Skip to content

Commit 677f33d

Browse files
ThomasVitaleThomasVitale
committed
Initial commit
1 parent a0b5f0e commit 677f33d

File tree

16 files changed

+6203
-3
lines changed

16 files changed

+6203
-3
lines changed

‎.github/workflows/release.yml‎

Lines changed: 223 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
name: Release
2+
on:
3+
- workflow_dispatch
4+
5+
env:
6+
COSIGN_EXPERIMENTAL: 1
7+
REGISTRY: ghcr.io
8+
IMAGE_NAME: ${{ github.repository }}
9+
VERSION: 1.10.0
10+
11+
jobs:
12+
build:
13+
name: Build
14+
runs-on: ubuntu-22.04
15+
permissions:
16+
contents: write
17+
packages: write
18+
outputs:
19+
image-release: ${{ steps.image-info.outputs.release }}
20+
steps:
21+
- name: Checkout source code
22+
uses: actions/[email protected]
23+
24+
- name: Set up Carvel
25+
uses: vmware-tanzu/[email protected]
26+
with:
27+
token: ${{ secrets.GITHUB_TOKEN }}
28+
29+
- name: Log into container registry
30+
uses: redhat-actions/[email protected]
31+
with:
32+
username: ${{ github.actor }}
33+
password: ${{ secrets.GITHUB_TOKEN }}
34+
registry: ${{ env.REGISTRY }}
35+
36+
- name: Create k3d cluster
37+
run: |
38+
# Initialize brew because of https://github.com/actions/runner-images/issues/6283
39+
eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
40+
brew install k3d
41+
k3d cluster create test-cluster
42+
43+
# Wait for the generation of a token for the Service Account
44+
while [ $(kubectl get configmap kube-root-ca.crt --no-headers | wc -l) -eq 0 ] ; do
45+
sleep 3
46+
done
47+
48+
- name: Package and publish OCI bundle
49+
run: |
50+
kctrl package release -y --version ${{ env.VERSION }} \
51+
--chdir package \
52+
--copy-to ../carvel-artifacts \
53+
--repo-output ../repo
54+
55+
- name: Get released OCI image name with digest
56+
id: image-info
57+
run: |
58+
package_file=$(find carvel-artifacts/packages -name 'package.yml')
59+
image_release=$(yq '.spec.template.spec.fetch[0].imgpkgBundle.image' ${package_file})
60+
echo "IMAGE_RELEASE=${image_release}" >> $GITHUB_ENV
61+
echo "release=${image_release}" >> $GITHUB_OUTPUT
62+
63+
- name: Add additional tags to OCI image
64+
run: |
65+
podman pull ${IMAGE_RELEASE}
66+
podman tag ${IMAGE_RELEASE} ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
67+
podman tag ${IMAGE_RELEASE} ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
68+
podman push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}
69+
podman push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
70+
71+
- name: Create a release
72+
env:
73+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
74+
run: |
75+
gh release create v${{ env.VERSION }} \
76+
--generate-notes \
77+
./carvel-artifacts/packages/cert-manager.packages.kadras.io/package.yml \
78+
./carvel-artifacts/packages/cert-manager.packages.kadras.io/metadata.yml \
79+
./README.md
80+
81+
- name: Upload package.yml artifact
82+
uses: actions/[email protected]
83+
with:
84+
name: ${{ env.VERSION }}.yml
85+
path: ./repo/packages/cert-manager.packages.kadras.io/${{ env.VERSION }}.yml
86+
retention-days: 1
87+
88+
- name: Upload metadata.yml artifact
89+
uses: actions/[email protected]
90+
with:
91+
name: metadata.yml
92+
path: ./repo/packages/cert-manager.packages.kadras.io/metadata.yml
93+
retention-days: 1
94+
95+
sign:
96+
name: Sign
97+
runs-on: ubuntu-22.04
98+
needs: [build]
99+
permissions:
100+
packages: write
101+
id-token: write
102+
env:
103+
IMAGE_RELEASE: ${{ needs.build.outputs.image-release }}
104+
steps:
105+
- name: Install Cosign
106+
uses: sigstore/[email protected]
107+
with:
