot-collect=${{package.full-version}} + pipeline: + - runs: | + mkdir -p ${{targets.subpkgdir}}/usr/bin + cp bin/collect ${{targets.subpkgdir}}/usr/bin/collect + - uses: strip + test: + pipeline: + - runs: /usr/bin/collect --help + +update: + enabled: true + github: + identifier: replicatedhq/troubleshoot + use-tag: true + strip-prefix: v + tag-filter: v${{vars.major-minor-version}}. + +test: + environment: + contents: + packages: + - ${{package.name}}=${{package.full-version}} + pipeline: + - runs: | + /usr/bin/support-bundle --help + /usr/bin/preflight --help + /usr/bin/collect --help