chore(main): release 0.19.0 (#105) #37
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - 'v*' | |
| env: | |
| REGISTRY: ghcr.io | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write # For signing | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Set up Go | |
| uses: actions/setup-go@v5 | |
| with: | |
| go-version-file: go.mod | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Run GoReleaser | |
| uses: goreleaser/goreleaser-action@v6 | |
| with: | |
| version: '~> v2' | |
| args: release --clean | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Docker image name | |
| id: docker-image | |
| run: | | |
| OWNER="${GITHUB_REPOSITORY_OWNER,,}" | |
| echo "name=${{ env.REGISTRY }}/${OWNER}/paperclip-operator" >> $GITHUB_OUTPUT | |
| - name: Sign container images | |
| run: | | |
| IMAGE="${{ steps.docker-image.outputs.name }}" | |
| VERSION="${{ github.ref_name }}" | |
| VERSION="${VERSION#v}" | |
| MAJOR=$(echo "$VERSION" | cut -d. -f1) | |
| MINOR=$(echo "$VERSION" | cut -d. -f2) | |
| TAGS=("latest" "${{ github.ref_name }}" "${MAJOR}.${MINOR}") | |
| for tag in "${TAGS[@]}"; do | |
| echo "Signing ${IMAGE}:${tag}..." | |
| DIGEST=$(docker buildx imagetools inspect "${IMAGE}:${tag}" --format '{{json .Manifest}}' | jq -r '.digest') | |
| if [ -n "$DIGEST" ] && [ "$DIGEST" != "null" ]; then | |
| cosign sign --yes "${IMAGE}:${tag}@${DIGEST}" | |
| else | |
| echo "Warning: could not resolve digest for ${IMAGE}:${tag}, skipping" | |
| fi | |
| done | |
| - name: Generate SBOM | |
| uses: anchore/sbom-action@v0 | |
| with: | |
| image: ${{ steps.docker-image.outputs.name }}:${{ github.ref_name }} | |
| format: spdx-json | |
| output-file: sbom.spdx.json | |
| upload-release-assets: false | |
| - name: Attest SBOM | |
| run: | | |
| IMAGE="${{ steps.docker-image.outputs.name }}" | |
| DIGEST=$(docker buildx imagetools inspect "${IMAGE}:${{ github.ref_name }}" --format '{{json .Manifest}}' | jq -r '.digest') | |
| cosign attest --yes --predicate sbom.spdx.json --type spdxjson \ | |
| "${IMAGE}@${DIGEST}" | |
| - name: Upload SBOM to release | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: gh release upload "${{ github.ref_name }}" sbom.spdx.json --clobber | |
| - name: Generate and upload install.yaml | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| make kustomize | |
| IMAGE="${{ steps.docker-image.outputs.name }}:${{ github.ref_name }}" | |
| (cd config/manager && "$GITHUB_WORKSPACE/bin/kustomize" edit set image controller="$IMAGE") | |
| make build-installer | |
| gh release upload "${{ github.ref_name }}" dist/install.yaml --clobber | |
| - name: Publish release | |
| env: | |
| GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }} | |
| run: gh release edit "${{ github.ref_name }}" --draft=false | |
| helm-release: | |
| name: Helm Chart Release | |
| needs: release | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Lowercase owner name | |
| id: owner | |
| run: echo "name=${GITHUB_REPOSITORY_OWNER,,}" >> $GITHUB_OUTPUT | |
| - name: Install Helm | |
| uses: azure/setup-helm@v4 | |
| - name: Extract version | |
| id: version | |
| run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Package and push Helm chart to OCI registry | |
| run: | | |
| VERSION="${{ steps.version.outputs.version }}" | |
| OWNER="${{ steps.owner.outputs.name }}" | |
| helm package charts/paperclip-operator --version "${VERSION}" --app-version "${VERSION}" | |
| PUSH_OUT=$(helm push "paperclip-operator-${VERSION}.tgz" "oci://ghcr.io/${OWNER}/charts" 2>&1) | |
| echo "${PUSH_OUT}" | |
| DIGEST=$(echo "${PUSH_OUT}" | awk '/Digest:/ {print $2}') | |
| if [ -z "${DIGEST}" ]; then echo "::error::could not parse chart digest"; exit 1; fi | |
| cosign sign --yes "ghcr.io/${OWNER}/charts/paperclip-operator@${DIGEST}" |