mirror of
https://github.com/kata-containers/kata-containers.git
synced 2026-07-12 10:16:48 +00:00
a843844ccb
Drop the "latest" tag from every release step that could publish it: the per-arch kata-deploy images, the multi-arch kata-deploy manifest, and the kata-monitor images/manifest. This guarantees a release run from this branch can never move the "latest" tag of any published image while we test the rest of the pipeline.
330 lines
11 KiB
YAML
330 lines
11 KiB
YAML
name: Release Kata Containers
|
|
on:
|
|
workflow_dispatch
|
|
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.ref }}
|
|
cancel-in-progress: false # Note - don't cancel the in progress build as we could end up with inconsistent results
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
release:
|
|
name: release
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: write # needed for the `gh release create` command
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
fetch-depth: 0
|
|
persist-credentials: false
|
|
|
|
- name: Create a new release
|
|
run: |
|
|
./tools/packaging/release/release.sh create-new-release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
|
|
build-and-push-assets-amd64:
|
|
needs: release
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
attestations: write
|
|
uses: ./.github/workflows/release-amd64.yaml
|
|
with:
|
|
target-arch: amd64
|
|
secrets:
|
|
QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
|
|
KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
|
|
|
|
build-and-push-assets-arm64:
|
|
needs: release
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
attestations: write
|
|
uses: ./.github/workflows/release-arm64.yaml
|
|
with:
|
|
target-arch: arm64
|
|
secrets:
|
|
QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
|
|
KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }}
|
|
|
|
build-and-push-assets-s390x:
|
|
needs: release
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
attestations: write
|
|
uses: ./.github/workflows/release-s390x.yaml
|
|
with:
|
|
target-arch: s390x
|
|
secrets:
|
|
QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
|
|
|
|
build-and-push-assets-ppc64le:
|
|
needs: release
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
attestations: write
|
|
uses: ./.github/workflows/release-ppc64le.yaml
|
|
with:
|
|
target-arch: ppc64le
|
|
secrets:
|
|
QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
|
|
|
|
publish-kata-monitor-image:
|
|
name: publish-kata-monitor-image
|
|
needs: [build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le]
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
uses: ./.github/workflows/release-kata-images.yaml
|
|
secrets:
|
|
QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
|
|
|
|
publish-multi-arch-images:
|
|
name: publish-multi-arch-images
|
|
runs-on: ubuntu-22.04
|
|
needs: [build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le]
|
|
permissions:
|
|
contents: write # needed for the `gh release` commands
|
|
packages: write # needed to push the multi-arch manifest to ghcr.io
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Login to Kata Containers ghcr.io
|
|
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Login to Kata Containers quay.io
|
|
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
|
|
with:
|
|
registry: quay.io
|
|
username: ${{ vars.QUAY_DEPLOYER_USERNAME }}
|
|
password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
|
|
|
|
- name: Get the image tags
|
|
run: |
|
|
release_version=$(./tools/packaging/release/release.sh release-version)
|
|
# TESTING: do NOT include the "latest" tag so a run from this branch
|
|
# can never move the "latest" image tag.
|
|
echo "KATA_DEPLOY_IMAGE_TAGS=$release_version" >> "$GITHUB_ENV"
|
|
|
|
- name: Publish multi-arch manifest on quay.io & ghcr.io
|
|
run: |
|
|
./tools/packaging/release/release.sh publish-multiarch-manifest
|
|
env:
|
|
KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-deploy ghcr.io/kata-containers/kata-deploy"
|
|
|
|
upload-multi-arch-static-tarball:
|
|
name: upload-multi-arch-static-tarball
|
|
needs: [build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le]
|
|
permissions:
|
|
contents: write # needed for the `gh release` commands
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set KATA_STATIC_TARBALL env var
|
|
run: |
|
|
tarball=$(pwd)/kata-static.tar.zst
|
|
echo "KATA_STATIC_TARBALL=${tarball}" >> "$GITHUB_ENV"
|
|
|
|
- name: Download amd64 artifacts
|
|
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
|
with:
|
|
name: kata-static-tarball-amd64
|
|
|
|
- name: Upload amd64 static tarball to GitHub
|
|
run: |
|
|
./tools/packaging/release/release.sh upload-kata-static-tarball
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
ARCHITECTURE: amd64
|
|
|
|
- name: Download arm64 artifacts
|
|
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
|
with:
|
|
name: kata-static-tarball-arm64
|
|
|
|
- name: Upload arm64 static tarball to GitHub
|
|
run: |
