Try out on our branch #183
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - v* | |
| branches: | |
| - "1609-release-standard-images" | |
| jobs: | |
| get-core-matrix: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - run: | | |
| git fetch --prune --unshallow | |
| sudo apt update && sudo apt install -y jq | |
| - id: set-matrix | |
| run: | | |
| content=`cat .github/flavors.json | jq 'map(select(.frameworkonly != "true"))'` | |
| # the following lines are only required for multi line json | |
| content="${content//'%'/'%25'}" | |
| content="${content//$'\n'/'%0A'}" | |
| content="${content//$'\r'/'%0D'}" | |
| # end of optional handling for multi line json | |
| echo "::set-output name=matrix::{\"include\": $content }" | |
| # The matrix for standard (provider) images | |
| get-standard-matrix: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - uses: Luet-lab/luet-install-action@v1 | |
| - run: | | |
| git fetch --prune --unshallow | |
| sudo apt update && sudo apt install -y jq | |
| - id: set-matrix | |
| run: | | |
| luet repo add kairos --yes --url quay.io/kairos/packages --type docker | |
| # Construct an array like this from the found versions: | |
| luet search -o json k8s/k3s | jq '.packages | map(.version)' > k3s_versions.json | |
| content=$(jq -s '. | combinations | .[0] + {"k3s_version": .[1]} | select(.frameworkonly != "true")' .github/flavors.json k3s_versions.json) | |
| # the following lines are only required for multi line json | |
| content="${content//'%'/'%25'}" | |
| content="${content//$'\n'/'%0A'}" | |
| content="${content//$'\r'/'%0D'}" | |
| # end of optional handling for multi line json | |
| echo "::set-output name=matrix::{\"include\": $content }" | |
| get-framework-matrix: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - run: | | |
| git fetch --prune --unshallow | |
| - id: set-matrix | |
| run: | | |
| content=`cat .github/flavors.json` | |
| # the following lines are only required for multi line json | |
| content="${content//'%'/'%25'}" | |
| content="${content//$'\n'/'%0A'}" | |
| content="${content//$'\r'/'%0D'}" | |
| # end of optional handling for multi line json | |
| echo "::set-output name=matrix::{\"include\": $content }" | |
| build-framework: | |
| runs-on: self-hosted | |
| needs: | |
| - get-framework-matrix | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{fromJson(needs.get-framework-matrix.outputs.matrix)}} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - run: | | |
| git fetch --prune --unshallow | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@main | |
| - name: Install earthly | |
| uses: Luet-lab/luet-install-action@v1 | |
| with: | |
| repository: quay.io/kairos/packages | |
| packages: utils/earthly | |
| - name: Login to Quay Registry | |
| run: echo ${{ secrets.QUAY_PASSWORD }} | docker login -u ${{ secrets.QUAY_USERNAME }} --password-stdin quay.io | |
| - name: Build 🔧 | |
| env: | |
| FLAVOR: ${{ matrix.flavor }} | |
| IMAGE: quay.io/kairos/framework | |
| run: | | |
| # Configure earthly to use the docker mirror in CI | |
| # https://docs.earthly.dev/ci-integration/pull-through-cache#configuring-earthly-to-use-the-cache | |
| mkdir -p ~/.earthly/ | |
| cat << EOF > ~/.earthly/config.yml | |
| global: | |
| buildkit_additional_config: | | |
| [registry."docker.io"] | |
| mirrors = ["registry.docker-mirror.svc.cluster.local:5000"] | |
| [registry."registry.docker-mirror.svc.cluster.local:5000"] | |
| insecure = true | |
| http = true | |
| EOF | |
| export TAG=${GITHUB_REF##*/} | |
| earthly +build-framework-image --FLAVOR=${FLAVOR} | |
| - name: Push to quay | |
| env: | |
| COSIGN_YES: true | |
| if: startsWith(github.ref, 'refs/tags/') | |
| run: | | |
| export TAG=${GITHUB_REF##*/}_${{ matrix.flavor }} | |
| export IMAGE="quay.io/kairos/framework" | |
| docker push "$IMAGE:$TAG" # Otherwise .RepoDigests will be empty for some reason | |
| cosign sign $(docker image inspect --format='{{index .RepoDigests 0}}' "$IMAGE:$TAG") | |
| build-core: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - get-core-matrix | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| actions: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJson(needs.get-core-matrix.outputs.matrix) }} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - run: | | |
