Skip to content
Release

Bump agent to v2.8.13 #258

Sign in to view logs

Bump agent to v2.8.13

Bump agent to v2.8.13 #258

Workflow file for this run

.github/workflows/release.yaml at 7640482
name: Release
on:
# Bump the CI
push:
tags:
- v*
jobs:
get-core-matrix:
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.set-matrix.outputs.matrix }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- run: |
sudo apt update && sudo apt install -y jq
- id: set-matrix
run: |
content=`cat ./.github/flavors.json | jq -r 'map(select(.arch == "amd64" and .variant == "core"))'`
# the following lines are only required for multi line json
content="${content//'%'/'%25'}"
content="${content//$'\n'/'%0A'}"
content="${content//$'\r'/'%0D'}"
# end of optional handling for multi line json
echo "::set-output name=matrix::{\"include\": $content }"
get-uki-matrix:
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.set-matrix.outputs.matrix }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- run: |
sudo apt update && sudo apt install -y jq
- id: set-matrix
run: |
content=`cat ./.github/flavors.json | jq -r 'map(select(.arch == "amd64" and .variant == "core" and (.flavor == "fedora" or (.flavor == "ubuntu" and .flavorRelease == "23.10"))))'`
# the following lines are only required for multi line json
content="${content//'%'/'%25'}"
content="${content//$'\n'/'%0A'}"
content="${content//$'\r'/'%0D'}"
# end of optional handling for multi line json
echo "::set-output name=matrix::{\"include\": $content }"
# The matrix for standard (provider) images
get-standard-matrix:
runs-on: ubuntu-latest
outputs:
matrix: ${{ steps.set-matrix.outputs.matrix }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- run: |
sudo apt update && sudo apt install -y jq wget
- name: Install earthly
uses: Luet-lab/luet-install-action@v1.1
with:
repository: quay.io/kairos/packages
packages: utils/earthly
- id: set-matrix
run: |
docker run --name luet quay.io/luet/base && docker cp luet:/usr/bin/luet ./
chmod +x luet
sudo mv luet /usr/bin/luet
# Construct an array like this from the found versions:
earthly --platform=linux/amd64 +extract-framework-profile
# fetch "k3s-openrc" versions
sudo luet --config framework-profile.yaml search -o json k8s/k3s | jq '.packages | map(select(.name == "k3s-openrc")) | map(.version) | unique' > k3s_openrc.json
# fetch alpine flavors
jq 'map(select(.arch == "amd64" and .variant == "standard" and .model == "generic" and .flavor == "alpine"))' .github/flavors.json > flavors_openrc.json
# generate combinations
jq -s '. | [combinations | .[0] + {"k3s_version": .[1]}]' flavors_openrc.json k3s_openrc.json > combinations_openrc.json
# fetch "k3s-systemd" versions
sudo luet --config framework-profile.yaml search -o json k8s/k3s | jq '.packages | map(select(.name == "k3s-systemd")) | map(.version) | unique' > k3s_systemd.json
# fetch non-alpine flavors
jq 'map(select(.arch == "amd64" and .variant == "standard" and .model == "generic" and .flavor != "alpine"))' .github/flavors.json > flavors_systemd.json
# generate combinations
jq -s '. | [combinations | .[0] + {"k3s_version": .[1]}]' flavors_systemd.json k3s_systemd.json > combinations_systemd.json
# merge the two combinations
content=$(jq -s 'add' combinations_openrc.json combinations_systemd.json)
# the following lines are only required for multi line json
content="${content//'%'/'%25'}"
content="${content//$'\n'/'%0A'}"
content="${content//$'\r'/'%0D'}"
