Skip to content

Commit a07d21c

Browse files
matheuscscpmatheuscscp
authored
Merge pull request #971 from fluxcd/backport-fix-release-v1.0.x
[release/v1.0.x] Fix release workflow
2 parents 9617e0e + f9d5f98 commit a07d21c

File tree

7 files changed

+107
-291
lines changed

7 files changed

+107
-291
lines changed

‎.github/workflows/backport.yaml‎

Lines changed: 6 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,31 +1,12 @@
11
name: backport
2-
32
on:
43
pull_request_target:
54
types: [closed, labeled]
6-
75
jobs:
8-
pull-request:
9-
runs-on: ubuntu-latest
6+
backport:
107
permissions:
11-
contents: write
12-
pull-requests: write
13-
if: github.event.pull_request.state == 'closed' && github.event.pull_request.merged && (github.event_name != 'labeled' || startsWith('backport:', github.event.label.name))
14-
steps:
15-
- name: Checkout
16-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
17-
with:
18-
ref: ${{ github.event.pull_request.head.sha }}
19-
- name: Create backport PRs
20-
uses: korthout/backport-action@ca4972adce8039ff995e618f5fc02d1b7961f27a # v3.3.0
21-
# xref: https://github.com/korthout/backport-action#inputs
22-
with:
23-
# Use token to allow workflows to be triggered for the created PR
24-
github_token: ${{ secrets.BOT_GITHUB_TOKEN }}
25-
# Match labels with a pattern `backport:<target-branch>`
26-
label_pattern: '^backport:([^ ]+)$'
27-
# A bit shorter pull-request title than the default
28-
pull_title: '[${target_branch}] ${pull_title}'
29-
# Simpler PR description than default
30-
pull_description: |-
31-
Automated backport to `${target_branch}`, triggered by a label in #${pull_number}.
8+
contents: write # for reading and creating branches.
9+
pull-requests: write # for creating pull requests against release branches.
10+
uses: fluxcd/gha-workflows/.github/workflows/[email protected]
11+
secrets:
12+
github-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/build.yaml‎

Lines changed: 15 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -4,39 +4,22 @@ on:
44
pull_request:
55
push:
66
branches: [ 'main', 'release/**' ]
7-
8-
permissions:
9-
contents: read # for actions/checkout to fetch code
10-
117
jobs:
128
test-linux-amd64:
139
runs-on: ubuntu-latest
10+
permissions:
11+
contents: read # for reading the repository code.
1412
steps:
15-
- name: checkout
16-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
17-
- name: Setup Go
18-
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
19-
with:
20-
go-version: 1.25.x
21-
cache-dependency-path: |
22-
**/go.sum
23-
**/go.mod
24-
- name: Setup QEMU
25-
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
26-
- name: Setup Docker Buildx
27-
id: buildx
28-
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
29-
- name: Run tests
30-
run: make test
31-
- name: Verify
32-
run: make verify
33-
- name: Build multi-arch container image
34-
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
35-
with:
36-
push: false
37-
builder: ${{ steps.buildx.outputs.name }}
38-
context: .
39-
file: ./Dockerfile
40-
platforms: linux/amd64,linux/arm/v7,linux/arm64
41-
tags: |
42-
${{ github.repository }}:latest
13+
- name: Test suite setup
14+
uses: fluxcd/gha-workflows/.github/actions/[email protected]
15+
with:
16+
go-version: 1.25.x
17+
- name: Run tests
18+
run: make test
19+
- name: Verify
20+
run: make verify
21+
- name: Build container image
22+
run: |
23+
make docker-build IMG=ghcr.io/fluxcd/${{ github.event.repository.name }} \
24+
BUILD_PLATFORMS=linux/amd64 \
25+
BUILD_ARGS="--load"

‎.github/workflows/cifuzz.yaml‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,22 +2,15 @@ name: fuzz
22
on:
33
pull_request:
44
branches: [ 'main', 'release/**' ]
5-
6-
permissions:
7-
contents: read # for actions/checkout to fetch code
8-
95
jobs:
106
smoketest:
117
runs-on: ubuntu-latest
8+
permissions:
9+
contents: read # for reading the repository code.
1210
steps:
13-
- name: Checkout
14-
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
15-
- name: Setup Go
16-
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
11+
- name: Test suite setup
12+
uses: fluxcd/gha-workflows/.github/actions/[email protected]
1713
with:
1814
go-version: 1.25.x
19-
cache-dependency-path: |
20-
**/go.sum
21-
**/go.mod
2215
- name: Smoke test Fuzzers
2316
run: make fuzz-smoketest

‎.github/workflows/release.yaml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: release
2+
on:
3+
push:
4+
tags:
5+
- 'v*'
6+
workflow_dispatch:
7+
inputs:
8+
tag:
9+
description: 'image tag prefix'
10+
default: 'rc'
11+
required: true
12+
jobs:
13+
release:
14+
permissions:
15+
contents: write # for creating the GitHub release.
16+
id-token: write # for creating OIDC tokens for signing.
17+
packages: write # for pushing and signing container images.
18+
uses: fluxcd/gha-workflows/.github/workflows/[email protected]
19+
with:
20+
controller: ${{ github.event.repository.name }}
21+
release-candidate-prefix: ${{ github.event.inputs.tag }}
22+
secrets:
23+
github-token: ${{ secrets.GITHUB_TOKEN }}
24+
dockerhub-token: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
25+
release-provenance:
26+
needs: [release]
27+
permissions:
28+
actions: read # for detecting the Github Actions environment.
29+
id-token: write # for creating OIDC tokens for signing.
30+
contents: write # for uploading attestations to GitHub releases.
31+
if: startsWith(github.ref, 'refs/tags/v')
32+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
33+
with:
34+
provenance-name: "provenance.intoto.jsonl"
35+
base64-subjects: "${{ needs.release.outputs.release-digests }}"
36+
upload-assets: true
37+
dockerhub-provenance:
38+
needs: [release]
39+
permissions:
40+
contents: read # for reading the repository code.
41+
actions: read # for detecting the Github Actions environment.
42+
id-token: write # for creating OIDC tokens for signing.
43+
packages: write # for uploading attestations.
44+
if: startsWith(github.ref, 'refs/tags/v')
45+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
46+
with:
47+
image: ${{ needs.release.outputs.image-name }}
48+
digest: ${{ needs.release.outputs.image-digest }}
49+
registry-username: ${{ github.repository_owner == 'fluxcd' && 'fluxcdbot' || github.repository_owner }}
50+
secrets:
51+
registry-password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
52+
ghcr-provenance:
53+
needs: [release]
54+
permissions:
55+
contents: read # for reading the repository code.
56+
actions: read # for detecting the Github Actions environment.
57+
id-token: write # for creating OIDC tokens for signing.
58+
packages: write # for uploading attestations.
59+
if: startsWith(github.ref, 'refs/tags/v')
60+
uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected]
61+
with:
62+
image: ghcr.io/${{ needs.release.outputs.image-name }}
63+
digest: ${{ needs.release.outputs.image-digest }}
64+
registry-username: fluxcdbot # not necessary for ghcr.io
65+
secrets:
66+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/release.yml‎

Lines changed: 0 additions & 160 deletions
This file was deleted.

0 commit comments

Comments
 (0)