108+
cosign-release: 'v1.13.0'
109+
110+
- name: Log into container registry
111+
uses: redhat-actions/[email protected]
112+
with:
113+
username: ${{ github.actor }}
114+
password: ${{ secrets.GITHUB_TOKEN }}
115+
registry: ${{ env.REGISTRY }}
116+
117+
- name: Sign image
118+
run: |
119+
cosign sign "${IMAGE_RELEASE}"
120+
121+
provenance:
122+
name: Provenance
123+
runs-on: ubuntu-22.04
124+
needs: [build,sign]
125+
permissions:
126+
packages: write
127+
id-token: write
128+
env:
129+
IMAGE_RELEASE: ${{ needs.build.outputs.image-release }}
130+
PROVENANCE_FILE: provenance.att
131+
steps:
132+
- name: Install Cosign
133+
uses: sigstore/[email protected]
134+
with:
135+
cosign-release: 'v1.13.0'
136+
137+
- name: Log into container registry
138+
uses: redhat-actions/[email protected]
139+
with:
140+
username: ${{ github.actor }}
141+
password: ${{ secrets.GITHUB_TOKEN }}
142+
registry: ${{ env.REGISTRY }}
143+
144+
- name: Extract digest
145+
run: |
146+
digest=$(echo ${IMAGE_RELEASE} | cut -d "@" -f2)
147+
echo "IMAGE_DIGEST=${digest}" >> $GITHUB_ENV
148+
149+
- name: Generate provenance
150+
uses: philips-labs/[email protected]
151+
with:
152+
command: generate
153+
subcommand: container
154+
arguments: --repository ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} --tags ${{ env.VERSION }} --digest ${{ env.IMAGE_DIGEST }} --output-path ${{ env.PROVENANCE_FILE }}
155+
env:
156+
COSIGN_EXPERIMENTAL: 0
157+
158+
- name: Attach provenance
159+
run: |
160+
jq '.predicate' "${PROVENANCE_FILE}" > provenance-predicate.att
161+
cosign attest --predicate provenance-predicate.att --type slsaprovenance "${IMAGE_RELEASE}"
162+
163+
- uses: actions/[email protected]
164+
with:
165+
name: provenance.att
166+
path: ${{ env.PROVENANCE_FILE }}
167+
168+
repo:
169+
name: Package Repository
170+
runs-on: ubuntu-22.04
171+
needs: [provenance]
172+
permissions:
173+
contents: read
174+
env:
175+
PACKAGE_REPO: kadras-packages
176+
steps:
177+
- name: Download package.yml artifact
178+
uses: actions/[email protected]
179+
with:
180+
name: ${{ env.VERSION }}.yml
181+
path: ./artifacts
182+
183+
- name: Download metadata.yml artifact
184+
uses: actions/[email protected]
185+
with:
186+
name: metadata.yml
187+
path: ./artifacts
188+
189+
- name: Checkout package repository source code
190+
uses: actions/[email protected]
191+
with:
192+
path: kadras-packages
193+
repository: ${{ github.repository_owner }}/${{ env.PACKAGE_REPO }}
194+
ref: main
195+
token: ${{ secrets.GH_ORG_PAT }}
196+
197+
- name: Push release artifacts to package repository
198+
env:
199+
GH_TOKEN: ${{ secrets.GH_ORG_PAT }}
200+
run: |
201+
package_path=kadras-packages/repo/packages/cert-manager.packages.kadras.io
202+
if [ ! -f ${package_path} ]; then
203+
mkdir -p ${package_path}
204+
fi
205+
206+
mv -f artifacts/${{ env.VERSION }}.yml ${package_path}/${{ env.VERSION }}.yml
207+
mv -f artifacts/metadata.yml ${package_path}/metadata.yml
208+
209+
cd kadras-packages
210+
211+
git config user.name github-actions
212+
git config user.email [email protected]
213+
214+
branch_name=$(date +%s | base64)
215+
git checkout -b ${branch_name}
216+
217+
git add repo/packages/cert-manager.packages.kadras.io/${{ env.VERSION }}.yml
218+
git add repo/packages/cert-manager.packages.kadras.io/metadata.yml
219+
220+
git commit -m "Update Cert Manager metadata and add version ${VERSION}"
221+
git push origin ${branch_name}
222+
223+
gh pr create -f --base main --title "Add Cert Manager ${VERSION}" --body "Update Cert Manager metadata and add version ${VERSION}"