# end of optional handling for multi line json
echo "::set-output name=matrix::{\"include\": $content }"
build-core:
runs-on: ubuntu-latest
needs:
- get-core-matrix
permissions:
id-token: write # OIDC support
contents: write
actions: read
security-events: write
strategy:
fail-fast: false
matrix: ${{ fromJson(needs.get-core-matrix.outputs.matrix) }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Install Cosign
uses: sigstore/cosign-installer@main
- name: Release space from worker
run: |
echo "Listing top largest packages"
pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr)
head -n 30 <<< "${pkgs}"
echo
df -h
echo
sudo apt-get remove -y '^llvm-.*|^libllvm.*' || true
sudo apt-get remove --auto-remove android-sdk-platform-tools || true
sudo apt-get purge --auto-remove android-sdk-platform-tools || true
sudo rm -rf /usr/local/lib/android
sudo apt-get remove -y '^dotnet-.*|^aspnetcore-.*' || true
sudo rm -rf /usr/share/dotnet
sudo apt-get remove -y '^mono-.*' || true
sudo apt-get remove -y '^ghc-.*' || true
sudo apt-get remove -y '.*jdk.*|.*jre.*' || true
sudo apt-get remove -y 'php.*' || true
sudo apt-get remove -y hhvm || true
sudo apt-get remove -y powershell || true
sudo apt-get remove -y firefox || true
sudo apt-get remove -y monodoc-manual || true
sudo apt-get remove -y msbuild || true
sudo apt-get remove -y microsoft-edge-stable || true
sudo apt-get remove -y '^google-.*' || true
sudo apt-get remove -y azure-cli || true
sudo apt-get remove -y '^mongo.*-.*|^postgresql-.*|^mysql-.*|^mssql-.*' || true
sudo apt-get remove -y '^gfortran-.*' || true
sudo apt-get autoremove -y
sudo apt-get clean
echo
echo "Listing top largest packages"
pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr)
head -n 30 <<< "${pkgs}"
echo
sudo rm -rfv build || true
sudo rm -rf /usr/local/lib/android # will release about 10 GB if you don't need Android
sudo rm -rf /usr/share/dotnet # will release about 20GB if you don't need .NET
df -h
- name: Login to Quay Registry
run: echo ${{ secrets.QUAY_PASSWORD }} | docker login -u ${{ secrets.QUAY_USERNAME }} --password-stdin quay.io
- name: Install earthly
uses: Luet-lab/luet-install-action@v1.1
with:
repository: quay.io/kairos/packages
packages: utils/earthly
- name: Build 🔧
run: |
earthly +all \
--VARIANT=${{ matrix.variant }} \
--FAMILY=${{ matrix.family }} \
--FLAVOR=${{ matrix.flavor }} \
--FLAVOR_RELEASE=${{ matrix.flavorRelease }} \
--MODEL=${{ matrix.model }} \
--BASE_IMAGE=${{ matrix.baseImage }}
sudo mv build release
- name: Push to quay
env:
COSIGN_YES: true
if: startsWith(github.ref, 'refs/tags/')
run: |
export IMAGE=$(cat release/IMAGE)
docker push "$IMAGE"
image_ref=$(docker image inspect --format='{{index .RepoDigests 0}}' "$IMAGE")
spdx=$(ls release/*.spdx.json)
cosign attach sbom --sbom $spdx $image_ref
cosign sign $image_ref --attachment sbom
# in-toto attestation
cosign attest --type spdx --predicate $spdx $image_ref
- name: Sign ISO sha files
env:
COSIGN_YES: true
run: |
sudo chmod -R 777 release
filename=$(ls release/*.iso.sha256)
cosign sign-blob --yes --output-certificate="${filename}.pem" \
--output-signature="${filename}.sig" "${filename}"
- name: Prepare files for release
run: |
mkdir sarif
mv release/*.sarif sarif/
mkdir reports
mv release/*.json reports/
cd reports
filename=$(ls *-grype.json | head -n 1) && filename=${filename%%-grype.json}
sudo tar cvf "${filename}-scan-reports.tar.gz" *.json
mv *.tar.gz ../release/
cd ..
