Bump hadron to v0.5.1 #419
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release AMD64 artifacts | |
| on: | |
| push: | |
| tags: | |
| - v* | |
| permissions: read-all | |
| jobs: | |
| core: | |
| name: ${{ matrix.image_name }} | |
| uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@8952c3a5f4f6255cc63af88cb3637a9684970c8d # v1.1.3 | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| security-events: write | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - image_name: "hadron" | |
| base_image: "ghcr.io/kairos-io/hadron:v0.5.1" | |
| trusted_boot: false | |
| custom_job_name_format: "core-amd64-generic" | |
| - image_name: "hadron" | |
| base_image: "ghcr.io/kairos-io/hadron:v0.5.1" | |
| trusted_boot: true | |
| custom_job_name_format: "core-amd64-generic-uki" | |
| secrets: | |
| registry_username: ${{ secrets.QUAY_USERNAME }} | |
| registry_password: ${{ secrets.QUAY_PASSWORD }} | |
| with: | |
| auroraboot_version: "v0.23.0" | |
| dockerfile_path: "images/Dockerfile" | |
| base_image: ${{ matrix.base_image }} | |
| arch: "amd64" | |
| model: "generic" | |
| version: "auto" | |
| no_cache: true | |
| registry_domain: "quay.io" | |
| registry_namespace: "kairos" | |
| trusted_boot: ${{ matrix.trusted_boot }} | |
| iso: ${{ !matrix.trusted_boot }} | |
| grype: true | |
| grype_sarif: true | |
| trivy: true | |
| trivy_sarif: true | |
| # Report-only: the scan still runs and reports, but criticals from the | |
| # upstream base image must not block releases. Mirrors master builds. | |
| # Both gates must be relaxed: security_scan_mode (the enforce step) AND | |
| # grype_sarif_fail_build (the SARIF step, which defaults to true). | |
| security_scan_mode: "report-only" | |
| grype_sarif_fail_build: false | |
| custom_job_name_format: ${{ matrix.custom_job_name_format }} | |
| list_release_artifacts: ${{ !matrix.trusted_boot }} | |
| cosign: true | |
| release: ${{ !matrix.trusted_boot }} | |
| get-k3s-versions: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| kubernetes_versions: ${{ steps.get-k3s-releases.outputs.kubernetes_versions }} | |
| steps: | |
| - run: | | |
| sudo apt update && sudo apt install -y jq curl | |
| - name: Get latest k3s releases | |
| id: get-k3s-releases | |
| run: | | |
| kubernetes_versions=$(curl -s https://api.github.com/repos/k3s-io/k3s/releases | jq -r ' | |
| [.[] | select(.prerelease == false and .draft == false and (.tag_name | test("rc") | not)) | .tag_name] | |
| | map(select(test("^v[0-9]+\\.[0-9]+\\.[0-9]+\\+k3s[0-9]+$"))) | |
| | map({ | |
| version: ., | |
| minor: (split(".")[1:2]|join("")), | |
| patch: (split(".")[2:3]|join("")|split("+")[0]), | |
| revision: (split("+k3s")[1]) | |
| }) | |
| | group_by(.minor) | |
| | map(sort_by([(.patch | tonumber), (.revision | tonumber)]) | reverse | .[0]) | |
| | sort_by(.minor | tonumber) | |
| | reverse | |
| | .[0:3] | |
| | map(.version) | |
| ' | jq -c '.') | |
| echo "kubernetes_versions=$kubernetes_versions" >> $GITHUB_OUTPUT | |
| get-k0s-versions: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| kubernetes_versions: ${{ steps.get-k0s-releases.outputs.kubernetes_versions }} | |
| steps: | |
| - run: | | |
| sudo apt update && sudo apt install -y jq curl | |
| - name: Get latest k0s releases | |
| id: get-k0s-releases | |
| run: | | |
| kubernetes_versions=$(curl -s https://api.github.com/repos/k0sproject/k0s/releases | jq -r ' | |
| [.[] | select(.prerelease == false and .draft == false and (.tag_name | test("rc") | not)) | .tag_name] | |
