chore(main): release 0.1.20 (#132) #20
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: ubuntu-latest | |
| steps: | |
| # Mint a short-lived App installation token. Required for the | |
| # release-undraft and SBOM-upload steps: GITHUB_TOKEN-issued events | |
| # don't fan out to downstream workflows. Replaces the long-lived | |
| # RELEASE_PLEASE_TOKEN PAT. | |
| - uses: actions/create-github-app-token@v3 | |
| id: app-token | |
| with: | |
| app-id: ${{ vars.RELEASE_BOT_APP_ID }} | |
| private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }} | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| cache: true | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to GitHub Container Registry | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Install Syft | |
| uses: anchore/sbom-action/download-syft@v0 | |
| - name: Run GoReleaser | |
| id: goreleaser | |
| uses: goreleaser/goreleaser-action@v7 | |
| with: | |
| distribution: goreleaser | |
| version: latest | |
| # --skip=validate bypasses the git-state checks (dirty tree, | |
| # tag-on-HEAD). dist/install.yaml is generated by the | |
| # `before:hooks` in .goreleaser.yaml, which runs after --clean. | |
| args: release --clean --skip=validate | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Compute image tags | |
| id: image_tags | |
| run: | | |
| TAG="${{ github.ref_name }}" | |
| MAJOR_MINOR=$(echo "$TAG" | sed 's/^v//' | cut -d. -f1,2) | |
| IMAGE="ghcr.io/paperclipinc/hermes-operator" | |
| { | |
| echo "image=${IMAGE}" | |
| echo "major_minor=${MAJOR_MINOR}" | |
| } >> "$GITHUB_OUTPUT" | |
| { | |
| echo "tags<<EOF" | |
| echo "${IMAGE}:${TAG}" | |
| echo "${IMAGE}:${MAJOR_MINOR}" | |
| echo "${IMAGE}:latest" | |
| echo "EOF" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Build and push container image (multi-arch) | |
| id: docker_build | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| file: Dockerfile | |
| push: true | |
| platforms: linux/amd64,linux/arm64 | |
| tags: ${{ steps.image_tags.outputs.tags }} | |
| provenance: true | |
| sbom: false | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| labels: | | |
| org.opencontainers.image.title=hermes-operator | |
| org.opencontainers.image.version=${{ github.ref_name }} | |
| org.opencontainers.image.revision=${{ github.sha }} | |
| org.opencontainers.image.source=https://github.com/paperclipinc/hermes-operator | |
| org.opencontainers.image.licenses=Apache-2.0 | |
| - name: Sign container image with cosign (keyless OIDC) | |
| env: | |
| COSIGN_EXPERIMENTAL: "true" | |
| IMAGE: ${{ steps.image_tags.outputs.image }} | |
| DIGEST: ${{ steps.docker_build.outputs.digest }} | |
| run: cosign sign --yes "${IMAGE}@${DIGEST}" | |
| - name: Generate SBOM for container image | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| image: ghcr.io/paperclipinc/hermes-operator:${{ github.ref_name }} | |
| artifact-name: sbom-${{ github.ref_name }}.spdx.json | |
| output-file: sbom-${{ github.ref_name }}.spdx.json | |
| - name: Attest SBOM with cosign | |
| env: | |
| COSIGN_EXPERIMENTAL: "true" | |
| IMAGE: ${{ steps.image_tags.outputs.image }} | |
| DIGEST: ${{ steps.docker_build.outputs.digest }} | |
| TAG: ${{ github.ref_name }} | |
| run: cosign attest --yes --predicate "sbom-${TAG}.spdx.json" --type spdxjson "${IMAGE}@${DIGEST}" | |
| - name: Upload SBOM to GitHub release | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| files: sbom-${{ github.ref_name }}.spdx.json | |
| token: ${{ steps.app-token.outputs.token }} | |
| - name: Publish release (undraft) | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| draft: false | |
| token: ${{ steps.app-token.outputs.token }} | |
| helm-release: | |
| name: Helm OCI Release | |
| runs-on: ubuntu-latest | |
| needs: release | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v7 | |
| - name: Log in to GitHub Container Registry | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install Helm | |
| uses: azure/setup-helm@v5 | |
| with: | |
| version: latest | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Package, push, and sign Helm chart | |
| run: | | |
| CHART_VERSION="${{ github.ref_name }}" | |
| CHART_VERSION="${CHART_VERSION#v}" | |
| # appVersion must be the bare version, matching what release-please | |
| # writes into Chart.yaml. The chart templates re-add the "v" to reach | |
| # the published image tag; passing the v-prefixed ref here produced | |
| # "vv<version>" (see #113). | |
| helm package charts/hermes-operator \ | |
| --version "${CHART_VERSION}" \ | |
| --app-version "${CHART_VERSION}" | |
| PUSH_OUT=$(helm push "hermes-operator-${CHART_VERSION}.tgz" oci://ghcr.io/paperclipinc/charts 2>&1) | |
| echo "${PUSH_OUT}" | |
| DIGEST=$(echo "${PUSH_OUT}" | awk '/Digest:/ {print $2}') | |
| if [ -z "${DIGEST}" ]; then echo "::error::could not parse chart digest"; exit 1; fi | |
| cosign sign --yes "ghcr.io/paperclipinc/charts/hermes-operator@${DIGEST}" |