🧹 make sure cnspec release works with versions containing 'v' (#874) #1173

Workflow file for this run

.github/workflows/publish.yaml at c7e0894

	name: Publish Container Images

	# This workflow uses actions that are not certified by GitHub.
	# They are provided by a third-party and are governed by
	# separate terms of service, privacy policy, and support
	# documentation.

	on:
	schedule:
	- cron: "43 9 * * *"
	push:
	branches: [main]
	# Publish semver tags as releases.
	tags: ["v..*"]

	env:
	# Use docker.io for Docker Hub if empty
	REGISTRY: ghcr.io
	# github.repository as <account>/<repo>
	IMAGE_NAME: ${{ github.repository }}
	RELEASE: ${{ github.ref_name }}

	jobs:
	debug-event:
	runs-on: ubuntu-latest
	steps:
	- name: Print workflow actor
	run: echo "${{ toJSON(github.actor) }}"
	- name: Print workflow event
	run: jq '.' $GITHUB_EVENT_PATH
	build-operator:
	name: Build operator binaries
	runs-on: ubuntu-latest
	permissions:
	contents: read
	packages: write
	# This is used to complete the identity challenge
	# with sigstore/fulcio when running outside of PRs.
	id-token: write

	strategy:
	matrix:
	os: [linux]
	arch: [amd64, arm64, arm]

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	- name: Import environment variables from file
	run: cat ".github/env" >> $GITHUB_ENV

	- uses: actions/setup-go@v4
	with:
	go-version: "${{ env.golang-version }}"
	cache: true

	# Install the cosign tool except on PR
	# https://github.com/sigstore/cosign-installer
	- name: Install cosign
	uses: sigstore/cosign-installer@v3

	# Login against a Docker registry except on PR
	# https://github.com/docker/login-action
	- name: Log into registry ${{ env.REGISTRY }}
	uses: docker/login-action@v3
	with:
	registry: ${{ env.REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	# Extract metadata (tags, labels) for Docker
	# https://github.com/docker/metadata-action
	- name: Extract Docker metadata
	id: meta
	uses: docker/metadata-action@v4
	with:
	images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
	tags: \|
	type=schedule,pattern=main
	type=ref,event=branch
	type=ref,event=tag
	type=ref,event=pr
	flavor: \|
	suffix=-${{ matrix.arch }},onlatest=true

	# Extract metadata (tags, labels) for Docker
	# https://github.com/docker/metadata-action
	- name: Extract Docker metadata (without suffixes)
	id: meta_clean
	uses: docker/metadata-action@v4
	with:
	images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
	tags: \|
	type=schedule,pattern=main
	type=ref,event=branch
	type=ref,event=tag
	type=ref,event=pr

	- name: Build binaries
	run: VERSION=${{ steps.meta_clean.outputs.version }} TARGET_OS=${{ matrix.os }} TARGET_ARCH=${{ matrix.arch }} make build

	# Build and push Docker image with Buildx
	# https://github.com/docker/build-push-action
	- name: Build and push operator image
	id: build-and-push-operator
	uses: docker/build-push-action@v5
	with:
	context: .
	platforms: ${{ matrix.os }}/${{ matrix.arch }}
	push: true
	labels: ${{ steps.meta.outputs.labels }}
	tags: ${{ steps.meta.outputs.tags }}

	- name: Scan Image
	uses: mondoohq/actions/docker-image@main
	env:
	MONDOO_CONFIG_BASE64: ${{ secrets.MONDOO_CLIENT }}
	with:
	image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push-operator.outputs.digest }}

	# Sign the resulting Docker image digest except on PRs.
	# This will only write to the public Rekor transparency log when the Docker
	# repository is public to avoid leaking data. If you would like to publish
	# transparency data even for private images, pass --force to cosign below.
	# https://github.com/sigstore/cosign
	- name: Sign the published Docker image
	# This step uses the identity token to provision an ephemeral certificate
	# against the sigstore community Fulcio instance.
	run: cosign sign -y ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-and-push-operator.outputs.digest }}

	push-virtual-tag:
	name: Push multi-platform virtual tag
	runs-on: ubuntu-latest
	needs:
	- build-operator

	permissions:
	contents: read
	packages: write
	# This is used to complete the identity challenge
	# with sigstore/fulcio when running outside of PRs.
	id-token: write

	steps:
	- name: Checkout repository
	uses: actions/checkout@v4

	# Install the cosign tool except on PR
	# https://github.com/sigstore/cosign-installer
	- name: Install cosign
	uses: sigstore/cosign-installer@v3

