ci: update styles and context7 index #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| # Conventional commits on main drive the version: semantic-release computes the | |
| # tag and cuts the GitHub Release, then the binaries and the three component | |
| # images are built from that exact tag. Nothing publishes when no commit since | |
| # the last release warrants a version bump. | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: "Version to release (e.g. 1.2.3), leave empty to let semantic-release decide" | |
| required: false | |
| type: string | |
| push: | |
| branches: | |
| - main | |
| permissions: {} | |
| env: | |
| DOCKERHUB_USER: devopsiaci | |
| jobs: | |
| version: | |
| name: Resolve version | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| issues: write | |
| pull-requests: write | |
| outputs: | |
| published: ${{ steps.resolve.outputs.published }} | |
| version: ${{ steps.resolve.outputs.version }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Semantic Release | |
| id: semantic_release | |
| if: inputs.tag == '' | |
| uses: cycjimmy/semantic-release-action@b12c8f6015dc215fe37bc154d4ad456dd3833c90 # v6.0.0 | |
| with: | |
| branch: main | |
| tag_format: ${version} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| # A manual run with an explicit tag skips semantic-release entirely. That | |
| # is also how a release whose build failed after the tag landed gets | |
| # rebuilt, without inventing a second version number for it. | |
| - name: Resolve the version to build | |
| id: resolve | |
| env: | |
| TAG_INPUT: ${{ inputs.tag }} | |
| SR_PUBLISHED: ${{ steps.semantic_release.outputs.new_release_published }} | |
| SR_VERSION: ${{ steps.semantic_release.outputs.new_release_version }} | |
| run: | | |
| if [ -n "${TAG_INPUT}" ]; then | |
| echo "published=true" >> "$GITHUB_OUTPUT" | |
| echo "version=${TAG_INPUT#v}" >> "$GITHUB_OUTPUT" | |
| elif [ "${SR_PUBLISHED}" = "true" ]; then | |
| echo "published=true" >> "$GITHUB_OUTPUT" | |
| echo "version=${SR_VERSION}" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "published=false" >> "$GITHUB_OUTPUT" | |
| echo "No release warranted by the commits since the last tag." | |
| fi | |
| binaries: | |
| name: ${{ matrix.component }} ${{ matrix.goos }}/${{ matrix.goarch }} | |
| needs: version | |
| if: needs.version.outputs.published == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| component: [manager, gateway, ui] | |
| goos: [linux, darwin] | |
| goarch: [amd64, arm64] | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ needs.version.outputs.version }} | |
| persist-credentials: false | |
| - name: Setup Go | |
| uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0 | |
| with: | |
| go-version-file: go.mod | |
| - name: Build | |
| env: | |
| CGO_ENABLED: "0" | |
| GOOS: ${{ matrix.goos }} | |
| GOARCH: ${{ matrix.goarch }} | |
| VERSION: ${{ needs.version.outputs.version }} | |
| COMPONENT: ${{ matrix.component }} | |
| run: | | |
| out="dwpk-${COMPONENT}_${VERSION}_${GOOS}_${GOARCH}" | |
| mkdir -p "dist/${out}" | |
| go build -ldflags "-s -w -X main.version=${VERSION}" \ | |
| -o "dist/${out}/dwpk-${COMPONENT}" "./cmd/${COMPONENT}" | |
| cp LICENSE README.md "dist/${out}/" | |
| tar -czf "dist/${out}.tar.gz" -C dist "${out}" | |
| ( cd dist && sha256sum "${out}.tar.gz" > "${out}.tar.gz.sha256" ) | |
| - name: Attach to the release | |
| uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2 | |
| with: | |
| tag_name: ${{ needs.version.outputs.version }} | |
| files: | | |
| dist/*.tar.gz | |
| dist/*.tar.gz.sha256 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| images: | |
| name: Image ${{ matrix.component }} | |
| needs: version | |
| if: needs.version.outputs.published == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| attestations: write | |
| contents: read | |
| id-token: write | |
| packages: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - component: manager | |
| dockerfile: Dockerfile | |
| repo: dwpk | |
| title: dwpk manager | |
