v0.13.0 #26
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: OperatorHub Submission | |
| on: | |
| release: | |
| types: [published] | |
| workflow_dispatch: | |
| inputs: | |
| tag: | |
| description: 'Release tag (e.g. v0.1.0)' | |
| required: true | |
| jobs: | |
| submit: | |
| name: Submit to OperatorHub | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Resolve tag | |
| id: version | |
| run: | | |
| TAG="${{ github.event.inputs.tag || github.ref_name }}" | |
| VERSION="${TAG#v}" | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "tag=$TAG" >> $GITHUB_OUTPUT | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ steps.version.outputs.tag }} | |
| - name: Prepare bundle | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| TAG="${{ steps.version.outputs.tag }}" | |
| BUNDLE_DIR="submission/operators/paperclip-operator/${VERSION}" | |
| # Resolve the published image to an immutable digest reference so the | |
| # submitted bundle is pinned (OLM best practice). Fall back to the | |
| # floating tag if the digest cannot be resolved (e.g. registry hiccup). | |
| IMG="ghcr.io/paperclipinc/paperclip-operator" | |
| DIGEST="$(docker buildx imagetools inspect "${IMG}:${TAG}" --format '{{ .Manifest.Digest }}' 2>/dev/null || true)" | |
| if [ -n "${DIGEST}" ]; then IMG_REF="${IMG}@${DIGEST}"; else IMG_REF="${IMG}:${TAG}"; fi | |
| echo "Pinning image to: ${IMG_REF}" | |
| mkdir -p "${BUNDLE_DIR}/manifests" "${BUNDLE_DIR}/metadata" | |
| # Copy and version the CSV | |
| sed \ | |
| -e "s/paperclip-operator\.v[0-9]\+\.[0-9]\+\.[0-9]\+/paperclip-operator.v${VERSION}/g" \ | |
| -e "s|ghcr.io/paperclipinc/paperclip-operator:v[0-9]\+\.[0-9]\+\.[0-9]\+|${IMG_REF}|g" \ | |
| -e "s/createdAt: .*/createdAt: \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"/" \ | |
| -e "s/^ version: [0-9]\+\.[0-9]\+\.[0-9]\+/ version: ${VERSION}/" \ | |
| bundle/manifests/paperclip-operator.v*.clusterserviceversion.yaml \ | |
| > "${BUNDLE_DIR}/manifests/paperclip-operator.v${VERSION}.clusterserviceversion.yaml" | |
| # Copy all CRD manifests and metadata as-is. The bundle ships every | |
| # CRD the operator's controllers watch (instances, | |
| # paperclipclusterdefaults, paperclipselfconfigs); an OLM install that | |
| # is missing any of them crashes on cache sync. Prefer the curated | |
| # bundle/manifests/ copies, falling back to config/crd/bases/. | |
| if ls bundle/manifests/paperclip.inc_*.yaml >/dev/null 2>&1; then | |
| cp bundle/manifests/paperclip.inc_*.yaml "${BUNDLE_DIR}/manifests/" | |
| else | |
| cp config/crd/bases/paperclip.inc_*.yaml "${BUNDLE_DIR}/manifests/" | |
| fi | |
| cp bundle/metadata/annotations.yaml "${BUNDLE_DIR}/metadata/" | |
| echo "Bundle prepared at ${BUNDLE_DIR}:" | |
| find "${BUNDLE_DIR}" -type f | |
| - name: Fork and submit to community-operators | |
| env: | |
| GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }} | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| BRANCH="paperclip-operator-v${VERSION}" | |
| # Configure gh as git credential helper so git push works with the PAT | |
| gh auth setup-git | |
| # Clone the community-operators repo (fork is auto-created by gh). | |
| # --remote is incompatible with passing a repo argument in modern gh; | |
| # gh repo fork --clone already sets up origin=fork and upstream=canonical | |
| # in the new clone. | |
| gh repo fork k8s-operatorhub/community-operators --clone=true -- community-operators | |
| cd community-operators | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| # Sync fork with upstream to avoid stale-branch CI failures | |
| git fetch upstream main | |
| git reset --hard upstream/main | |
| git checkout -b "${BRANCH}" | |
| # Copy prepared bundle | |
