mirror of
https://github.com/external-secrets/external-secrets.git
synced 2024-12-14 11:57:59 +00:00
47cca671be
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.2.0 to 4.2.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](d632683dd7...eef61447b9
)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
124 lines
4 KiB
YAML
124 lines
4 KiB
YAML
name: Create Release
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: 'version to release, e.g. v1.5.13'
|
|
required: true
|
|
default: 'v0.1.0'
|
|
source_ref:
|
|
description: 'source ref to publish from. E.g.: main or release-x.y'
|
|
required: true
|
|
default: 'main'
|
|
|
|
env:
|
|
IMAGE_NAME: ghcr.io/${{ github.repository }}
|
|
|
|
jobs:
|
|
release:
|
|
name: Create Release
|
|
runs-on: ubuntu-latest
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
|
with:
|
|
fetch-depth: 0
|
|
ref: ${{ github.event.inputs.source_ref }}
|
|
|
|
- name: Create Release
|
|
uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
|
|
with:
|
|
tag_name: ${{ github.event.inputs.version }}
|
|
target_commitish: ${{ github.event.inputs.source_ref }}
|
|
generate_release_notes: true
|
|
body: |
|
|
Image: `${{ env.IMAGE_NAME }}:${{ github.event.inputs.version }}`
|
|
Image: `${{ env.IMAGE_NAME }}:${{ github.event.inputs.version }}-ubi`
|
|
Image: `${{ env.IMAGE_NAME }}:${{ github.event.inputs.version }}-ubi-boringssl`
|
|
env:
|
|
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
|
|
|
- name: Configure Git
|
|
run: |
|
|
git config user.name "$GITHUB_ACTOR"
|
|
git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
|
|
|
|
- name: Update Docs
|
|
if: github.ref == 'refs/heads/main'
|
|
run: make docs.publish DOCS_VERSION=${{ github.event.inputs.version }} DOCS_ALIAS=latest
|
|
env:
|
|
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|
|
|
|
promote:
|
|
name: Promote Container Image
|
|
runs-on: ubuntu-latest
|
|
strategy:
|
|
matrix:
|
|
include:
|
|
- tag_suffix: "" # distroless image
|
|
- tag_suffix: "-ubi" # ubi image
|
|
- tag_suffix: "-ubi-boringssl" # ubi image
|
|
|
|
permissions:
|
|
id-token: write
|
|
contents: write
|
|
|
|
env:
|
|
SOURCE_TAG: ${{ github.event.inputs.source_ref }}${{ matrix.tag_suffix }}
|
|
RELEASE_TAG: ${{ github.event.inputs.version }}${{ matrix.tag_suffix }}
|
|
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Setup Go
|
|
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
|
|
id: setup-go
|
|
with:
|
|
go-version-file: "go.mod"
|
|
|
|
- name: Download Go modules
|
|
if: ${{ steps.setup-go.outputs.cache-hit != 'true' }}
|
|
run: go mod download
|
|
|
|
- name: Login to Docker
|
|
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ secrets.GHCR_USERNAME }}
|
|
password: ${{ secrets.GHCR_TOKEN }}
|
|
|
|
- name: Promote Container Image
|
|
run: make docker.promote
|
|
|
|
- name: Build release manifests
|
|
run: |
|
|
# temporarily patch the version so we generate manifests with the new version
|
|
yq e -i '.version = "${{ github.event.inputs.version }}"' ./deploy/charts/external-secrets/Chart.yaml
|
|
yq e -i '.appVersion = "${{ github.event.inputs.version }}"' ./deploy/charts/external-secrets/Chart.yaml
|
|
make manifests
|
|
|
|
- name: Sign promoted image
|
|
id: sign
|
|
uses: ./.github/actions/sign
|
|
with:
|
|
image-name: ${{ env.IMAGE_NAME }}
|
|
image-tag: ${{ env.RELEASE_TAG }}
|
|
GHCR_USERNAME: ${{ secrets.GHCR_USERNAME }}
|
|
GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }}
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Update Release
|
|
uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
|
|
with:
|
|
tag_name: ${{ github.event.inputs.version }}
|
|
files: |
|
|
provenance.${{ env.RELEASE_TAG }}.intoto.jsonl
|
|
sbom.${{ env.RELEASE_TAG }}.spdx.json
|
|
bin/deploy/manifests/external-secrets.yaml
|
|
env:
|
|
GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
|