ci: bump the factory pin to v1.4.0 and drop the Jetson SBOM attestati… #509
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release ARM artifacts | |
| on: | |
| push: | |
| tags: | |
| - v* | |
| permissions: read-all | |
| jobs: | |
| # Release gate: refuse to publish artifacts containing known-vulnerable | |
| # dependencies. Scans the binaries this release will actually ship, for the | |
| # kairos-init version pinned in images/Dockerfile. See | |
| # .github/workflows/release-scan.yml and | |
| # https://github.com/kairos-io/kairos/issues/3985. | |
| vulnerability-scan: | |
| uses: ./.github/workflows/release-scan.yml | |
| core: | |
| name: ${{ matrix.image_name }} | |
| uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@730309d995590a11ea0620ccad0c4832b5fb03a9 # v1.4.0 | |
| needs: | |
| - vulnerability-scan | |
| secrets: | |
| registry_username: ${{ secrets.QUAY_USERNAME }} | |
| registry_password: ${{ secrets.QUAY_PASSWORD }} | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| security-events: write | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| base_image: | |
| - "ghcr.io/kairos-io/hadron:v0.5.1" | |
| model: | |
| - "generic" | |
| - "rpi4" | |
| # Report-only: the scan still runs and reports, but criticals from the | |
| # upstream base image must not block releases. Mirrors master builds. | |
| security_scan_mode: ["report-only"] | |
| cleanup: [true] | |
| grype: [true] | |
| include: | |
| - image_name: "hadron" | |
| base_image: "ghcr.io/kairos-io/hadron:v0.5.1" | |
| model: "generic" | |
| cleanup: true | |
| grype: true | |
| custom_job_name_format: "core-arm64-generic" | |
| - image_name: "hadron" | |
| base_image: "ghcr.io/kairos-io/hadron:v0.5.1" | |
| model: "rpi4" | |
| cleanup: true | |
| grype: true | |
| custom_job_name_format: "core-arm64-rpi4" | |
| - model: "nvidia-jetson-agx-orin" | |
| image_name: "ubuntu:22.04" | |
| base_image: "ubuntu:22.04" | |
| security_scan_mode: "report-only" | |
| cleanup: true | |
| grype: true | |
| custom_job_name_format: "" | |
| - model: "nvidia-jetson-orin-nx" | |
| image_name: "ubuntu:22.04" | |
| base_image: "ubuntu:22.04" | |
| security_scan_mode: "report-only" | |
| cleanup: true | |
| grype: false # too many vulns under the L4T rootfs | |
| custom_job_name_format: "" | |
| with: | |
| auroraboot_version: "v0.26.2" | |
| dockerfile_path: "images/Dockerfile" | |
| base_image: ${{ matrix.base_image }} | |
| arch: "arm64" | |
| model: ${{ matrix.model }} | |
| # BuildKit refuses an attestation over 40 MiB and fails the whole push. | |
| # The Jetson SBOM crosses it because of the CUDA userspace; the image | |
| # itself builds and exports fine. Bumping packages cannot help, as the | |
| # document scales with file count, not with version age. | |
| sbom: ${{ !startsWith(matrix.model, 'nvidia-jetson') }} | |
| version: "auto" | |
| no_cache: true | |
| registry_domain: "quay.io" | |
| registry_namespace: "kairos" | |
| grype: ${{ matrix.grype }} | |
| grype_sarif: ${{ matrix.grype }} | |
| trivy: true | |
| trivy_sarif: true | |
| security_scan_mode: ${{ matrix.security_scan_mode }} | |
| # Don't let the SARIF step fail report-only builds (e.g. upstream k3s | |
| # CVEs we can't control); enforce builds still fail on criticals. | |
| grype_sarif_fail_build: ${{ matrix.security_scan_mode != 'report-only' }} | |
| custom_job_name_format: ${{ matrix.custom_job_name_format }} | |
| list_release_artifacts: true | |
| cosign: true | |
| release: true | |
| iso: ${{ matrix.model == 'generic' }} # only produce ISOs for generic | |
| cleanup: ${{ matrix.cleanup }} | |
| get-k3s-versions: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| kubernetes_versions: ${{ steps.get-k3s-releases.outputs.kubernetes_versions }} | |
| steps: | |
