Skip to content

Commit e2f2f6b

Browse files
aanmaanm
committed
.github/workflows: prepare v1.19 branch
Add duplicated workflows for the v1.19 branch preparation. Signed-off-by: André Martins <andre@cilium.io>
1 parent 7178710 commit e2f2f6b

8 files changed

Lines changed: 947 additions & 0 deletions

‎.github/workflows/build-images-base-v1.19.yaml‎

Lines changed: 295 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,295 @@
1+
name: Base Image Release Build
2+
3+
# Any change in triggers needs to be reflected in the concurrency group.
4+
on:
5+
pull_request_target:
6+
branches:
7+
- v1.19
8+
types:
9+
- opened
10+
- synchronize
11+
- reopened
12+
paths:
13+
- images/runtime/**
14+
- images/builder/**
15+
16+
permissions:
17+
# To be able to access the repository with `actions/checkout`
18+
contents: read
19+
# Required to generate OIDC tokens for `sigstore/cosign-installer` authentication
20+
id-token: write
21+
22+
concurrency:
23+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
24+
cancel-in-progress: true
25+
26+
jobs:
27+
build-and-push:
28+
# Skip this workflow for repositories without credentials and branches that are created by renovate where the event type is pull_request_target
29+
if: ${{ vars.QUAY_BASE_RELEASE_ENABLED == 'true' && ! (github.event_name == 'pull_request_target' && startsWith(github.head_ref, 'renovate/')) }}
30+
name: Build and Push Images
31+
timeout-minutes: 60
32+
environment: 'release-base-images'
33+
runs-on: ubuntu-24.04
34+
steps:
35+
- name: Checkout base or default branch (trusted)
36+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
37+
with:
38+
# This workflow is supposed to run only on pull_request_target context, but in case workflow call is made from a push context we still keep the default to default_branch
39+
ref: ${{ github.base_ref || github.event.repository.default_branch }}
40+
persist-credentials: false
41+
42+
- name: Cleanup Disk space in runner
43+
uses: ./.github/actions/disk-cleanup
44+
45+
- name: Copy scripts to trusted directory
46+
run: |
47+
mkdir -p ../cilium-base-branch/images/runtime/
48+
cp ./images/runtime/update-cilium-runtime-image.sh ../cilium-base-branch/images/runtime/
49+
mkdir -p ../cilium-base-branch/images/builder/
50+
cp ./images/builder/update-cilium-builder-image.sh ../cilium-base-branch/images/builder/
51+
mkdir -p ../cilium-base-branch/images/scripts/
52+
cp ./images/scripts/get-image-digest.sh ../cilium-base-branch/images/scripts/
53+
mkdir -p ../cilium-base-branch/api/v1
54+
cp ./api/v1/Makefile ../cilium-base-branch/api/v1/
55+
cp ./Makefile.defs ../cilium-base-branch/Makefile.defs
56+
cp ./Makefile.quiet ../cilium-base-branch/Makefile.quiet
57+
58+
- name: Set Environment Variables
59+
uses: ./.github/actions/set-env-variables
60+
61+
- name: Set up Docker Buildx
62+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
63+
64+
- name: Set up QEMU
65+
id: qemu
66+
uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
67+
68+
# Warning: since this is a privileged workflow, subsequent workflow job
69+
# steps must take care not to execute untrusted code.
70+
- name: Checkout pull request branch (NOT TRUSTED)
71+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
72+
with:
73+
persist-credentials: false
74+
ref: ${{ github.event.pull_request.head.sha }}
75+
76+
- name: Set-up git
77+
run: |
78+
git config user.name "Cilium Imagebot"
79+
git config user.email "noreply@cilium.io"
80+
81+
- name: Generating image tag for Cilium-Runtime
82+
id: runtime-tag
83+
run: |
84+
echo tag="$(git ls-tree --full-tree HEAD -- ./images/runtime | awk '{ print $3 }')" >> $GITHUB_OUTPUT
85+
86+
- name: Checking if tag for Cilium-Runtime already exists
