|
| 1 | +name: Build Service OCM Component |
| 2 | +on: |
| 3 | + workflow_dispatch: |
| 4 | + inputs: |
| 5 | + componentName: |
| 6 | + description: 'Service component name (e.g., github.com/platform-mesh/security-operator)' |
| 7 | + required: true |
| 8 | + type: string |
| 9 | + chartName: |
| 10 | + description: 'Chart name (e.g., security-operator)' |
| 11 | + required: true |
| 12 | + type: string |
| 13 | + chartVersion: |
| 14 | + description: 'Chart version (semver)' |
| 15 | + required: true |
| 16 | + type: string |
| 17 | + appVersion: |
| 18 | + description: 'App/image version (semver)' |
| 19 | + required: true |
| 20 | + type: string |
| 21 | + imageComponentName: |
| 22 | + description: 'Image component name suffix (defaults to repo name, e.g., security-operator)' |
| 23 | + required: false |
| 24 | + type: string |
| 25 | + |
| 26 | +permissions: |
| 27 | + packages: write |
| 28 | + contents: read |
| 29 | + |
| 30 | +jobs: |
| 31 | + service-component: |
| 32 | + runs-on: ubuntu-latest |
| 33 | + steps: |
| 34 | + - name: Check out the repo |
| 35 | + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 |
| 36 | + |
| 37 | + - name: Setup OCM CLI |
| 38 | + run: | |
| 39 | + REPO=${repo:=open-component-model/ocm} |
| 40 | + if [ -z "$version" -o "$version" == latest ]; then |
| 41 | + version="$(basename "$(curl -Ls -o /dev/null -w %{url_effective} https://github.com/$REPO/releases/latest)")" |
| 42 | + echo "Selecting latest version: $version" |
| 43 | + fi |
| 44 | + VERSION=${version#v} |
| 45 | + ARCHIVE_FILE="ocm-${VERSION}-linux-amd64.tar.gz" |
| 46 | + URL="https://github.com/$REPO/releases/download/v${VERSION}/$ARCHIVE_FILE" |
| 47 | + echo "Installing ocm-cli version $version from $REPO" |
| 48 | + curl -LsS -o ocm-cli.tgz "$URL" |
| 49 | + tar --overwrite -xvzf ocm-cli.tgz >/dev/null |
| 50 | + chmod a+x ocm |
| 51 | +
|
| 52 | + - name: Write OCM credentials file |
| 53 | + run: | |
| 54 | + cat <<EOF > $HOME/.ocmconfig |
| 55 | + type: generic.config.ocm.software/v1 |
| 56 | + configurations: |
| 57 | + - type: credentials.config.ocm.software |
| 58 | + consumers: |
| 59 | + - identity: |
| 60 | + type: OCIRegistry |
| 61 | + scheme: https |
| 62 | + hostname: ghcr.io |
| 63 | + pathprefix: platform-mesh |
| 64 | + credentials: |
| 65 | + - type: Credentials |
| 66 | + properties: |
| 67 | + username: github |
| 68 | + password: ${{ secrets.GITHUB_TOKEN }} |
| 69 | + EOF |
| 70 | +
|
| 71 | + - name: Determine image component name |
| 72 | + run: | |
| 73 | + # Use imageComponentName if provided, otherwise derive from chartName |
| 74 | + IMAGE_COMPONENT_NAME="${{ inputs.imageComponentName }}" |
| 75 | + if [ -z "$IMAGE_COMPONENT_NAME" ]; then |
| 76 | + IMAGE_COMPONENT_NAME="${{ inputs.chartName }}" |
| 77 | + fi |
| 78 | + echo "IMAGE_COMPONENT_NAME=$IMAGE_COMPONENT_NAME" >> $GITHUB_ENV |
| 79 | +
|
| 80 | + - name: Write service component constructor |
| 81 | + run: | |
| 82 | + cat <<'EOF' > service-component-constructor.yaml |
| 83 | + components: |
| 84 | + - name: "{{ .COMPONENT_NAME }}" |
| 85 | + version: "{{ .VERSION }}" |
| 86 | + provider: |
| 87 | + name: Platform Mesh Team |
| 88 | + componentReferences: |
| 89 | + - name: chart |
| 90 | + componentName: "github.com/platform-mesh/helm-charts/{{ .CHART_NAME }}" |
| 91 | + version: "{{ .VERSION }}" |
| 92 | + - name: image |
| 93 | + componentName: "github.com/platform-mesh/images/{{ .IMAGE_COMPONENT_NAME }}" |
| 94 | + version: "{{ .APP_VERSION }}" |
| 95 | + EOF |
| 96 | +
|
| 97 | + - name: Create OCM ComponentArchive |
| 98 | + run: | |
| 99 | + ocm_ctf=transport.ctf |
| 100 | + ./ocm add components -c --templater=go --file "$ocm_ctf" service-component-constructor.yaml -- \ |
| 101 | + COMPONENT_NAME=${{ inputs.componentName }} \ |
| 102 | + VERSION=${{ inputs.chartVersion }} \ |
| 103 | + CHART_NAME=${{ inputs.chartName }} \ |
| 104 | + IMAGE_COMPONENT_NAME=${{ env.IMAGE_COMPONENT_NAME }} \ |
| 105 | + APP_VERSION=${{ inputs.appVersion }} |
| 106 | +
|
| 107 | + - name: Sign OCM Component |
| 108 | + run: | |
| 109 | + printf '%s' "$OCM_SIGNING_PRIVATE_KEY" > /tmp/ocm-signing.priv |
| 110 | + ./ocm sign componentversion --signature platform-mesh --private-key /tmp/ocm-signing.priv transport.ctf |
| 111 | + rm -f /tmp/ocm-signing.priv |
| 112 | + env: |
| 113 | + OCM_SIGNING_PRIVATE_KEY: ${{ secrets.OCM_SIGNING_PRIVATE_KEY }} |
| 114 | + |
| 115 | + - name: Transfer to OCM registry |
| 116 | + run: ./ocm transfer ctf --overwrite transport.ctf "ghcr.io/platform-mesh" |
| 117 | + |
| 118 | + - name: Trigger aggregator build |
| 119 | + run: | |
| 120 | + gh workflow run ocm.yaml --repo "platform-mesh/ocm" |
| 121 | + env: |
| 122 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
0 commit comments