Skip to content

Commit 726fa18

Browse files
mattbatesmattbates
authored
Merge pull request #18 from cofide/mb/use-go-releaser
Use goreleaser in GH action
2 parents 0f4e67e + 4670b6a commit 726fa18

24 files changed

+197
-750
lines changed

‎.github/workflows/release.yml‎

Lines changed: 36 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -1,87 +1,48 @@
11
name: release
22

33
on:
4+
workflow_dispatch:
45
push:
56
tags:
67
- 'v[0-9]+.[0-9]+.[0-9]+*'
78

89
permissions:
910
contents: write
10-
id-token: write
11+
packages: write
1112

1213
jobs:
13-
build-push-images:
14-
name: Build and push images
15-
runs-on: ${{ matrix.runs-on }}
16-
strategy:
17-
matrix:
18-
include:
19-
- dockerfile: Dockerfile
20-
repo: amazonaws.com/cofide/spiffe-enable
21-
platform: linux/amd64
22-
runs-on: ubuntu-latest
23-
arch: amd64
24-
- dockerfile: Dockerfile
25-
repo: amazonaws.com/cofide/spiffe-enable
26-
platform: linux/arm64
27-
runs-on: connect-ci-runner-arm
28-
arch: arm64
29-
steps:
30-
- name: Checkout
31-
uses: actions/checkout@v4
32-
- name: Set up Docker Buildx
33-
uses: docker/setup-buildx-action@v3
34-
- name: Configure AWS credentials
35-
uses: aws-actions/configure-aws-credentials@v4
36-
with:
37-
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/connect-ecr-gh-actions-access
38-
role-session-name: connect-ecr-gh-actions-access
39-
aws-region: ${{ secrets.AWS_REGION }}
40-
- name: Login to Amazon ECR
41-
uses: aws-actions/amazon-ecr-login@v2
42-
- name: Build and push
43-
uses: docker/build-push-action@v6
44-
with:
45-
context: .
46-
file: ${{ matrix.dockerfile }}
47-
provenance: false # this is a fix needed to be able to merge the images in a new manifest list later on
48-
push: true
49-
platforms: ${{ matrix.platform }}
50-
cache-from: type=gha
51-
cache-to: type=gha,mode=max
52-
tags: ${{format('{0}.dkr.ecr.{1}.{2}:{3}-{4}', secrets.AWS_ACCOUNT_ID, secrets.AWS_REGION, matrix.repo, matrix.arch, github.ref_name)}}
14+
goreleaser:
15+
name: Build and Release with GoReleaser
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@v4
20+
with:
21+
fetch-depth: 0 # Required for GoReleaser to generate changelogs
22+
23+
- name: Setup Go
24+
uses: actions/setup-go@v5
25+
with:
26+
go-version-file: go.mod
27+
cache: true
5328

54-
build-merge-arch-images:
55-
runs-on: ubuntu-latest
56-
needs: build-push-images
57-
strategy:
58-
matrix:
59-
include:
60-
- repo: amazonaws.com/cofide/spiffe-enable
61-
steps:
62-
- name: Checkout
63-
uses: actions/checkout@v4
64-
- name: Set up Docker Buildx
65-
uses: docker/setup-buildx-action@v3
66-
- name: Configure AWS credentials
67-
uses: aws-actions/configure-aws-credentials@v4
68-
with:
69-
role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/connect-ecr-gh-actions-access
70-
role-session-name: connect-ecr-gh-actions-access
71-
aws-region: ${{ secrets.AWS_REGION }}
72-
- name: Login to Amazon ECR
73-
uses: aws-actions/amazon-ecr-login@v2
74-
- name: pull images
75-
run: |
76-
docker pull --platform linux/amd64 ${{format('{0}.dkr.ecr.{1}.{2}:amd64-{3}', secrets.AWS_ACCOUNT_ID, secrets.AWS_REGION, matrix.repo, github.ref_name)}}
77-
docker pull --platform linux/arm64 ${{format('{0}.dkr.ecr.{1}.{2}:arm64-{3}', secrets.AWS_ACCOUNT_ID, secrets.AWS_REGION, matrix.repo, github.ref_name)}}
78-
- name: Merge images
79-
run: |
80-
docker manifest create $IMAGE --amend $IMAGE_AMD64 --amend $IMAGE_ARM64
81-
docker manifest annotate $IMAGE $IMAGE_AMD64 --os linux --arch amd64
82-
docker manifest annotate $IMAGE $IMAGE_ARM64 --os linux --arch arm64
83-
docker manifest push $IMAGE
84-
env:
85-
IMAGE_AMD64: ${{format('{0}.dkr.ecr.{1}.{2}:amd64-{3}', secrets.AWS_ACCOUNT_ID, secrets.AWS_REGION, matrix.repo, github.ref_name)}}
86-
IMAGE_ARM64: ${{format('{0}.dkr.ecr.{1}.{2}:arm64-{3}', secrets.AWS_ACCOUNT_ID, secrets.AWS_REGION, matrix.repo, github.ref_name)}}
87-
IMAGE: ${{format('{0}.dkr.ecr.{1}.{2}:{3}', secrets.AWS_ACCOUNT_ID, secrets.AWS_REGION, matrix.repo, github.ref_name)}}
29+
- uses: ko-build/[email protected]
30+
31+
- name: Log in to GitHub Container Registry
32+
uses: docker/login-action@v3
33+
with:
34+
registry: ghcr.io
35+
username: ${{ github.actor }}
36+
password: ${{ secrets.GITHUB_TOKEN }}
37+
38+
- name: Set up Docker Buildx
39+
uses: docker/setup-buildx-action@v3
40+
41+
- name: Run GoReleaser
42+
uses: goreleaser/goreleaser-action@v6
43+
with:
44+
distribution: goreleaser
45+
version: '~> v2'
46+
args: release --clean
47+
env:
48+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,6 @@ go.work
2828