87+
id: cilium-runtime-tag-in-repositories
88+
shell: bash
89+
run: |
90+
if docker buildx imagetools inspect quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-runtime:${{ steps.runtime-tag.outputs.tag }} &>/dev/null; then
91+
echo exists="true" >> $GITHUB_OUTPUT
92+
else
93+
echo exists="false" >> $GITHUB_OUTPUT
94+
fi
95+
96+
- name: Login to quay.io
97+
if: ${{ steps.cilium-runtime-tag-in-repositories.outputs.exists == 'false' }}
98+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
99+
with:
100+
registry: quay.io
101+
username: ${{ secrets.QUAY_BASE_RELEASE_USERNAME_202411 }}
102+
password: ${{ secrets.QUAY_BASE_RELEASE_PASSWORD_202411 }}
103+
104+
- name: Release build cilium-runtime
105+
if: ${{ steps.cilium-runtime-tag-in-repositories.outputs.exists == 'false' }}
106+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
107+
id: docker_build_release_runtime
108+
with:
109+
provenance: false
110+
context: ./images/runtime
111+
file: ./images/runtime/Dockerfile
112+
push: true
113+
platforms: linux/amd64,linux/arm64
114+
tags: |
115+
quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-runtime:${{ steps.runtime-tag.outputs.tag }}
116+
117+
- name: Generate SBOM, Sign, and Attest Runtime Image
118+
if: ${{ steps.cilium-runtime-tag-in-repositories.outputs.exists == 'false' }}
119+
uses: ./.github/actions/cosign
120+
with:
121+
image: "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-runtime@${{ steps.docker_build_release_runtime.outputs.digest }}"
122+
image_tag: "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-runtime:${{ steps.runtime-tag.outputs.tag }}"
123+
sbom_name: "cilium-runtime_${{ steps.runtime-tag.outputs.tag }}"
124+
125+
- name: Image Release Digest Runtime
126+
if: ${{ steps.cilium-runtime-tag-in-repositories.outputs.exists == 'false' }}
127+
shell: bash
128+
run: |
129+
mkdir -p image-digest/
130+
echo "## cilium-runtime" > image-digest/cilium-runtime.txt
131+
echo "" >> image-digest/cilium-runtime.txt
132+
echo "\`quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-runtime:${{ steps.runtime-tag.outputs.tag }}@${{ steps.docker_build_release_runtime.outputs.digest }}\`" >> image-digest/cilium-runtime.txt
133+
echo "" >> image-digest/cilium-runtime.txt
134+
135+
- name: Upload artifact digests runtime
136+
if: ${{ steps.cilium-runtime-tag-in-repositories.outputs.exists == 'false' }}
137+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
138+
with:
139+
name: image-digest cilium-runtime
140+
path: image-digest
141+
retention-days: 1
142+
143+
- name: Update Runtime Image
144+
id: update-runtime-image
145+
run: |
146+
if [[ "${{ steps.cilium-runtime-tag-in-repositories.outputs.exists == 'false' }}" == "true" ]]; then
147+
../cilium-base-branch/images/runtime/update-cilium-runtime-image.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-runtime:${{ steps.runtime-tag.outputs.tag }}@${{ steps.docker_build_release_runtime.outputs.digest }}"
148+
else
149+
digest=$(../cilium-base-branch/images/scripts/get-image-digest.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-runtime:${{ steps.runtime-tag.outputs.tag }}")
150+
../cilium-base-branch/images/runtime/update-cilium-runtime-image.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-runtime:${{ steps.runtime-tag.outputs.tag }}@${digest}"
151+
fi
152+
if ! git diff --quiet; then
153+
git commit -sam "images: update cilium-{runtime,builder}"
154+
echo committed="true" >> $GITHUB_OUTPUT
155+
else
156+
echo committed="false" >> $GITHUB_OUTPUT
157+
fi
158+
159+
- name: Generating image tag for Cilium-Builder
160+
id: builder-tag
161+
run: |
162+