rm release/IMAGE release/VERSION release/versions.yaml
- name: Release
uses: softprops/action-gh-release@9d7c94cfd0a1f3ed45544c887983e9fa900f0564
if: startsWith(github.ref, 'refs/tags/')
with:
files: |
release/*
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v3
if: startsWith(github.ref, 'refs/tags/')
with:
sarif_file: 'sarif'
category: ${{ matrix.flavor }}
build-core-uki:
runs-on: ubuntu-latest
permissions:
id-token: write # OIDC support
contents: write
actions: read
security-events: write
needs:
- get-uki-matrix
strategy:
matrix: ${{ fromJson(needs.get-uki-matrix.outputs.matrix) }}
steps:
- name: Release space from worker
run: |
echo "Listing top largest packages"
pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr)
head -n 30 <<< "${pkgs}"
echo
df -h
echo
sudo apt-get remove -y '^llvm-.*|^libllvm.*' || true
sudo apt-get remove --auto-remove android-sdk-platform-tools || true
sudo apt-get purge --auto-remove android-sdk-platform-tools || true
sudo rm -rf /usr/local/lib/android
sudo apt-get remove -y '^dotnet-.*|^aspnetcore-.*' || true
sudo rm -rf /usr/share/dotnet
sudo apt-get remove -y '^mono-.*' || true
sudo apt-get remove -y '^ghc-.*' || true
sudo apt-get remove -y '.*jdk.*|.*jre.*' || true
sudo apt-get remove -y 'php.*' || true
sudo apt-get remove -y hhvm || true
sudo apt-get remove -y powershell || true
sudo apt-get remove -y firefox || true
sudo apt-get remove -y monodoc-manual || true
sudo apt-get remove -y msbuild || true
sudo apt-get remove -y microsoft-edge-stable || true
sudo apt-get remove -y '^google-.*' || true
sudo apt-get remove -y azure-cli || true
sudo apt-get remove -y '^mongo.*-.*|^postgresql-.*|^mysql-.*|^mssql-.*' || true
sudo apt-get remove -y '^gfortran-.*' || true
sudo apt-get autoremove -y
sudo apt-get clean
echo
echo "Listing top largest packages"
pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr)
head -n 30 <<< "${pkgs}"
echo
sudo rm -rfv build || true
df -h
- uses: actions/checkout@v4
- run: |
git fetch --prune --unshallow
- name: Release space from worker
run: |
sudo rm -rf /usr/local/lib/android # will release about 10 GB if you don't need Android
sudo rm -rf /usr/share/dotnet # will release about 20GB if you don't need .NET
- name: Set up QEMU
uses: docker/setup-qemu-action@master
with:
platforms: all
- name: Set up Docker Buildx
id: buildx
uses: docker/setup-buildx-action@master
- name: Install Cosign
uses: sigstore/cosign-installer@main
- name: Login to Quay Registry
run: echo ${{ secrets.QUAY_PASSWORD }} | docker login -u ${{ secrets.QUAY_USERNAME }} --password-stdin quay.io
- name: Install earthly
uses: Luet-lab/luet-install-action@v1.1
with:
repository: quay.io/kairos/packages
packages: utils/earthly
- name: Block all traffic to metadata ip # For cloud runners, the metadata ip can interact with our test machines
run: |
sudo iptables -I INPUT -s 169.254.169.254 -j DROP
sudo iptables -I OUTPUT -d 169.254.169.254 -j DROP
- name: Build 🔧
run: |
earthly --platform=linux/amd64 +base-image \
--VARIANT=${{ matrix.variant }} \
--FLAVOR=${{ matrix.flavor }} \
--FLAVOR_RELEASE="${{ matrix.flavorRelease }}" \
--BASE_IMAGE=${{ matrix.baseImage }} \
--MODEL=${{ matrix.model }} \
--FAMILY=${{ matrix.family }} \
--BOOTLOADER=systemd-boot
sudo mv build/* .
