agent: Handle inplace CopyFile requests #62
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | Publish Kata Containers payload | |
| on: | |
| push: | |
| branches: | |
| - msft-main | |
| workflow_dispatch: | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| jobs: | |
| build-assets-amd64: | |
| permissions: | |
| contents: read | |
| packages: write # needed to push build artifacts to ghcr.io | |
| id-token: write # needed to sign images and generate attestations | |
| attestations: write # needed to generate artifact attestations | |
| uses: ./.github/workflows/build-kata-static-tarball-amd64.yaml | |
| with: | |
| commit-hash: ${{ github.sha }} | |
| push-to-registry: yes | |
| target-branch: ${{ github.ref_name }} | |
| secrets: | |
| QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }} | |
| build-assets-arm64: | |
| permissions: | |
| contents: read | |
| packages: write # needed to push build artifacts to ghcr.io | |
| id-token: write # needed to sign images and generate attestations | |
| attestations: write # needed to generate artifact attestations | |
| uses: ./.github/workflows/build-kata-static-tarball-arm64.yaml | |
| with: | |
| commit-hash: ${{ github.sha }} | |
| push-to-registry: yes | |
| target-branch: ${{ github.ref_name }} | |
| secrets: | |
| QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| KBUILD_SIGN_PIN: ${{ secrets.KBUILD_SIGN_PIN }} | |
| build-assets-s390x: | |
| permissions: | |
| contents: read | |
| packages: write # needed to push build artifacts to ghcr.io | |
| id-token: write # needed to sign images and generate attestations | |
| attestations: write # needed to generate artifact attestations | |
| uses: ./.github/workflows/build-kata-static-tarball-s390x.yaml | |
| with: | |
| commit-hash: ${{ github.sha }} | |
| push-to-registry: yes | |
| target-branch: ${{ github.ref_name }} | |
| secrets: | |
| QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| build-assets-ppc64le: | |
| permissions: | |
| contents: read | |
| packages: write # needed to push build artifacts to ghcr.io | |
| uses: ./.github/workflows/build-kata-static-tarball-ppc64le.yaml | |
| with: | |
| commit-hash: ${{ github.sha }} | |
| push-to-registry: yes | |
| target-branch: ${{ github.ref_name }} | |
| secrets: | |
| QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| publish-kata-deploy-image-amd64: | |
| needs: build-assets-amd64 | |
| permissions: | |
| contents: read | |
| packages: write # needed to push build artifacts to ghcr.io | |
| uses: ./.github/workflows/publish-kata-images.yaml | |
| with: | |
| commit-hash: ${{ github.sha }} | |
| registry: quay.io | |
| repo: kata-containers/kata-deploy-ci | |
| tag: kata-containers-latest-amd64 | |
| target-branch: ${{ github.ref_name }} | |
| runner: ubuntu-22.04 | |
| arch: amd64 | |
| image-kind: deploy | |
| secrets: | |
| QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| publish-kata-deploy-image-arm64: | |
| needs: build-assets-arm64 | |
| permissions: | |
| contents: read | |
| packages: write # needed to push build artifacts to ghcr.io | |
| uses: ./.github/workflows/publish-kata-images.yaml | |
| with: | |
| commit-hash: ${{ github.sha }} | |
| registry: quay.io | |
| repo: kata-containers/kata-deploy-ci | |
| tag: kata-containers-latest-arm64 | |
| target-branch: ${{ github.ref_name }} | |
| runner: ubuntu-24.04-arm | |
| arch: arm64 | |
| image-kind: deploy | |
| secrets: | |
| QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| publish-kata-deploy-image-s390x: | |
| needs: build-assets-s390x | |
| permissions: | |
| contents: read | |
| packages: write # needed to push build artifacts to ghcr.io | |
| uses: ./.github/workflows/publish-kata-images.yaml | |
| with: | |
| commit-hash: ${{ github.sha }} | |
| registry: quay.io | |
| repo: kata-containers/kata-deploy-ci | |
| tag: kata-containers-latest-s390x | |
| target-branch: ${{ github.ref_name }} | |
| runner: ubuntu-24.04-s390x | |
| arch: s390x | |
| image-kind: deploy | |
| secrets: | |
| QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| publish-kata-deploy-image-ppc64le: | |
| needs: build-assets-ppc64le | |
| permissions: | |
| contents: read | |
| packages: write # needed to push build artifacts to ghcr.io | |
| uses: ./.github/workflows/publish-kata-images.yaml | |
| with: | |
| commit-hash: ${{ github.sha }} | |
| registry: quay.io | |
| repo: kata-containers/kata-deploy-ci | |
| tag: kata-containers-latest-ppc64le | |
| target-branch: ${{ github.ref_name }} | |
| runner: ubuntu-24.04-ppc64le | |
| arch: ppc64le | |
| image-kind: deploy | |
| secrets: | |
| QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| publish-kata-monitor-image-amd64: | |
| needs: build-assets-amd64 | |
| permissions: | |
| contents: read | |
| packages: write # needed to push build artifacts to ghcr.io | |
| uses: ./.github/workflows/publish-kata-images.yaml | |
| with: | |
| commit-hash: ${{ github.sha }} | |
| registry: quay.io | |
| repo: kata-containers/kata-monitor-ci | |
| tag: kata-monitor-latest-amd64 | |
| target-branch: ${{ github.ref_name }} | |
| runner: ubuntu-22.04 | |
| arch: amd64 | |
| image-kind: monitor | |
| secrets: | |
| QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| publish-kata-monitor-image-arm64: | |