echo tag="$(git ls-tree --full-tree HEAD -- ./images/builder | awk '{ print $3 }')" >> $GITHUB_OUTPUT
163+
164+
- name: Checking if tag for Cilium-Builder already exists
165+
id: cilium-builder-tag-in-repositories
166+
shell: bash
167+
run: |
168+
if docker buildx imagetools inspect quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-builder:${{ steps.builder-tag.outputs.tag }} &>/dev/null; then
169+
echo exists="true" >> $GITHUB_OUTPUT
170+
else
171+
echo exists="false" >> $GITHUB_OUTPUT
172+
fi
173+
174+
- name: Login to quay.io
175+
if: ${{ steps.cilium-builder-tag-in-repositories.outputs.exists == 'false' && steps.cilium-runtime-tag-in-repositories.outputs.exists != 'false' }}
176+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
177+
with:
178+
registry: quay.io
179+
username: ${{ secrets.QUAY_BASE_RELEASE_USERNAME_202411 }}
180+
password: ${{ secrets.QUAY_BASE_RELEASE_PASSWORD_202411 }}
181+
182+
- name: Release build cilium-builder
183+
if: ${{ steps.cilium-builder-tag-in-repositories.outputs.exists == 'false' }}
184+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
185+
id: docker_build_release_builder
186+
with:
187+
provenance: false
188+
context: ./images/builder
189+
file: ./images/builder/Dockerfile
190+
push: true
191+
platforms: linux/amd64,linux/arm64
192+
tags: |
193+
quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-builder:${{ steps.builder-tag.outputs.tag }}
194+
195+
- name: Generate SBOM, Sign, and Attest Builder Image
196+
if: ${{ steps.cilium-builder-tag-in-repositories.outputs.exists == 'false' }}
197+
uses: ./.github/actions/cosign
198+
with:
199+
image: "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-builder@${{ steps.docker_build_release_builder.outputs.digest }}"
200+
image_tag: "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-builder:${{ steps.builder-tag.outputs.tag }}"
201+
sbom_name: "cilium-builder_${{ steps.builder-tag.outputs.tag }}"
202+
203+
- name: Image Release Digest Builder
204+
if: ${{ steps.cilium-builder-tag-in-repositories.outputs.exists == 'false' }}
205+
shell: bash
206+
run: |
207+
mkdir -p image-digest/
208+
echo "## cilium-builder" > image-digest/cilium-builder.txt
209+
echo "" >> image-digest/cilium-builder.txt
210+
echo "\`quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-builder:${{ steps.builder-tag.outputs.tag }}@${{ steps.docker_build_release_builder.outputs.digest }}\`" >> image-digest/cilium-builder.txt
211+
echo "" >> image-digest/cilium-builder.txt
212+
213+
- name: Upload artifact digests builder
214+
if: ${{ steps.cilium-builder-tag-in-repositories.outputs.exists == 'false' }}
215+
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
216+
with:
217+
name: image-digest cilium-builder
218+
path: image-digest
219+
retention-days: 1
220+
221+
- name: Update Runtime Image
222+
run: |
223+
if [[ "${{ steps.cilium-runtime-tag-in-repositories.outputs.exists == 'false' }}" == "true" ]]; then
224+
../cilium-base-branch/images/runtime/update-cilium-runtime-image.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-runtime:${{ steps.runtime-tag.outputs.tag }}@${{ steps.docker_build_release_runtime.outputs.digest }}"
225+
else
226+
digest=$(../cilium-base-branch/images/scripts/get-image-digest.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-runtime:${{ steps.runtime-tag.outputs.tag }}")
227+
../cilium-base-branch/images/runtime/update-cilium-runtime-image.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-runtime:${{ steps.runtime-tag.outputs.tag }}@${digest}"
228+
fi
229+
230+
- name: Update Builder Images
231+
run: |
232+
if [[ "${{ steps.cilium-builder-tag-in-repositories.outputs.exists == 'false' }}" == "true" ]]; then
233+
