-
Notifications
You must be signed in to change notification settings - Fork 55
112 lines (93 loc) · 3.42 KB
/
release.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
# Copyright © 2021 - 2023 SUSE LLC
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
# http://www.apache.org/licenses/LICENSE-2.0
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: Release
on:
workflow_dispatch:
push:
tags:
- "v*"
permissions:
id-token: write # This is the key for OIDC!
contents: write
packages: write
env:
SETUP_GO_VERSION: '1.20.4'
jobs:
release:
runs-on: ubuntu-latest
permissions:
id-token: write # This is the key for OIDC!
contents: write
packages: write
steps:
- name: Checkout
uses: actions/checkout@v3
with:
submodules: recursive
fetch-depth: 0
- name: Set up Go
uses: actions/setup-go@v4
timeout-minutes: 5
with:
cache: false
go-version: ${{ env.SETUP_GO_VERSION }}
- name: Login to GitHub Docker Registry
uses: docker/login-action@v2
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- uses: anchore/sbom-action/download-syft@v0.14.1
- uses: sigstore/cosign-installer@v2.8.1
- name: Get latest tag
id: get_latest_tag
run: echo "LATEST_TAG=$(git describe --tags --abbrev=0)" >> $GITHUB_OUTPUT
- name: Run GoReleaser
uses: goreleaser/goreleaser-action@v4
with:
distribution: goreleaser
version: 1.18.2
args: release --rm-dist
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
COMMITTER_TOKEN: ${{ secrets.COMMITTER_TOKEN }}
# Goreleaser will cleanup the draft, so we need to populate it again
- name: Run Releaser Drafter
uses: release-drafter/release-drafter@v5
with:
config-name: release-drafter.yml
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
- name: Get current tag
id: get_tag
run: echo ::set-output name=TAG::${GITHUB_REF/refs\/tags\//}
- name: Verify signatures on the generated docker images and manifests
id: verify_signatures
run: |
cosign verify ghcr.io/epinio/epinio-server:${{ steps.get_latest_tag.outputs.LATEST_TAG }}
cosign verify ghcr.io/epinio/epinio-unpacker:${{ steps.get_latest_tag.outputs.LATEST_TAG }}
env:
DOCKER_CLI_EXPERIMENTAL: enabled
COSIGN_EXPERIMENTAL: 1
# Trigger automatic release of the Epinio Helm chart when we release
# Epinio, by posting an event to the helm chart repository. This event
# contains epinio's latest tag.
- name: epinio/helm-charts Repository Dispatch
uses: peter-evans/repository-dispatch@v2
with:
token: ${{ secrets.CHART_REPO_ACCESS_TOKEN }}
repository: epinio/helm-charts
event-type: epinio-release
client-payload: '{"ref": "${{ steps.get_tag.outputs.TAG }}"}'