| mkdir -p operators/paperclip-operator | |
| cp -r ../submission/operators/paperclip-operator/${VERSION} operators/paperclip-operator/${VERSION} | |
| # Write the operator-level ci.yaml so framework-automation auto-applies | |
| # the `authorized-changes` label on our bundle PRs. Without this, each | |
| # PR waits for a human maintainer review (typically ~hours to a day). | |
| # Idempotent: if the file already exists upstream with the same content, | |
| # git will see no diff. | |
| # Seed ci.yaml only when the catalog has none. Overwriting it every | |
| # release is a privileged change that withholds authorized-changes and | |
| # blocks auto-merge. | |
| if [ ! -f operators/paperclip-operator/ci.yaml ]; then | |
| cat > operators/paperclip-operator/ci.yaml <<'CI_YAML' | |
| --- | |
| # Authorized reviewers for paperclip-operator PRs. | |
| # A PR authored by any user listed here gets the `authorized-changes` label | |
| # applied automatically by framework-automation, which enables the PR to | |
| # auto-merge once framework checks pass. | |
| reviewers: | |
| - stubbi | |
| CI_YAML | |
| fi | |
| git add "operators/paperclip-operator/${VERSION}" operators/paperclip-operator/ci.yaml | |
| git commit -s -m "operator paperclip-operator (${VERSION})" | |
| git push --force origin "${BRANCH}" | |
| # Create PR or update existing one | |
| FORK_OWNER=$(gh api user --jq '.login') | |
| if ! gh pr view "${FORK_OWNER}:${BRANCH}" --repo k8s-operatorhub/community-operators --json state --jq '.state' 2>/dev/null | grep -q OPEN; then | |
| gh pr create \ | |
| --repo k8s-operatorhub/community-operators \ | |
| --head "${FORK_OWNER}:${BRANCH}" \ | |
| --title "operator paperclip-operator (${VERSION})" \ | |
| --body "$(cat <<EOF | |
| ### Update to paperclip-operator | |
| **Version:** ${VERSION} | |
| **Operator:** [Paperclip Kubernetes Operator](https://github.com/paperclipinc/paperclip-operator) | |
| #### Changes | |
| See [release notes](https://github.com/paperclipinc/paperclip-operator/releases/tag/v${VERSION}). | |
| #### Testing | |
| - CI tests pass on the source repository | |
| - Container image is published and signed at \`ghcr.io/paperclipinc/paperclip-operator:v${VERSION}\` | |
| EOF | |
| )" | |
| else | |
| echo "PR already exists for ${FORK_OWNER}:${BRANCH} - branch was force-pushed with updated content" | |
| fi | |
| submit-redhat: | |
| name: Submit to RedHat community-operators-prod | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Resolve tag | |
| id: version | |
| run: | | |
| TAG="${{ github.event.inputs.tag || github.ref_name }}" | |
| VERSION="${TAG#v}" | |
| echo "version=$VERSION" >> $GITHUB_OUTPUT | |
| echo "tag=$TAG" >> $GITHUB_OUTPUT | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ steps.version.outputs.tag }} | |
| - name: Prepare bundle | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| TAG="${{ steps.version.outputs.tag }}" | |
| BUNDLE_DIR="submission/operators/paperclip-operator/${VERSION}" | |
| # Resolve the published image to an immutable digest reference so the | |
| # submitted bundle is pinned (OLM best practice). Fall back to the | |
| # floating tag if the digest cannot be resolved (e.g. registry hiccup). | |
| IMG="ghcr.io/paperclipinc/paperclip-operator" | |
| DIGEST="$(docker buildx imagetools inspect "${IMG}:${TAG}" --format '{{ .Manifest.Digest }}' 2>/dev/null || true)" | |
| if [ -n "${DIGEST}" ]; then IMG_REF="${IMG}@${DIGEST}"; else IMG_REF="${IMG}:${TAG}"; fi | |
| echo "Pinning image to: ${IMG_REF}" | |
| mkdir -p "${BUNDLE_DIR}/manifests" "${BUNDLE_DIR}/metadata" | |
| # Copy and version the CSV | |
| sed \ | |
| -e "s/paperclip-operator\.v[0-9]\+\.[0-9]\+\.[0-9]\+/paperclip-operator.v${VERSION}/g" \ | |