| | map(select(test("^v[0-9]+\\.[0-9]+\\.[0-9]+\\+k0s\\.[0-9]+$"))) | |
| | map({ | |
| version: ., | |
| minor: (split(".")[1:2]|join("")), | |
| patch: (split(".")[2:3]|join("")|split("+")[0]), | |
| revision: (split("+k0s.")[1]) | |
| }) | |
| | group_by(.minor) | |
| | map(sort_by([(.patch | tonumber), (.revision | tonumber)]) | reverse | .[0]) | |
| | sort_by(.minor | tonumber) | |
| | reverse | |
| | .[0:3] | |
| | map(.version) | |
| '| jq -c '.') | |
| echo "kubernetes_versions=$kubernetes_versions" >> $GITHUB_OUTPUT | |
| standard-k3s: | |
| name: ${{ matrix.image_name }} | |
| uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@8952c3a5f4f6255cc63af88cb3637a9684970c8d # v1.1.3 | |
| needs: | |
| - get-k3s-versions | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| security-events: write | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| image_name: | |
| - "hadron" | |
| base_image: | |
| - "ghcr.io/kairos-io/hadron:v0.5.1" | |
| kubernetes_version: ${{ fromJson(needs.get-k3s-versions.outputs.kubernetes_versions) }} | |
| secrets: | |
| registry_username: ${{ secrets.QUAY_USERNAME }} | |
| registry_password: ${{ secrets.QUAY_PASSWORD }} | |
| with: | |
| auroraboot_version: "v0.23.0" | |
| dockerfile_path: "images/Dockerfile" | |
| base_image: ${{ matrix.base_image }} | |
| arch: "amd64" | |
| model: "generic" | |
| version: "auto" | |
| no_cache: true | |
| registry_domain: "quay.io" | |
| registry_namespace: "kairos" | |
| iso: true | |
| kubernetes_version: ${{ matrix.kubernetes_version }} | |
| kubernetes_distro: "k3s" | |
| grype: true | |
| grype_sarif: true | |
| trivy: true | |
| trivy_sarif: true | |
| security_scan_mode: "report-only" | |
| # k3s CVEs come from upstream and are out of our control; the SARIF | |
| # step must not fail the release. Gating is left to security_scan_mode. | |
| grype_sarif_fail_build: false | |
| custom_job_name_format: "standard-amd64-generic-k3s" | |
| list_release_artifacts: true | |
| cosign: true | |
| release: true | |
| standard-k0s: | |
| name: ${{ matrix.image_name }} | |
| uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@8952c3a5f4f6255cc63af88cb3637a9684970c8d # v1.1.3 | |
| needs: | |
| - get-k0s-versions | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| security-events: write | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| image_name: | |
| - "hadron" | |
| base_image: | |
| - "ghcr.io/kairos-io/hadron:v0.5.1" | |
| kubernetes_version: ${{ fromJson(needs.get-k0s-versions.outputs.kubernetes_versions) }} | |
| secrets: | |
| registry_username: ${{ secrets.QUAY_USERNAME }} | |
| registry_password: ${{ secrets.QUAY_PASSWORD }} | |
| with: | |
| auroraboot_version: "v0.23.0" | |
| dockerfile_path: "images/Dockerfile" | |
| base_image: ${{ matrix.base_image }} | |
| arch: "amd64" | |
| model: "generic" | |
| version: "auto" | |
| no_cache: true | |
| registry_domain: "quay.io" | |
| registry_namespace: "kairos" | |
| iso: true | |
| kubernetes_version: ${{ matrix.kubernetes_version }} | |
| kubernetes_distro: "k0s" | |
| grype: true | |
| grype_sarif: true | |
| trivy: true | |
| trivy_sarif: true | |
| security_scan_mode: "report-only" | |
| # k0s CVEs come from upstream and are out of our control; the SARIF | |
| # step must not fail the release. Gating is left to security_scan_mode. | |
| grype_sarif_fail_build: false | |
| custom_job_name_format: "standard-amd64-generic-k0s" | |
| list_release_artifacts: true | |
| cosign: true | |
| release: true |