lfx-v2-indexer-service/.github/workflows/ko-build-tag.yaml at main · mauriciozanettisalomao/lfx-v2-indexer-service · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
# Copyright The Linux Foundation and each contributor to LFX.
# SPDX-License-Identifier: MIT
---
name: Publish Tagged Release

on:
  push:
    tags:
      - v*

env:
  COSIGN_VERSION: v2.5.3
  HELM_VERSION: v3.18.4

permissions:
  contents: read

jobs:
  publish:
    name: Publish Tagged Release
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      app_version: ${{ steps.prepare.outputs.app_version }}
      chart_name: ${{ steps.prepare.outputs.chart_name }}
      chart_version: ${{ steps.prepare.outputs.chart_version }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Prepare versions and chart name
        id: prepare
        run: |
          set -euo pipefail
          APP_VERSION=$(echo ${{ github.ref_name }} | sed 's/v//g')
          CHART_NAME="$(yq '.name' charts/*/Chart.yaml)"
          CHART_VERSION="$(yq '.version' charts/*/Chart.yaml)"
          {
            echo "app_version=$APP_VERSION"
            echo "chart_name=$CHART_NAME"
            echo "chart_version=$CHART_VERSION"
          } >> "$GITHUB_OUTPUT"

      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Setup Ko
        uses: ko-build/setup-ko@v0.8
        with:
          version: v0.17.1

      - name: Build and publish indexer image
        run: |
          ko build github.com/linuxfoundation/lfx-v2-indexer-service/cmd/lfx-indexer \
            -B \
            --platform linux/amd64,linux/arm64 \
            -t ${{ github.ref_name }} \
            -t ${{ steps.prepare.outputs.app_version }} \
            -t latest \
            --sbom spdx

  release-helm-chart:
    needs: publish
    runs-on: ubuntu-24.04
    permissions:
      contents: write
      packages: write
      id-token: write
    outputs:
      digest: ${{ steps.publish-ghcr.outputs.digest }}
      image_name: ${{ steps.publish-ghcr.outputs.image_name }}
    steps:
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4

      - name: Publish Chart to GHCR
        id: publish-ghcr
        uses: linuxfoundation/lfx-public-workflows/.github/actions/helm-chart-oci-publisher@c465d6571fa0b8be9d551d902955164ea04a00af # main
        with:
          name: ${{ needs.publish.outputs.chart_name }}
          repository: ${{ github.repository }}/chart
          chart_version: ${{ needs.publish.outputs.chart_version }}
          app_version: ${{ needs.publish.outputs.app_version }}
          registry: ghcr.io
          registry_username: ${{ github.actor }}
          registry_password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159 # v3.9.2
        with:
          cosign-release: "${{ env.COSIGN_VERSION }}"

      - name: Login to GitHub
        uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Sign the Helm chart in GHCR
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          set -euo pipefail
          cosign sign --yes '${{ steps.publish-ghcr.outputs.image_name }}@${{ steps.publish-ghcr.outputs.digest }}'

  create-ghcr-helm-provenance:
    needs:
      - release-helm-chart
    permissions:
      actions: read
      id-token: write
      packages: write
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
    with:
      image: ${{ needs.release-helm-chart.outputs.image_name }}
      digest: ${{ needs.release-helm-chart.outputs.digest }}
      registry-username: ${{ github.actor }}
    secrets:
      registry-password: ${{ secrets.GITHUB_TOKEN }}