Skip to content

Commit ffede34

Browse files
ZenitharZenithar
committed
chore(ci): add terraformer release workflow.
1 parent 41ecab6 commit ffede34

File tree

1 file changed

+193
-0
lines changed

1 file changed

+193
-0
lines changed

‎.github/workflows/release-harp-terraformer.yml‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
name: Release (Harp Terraformer)
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
release:
7+
description: 'Release version'
8+
required: true
9+
10+
jobs:
11+
build:
12+
runs-on: ubuntu-latest
13+
permissions:
14+
packages: write
15+
contents: read
16+
strategy:
17+
fail-fast: false
18+
matrix:
19+
include:
20+
# normal
21+
- golang-image: "golang"
22+
golang-version: "1.17"
23+
tools-image: ghcr.io/elastic/harp/harp-tools:latest
24+
harp-image: harp-terraformer
25+
# fips
26+
- golang-image: "goboring/golang"
27+
golang-version: "1.16.7b7"
28+
tools-image: ghcr.io/elastic/harp/harp-tools-fips:latest
29+
harp-image: harp-terraformer-fips
30+
steps:
31+
-
32+
name: Check out the repo
33+
uses: actions/checkout@v2
34+
with:
35+
fetch-depth: 0
36+
-
37+
name: Set up Go
38+
uses: actions/setup-go@v2
39+
with:
40+
go-version: 1.17
41+
-
42+
name: Set up Docker Buildx
43+
id: buildx
44+
uses: docker/setup-buildx-action@v1
45+
with:
46+
install: true
47+
- name: Cache Docker layers
48+
uses: actions/cache@v2
49+
with:
50+
path: /tmp/.buildx-cache
51+
key: ${{ runner.os }}-multi-buildx-terraformer-${{ matrix.golang-version }}-${{ github.sha }}
52+
restore-keys: |
53+
${{ runner.os }}-multi-buildx-terraformer-${{ matrix.golang-version }}-${{ github.sha }}
54+
${{ runner.os }}-multi-buildx-terraformer-${{ matrix.golang-version }}
55+
${{ runner.os }}-multi-buildx-terraformer
56+
-
57+
name: Set Dockerfile settings
58+
run: |
59+
echo Building $DOCKER_IMAGE_NAME with $GOLANG_IMAGE:$GOLANG_VERSION
60+
echo "DOCKERFILE_ONLY=1" >> $GITHUB_ENV
61+
echo "GOLANG_IMAGE=$GOLANG_IMAGE" >> $GITHUB_ENV
62+
echo "GOLANG_VERSION=$GOLANG_VERSION" >> $GITHUB_ENV
63+
echo "TOOL_IMAGE_NAME=$TOOL_IMAGE_NAME" >> $GITHUB_ENV
64+
echo "RELEASE=$RELEASE" >> $GITHUB_ENV
65+
env:
66+
DOCKERFILE_ONLY: 1
67+
GOLANG_IMAGE: ${{ matrix.golang-image }}
68+
GOLANG_VERSION: ${{ matrix.golang-version }}
69+
TOOL_IMAGE_NAME: ${{ matrix.tools-image }}
70+
RELEASE: ${{ github.event.inputs.release }}
71+
-
72+
name: Generate Dockerfile
73+
uses: magefile/mage-action@v1
74+
with:
75+
version: latest
76+
args: releaser:harpterraformer
77+
-
78+
name: Log in to the Container registry
79+
uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
80+
with:
81+
registry: ghcr.io
82+
username: ${{ github.actor }}
83+
password: ${{ secrets.GITHUB_TOKEN }}
84+
-
85+
name: Build Docker image
86+
id: docker_build
87+
uses: docker/build-push-action@v2
88+
with:
89+
context: .
90+
file: Dockerfile.release
91+
pull: false
92+
push: true
93+
tags: |
94+
ghcr.io/elastic/harp-plugins/${{ matrix.harp-image }}:v${{ github.event.inputs.release }}
95+
ghcr.io/elastic/harp-plugins/${{ matrix.harp-image }}:latest
96+
cache-from: type=local,src=/tmp/.buildx-cache
97+
cache-to: type=local,mode=max,dest=/tmp/.buildx-cache-new
98+
build-args: |
99+