2929
# remove the binary if its been built
3030
injector-webhook
31+
32+
# remove the dist directory used by GoReleaser for builds
33+
dist

‎.goreleaser.yaml‎

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
version: 2
2+
project_name: spiffe-enable
3+
4+
before:
5+
hooks:
6+
- go mod tidy
7+
- go generate ./...
8+
9+
builds:
10+
- id: spiffe-enable
11+
binary: spiffe-enable
12+
main: ./cmd/manager
13+
env:
14+
- CGO_ENABLED=0
15+
goos:
16+
- linux
17+
- darwin
18+
goarch:
19+
- amd64
20+
- arm64
21+
ldflags:
22+
- -s -w -X main.version={{.Version}} -X main.commit={{.ShortCommit}} -X main.date={{.Date}}
23+
24+
- id: spiffe-enable-ui
25+
binary: spiffe-enable-ui
26+
main: ./ui/server
27+
env:
28+
- CGO_ENABLED=0
29+
goos:
30+
- linux
31+
- darwin
32+
goarch:
33+
- amd64
34+
- arm64
35+
ldflags:
36+
- -s -w -X main.version={{.Version}} -X main.commit={{.ShortCommit}} -X main.date={{.Date}}
37+
38+
archives:
39+
- name_template: "{{ .ProjectName }}_{{ .Version }}_{{ .Os }}_{{ .Arch }}"
40+
formats: tar.gz
41+
ids:
42+
- spiffe-enable
43+
- spiffe-enable-ui
44+
files:
45+
- README.md
46+
47+
checksum:
48+
name_template: '{{ .ProjectName }}_{{ .Version }}_checksums.txt'
49+
50+
changelog:
51+
sort: asc
52+
filters:
53+
exclude:
54+
- '^docs:'
55+
- '^test:'
56+
- 'Merge pull request'
57+
- 'Merge branch'
58+
59+
kos:
60+
- repositories:
61+
- ghcr.io/cofide/spiffe-enable
62+
tags:
63+
- "{{.Version}}"
64+
- latest
65+
bare: true
66+
preserve_import_paths: false
67+
platforms:
68+
- linux/amd64
69+
- linux/arm64
70+
71+
dockers:
72+
- goarch: arm64
73+
use: buildx
74+
dockerfile: Dockerfile.ui
75+
ids:
76+
- spiffe-enable-ui
77+
build_flag_templates:
78+
- "--platform=linux/arm64/v8"
79+
- "--label=org.opencontainers.image.title={{ .ProjectName }}-ui"
80+
- "--label=org.opencontainers.image.description=UI for spiffe-enable"
81+
- "--label=org.opencontainers.image.version={{ .Version }}"
82+
- "--label=org.opencontainers.image.revision={{ .FullCommit }}"
83+
- "--label=org.opencontainers.image.created={{ .Date }}"
84+
- "--label=org.opencontainers.image.source=https://github.com/cofide/spiffe-enable"
85+
image_templates:
86+
- "ghcr.io/cofide/spiffe-enable-ui:{{ .Version }}-arm64v8"
87+
- "ghcr.io/cofide/spiffe-enable-ui:latest-arm64v8"
88+
89+
- goarch: amd64
90+
use: buildx
91+
dockerfile: Dockerfile.ui
92+
ids:
93+
- spiffe-enable-ui
94+
build_flag_templates:
95+
- "--platform=linux/amd64"
96+
- "--label=org.opencontainers.image.title={{ .ProjectName }}-ui"
97+
- "--label=org.opencontainers.image.description=UI for spiffe-enable"
98+
- "--label=org.opencontainers.image.version={{ .Version }}"
99+
- "--label=org.opencontainers.image.revision={{ .FullCommit }}"
100+
- "--label=org.opencontainers.image.created={{ .Date }}"
101+
- "--label=org.opencontainers.image.source=https://github.com/cofide/spiffe-enable"
102+
image_templates:
103+
- "ghcr.io/cofide/spiffe-enable-ui:{{ .Version }}-amd64"
104+
- "ghcr.io/cofide/spiffe-enable-ui:latest-amd64"
105+
106+
- goarch: arm64
107+
use: buildx
108+
dockerfile: Dockerfile.nftables
109+
build_flag_templates:
110+
- "--platform=linux/arm64/v8"
111+
- "--label=org.opencontainers.image.title={{ .ProjectName }}-init"
112+
- "--label=org.opencontainers.image.description=Init container for spiffe-enable"
113+
- "--label=org.opencontainers.image.version={{ .Version }}"
114+
- "--label=org.opencontainers.image.revision={{ .FullCommit }}"
115+
- "--label=org.opencontainers.image.created={{ .Date }}"
116+
- "--label=org.opencontainers.image.source=https://github.com/cofide/spiffe-enable"
117+
image_templates:
118+
- "ghcr.io/cofide/spiffe-enable-init:{{ .Version }}-arm64v8"
119+
- "ghcr.io/cofide/spiffe-enable-init:latest-arm64v8"
120+
121+
- goarch: amd64
122+
use: buildx
123+
dockerfile: Dockerfile.nftables
124+
build_flag_templates:
125+
- "--platform=linux/amd64"
126+
- "--label=org.opencontainers.image.title={{ .ProjectName }}-init"
127+
- "--label=org.opencontainers.image.description=Init container for spiffe-enable"
128+
- "--label=org.opencontainers.image.version={{ .Version }}"
129+
- "--label=org.opencontainers.image.revision={{ .FullCommit }}"
130+
- "--label=org.opencontainers.image.created={{ .Date }}"
131+
- "--label=org.opencontainers.image.source=https://github.com/cofide/spiffe-enable"
132+
image_templates:
133+
- "ghcr.io/cofide/spiffe-enable-init:{{ .Version }}-amd64"
134+
- "ghcr.io/cofide/spiffe-enable-init:latest-amd64"
135+
136+
docker_manifests:
137+
- name_template: "ghcr.io/cofide/spiffe-enable-ui:{{ .Version }}"
138+
image_templates:
139+
- "ghcr.io/cofide/spiffe-enable-ui:{{ .Version }}-amd64"
140+
- "ghcr.io/cofide/spiffe-enable-ui:{{ .Version }}-arm64v8"
141+
- name_template: "ghcr.io/cofide/spiffe-enable-ui:latest"
142+
image_templates:
143+
- "ghcr.io/cofide/spiffe-enable-ui:latest-amd64"
144+
- "ghcr.io/cofide/spiffe-enable-ui:latest-arm64v8"
145+
- name_template: "ghcr.io/cofide/spiffe-enable-init:{{ .Version }}"
146+
image_templates:
147+
- "ghcr.io/cofide/spiffe-enable-init:{{ .Version }}-amd64"
148+
- "ghcr.io/cofide/spiffe-enable-init:{{ .Version }}-arm64v8"
149+
- name_template: "ghcr.io/cofide/spiffe-enable-init:latest"
150+
image_templates:
151+
- "ghcr.io/cofide/spiffe-enable-init:latest-amd64"
152+
- "ghcr.io/cofide/spiffe-enable-init:latest-arm64v8"

