Skip to content

Commit 2077e3d

Browse files
andrpacandrpac
committed
feat: dirty commit with new promote pipeline
1 parent e241659 commit 2077e3d

File tree

2 files changed

+184
-10
lines changed

2 files changed

+184
-10
lines changed

‎.github/actions/image2commit/action.yml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ inputs:
1515
outputs:
1616
commit_sha:
1717
description: "Resolved full commit SHA"
18-
18+
value: ${{ steps.resolve.outputs.commit_sha }}
1919
runs:
2020
using: "composite"
2121
steps:
@@ -37,4 +37,6 @@ runs:
3737
"${{ inputs.repo }}" \
3838
"${{ inputs.image_sha }}"
3939
)
40+
41+
echo "Raw full_sha: $full_sha"
4042
echo "commit_sha=$full_sha" >> $GITHUB_OUTPUT

‎.github/workflows/release-image.yml

Lines changed: 181 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -16,36 +16,41 @@ on:
1616
required: false
1717
default: "latest"
1818
type: string
19-
19+
push:
20+
branches:
21+
- '**'
22+
2023
permissions:
2124
contents: write
2225
pull-requests: write
2326

2427
jobs:
25-
26-
# Note, the first step is necessary for getting the exact commit from the passed in image_sha
27-
# This is because, the release-image step should exactly check out that exact commit
28+
# Image2commit: Creates a mapping between the image_sha given as input and the actual git commit
29+
# This is necassary for the release-image step that requires checking out that exact git commit
2830
image2commit:
2931
name: Resolve Commit SHA from Image
3032
runs-on: ubuntu-latest
33+
environment: release
3134
outputs:
3235
commit_sha: ${{ steps.resolve.outputs.commit_sha }}
33-
3436
steps:
37+
- name: Checkout code
38+
uses: actions/checkout@v4
39+
3540
- name: Log in to Docker registry
3641
uses: docker/login-action@v3
3742
with:
3843
registry: docker.io
39-
username: ${{ secrets.DOCKER_USERNAME }}
40-
password: ${{ secrets.DOCKER_PASSWORD }}
44+
username: ${{ secrets.ANDRPAC_DOCKER_USERNAME }}
45+
password: ${{ secrets.ANDRPAC_DOCKER_PASSWORD }}
4146

4247
- name: Run image2commit
4348
id: resolve
4449
uses: ./.github/actions/image2commit
4550
with:
4651
register: docker.io
4752
repo: andrpac/mongodb-atlas-kubernetes-operator-prerelease
48-
image_sha: ${{ github.event.inputs.image_sha }}
53+
image_sha: latest # !!!!!!!!!!!!!!!! To make the acutal input later !!!!!!
4954