	# Login against a Docker registry except on PR
	# https://github.com/docker/login-action
	- name: Log into registry ${{ env.REGISTRY }}
	uses: docker/login-action@v3
	with:
	registry: ${{ env.REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	# Extract metadata (tags, labels) for Docker
	# https://github.com/docker/metadata-action
	- name: Extract Docker metadata
	id: meta
	uses: docker/metadata-action@v4
	with:
	images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

	- name: Push multi-platform virtual tag and sign
	run: bash scripts/push-virtual-tag.sh
	env:
	TAGS: ${{ steps.meta.outputs.tags }}
	CPU_ARCHS: amd64 arm64 arm

	build-bundle:
	if: startsWith(github.ref, 'refs/tags/v')
	needs:
	- push-virtual-tag
	runs-on: ubuntu-latest
	permissions:
	contents: read
	packages: write
	# This is used to complete the identity challenge
	# with sigstore/fulcio when running outside of PRs.
	id-token: write
	steps:
	- uses: actions/checkout@v4
	- name: Import environment variables from file
	run: cat ".github/env" >> $GITHUB_ENV
	- name: Install Go
	uses: actions/setup-go@v4
	with:
	go-version: "${{ env.golang-version }}"

	# Install the cosign tool except on PR
	# https://github.com/sigstore/cosign-installer
	- name: Install cosign
	uses: sigstore/cosign-installer@v3

	- name: Set up QEMU
	uses: docker/setup-qemu-action@v3
	with:
	image: tonistiigi/binfmt:latest
	platforms: amd64,arm

	# Workaround: https://github.com/docker/build-push-action/issues/461
	- name: Setup Docker buildx
	uses: docker/setup-buildx-action@v3

	# Login against a Docker registry except on PR
	# https://github.com/docker/login-action
	- name: Log into registry ${{ env.REGISTRY }}
	uses: docker/login-action@v3
	with:
	registry: ${{ env.REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Make bundle
	id: make-bundle
	run: \|
	export ARCH=$(case $(uname -m) in x86_64) echo -n amd64 ;; aarch64) echo -n arm64 ;; *) echo -n $(uname -m) ;; esac)
	export OS=$(uname \| awk '{print tolower($0)}')
	export OPERATOR_SDK_DL_URL=https://github.com/operator-framework/operator-sdk/releases/download/${{ env.operator-sdk-version }}
	curl -LO ${OPERATOR_SDK_DL_URL}/operator-sdk_${OS}_${ARCH}
	gpg --keyserver keyserver.ubuntu.com --recv-keys 052996E2A20B5C7E
	curl -LO ${OPERATOR_SDK_DL_URL}/checksums.txt
	curl -LO ${OPERATOR_SDK_DL_URL}/checksums.txt.asc
	gpg -u "Operator SDK (release) <[email protected]>" --verify checksums.txt.asc
	grep operator-sdk_${OS}_${ARCH} checksums.txt \| sha256sum -c -
	chmod +x operator-sdk_${OS}_${ARCH} && sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk
	make bundle IMG='${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ env.RELEASE }}' VERSION='${{ env.RELEASE }}'

	# Extract metadata (tags, labels) for Docker
	# https://github.com/docker/metadata-action
	- name: Extract Docker metadata
	id: meta-bundle
	uses: docker/metadata-action@v4
	with:
	images: "${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-bundle"

	# Build and push Docker image bundle with Buildx
	- name: Build and push bundle image
	id: build-and-push-bundle
	uses: docker/build-push-action@v5
	with:
	context: .
	file: bundle.Dockerfile
	platforms: linux/amd64,linux/arm/v7,linux/arm64
	push: true
	labels: ${{ steps.meta-bundle.outputs.labels }}
	tags: ${{ steps.meta-bundle.outputs.tags }}