../cilium-base-branch/images/builder/update-cilium-builder-image.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-builder:${{ steps.builder-tag.outputs.tag }}@${{ steps.docker_build_release_builder.outputs.digest }}"
234+
else
235+
digest=$(../cilium-base-branch/images/scripts/get-image-digest.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-builder:${{ steps.builder-tag.outputs.tag }}")
236+
../cilium-base-branch/images/builder/update-cilium-builder-image.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-builder:${{ steps.builder-tag.outputs.tag }}@${digest}"
237+
fi
238+
239+
- name: Update protobuf APIs and commit changes
240+
id: update-builder-image
241+
run: |
242+
if [[ "${{ steps.cilium-builder-tag-in-repositories.outputs.exists == 'false' }}" == "true" ]]; then
243+
../cilium-base-branch/images/builder/update-cilium-builder-image.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-builder:${{ steps.builder-tag.outputs.tag }}@${{ steps.docker_build_release_builder.outputs.digest }}"
244+
export CONTAINER_IMAGE=quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-builder:${{ steps.builder-tag.outputs.tag }}@${{ steps.docker_build_release_builder.outputs.digest }}
245+
else
246+
digest=$(../cilium-base-branch/images/scripts/get-image-digest.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-builder:${{ steps.builder-tag.outputs.tag }}")
247+
../cilium-base-branch/images/builder/update-cilium-builder-image.sh "quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-builder:${{ steps.builder-tag.outputs.tag }}@${digest}"
248+
export CONTAINER_IMAGE="quay.io/${{ env.QUAY_ORGANIZATION_DEV }}/cilium-builder:${{ steps.builder-tag.outputs.tag }}@${digest}"
249+
fi
250+
export VOLUME=$PWD/api/v1
251+
make -C ../cilium-base-branch/api/v1
252+
if ! git diff --quiet; then
253+
if [[ "${{ steps.update-runtime-image.outputs.committed }}" == "true" ]]; then
254+
git commit --amend -sam "images: update cilium-{runtime,builder}"
255+
else
256+
git commit -sam "images: update cilium-{runtime,builder}"
257+
fi
258+
echo committed="true" >> $GITHUB_OUTPUT
259+
else
260+
echo committed="false" >> $GITHUB_OUTPUT
261+
fi
262+
263+
- name: Get token
264+
if: ${{ steps.update-runtime-image.outputs.committed == 'true' || steps.update-builder-image.outputs.committed == 'true' }}
265+
id: get_token
266+
uses: cilium/actions-app-token@61a6271ce92ba02f49bf81c755685d59fb25a59a # v0.21.1
267+
with:
268+
APP_PEM: ${{ secrets.AUTO_COMMITTER_PEM_202411 }}
269+
APP_ID: ${{ secrets.AUTO_COMMITTER_APP_ID_202411 }}
270+
271+
- name: Push changes into PR
272+
if: ${{ steps.update-runtime-image.outputs.committed == 'true' || steps.update-builder-image.outputs.committed == 'true' }}
273+
env:
274+
ref: ${{ github.event.pull_request.head.ref || github.ref }}
275+
repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
276+
run: |
277+
git diff HEAD^
278+
git push https://x-access-token:${{ steps.get_token.outputs.app_token }}@github.com/${{ env.repository }}.git HEAD:$ref
279+
280+
- name: Prepare for Image Digests
281+
shell: bash
282+
run: |
283+
mkdir -p image-digest/
284+
285+
- name: Download digests of all images built
286+
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
287+
with:
288+
path: image-digest/
289+
pattern: "*image-digest *"
290+
291+
- name: Image Digests Output
292+
shell: bash
293+
run: |
294+
cd image-digest/
295+
find -type f | sort | xargs -d '\n' cat

‎.github/workflows/build-images-base.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ on:
1111
- images/runtime/**
1212
- images/builder/**
1313
branches-ignore:
14+
- v1.19
1415
- v1.18
1516
- v1.17
1617
- v1.16

0 commit comments

Comments
 (0)