|
|
./tools/packaging/release/release.sh upload-kata-static-tarball
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
ARCHITECTURE: arm64
|
|
|
|
- name: Download s390x artifacts
|
|
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
|
with:
|
|
name: kata-static-tarball-s390x
|
|
|
|
- name: Upload s390x static tarball to GitHub
|
|
run: |
|
|
./tools/packaging/release/release.sh upload-kata-static-tarball
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
ARCHITECTURE: s390x
|
|
|
|
- name: Download ppc64le artifacts
|
|
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
|
with:
|
|
name: kata-static-tarball-ppc64le
|
|
|
|
- name: Upload ppc64le static tarball to GitHub
|
|
run: |
|
|
./tools/packaging/release/release.sh upload-kata-static-tarball
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
ARCHITECTURE: ppc64le
|
|
|
|
- name: Set KATA_TOOLS_STATIC_TARBALL env var
|
|
run: |
|
|
tarball=$(pwd)/kata-tools-static.tar.zst
|
|
echo "KATA_TOOLS_STATIC_TARBALL=${tarball}" >> "$GITHUB_ENV"
|
|
|
|
- name: Download amd64 tools artifacts
|
|
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
|
|
with:
|
|
name: kata-tools-static-tarball-amd64
|
|
|
|
- name: Upload amd64 static tarball tools to GitHub
|
|
run: |
|
|
./tools/packaging/release/release.sh upload-kata-tools-static-tarball
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
ARCHITECTURE: amd64
|
|
|
|
upload-versions-yaml:
|
|
name: upload-versions-yaml
|
|
needs: release
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: write # needed for the `gh release` commands
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Upload versions.yaml to GitHub
|
|
run: |
|
|
./tools/packaging/release/release.sh upload-versions-yaml-file
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
|
|
upload-cargo-vendored-tarball:
|
|
name: upload-cargo-vendored-tarball
|
|
needs: release
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: write # needed for the `gh release` commands
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Generate and upload vendored code tarball
|
|
run: |
|
|
./tools/packaging/release/release.sh upload-vendored-code-tarball
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
|
|
upload-libseccomp-tarball:
|
|
name: upload-libseccomp-tarball
|
|
needs: release
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: write # needed for the `gh release` commands
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Download libseccomp tarball and upload it to GitHub
|
|
run: |
|
|
./tools/packaging/release/release.sh upload-libseccomp-tarball
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
|
|
upload-helm-chart-tarball:
|
|
name: upload-helm-chart-tarball
|
|
needs: release
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: write # needed for the `gh release` commands
|
|
packages: write # needed to push the helm chart to ghcr.io
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install helm
|
|
uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0
|
|
id: install
|
|
|
|
- name: Generate and upload helm chart tarball
|
|
run: |
|
|
./tools/packaging/release/release.sh upload-helm-chart-tarball
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
|
|
- name: Login to the OCI registries
|
|
env:
|
|
QUAY_DEPLOYER_USERNAME: ${{ vars.QUAY_DEPLOYER_USERNAME }}
|
|
QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }}
|
|
GITHUB_TOKEN: ${{ github.token }}
|
|
run: |
|
|
echo "${QUAY_DEPLOYER_PASSWORD}" | helm registry login quay.io --username "${QUAY_DEPLOYER_USERNAME}" --password-stdin
|
|
echo "${GITHUB_TOKEN}" | helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin
|
|
|
|
- name: Push helm chart to the OCI registries
|
|
run: |
|
|
release_version=$(./tools/packaging/release/release.sh release-version)
|
|
helm push "kata-deploy-${release_version}.tgz" oci://quay.io/kata-containers/kata-deploy-charts
|
|
helm push "kata-deploy-${release_version}.tgz" oci://ghcr.io/kata-containers/kata-deploy-charts
|
|
|
|
publish-release:
|
|
name: publish-release
|
|
needs: [ build-and-push-assets-amd64, build-and-push-assets-arm64, build-and-push-assets-s390x, build-and-push-assets-ppc64le, publish-multi-arch-images, publish-kata-monitor-image, upload-multi-arch-static-tarball, upload-versions-yaml, upload-cargo-vendored-tarball, upload-libseccomp-tarball ]
|
|
runs-on: ubuntu-22.04
|
|
permissions:
|
|
contents: write # needed for the `gh release` commands
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Publish a release
|
|
run: |
|
|
# TESTING: intentionally NOT publishing the release so the draft is
|
|
# never marked as completed. This lets us exercise all the other
|
|
# release steps without actually cutting a release.
|
|
echo "Skipping 'release.sh publish-release' on purpose (testing mode)."
|
|
echo "The release will remain a draft and will NOT be marked as completed."
|
|
# ./tools/packaging/release/release.sh publish-release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|