| needs: build-assets-arm64 | |
| permissions: | |
| contents: read | |
| packages: write # needed to push build artifacts to ghcr.io | |
| uses: ./.github/workflows/publish-kata-images.yaml | |
| with: | |
| commit-hash: ${{ github.sha }} | |
| registry: quay.io | |
| repo: kata-containers/kata-monitor-ci | |
| tag: kata-monitor-latest-arm64 | |
| target-branch: ${{ github.ref_name }} | |
| runner: ubuntu-24.04-arm | |
| arch: arm64 | |
| image-kind: monitor | |
| secrets: | |
| QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| publish-kata-monitor-image-s390x: | |
| needs: build-assets-s390x | |
| permissions: | |
| contents: read | |
| packages: write # needed to push build artifacts to ghcr.io | |
| uses: ./.github/workflows/publish-kata-images.yaml | |
| with: | |
| commit-hash: ${{ github.sha }} | |
| registry: quay.io | |
| repo: kata-containers/kata-monitor-ci | |
| tag: kata-monitor-latest-s390x | |
| target-branch: ${{ github.ref_name }} | |
| runner: ubuntu-24.04-s390x | |
| arch: s390x | |
| image-kind: monitor | |
| secrets: | |
| QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| publish-kata-monitor-image-ppc64le: | |
| needs: build-assets-ppc64le | |
| permissions: | |
| contents: read | |
| packages: write # needed to push build artifacts to ghcr.io | |
| uses: ./.github/workflows/publish-kata-images.yaml | |
| with: | |
| commit-hash: ${{ github.sha }} | |
| registry: quay.io | |
| repo: kata-containers/kata-monitor-ci | |
| tag: kata-monitor-latest-ppc64le | |
| target-branch: ${{ github.ref_name }} | |
| runner: ubuntu-24.04-ppc64le | |
| arch: ppc64le | |
| image-kind: monitor | |
| secrets: | |
| QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| publish-manifest: | |
| name: publish-manifest | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| packages: write # needed to push manifest images to ghcr.io | |
| needs: [publish-kata-deploy-image-amd64, publish-kata-deploy-image-arm64, publish-kata-deploy-image-s390x, publish-kata-deploy-image-ppc64le] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Login to Kata Containers quay.io | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| registry: quay.io | |
| username: ${{ vars.QUAY_DEPLOYER_USERNAME }} | |
| password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| - name: Push multi-arch manifest | |
| run: | | |
| ./tools/packaging/release/release.sh publish-multiarch-manifest | |
| env: | |
| KATA_DEPLOY_IMAGE_TAGS: "kata-containers-latest" | |
| KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-deploy-ci" | |
| publish-kata-monitor-manifest: | |
| name: publish-kata-monitor-manifest | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| contents: read | |
| packages: write # needed to push manifest images to ghcr.io | |
| needs: [publish-kata-monitor-image-amd64, publish-kata-monitor-image-arm64, publish-kata-monitor-image-s390x, publish-kata-monitor-image-ppc64le] | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Login to Kata Containers ghcr.io | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Login to Kata Containers quay.io | |
| uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0 | |
| with: | |
| registry: quay.io | |
| username: ${{ vars.QUAY_DEPLOYER_USERNAME }} | |
| password: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| - name: Push multi-arch monitor manifest | |
| run: | | |
| # kata-monitor has no job-dispatcher sidecar image, so opt out of the | |
| # kata-deploy-specific dispatcher manifest derivation. | |
| ./tools/packaging/release/release.sh publish-multiarch-manifest | |
| env: | |
| KATA_DEPLOY_IMAGE_TAGS: "kata-monitor-latest" | |
| KATA_DEPLOY_REGISTRIES: "quay.io/kata-containers/kata-monitor-ci ghcr.io/${{ github.repository_owner }}/kata-monitor-ci" | |
| KATA_DEPLOY_PUBLISH_JOB_DISPATCHER: "false" | |
| upload-helm-chart-tarball: | |
| name: upload-helm-chart-tarball | |
| needs: publish-manifest | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| packages: write # needed to push the helm chart to ghcr.io | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| - name: Install helm | |
| uses: azure/setup-helm@fe7b79cd5ee1e45176fcad797de68ecaf3ca4814 # v4.2.0 | |
| id: install | |
| - name: Login to the OCI registries | |
| env: | |
| QUAY_DEPLOYER_USERNAME: ${{ vars.QUAY_DEPLOYER_USERNAME }} | |
| QUAY_DEPLOYER_PASSWORD: ${{ secrets.QUAY_DEPLOYER_PASSWORD }} | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: | | |
| echo "${QUAY_DEPLOYER_PASSWORD}" | helm registry login quay.io --username "${QUAY_DEPLOYER_USERNAME}" --password-stdin | |
| echo "${GITHUB_TOKEN}" | helm registry login ghcr.io --username "${GITHUB_ACTOR}" --password-stdin | |
| - name: Push helm chart to the OCI registries | |
| run: | | |
| ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-helm-chart.sh \ | |
| quay.io/kata-containers/kata-deploy-ci \ | |
| kata-containers-latest \ | |
| quay.io/kata-containers/kata-deploy-charts \ | |
| 0.0.0-dev | |
| ./tools/packaging/kata-deploy/local-build/kata-deploy-build-and-upload-helm-chart.sh \ | |
| quay.io/kata-containers/kata-deploy-ci \ | |
| kata-containers-latest \ | |
| ghcr.io/kata-containers/kata-deploy-charts \ | |
| 0.0.0-dev |