GOLANG_IMAGE=${{ matrix.golang-image }}
100+
GOLANG_VERSION=${{ matrix.golang-version }}
101+
RELEASE=${{ github.event.inputs.release }}
102+
-
103+
name: Create SBOM
104+
uses: anchore/sbom-action@v0
105+
with:
106+
image: ghcr.io/elastic/harp-plugins/${{ matrix.harp-image }}:v${{ github.event.inputs.release }}
107+
registry-username: ${{ github.actor }}
108+
registry-password: ${{ github.token }}
109+
artifact-name: sbom.spdx
110+
format: spdx
111+
-
112+
uses: sigstore/cosign-installer@main
113+
-
114+
name: Sign image and add attestations
115+
run: |
116+
echo -n "${COSIGN_PASSWORD}" | \
117+
cosign sign --key <(echo -n "${COSIGN_KEY}") \
118+
-a "repo=${{ github.repository }}" \
119+
-a "workflow=${{ github.workflow }}" \
120+
-a "ref=${{ github.sha }}" \
121+
ghcr.io/elastic/harp-plugins/${{ matrix.harp-image }}:v${{ github.event.inputs.release }}
122+
cosign attach sbom --sbom sbom.spdx ghcr.io/elastic/harp-plugins/${{ matrix.harp-image }}:v${{ github.event.inputs.release }}
123+
env:
124+
COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
125+
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
126+
-
127+
name: Move cache
128+
run: |
129+
rm -rf /tmp/.buildx-cache
130+
mv /tmp/.buildx-cache-new /tmp/.buildx-cache
131+
132+
release:
133+
needs: build
134+
runs-on: ubuntu-latest
135+
permissions:
136+
packages: read
137+
contents: write
138+
steps:
139+
-
140+
name: Log in to the Container registry
141+
uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
142+
with:
143+
registry: ghcr.io
144+
username: ${{ github.actor }}
145+
password: ${{ secrets.GITHUB_TOKEN }}
146+
-
147+
name: Extract artifacts from the docker image
148+
id: extract-std
149+
uses: shrink/actions-docker-extract@v1
150+
with:
151+
image: ghcr.io/elastic/harp-plugins/harp-terraformer:v${{ github.event.inputs.release }}
152+
path: '/app/.'
153+
-
154+
name: Extract FIPS artifacts from the docker image
155+
id: extract-fips
156+
uses: shrink/actions-docker-extract@v1
157+
with:
158+
image: ghcr.io/elastic/harp-plugins/harp-terraformer-fips:v${{ github.event.inputs.release }}
159+
path: '/app/.'
160+
-
161+
name: Assemble a package
162+
run: |
163+
mkdir .dist
164+
cp ${{ steps.extract-std.outputs.destination }}/* .dist/
165+
cp ${{ steps.extract-fips.outputs.destination }}/* .dist/
166+
cd .dist
167+
find . -maxdepth 1 -mindepth 1 -type f -exec tar czvf {}.tar.gz {} --remove-files \;
168+
-
169+
name: Create checksum
170+
id: create-checksum
171+
run: |
172+
cd .dist
173+
sha512sum * > checksum.txt
174+
-
175+
uses: sigstore/cosign-installer@main
176+
-
177+
name: Sign the checksum
178+
run: |
179+
cd .dist
180+
echo -n "${COSIGN_PASSWORD}" | \
181+
cosign sign-blob --key <(echo -n "${COSIGN_KEY}") \
182+
--output-signature=checksum.txt.sig \
183+
checksum.txt
184+
env:
185+
COSIGN_KEY: ${{ secrets.COSIGN_KEY }}
186+
COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }}
187+
-
188+
name: Upload to release
189+
uses: AButler/upload-release-assets@v2.0
190+
with:
191+
files: '.dist/*'
192+
repo-token: ${{ secrets.GITHUB_TOKEN }}
193+
release-tag: cmd/harp-terraformer/v${{ github.event.inputs.release }}

0 commit comments

Comments
 (0)