lfx-v2-fga-sync/.github/workflows/ko-build-tag.yaml at main · linuxfoundation/lfx-v2-fga-sync · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
# Copyright The Linux Foundation and each contributor to LFX.
# SPDX-License-Identifier: MIT
---
name: Publish Tagged Release

"on":
  push:
    tags:
      - v*

env:
  COSIGN_VERSION: v2.5.3
  HELM_VERSION: v3.18.4

permissions:
  contents: read

jobs:
  publish:
    name: Publish Tagged Release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      app_version: ${{ steps.prepare.outputs.app_version }}
      chart_name: ${{ steps.prepare.outputs.chart_name }}
      chart_version: ${{ steps.prepare.outputs.chart_version }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Prepare versions and chart name
        id: prepare
        run: |
          set -euo pipefail
          APP_VERSION=$(echo ${{ github.ref_name }} | sed 's/v//g')
          CHART_NAME="$(yq '.name' charts/*/Chart.yaml)"
          CHART_VERSION=$(echo ${{ github.ref_name }} | sed 's/v//g')
          {
            echo "app_version=$APP_VERSION"
            echo "chart_name=$CHART_NAME"
            echo "chart_version=$CHART_VERSION"
          } >> "$GITHUB_OUTPUT"

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Setup Ko
        uses: ko-build/setup-ko@v0.8
        with:
          version: v0.17.1

      - name: Build and publish fga-sync image
        env:
          VERSION: ${{ steps.prepare.outputs.app_version }}
          GIT_COMMIT: ${{ github.sha }}
        run: |
          BUILD_TIME=$(date -u '+%Y-%m-%d_%H:%M:%S')
          export BUILD_TIME
          GIT_COMMIT=${GIT_COMMIT:0:7}
          export GIT_COMMIT
          ko build github.com/linuxfoundation/lfx-v2-fga-sync \
            -B \
            --platform linux/amd64,linux/arm64 \
            -t ${{ github.ref_name }} \
            -t ${{ steps.prepare.outputs.app_version }} \
            -t latest \
            --sbom spdx

  release-helm-chart:
    needs: publish
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      packages: write
      id-token: write
    outputs:
      digest: ${{ steps.publish-ghcr.outputs.digest }}
      image_name: ${{ steps.publish-ghcr.outputs.image_name }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Publish Chart to GHCR
        id: publish-ghcr
        # yamllint disable-line rule:line-length
        uses: linuxfoundation/lfx-public-workflows/.github/actions/helm-chart-oci-publisher@17e4144d7ba68f7c3e8c16eece5aed15fd7c2dc8 # main
        with:
          name: ${{ needs.publish.outputs.chart_name }}
          repository: ${{ github.repository }}/chart
          chart_version: ${{ needs.publish.outputs.chart_version }}
          app_version: ${{ needs.publish.outputs.app_version }}
          registry: ghcr.io
          registry_username: ${{ github.actor }}
          registry_password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
        with:
          cosign-release: "${{ env.COSIGN_VERSION }}"

      - name: Login to GitHub
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Sign the Helm chart in GHCR
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          cosign sign --yes '${{ steps.publish-ghcr.outputs.image_name }}@${{ steps.publish-ghcr.outputs.digest }}'

  create-ghcr-helm-provenance:
    needs:
      - release-helm-chart
    permissions:
      actions: read
      id-token: write
      packages: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ${{ needs.release-helm-chart.outputs.image_name }}
      digest: ${{ needs.release-helm-chart.outputs.digest }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}