‎Dockerfile.nftables‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM alpine:latest
1+
FROM --platform=$TARGETPLATFORM alpine:latest
22

33
# Install nftables
44
RUN apk add --no-cache nftables

‎Dockerfile.ui‎

Lines changed: 1 addition & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,6 @@
1-
# Build the UI binary
2-
FROM cgr.dev/chainguard/go:latest AS builder
3-
ARG TARGETOS
4-
ARG TARGETARCH
5-
6-
WORKDIR /workspace
7-
# Copy the Go Modules manifests
8-
COPY go.mod go.sum ./
9-
# cache deps before building and copying source so that we don't need to re-download as much
10-
# and so that source changes don't invalidate our downloaded layer
11-
RUN go mod download
12-
13-
COPY ui/server ui/server
14-
15-
# Build
16-
# the GOARCH has not a default value to allow the binary be built according to the host where the command
17-
# was called. For example, if we call make docker-build in a local env which has the Apple Silicon M1 SO
18-
# the docker BUILDPLATFORM arg will be linux/arm64 when for Apple x86 it will be linux/amd64. Therefore,
19-
# by leaving it empty we can ensure that the container and binary shipped on it will have the same platform.
20-
RUN CGO_ENABLED=0 GOOS=${TARGETOS:-linux} GOARCH=${TARGETARCH} go build -a -o spiffe-enable-ui ui/server/main.go
21-
221
FROM cgr.dev/chainguard/static:latest
232
WORKDIR /
24-
COPY --from=builder /workspace/spiffe-enable-ui .
3+
COPY spiffe-enable-ui .
254
# The Chainguard image has a single user 'nonroot' with uid '65532', belonging to gid '65532'.
265
USER nonroot
276

0 commit comments

Comments
 (0)