kairos/.github/workflows/release-arm.yaml at 1b3ee116399096d7d4394061d073b77bcdfcb00b · kairos-io/kairos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
name: Release ARM artifacts

on:
  push:
    tags:
      - v*
permissions: read-all
jobs:
  core:
    name: ${{ matrix.base_image }}
    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@583ec0586948b7b8e7692f6db22e902b373d48f3 # v0.0.13
    secrets:
      registry_username: ${{ secrets.QUAY_USERNAME }}
      registry_password: ${{ secrets.QUAY_PASSWORD }}
    permissions:
      id-token: write  # OIDC support
      contents: write
      security-events: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        base_image:
          - "ghcr.io/kairos-io/hadron:v0.0.4"
        model:
          - "generic"
          - "rpi4"
        cleanup: [true]
        grype: [true]
        include:
          - model: "nvidia-jetson-agx-orin"
            base_image: "ubuntu:22.04"
            cleanup: true
            grype: true
          - model: "nvidia-jetson-orin-nx"
            base_image: "ubuntu:22.04"
            cleanup: true
            grype: false # too many vulns under the L4T rootfs
    with:
      auroraboot_version: "v0.19.1"
      dockerfile_path: "images/Dockerfile"
      base_image: ${{ matrix.base_image }}
      arch: "arm64"
      model: ${{ matrix.model }}
      version: "auto"
      no_cache: true
      registry_domain: "quay.io"
      registry_namespace: "kairos"
      grype: ${{ matrix.grype }}
      grype_sarif: ${{ matrix.grype }}
      trivy: true
      trivy_sarif: true
      list_release_artifacts: true
      cosign: true
      release: true
      iso: ${{ matrix.model == 'generic' }} # only produce ISOs for generic
      cleanup: ${{ matrix.cleanup }}
  get-k3s-versions:
    runs-on: ubuntu-latest
    outputs:
      kubernetes_versions: ${{ steps.get-k3s-releases.outputs.kubernetes_versions }}
    steps:
      - run: |
          sudo apt update && sudo apt install -y jq curl
      - name: Get latest k3s releases
        id: get-k3s-releases
        run: |
          kubernetes_versions=$(curl -s https://api.github.com/repos/k3s-io/k3s/releases | jq -r '
            [.[] | select(.prerelease == false and .draft == false and (.tag_name | test("rc") | not)) | .tag_name]
            | map({
                version: .,
                minor: (split(".")[1:2]|join("")),
                patch: (split(".")[2:3]|join("")|split("+")[0]),
                revision: (split("+k3s")[1])
              })
            | group_by(.minor)
            | map(sort_by([(.patch | tonumber), (.revision | tonumber)]) | reverse | .[0])
            | sort_by(.minor | tonumber)
            | reverse
            | .[0:3]
            | map(.version)
          ' | jq -c '.')
          echo "kubernetes_versions=$kubernetes_versions" >> $GITHUB_OUTPUT
  standard:
    name: ${{ matrix.base_image }}
    uses: kairos-io/kairos-factory-action/.github/workflows/reusable-factory.yaml@583ec0586948b7b8e7692f6db22e902b373d48f3 # v0.0.13
    secrets:
      registry_username: ${{ secrets.QUAY_USERNAME }}
      registry_password: ${{ secrets.QUAY_PASSWORD }}
    needs:
      - get-k3s-versions
    permissions:
      id-token: write  # OIDC support
      contents: write
      security-events: write
      actions: read
    strategy:
      fail-fast: false
      matrix:
        kubernetes_version: ${{ fromJson(needs.get-k3s-versions.outputs.kubernetes_versions) }}
        base_image:
          - "ghcr.io/kairos-io/hadron:v0.0.4"
        model:
          - "generic"
          - "rpi4"
        cleanup: [false]
        grype: [true]
        include:
          - model: "nvidia-jetson-agx-orin"
            base_image: "ubuntu:22.04"
            cleanup: true
            grype: true
          - model: "nvidia-jetson-orin-nx"
            base_image: "ubuntu:22.04"
            cleanup: true
            grype: false # too many vulns under the L4T rootfs
    with:
      auroraboot_version: "v0.19.1"
      dockerfile_path: "images/Dockerfile"
      base_image: ${{ matrix.base_image }}
      arch: "arm64"
      model: ${{ matrix.model }}
      kubernetes_version: ${{ matrix.kubernetes_version }}
      kubernetes_distro: "k3s"
      version: "auto"
      no_cache: true
      registry_domain: "quay.io"
      registry_namespace: "kairos"
      iso: ${{ matrix.model == 'generic' }} # only produce ISOs for generic
      grype: ${{ matrix.grype }}
      grype_sarif: ${{ matrix.grype }}
      trivy: true
      trivy_sarif: true
      list_release_artifacts: true
      cosign: true
      release: true
      cleanup: ${{ matrix.cleanup }}