| - run: | | |
| sudo apt update && sudo apt install -y jq curl | |
| - name: Get latest k3s releases | |
| id: get-k3s-releases | |
| run: | | |
| kubernetes_versions=$(curl -s https://api.github.com/repos/k3s-io/k3s/releases | jq -r ' | |
| [.[] | select(.prerelease == false and .draft == false and (.tag_name | test("rc") | not)) | .tag_name] | |
| | map({ | |
| version: ., | |
| minor: (split(".")[1:2]|join("")), | |
| patch: (split(".")[2:3]|join("")|split("+")[0]), | |
| revision: (split("+k3s")[1]) | |
| }) | |
| | group_by(.minor) | |
| | map(sort_by([(.patch | tonumber), (.revision | tonumber)]) | reverse | .[0]) | |
| | sort_by(.minor | tonumber) | |
| | reverse | |
| | .[0:3] | |
| | map(.version) | |
| ' | jq -c '.') | |
| echo "kubernetes_versions=$kubernetes_versions" >> $GITHUB_OUTPUT | |
| standard: | |
| name: ${{ matrix.image_name }} | |
| uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@730309d995590a11ea0620ccad0c4832b5fb03a9 # v1.4.0 | |
| secrets: | |
| registry_username: ${{ secrets.QUAY_USERNAME }} | |
| registry_password: ${{ secrets.QUAY_PASSWORD }} | |
| needs: | |
| - vulnerability-scan | |
| - get-k3s-versions | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| security-events: write | |
| actions: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| kubernetes_version: ${{ fromJson(needs.get-k3s-versions.outputs.kubernetes_versions) }} | |
| base_image: | |
| - "ghcr.io/kairos-io/hadron:v0.5.1" | |
| model: | |
| - "generic" | |
| - "rpi4" | |
| image_name: | |
| - "hadron" | |
| security_scan_mode: ["report-only"] | |
| cleanup: [false] | |
| grype: [true] | |
| custom_job_name_format: | |
| - "standard-arm64-generic-k3s" | |
| - "standard-arm64-rpi4-k3s" | |
| exclude: | |
| - model: "generic" | |
| custom_job_name_format: "standard-arm64-rpi4-k3s" | |
| - model: "rpi4" | |
| custom_job_name_format: "standard-arm64-generic-k3s" | |
| include: | |
| - model: "nvidia-jetson-agx-orin" | |
| image_name: "ubuntu:22.04" | |
| base_image: "ubuntu:22.04" | |
| security_scan_mode: "report-only" | |
| cleanup: true | |
| grype: true | |
| custom_job_name_format: "" | |
| - model: "nvidia-jetson-orin-nx" | |
| image_name: "ubuntu:22.04" | |
| base_image: "ubuntu:22.04" | |
| security_scan_mode: "report-only" | |
| cleanup: true | |
| grype: false # too many vulns under the L4T rootfs | |
| custom_job_name_format: "" | |
| with: | |
| auroraboot_version: "v0.26.2" | |
| dockerfile_path: "images/Dockerfile" | |
| base_image: ${{ matrix.base_image }} | |
| arch: "arm64" | |
| model: ${{ matrix.model }} | |
| # BuildKit refuses an attestation over 40 MiB and fails the whole push. | |
| # The Jetson SBOM crosses it because of the CUDA userspace; the image | |
| # itself builds and exports fine. Bumping packages cannot help, as the | |
| # document scales with file count, not with version age. | |
| sbom: ${{ !startsWith(matrix.model, 'nvidia-jetson') }} | |
| kubernetes_version: ${{ matrix.kubernetes_version }} | |
| kubernetes_distro: "k3s" | |
| version: "auto" | |
| no_cache: true | |
| registry_domain: "quay.io" | |
| registry_namespace: "kairos" | |
| iso: ${{ matrix.model == 'generic' }} # only produce ISOs for generic | |
| grype: ${{ matrix.grype }} | |
| grype_sarif: ${{ matrix.grype }} | |
| trivy: true | |
| trivy_sarif: true | |
| security_scan_mode: ${{ matrix.security_scan_mode }} | |
| # Don't let the SARIF step fail report-only builds (e.g. upstream k3s | |
| # CVEs we can't control); enforce builds still fail on criticals. | |
| grype_sarif_fail_build: ${{ matrix.security_scan_mode != 'report-only' }} | |
| custom_job_name_format: ${{ matrix.custom_job_name_format }} | |
| list_release_artifacts: true | |
| cosign: true | |
| release: true | |
| cleanup: ${{ matrix.cleanup }} |