Add securebuild release jobs (#2114)

.github/workflows/publish-securebuild.yml

@@ -0,0 +1,96 @@
+name: publish-securebuild
+
+env:
+  SECUREBUILD_CLI_VERSION: v0.0.496
+  SECUREBUILD_CLI_SHA256: af016db0fa16d51f68f443dea31a63152ad23504bb296137b01f270102011f79
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: Stable version tag to build (for example, v0.130.0)
+        required: true
+        type: string
+    secrets:
+      SECUREBUILD_API_TOKEN:
+        required: true
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Stable version tag to build (for example, v0.130.0)
+        required: true
+        type: string
+
+jobs:
+  validate-version:
+    runs-on: ubuntu-22.04
+    steps:
+      - name: Require a stable release version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          if ! [[ "$VERSION" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "SecureBuild only supports stable release versions (for example, v0.130.0): $VERSION"
+            exit 1
+          fi
+
+  build-package:
+    needs: validate-version
+    runs-on: ubuntu-22.04
+    continue-on-error: true
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Set version
+        id: version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+      - name: Install SecureBuild CLI
+        run: |
+          curl --fail --silent --show-error --location \
+            "https://github.com/securebuildhq/securebuild/releases/download/${SECUREBUILD_CLI_VERSION}/securebuild-cli-linux-amd64" \
+            --output securebuild
+          echo "${SECUREBUILD_CLI_SHA256}  securebuild" | sha256sum --check --strict
+          chmod +x securebuild
+
+      - name: Build package
+        env:
+          SECUREBUILD_API_TOKEN: ${{ secrets.SECUREBUILD_API_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          ./securebuild build package \
+            --package-family-name troubleshoot \
+            --tag "$VERSION" \
+            --api-token "$SECUREBUILD_API_TOKEN"
+
+  build-image:
+    needs: build-package
+    if: ${{ !cancelled() && needs.build-package.result == 'success' }}
+    runs-on: ubuntu-22.04
+    continue-on-error: true
+    strategy:
+      matrix:
+        image-name:
+          - troubleshoot
+          - preflight
+    steps:
+      - name: Install SecureBuild CLI
+        run: |
+          curl --fail --silent --show-error --location \
+            "https://github.com/securebuildhq/securebuild/releases/download/${SECUREBUILD_CLI_VERSION}/securebuild-cli-linux-amd64" \
+            --output securebuild
+          echo "${SECUREBUILD_CLI_SHA256}  securebuild" | sha256sum --check --strict
+          chmod +x securebuild
+
+      - name: Build image
+        env:
+          IMAGE_NAME: ${{ matrix.image-name }}
+          SECUREBUILD_API_TOKEN: ${{ secrets.SECUREBUILD_API_TOKEN }}
+          VERSION: ${{ needs.build-package.outputs.version }}
+        run: |
+          ./securebuild build image \
+            --image-name "$IMAGE_NAME" \
+            --tag "$VERSION" \
+            --api-token "$SECUREBUILD_API_TOKEN"

.github/workflows/release.yaml

@@ -59,6 +59,14 @@ jobs:
         with:
           krew_template_file: deploy/krew/support-bundle.yaml
 
+  securebuild:
+    if: ${{ !contains(github.ref_name, '-') }}
+    uses: ./.github/workflows/publish-securebuild.yml
+    with:
+      version: ${{ github.ref_name }}
+    secrets:
+      SECUREBUILD_API_TOKEN: ${{ secrets.SECUREBUILD_API_TOKEN }}
+
   notify:
     if: ${{ !contains(github.ref_name, '-') }}
     uses: replicatedhq/reusable-workflows/.github/workflows/notify-release.yml@0432fb838fc83852b78be97a150b35991a85d56f