sudo rm -rf build
- name: Install kairos-agent (for versioneer)
uses: Luet-lab/luet-install-action@v1.1
with:
repository: quay.io/kairos/packages
packages: system/kairos-agent
- name: Push to quay
env:
COSIGN_YES: true
run: |
SUFFIX="-uki"
IMAGE=$(cat IMAGE)
docker tag $(cat IMAGE) "$IMAGE$SUFFIX"
docker push "$IMAGE$SUFFIX"
image_ref=$(docker image inspect --format='{{index .RepoDigests 0}}' "$IMAGE$SUFFIX")
cosign sign $image_ref
- name: Build UKI ISO
run: |
earthly +uki-iso \
--BASE_IMAGE=quay.io/kairos/${{ matrix.flavor }}:${{ matrix.flavorRelease }}-${{ matrix.variant }}-${{ matrix.arch }}-${{ matrix.model }}-${{ github.ref_name }}-uki \
--ENKI_CREATE_CI_KEYS=true
- name: Release
uses: softprops/action-gh-release@9d7c94cfd0a1f3ed45544c887983e9fa900f0564
if: startsWith(github.ref, 'refs/tags/')
with:
files: |
build/*.efi
build-standard:
runs-on: ubuntu-latest
needs:
- get-standard-matrix
permissions:
id-token: write # OIDC support
contents: write
actions: read
security-events: write
strategy:
fail-fast: false
matrix: ${{ fromJson(needs.get-standard-matrix.outputs.matrix) }}
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Install Cosign
uses: sigstore/cosign-installer@main
- name: Release space from worker
run: |
echo "Listing top largest packages"
pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr)
head -n 30 <<< "${pkgs}"
echo
df -h
echo
sudo apt-get remove -y '^llvm-.*|^libllvm.*' || true
sudo apt-get remove --auto-remove android-sdk-platform-tools || true
sudo apt-get purge --auto-remove android-sdk-platform-tools || true
sudo rm -rf /usr/local/lib/android
sudo apt-get remove -y '^dotnet-.*|^aspnetcore-.*' || true
sudo rm -rf /usr/share/dotnet
sudo apt-get remove -y '^mono-.*' || true
sudo apt-get remove -y '^ghc-.*' || true
sudo apt-get remove -y '.*jdk.*|.*jre.*' || true
sudo apt-get remove -y 'php.*' || true
sudo apt-get remove -y hhvm || true
sudo apt-get remove -y powershell || true
sudo apt-get remove -y firefox || true
sudo apt-get remove -y monodoc-manual || true
sudo apt-get remove -y msbuild || true
sudo apt-get remove -y microsoft-edge-stable || true
sudo apt-get remove -y '^google-.*' || true
sudo apt-get remove -y azure-cli || true
sudo apt-get remove -y '^mongo.*-.*|^postgresql-.*|^mysql-.*|^mssql-.*' || true
sudo apt-get remove -y '^gfortran-.*' || true
sudo apt-get autoremove -y
sudo apt-get clean
echo
echo "Listing top largest packages"
pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr)
head -n 30 <<< "${pkgs}"
echo
sudo rm -rfv build || true
df -h
- name: Install earthly
uses: Luet-lab/luet-install-action@v1.1
with:
repository: quay.io/kairos/packages
packages: utils/earthly
- name: Login to Quay Registry
run: echo ${{ secrets.QUAY_PASSWORD }} | docker login -u ${{ secrets.QUAY_USERNAME }} --password-stdin quay.io
- name: Build 🔧
run: |
earthly +all \
--VARIANT=${{ matrix.variant }} \
--FAMILY=${{ matrix.family }} \
--FLAVOR=${{ matrix.flavor }} \
--FLAVOR_RELEASE=${{ matrix.flavorRelease }} \
--MODEL=${{ matrix.model }} \
--K3S_VERSION=${{ matrix.k3s_version }} \
--BASE_IMAGE=${{ matrix.baseImage }}
sudo mv build release
- name: Push to quay
if: startsWith(github.ref, 'refs/tags/')
env:
COSIGN_YES: true
run: |
IMAGE=$(cat release/IMAGE)
docker push "$IMAGE"
cosign sign $(docker image inspect --format='{{index .RepoDigests 0}}' "$IMAGE")
- name: Prepare files for release
run: |
mkdir sarif
mv release/*.sarif sarif/
mkdir reports
mv release/*.json reports/
cd reports
filename=$(ls *-grype.json | head -n 1) && filename=${filename%%-grype.json}
sudo tar cvf "${filename}-scan-reports.tar.gz" *.json
mv *.tar.gz ../release/
cd ..
sudo rm -rf release/VERSION release/IMAGE release/versions.yaml
- name: Release
uses: softprops/action-gh-release@9d7c94cfd0a1f3ed45544c887983e9fa900f0564
if: startsWith(github.ref, 'refs/tags/')
with:
files: |
release/*