| description: The dwpk operator - reconciles UserSpace, Workspace and WorkspaceImage | |
| - component: gateway | |
| dockerfile: cmd/gateway/Dockerfile | |
| repo: dwpk-gateway | |
| title: dwpk gateway | |
| description: The dwpk SSH gateway - public-key authentication into workspace pods | |
| - component: ui | |
| dockerfile: cmd/ui/Dockerfile | |
| repo: dwpk-ui | |
| title: dwpk UI | |
| description: The dwpk marketplace web UI | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ needs.version.outputs.version }} | |
| persist-credentials: false | |
| - name: Set Docker metadata | |
| id: meta | |
| uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 | |
| with: | |
| images: | | |
| ${{ env.DOCKERHUB_USER }}/${{ matrix.repo }} | |
| ghcr.io/${{ github.repository_owner }}/${{ matrix.repo }} | |
| labels: | | |
| org.opencontainers.image.authors=ialejandro | |
| org.opencontainers.image.description=${{ matrix.description }} | |
| org.opencontainers.image.maintainer=ialejandro | |
| org.opencontainers.image.title=${{ matrix.title }} | |
| org.opencontainers.image.vendor=DevOps IA | |
| tags: | | |
| type=raw,value=${{ needs.version.outputs.version }} | |
| type=raw,value=latest | |
| type=sha,enable=false | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 | |
| - name: "[DOCKERHUB] Log in to Docker Hub" | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_PASSWORD }} | |
| - name: "[GHCR] Log in to the Container registry" | |
| uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build and push | |
| id: push | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 | |
| with: | |
| build-args: VERSION=${{ needs.version.outputs.version }} | |
| cache-from: type=gha,scope=${{ matrix.component }} | |
| cache-to: type=gha,mode=max,scope=${{ matrix.component }} | |
| context: . | |
| file: ${{ matrix.dockerfile }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| sbom: true | |
| tags: ${{ steps.meta.outputs.tags }} | |
| - name: "[DOCKERHUB] Update the registry description" | |
| uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0 | |
| with: | |
| username: ${{ secrets.DOCKERHUB_USERNAME }} | |
| password: ${{ secrets.DOCKERHUB_PASSWORD }} | |
| repository: ${{ env.DOCKERHUB_USER }}/${{ matrix.repo }} | |
| # GHCR only: DockerHub has no attestation endpoint, and it is the same | |
| # image digest either way. | |
| - name: "[GHCR] Generate artifact attestation" | |
| uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 | |
| with: | |
| subject-name: ghcr.io/${{ github.repository_owner }}/${{ matrix.repo }} | |
| subject-digest: ${{ steps.push.outputs.digest }} | |
| push-to-registry: true | |
| docs: | |
| name: Publish versioned docs | |
| needs: version | |
| if: needs.version.outputs.published == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ needs.version.outputs.version }} | |
| fetch-depth: 0 | |
| - name: Setup Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: "3" | |
| - name: Install mkdocs-material and mike | |
| run: pip install mkdocs-material mike mkdocs-llmstxt | |
| # mike's version identifier is major.minor, not the full patch version: | |
| # a patch release (1.4.0 -> 1.4.1) redeploys the same "1.4" entry in | |
| # place instead of adding a new one to the dropdown, which only a major | |
| # or minor bump does. | |
| - name: Deploy this version and move the "latest" alias | |
| env: | |
| VERSION: ${{ needs.version.outputs.version }} | |
| run: | | |
| git config user.name "github-actions[bot]" | |
| git config user.email "github-actions[bot]@users.noreply.github.com" | |
| # mike resolves the "gh-pages" ref literally (git show gh-pages:...) | |
| # and needs it fetched to see - and not clobber - versions already | |
| # deployed there. First-ever deploy: this fails harmlessly, and mike | |
| # creates gh-pages from scratch. | |
| git fetch origin gh-pages:gh-pages --depth=1 2>/dev/null || true | |
| minor="${VERSION%.*}" | |
| mike deploy --push --update-aliases "${minor}" latest | |
| mike set-default --push latest |