	# Sign the resulting Docker image digest except on PRs.
	# This will only write to the public Rekor transparency log when the Docker
	# repository is public to avoid leaking data. If you would like to publish
	# transparency data even for private images, pass --force to cosign below.
	# https://github.com/sigstore/cosign
	- name: Sign the published Docker image
	# This step uses the identity token to provision an ephemeral certificate
	# against the sigstore community Fulcio instance.
	run: cosign sign -y ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}-bundle@${{ steps.build-and-push-bundle.outputs.digest }}

	# run olm e2e tests
	run-olm-e2e:
	name: OLM integration tests
	if: startsWith(github.ref, 'refs/tags/v')
	needs:
	- build-bundle
	runs-on: ubuntu-latest

	strategy:
	fail-fast: false
	matrix:
	k8s-version: [v1.24.16, v1.25.12, v1.26.7, v1.27.4]

	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0 # fetch is needed for "git tag --list" in the Makefile
	- name: Import environment variables from file
	run: cat ".github/env" >> $GITHUB_ENV

	- name: Install Go
	uses: actions/setup-go@v4
	with:
	go-version: "${{ env.golang-version }}"
	- name: Start minikube
	uses: medyagh/setup-minikube@master
	with:
	memory: 4000m
	kubernetes-version: ${{ matrix.k8s-version }}

	- name: Install operator-sdk
	id: operator-sdk
	run: \|
	export ARCH=$(case $(uname -m) in x86_64) echo -n amd64 ;; aarch64) echo -n arm64 ;; *) echo -n $(uname -m) ;; esac)
	export OS=$(uname \| awk '{print tolower($0)}')
	export OPERATOR_SDK_DL_URL=https://github.com/operator-framework/operator-sdk/releases/download/${{ env.operator-sdk-version }}
	curl -LO ${OPERATOR_SDK_DL_URL}/operator-sdk_${OS}_${ARCH}
	gpg --keyserver keyserver.ubuntu.com --recv-keys 052996E2A20B5C7E
	curl -LO ${OPERATOR_SDK_DL_URL}/checksums.txt
	curl -LO ${OPERATOR_SDK_DL_URL}/checksums.txt.asc
	gpg -u "Operator SDK (release) <[email protected]>" --verify checksums.txt.asc
	grep operator-sdk_${OS}_${ARCH} checksums.txt \| sha256sum -c -
	chmod +x operator-sdk_${OS}_${ARCH} && sudo mv operator-sdk_${OS}_${ARCH} /usr/local/bin/operator-sdk

	# Now that dependencies are cached the tests start almost immediately after minikube has started
	# this makes tests fail occasionally. This sleep gives the runner some time to become more stable
	# before the test execution starts.
	- name: Wait a bit for the runner to become more stable
	run: kubectl -n kube-system wait --for=condition=Ready pods --all --timeout=60s

	- name: Install Mondoo operator using OLM
	run: \|
	operator-sdk olm install
	kubectl -n olm wait --for=condition=Ready pods --all --timeout=60s
	kubectl create ns mondoo-operator
	operator-sdk run bundle ghcr.io/${{ github.repository }}-bundle:${{ github.ref_name }} --namespace mondoo-operator --timeout 3m0s

	- name: Gather running pods
	if: failure()
	run: \|
	kubectl get pods -A
	mkdir -p tests/integration/_output
	kubectl get pods -n mondoo-operator -o yaml >> tests/integration/_output/mondoo-pods.log
	kubectl logs -n olm deployment/olm-operator >> tests/integration/_output/olm-operator-pods.log

	- name: Store creds
	run: echo ${{ secrets.MONDOO_CLIENT }} \| base64 -d > creds.json

	- name: Extract Docker metadata
	id: meta
	uses: docker/metadata-action@v4
	with:
	images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

	- name: Run integration tests
	env:
	MONDOO_SERVICE_ACCOUNT_EDGE: ${{ secrets.MONDOO_SERVICE_ACCOUNT_EDGE }}
	run: EXTERNAL_INSTALLATION=1 VERSION=${{ steps.meta.outputs.version }} make test/integration/ci

