paperclip-operator/.github/workflows/release.yaml at 7ae02de710d871c8a6b266a2f6d4e5e90cec7f05 · paperclipinc/paperclip-operator · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
name: Release

on:
  push:
    tags:
      - 'v*'

env:
  REGISTRY: ghcr.io

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
      id-token: write  # For signing

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Set up Go
        uses: actions/setup-go@v5
        with:
          go-version-file: go.mod

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Install Cosign
        uses: sigstore/cosign-installer@v3

      - name: Run GoReleaser
        uses: goreleaser/goreleaser-action@v6
        with:
          version: '~> v2'
          args: release --clean
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Docker image name
        id: docker-image
        run: |
          OWNER="${GITHUB_REPOSITORY_OWNER,,}"
          echo "name=${{ env.REGISTRY }}/${OWNER}/k8s-operator" >> $GITHUB_OUTPUT

      - name: Sign container images
        run: |
          IMAGE="${{ steps.docker-image.outputs.name }}"
          VERSION="${{ github.ref_name }}"
          VERSION="${VERSION#v}"
          MAJOR=$(echo "$VERSION" | cut -d. -f1)
          MINOR=$(echo "$VERSION" | cut -d. -f2)
          TAGS=("latest" "${{ github.ref_name }}" "${MAJOR}.${MINOR}")

          for tag in "${TAGS[@]}"; do
            echo "Signing ${IMAGE}:${tag}..."
            DIGEST=$(docker buildx imagetools inspect "${IMAGE}:${tag}" --format '{{json .Manifest}}' | jq -r '.digest')
            if [ -n "$DIGEST" ] && [ "$DIGEST" != "null" ]; then
              cosign sign --yes "${IMAGE}:${tag}@${DIGEST}"
            else
              echo "Warning: could not resolve digest for ${IMAGE}:${tag}, skipping"
            fi
          done

      - name: Generate SBOM
        uses: anchore/sbom-action@v0
        with:
          image: ${{ steps.docker-image.outputs.name }}:${{ github.ref_name }}
          format: spdx-json
          output-file: sbom.spdx.json
          upload-release-assets: false

      - name: Attest SBOM
        run: |
          IMAGE="${{ steps.docker-image.outputs.name }}"
          DIGEST=$(docker buildx imagetools inspect "${IMAGE}:${{ github.ref_name }}" --format '{{json .Manifest}}' | jq -r '.digest')
          cosign attest --yes --predicate sbom.spdx.json --type spdxjson \
            "${IMAGE}@${DIGEST}"

      - name: Upload SBOM to release
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: gh release upload "${{ github.ref_name }}" sbom.spdx.json --clobber

      - name: Publish release
        env:
          GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
        run: gh release edit "${{ github.ref_name }}" --draft=false

  helm-release:
    name: Helm Chart Release
    needs: release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Lowercase owner name
        id: owner
        run: echo "name=${GITHUB_REPOSITORY_OWNER,,}" >> $GITHUB_OUTPUT

      - name: Install Helm
        uses: azure/setup-helm@v4

      - name: Extract version
        id: version
        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT

      - name: Login to GHCR
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Package and push Helm chart to OCI registry
        run: |
          VERSION="${{ steps.version.outputs.version }}"
          helm package charts/paperclip-operator --version "${VERSION}" --app-version "${VERSION}"
          helm push "paperclip-operator-${VERSION}.tgz" oci://ghcr.io/${{ steps.owner.outputs.name }}/charts