‎.github/workflows/test.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
name: Test
2+
on:
3+
- push
4+
5+
jobs:
6+
check-config:
7+
name: Check Configuration
8+
runs-on: ubuntu-22.04
9+
permissions:
10+
contents: read
11+
steps:
12+
- name: Checkout source code
13+
uses: actions/checkout@v3
14+
15+
- name: Set up Carvel
16+
uses: vmware-tanzu/[email protected]
17+
with:
18+
only: ytt
19+
token: ${{ secrets.GITHUB_TOKEN }}
20+
21+
- name: Check configuration
22+
run: |
23+
make check
24+
test-package:
25+
name: Test Package
26+
runs-on: ubuntu-22.04
27+
permissions:
28+
contents: read
29+
steps:
30+
- name: Checkout source code
31+
uses: actions/checkout@v3
32+
33+
- name: Set up Carvel
34+
uses: vmware-tanzu/[email protected]
35+
with:
36+
token: ${{ secrets.GITHUB_TOKEN }}
37+
38+
- name: Create k3d cluster
39+
run: |
40+
# Initialize brew because of https://github.com/actions/runner-images/issues/6283
41+
eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
42+
brew install k3d
43+
k3d cluster create test-cluster
44+
45+
# Wait for the generation of a token for the Service Account
46+
while [ $(kubectl get configmap kube-root-ca.crt --no-headers | wc -l) -eq 0 ] ; do
47+
sleep 3
48+
done
49+
50+
- name: Run tests
51+
run: |
52+
chmod +x test/test.sh
53+
test/test.sh

‎.gitignore‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
### Carvel ###
2+
carvel-artifacts/
3+
repo/
4+
15
# Binaries for programs and plugins
26
*.exe
37
*.exe~
@@ -13,3 +17,39 @@
1317

1418
# Dependency directories (remove the comment below to include it)
1519
# vendor/
20+
21+
### VS Code ###
22+
.vscode/
23+
24+
#############
25+
### macOS ###
26+
#############
27+
28+
# General
29+
.DS_Store
30+
*.DS_Store
31+
**/.DS_Store
32+
.AppleDouble
33+
.LSOverride
34+
35+
# Icon must end with two \r
36+
Icon
37+
38+
# Thumbnails
39+
._*
40+
41+
# Files that might appear in the root of a volume
42+
.DocumentRevisions-V100
43+
.fseventsd
44+
.Spotlight-V100
45+
.TemporaryItems
46+
.Trashes
47+
.VolumeIcon.icns
48+
.com.apple.timemachine.donotpresent
49+
50+
# Directories potentially created on remote AFP share
51+
.AppleDB
52+
.AppleDesktop
53+
Network Trash Folder
54+
Temporary Items
55+
.apdisk

‎LICENSE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@
186186
same "printed page" as the copyright notice for easier
187187
identification within third-party archives.
188188

189-
Copyright [yyyy] [name of copyright owner]
189+
Copyright 2022 Arktonix
190190

191191
Licensed under the Apache License, Version 2.0 (the "License");
192192
you may not use this file except in compliance with the License.

‎Makefile‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Check the ytt-annotated Kubernetes configuration
2+
check:
3+
ytt --file package/config
4+
5+
# Use ytt to generate an OpenAPI specification
6+
schema:
7+
ytt -f package/config/values-schema.yml --data-values-schema-inspect -o openapi-v3 > package/config/schema-openapi.yml

0 commit comments

Comments
 (0)