	- name: Clean up
	run: \|
	operator-sdk cleanup mondoo-operator --namespace mondoo-operator
	operator-sdk olm uninstall

	- name: Upload test logs artifact
	uses: actions/upload-artifact@v3
	if: failure()
	with:
	name: olm-test-logs-${{ matrix.k8s-version }}
	path: /home/runner/work/mondoo-operator/mondoo-operator/tests/integration/_output/

	- uses: dorny/test-reporter@v1
	if: failure() \|\| success()
	with:
	name: Report OLM test results
	path: '*.xml' # Path to test results
	reporter: java-junit # Format of test results

	# publish kubectl manifests
	run-release-manifests:
	if: startsWith(github.ref, 'refs/tags/v')
	uses: ./.github/workflows/release-manifests.yaml
	needs:
	- push-virtual-tag
	# this should ensure the manifest is tagged latest, which is required for the install automation
	- release-helm

	# publish helm chart after the release of container images is complete
	run-helm-tests:
	name: Run helm integration tests
	if: startsWith(github.ref, 'refs/tags/v')
	needs:
	- push-virtual-tag
	runs-on: ubuntu-latest

	permissions:
	contents: read
	checks: write
	statuses: write

	strategy:
	fail-fast: false
	matrix:
	k8s-version: [v1.24.16, v1.25.12, v1.26.7, v1.27.4]

	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Import environment variables from file
	run: cat ".github/env" >> $GITHUB_ENV

	- name: Install Go
	uses: actions/setup-go@v4
	with:
	go-version: "${{ env.golang-version }}"

	- name: Start minikube
	uses: medyagh/setup-minikube@master
	with:
	memory: 4000m
	kubernetes-version: ${{ matrix.k8s-version }}

	- name: Install Helm
	uses: azure/setup-helm@v3
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	id: install

	- name: Store creds
	run: echo ${{ secrets.MONDOO_CLIENT }} \| base64 -d > creds.json

	- name: Extract Docker metadata
	id: meta
	uses: docker/metadata-action@v4
	with:
	images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

	- name: Install Mondoo Operator Helm chart
	run: helm install mondoo-operator charts/mondoo-operator -n mondoo-operator --create-namespace --wait

	# Now that dependencies are cached the tests start almost immediately after minikube has started
	# this makes tests fail occasionally. This sleep gives the runner some time to become more stable
	# before the test execution starts.
	- name: Wait a bit for the runner to become more stable
	run: kubectl -n kube-system wait --for=condition=Ready pods --all --timeout=60s

	- name: Run integration tests
	env:
	MONDOO_SERVICE_ACCOUNT_EDGE: ${{ secrets.MONDOO_SERVICE_ACCOUNT_EDGE }}
	run: EXTERNAL_INSTALLATION=1 VERSION=${{ steps.meta.outputs.version }} make test/integration/ci

	- name: Upload test logs artifact
	uses: actions/upload-artifact@v3
	if: failure()
	with:
	name: helm-test-logs-${{ matrix.k8s-version }}
	path: /home/runner/work/mondoo-operator/mondoo-operator/tests/integration/_output/

	- uses: dorny/test-reporter@v1
	if: failure() \|\| success()
	with:
	name: Report Helm test results
	path: '*.xml' # Path to test results
	reporter: java-junit # Format of test results

	release-helm:
	name: Release helm chart
	needs:
	- run-helm-tests
	runs-on: ubuntu-latest

	permissions:
	contents: write

	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0

	- name: Configure Git
	run: \|
	git config user.name "$GITHUB_ACTOR"
	git config user.email "[email protected]"

	- name: Install Helm
	uses: azure/setup-helm@v3
	with:
	token: ${{ secrets.GITHUB_TOKEN }}
	id: install

	- name: Run chart-releaser
	# switch back to helm/chart-releaser-action when #60 is fixed
	# https://github.com/helm/chart-releaser-action/issues/60
	uses: luisico/chart-releaser-action@on-tags
	env:
	CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🧹 make sure cnspec release works with versions containing 'v' (#874) #1173

Workflow file

🧹 make sure cnspec release works with versions containing 'v' (#874) #1173

Jobs

Run details

Workflow file for this run