| git fetch --prune --unshallow | |
| - name: setup-docker | |
| uses: docker-practice/actions-setup-docker@master | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@main | |
| - name: Release space from worker | |
| run: | | |
| sudo rm -rf /usr/local/lib/android # will release about 10 GB if you don't need Android | |
| sudo rm -rf /usr/share/dotnet # will release about 20GB if you don't need .NET | |
| - name: Login to Quay Registry | |
| run: echo ${{ secrets.QUAY_PASSWORD }} | docker login -u ${{ secrets.QUAY_USERNAME }} --password-stdin quay.io | |
| - name: Install earthly | |
| uses: Luet-lab/luet-install-action@v1 | |
| with: | |
| repository: quay.io/kairos/packages | |
| packages: utils/earthly | |
| - name: Build 🔧 | |
| env: | |
| FLAVOR: ${{ matrix.flavor }} | |
| run: | | |
| earthly +all --VARIANT=core --FLAVOR=$FLAVOR | |
| sudo mv build release | |
| - name: Push to quay | |
| env: | |
| COSIGN_YES: true | |
| if: startsWith(github.ref, 'refs/tags/') | |
| run: | | |
| export IMAGE=$(cat release/IMAGE) | |
| docker push "$IMAGE" | |
| image_ref=$(docker image inspect --format='{{index .RepoDigests 0}}' "$IMAGE") | |
| spdx=$(ls release/*.spdx.json) | |
| cosign attach sbom --sbom $spdx $image_ref | |
| cosign sign $image_ref --attachment sbom | |
| # in-toto attestation | |
| cosign attest --type spdx --predicate $spdx $image_ref | |
| - name: Sign ISO sha files | |
| env: | |
| COSIGN_YES: true | |
| run: | | |
| sudo chmod -R 777 release | |
| filename=$(ls release/*.iso.sha256) | |
| cosign sign-blob --yes --output-certificate="release/${filename}.pem" \ | |
| --output-signature="release/${filename}.sig" \ | |
| "release/${filename}" | |
| - name: Release | |
| uses: softprops/action-gh-release@v1 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| files: | | |
| release/* | |
| - name: Prepare sarif files 🔧 | |
| run: | | |
| mkdir sarif | |
| mv release/*.sarif sarif/ | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v2 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| sarif_file: 'sarif' | |
| category: ${{ matrix.flavor }} | |
| build-core-uki: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - run: | | |
| git fetch --prune --unshallow | |
| - name: Install earthly | |
| uses: Luet-lab/luet-install-action@v1 | |
| with: | |
| repository: quay.io/kairos/packages | |
| packages: utils/earthly | |
| - name: Build uki image 🔧 | |
| run: | | |
| # Do fedora as its the smaller uki possible | |
| earthly +uki --VARIANT=core --FLAVOR=fedora | |
| - name: Release | |
| uses: softprops/action-gh-release@v1 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| files: | | |
| build/*.efi | |
| build-standard: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - get-standard-matrix | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| actions: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJson(needs.get-standard-matrix.outputs.matrix) }} | |
| steps: | |
| - uses: actions/checkout@v3 | |
| - run: | | |
| git fetch --prune --unshallow | |
| - name: setup-docker | |
| uses: docker-practice/actions-setup-docker@master | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@main | |
| - name: Release space from worker | |
| run: | | |
| sudo rm -rf /usr/local/lib/android # will release about 10 GB if you don't need Android | |
| sudo rm -rf /usr/share/dotnet # will release about 20GB if you don't need .NET | |
| - name: Login to Quay Registry | |
| run: echo ${{ secrets.QUAY_PASSWORD }} | docker login -u ${{ secrets.QUAY_USERNAME }} --password-stdin quay.io | |
| - name: Build 🔧 | |
| run: | | |
| ./earthly.sh +all -VARIANT=standard -K3S_VERSION=${{ matrix.k3s_version }} -FLAVOR=${{ matrix.flavor }} | |
| sudo mv build release | |
| - name: Push to quay | |
| if: startsWith(github.ref, 'refs/tags/') | |
| env: | |
| COSIGN_YES: true | |
| run: | | |
| # TODO: Stick to the old naming | |
| IMAGE=$(cat release/IMAGE) | |
| docker push "$IMAGE" | |
| cosign sign $(docker image inspect --format='{{index .RepoDigests 0}}' "$IMAGE") | |
| sudo rm -rf release/IMAGE release/VERSION | |
| - name: Release | |
| uses: softprops/action-gh-release@v1 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| files: | | |
| release/* |