| -e "s|ghcr.io/paperclipinc/paperclip-operator:v[0-9]\+\.[0-9]\+\.[0-9]\+|${IMG_REF}|g" \ | |
| -e "s/createdAt: .*/createdAt: \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"/" \ | |
| -e "s/^ version: [0-9]\+\.[0-9]\+\.[0-9]\+/ version: ${VERSION}/" \ | |
| bundle/manifests/paperclip-operator.v*.clusterserviceversion.yaml \ | |
| > "${BUNDLE_DIR}/manifests/paperclip-operator.v${VERSION}.clusterserviceversion.yaml" | |
| # Copy all CRD manifests and metadata as-is. The bundle ships every | |
| # CRD the operator's controllers watch (instances, | |
| # paperclipclusterdefaults, paperclipselfconfigs); an OLM install that | |
| # is missing any of them crashes on cache sync. Prefer the curated | |
| # bundle/manifests/ copies, falling back to config/crd/bases/. | |
| if ls bundle/manifests/paperclip.inc_*.yaml >/dev/null 2>&1; then | |
| cp bundle/manifests/paperclip.inc_*.yaml "${BUNDLE_DIR}/manifests/" | |
| else | |
| cp config/crd/bases/paperclip.inc_*.yaml "${BUNDLE_DIR}/manifests/" | |
| fi | |
| cp bundle/metadata/annotations.yaml "${BUNDLE_DIR}/metadata/" | |
| echo "Bundle prepared at ${BUNDLE_DIR}:" | |
| find "${BUNDLE_DIR}" -type f | |
| - name: Fork and submit to community-operators-prod | |
| env: | |
| GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }} | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| BRANCH="paperclip-operator-v${VERSION}" | |
| # Configure gh as git credential helper so git push works with the PAT | |
| gh auth setup-git | |
| # Clone the community-operators-prod repo (fork is auto-created by gh). | |
| # gh repo fork --clone already sets up origin=fork and upstream=canonical | |
| # in the new clone. | |
| gh repo fork redhat-openshift-ecosystem/community-operators-prod --clone=true -- community-operators-prod | |
| cd community-operators-prod | |
| git config user.name "github-actions[bot]" | |
| git config user.email "41898282+github-actions[bot]@users.noreply.github.com" | |
| # Sync fork with upstream to avoid stale-branch CI failures | |
| git fetch upstream main | |
| git reset --hard upstream/main | |
| git checkout -b "${BRANCH}" | |
| # Copy prepared bundle. RedHat uses a different review model, so we do | |
| # NOT write a ci.yaml here (unlike the k8s community-operators job). | |
| mkdir -p operators/paperclip-operator | |
| cp -r ../submission/operators/paperclip-operator/${VERSION} operators/paperclip-operator/${VERSION} | |
| git add "operators/paperclip-operator/${VERSION}" | |
| git commit -s -m "operator paperclip-operator (${VERSION})" | |
| git push --force origin "${BRANCH}" | |
| # Create PR or update existing one | |
| FORK_OWNER=$(gh api user --jq '.login') | |
| if ! gh pr view "${FORK_OWNER}:${BRANCH}" --repo redhat-openshift-ecosystem/community-operators-prod --json state --jq '.state' 2>/dev/null | grep -q OPEN; then | |
| gh pr create \ | |
| --repo redhat-openshift-ecosystem/community-operators-prod \ | |
| --head "${FORK_OWNER}:${BRANCH}" \ | |
| --title "operator paperclip-operator (${VERSION})" \ | |
| --body "$(cat <<EOF | |
| ### Update to paperclip-operator | |
| **Version:** ${VERSION} | |
| **Operator:** [Paperclip Kubernetes Operator](https://github.com/paperclipinc/paperclip-operator) | |
| #### Changes | |
| See [release notes](https://github.com/paperclipinc/paperclip-operator/releases/tag/v${VERSION}). | |
| #### Testing | |
| - CI tests pass on the source repository | |
| - Container image is published and signed at \`ghcr.io/paperclipinc/paperclip-operator:v${VERSION}\` | |
| EOF | |
| )" | |
| else | |
| echo "PR already exists for ${FORK_OWNER}:${BRANCH} - branch was force-pushed with updated content" | |
| fi |