5055
check-commit:
5156
name: Check resolved commit
@@ -56,6 +61,163 @@ jobs:
5661
run: |
5762
echo "Resolved commit: ${{ needs.image2commit.outputs.commit_sha }}"
5863
64+
# Release-image: Created and uploads a release for the specified operator version given in the image_sha
65+
# Note, with new releases, all of the release artifacts will be stored withing docs/releases/{release_version}
66+
release-image:
67+
runs-on: ubuntu-latest
68+
environment: release
69+
needs: image2commit
70+
env:
71+
VERSION: ${{ github.event.inputs.version || 'test-0.0.0-dev' }}
72+
AUTHORS: ${{ github.event.inputs.authors || 'unknown' }}
73+
IMAGE_SHA: ${{ github.event.inputs.image_sha || 'latest' }}
74+
DOCKER_SIGNATURE_REPO: docker.io/andrpac/signatures
75+
DOCKER_RELEASE_REPO: docker.io/andrpac/mongodb-atlas-kubernetes-operator
76+
DOCKER_PRERELEASE_REPO: docker.io/andrpac/mongodb-atlas-kubernetes-operator-prerelease
77+
QUAY_RELEASE_REPO: quay.io/andrpac/mongodb-atlas-kubernetes-operator
78+
QUAY_PRERELEASE_REPO: quay.io/andrpac/mongodb-atlas-kubernetes-operator-prerelease
79+
steps:
80+
- name: Checkout code
81+
uses: actions/checkout@v4
82+
with:
83+
fetch-depth: 0
84+
#ref: $#{{ needs.image2commit.outputs.commit_sha }} !!!!!!!!! SUPER IMPORTNAT TO PUT BACK !!!!!!!
85+
86+
- name: Generate GitHub App Token
87+
id: generate_token
88+
uses: mongodb/apix-action/token@v8
89+
with:
90+
app-id: ${{ secrets.AKO_RELEASER_APP_ID }}
91+
private-key: ${{ secrets.AKO_RELEASER_RSA_KEY }}
92+
93+
# Login in into all registries
94+
- name: Log in to Docker registry
95+
uses: docker/login-action@v3
96+
with:
97+
registry: docker.io
98+
username: ${{ secrets.ANDRPAC_DOCKER_USERNAME }}
99+
password: ${{ secrets.ANDRPAC_DOCKER_PASSWORD }}
100+
101+
- name: Log in to Quay registry
102+
uses: docker/login-action@v3
103+
with:
104+
registry: quay.io
105+
username: ${{ secrets.ANDRPAC_QUAY_USERNAME }}
106+
password: ${{ secrets.ANDRPAC_QUAY_PASSWORD }}
107+
108+
- name: Log in to Artifactory
109+
uses: docker/login-action@v3
110+
with:
111+
registry: artifactory.corp.mongodb.com
112+
username: ${{ secrets.MDB_ARTIFACTORY_USERNAME }}
113+
password: ${{ secrets.MDB_ARTIFACTORY_PASSWORD }}
114+
115+
- name: Install devbox
116+
uses: jetify-com/[email protected]
117+
118+
# This step configures all of the dynamic variables needed for later steps
119+
- name: Configure job environment for downstream steps
120+
id: tags
121+
run: |
122+
promoted_tag="promoted-${IMAGE_SHA}"
123+
release_tag="${VERSION}"
124+
certified_tag="certified-${release_tag}"
125+
126+
docker_image_url="${DOCKER_RELEASE_REPO}:${release_tag}"
127+
quay_image_url="${QUAY_RELEASE_REPO}:${release_tag}"
128+
quay_certified_image_url="${QUAY_RELEASE_REPO}:${certified_tag}"
129+
130+
echo "promoted_tag=$promoted_tag" >> $GITHUB_OUTPUT
131+
echo "release_tag=$release_tag" >> $GITHUB_OUTPUT
132+
echo "certified_tag=$certified_tag" >> $GITHUB_OUTPUT
133+
echo "docker_image_url=$docker_image_url" >> $GITHUB_OUTPUT
134+
echo "quay_image_url=$quay_image_url" >> $GITHUB_OUTPUT
135+
echo "quay_certified_image_url=$quay_certified_image_url" >> $GITHUB_OUTPUT
136+
137+
# Move prerelease images to official release registries in Docker Hub and Quay
138+
- name: Move image to Docker registry release from prerelease
139+
run: devbox run -- ./scripts/move-image.sh
140+
env:
141+
IMAGE_SRC_REPO: ${{ env.DOCKER_PRERELEASE_REPO }}
142+
IMAGE_DEST_REPO: ${{ env.DOCKER_RELEASE_REPO }}
143+
IMAGE_SRC_TAG: ${{ steps.tags.outputs.promoted_tag }}
144+
IMAGE_DEST_TAG: ${{ steps.tags.outputs.release_tag }}
145+
146+
- name: Move image to Quay registry release from prerelease
147+
run: devbox run -- ./scripts/move-image.sh
148+
env:
149+
IMAGE_SRC_REPO: ${{ env.QUAY_PRERELEASE_REPO }}
150+
IMAGE_DEST_REPO: ${{ env.QUAY_RELEASE_REPO }}
151+
IMAGE_SRC_TAG: ${{ steps.tags.outputs.promoted_tag }}
152+
IMAGE_DEST_TAG: ${{ steps.tags.outputs.release_tag }}
153+
154+
# Create Openshift certified images
155+
- name: Create OpenShift certified image on Quay
156+
run: devbox run -- ./scripts/move-image.sh
157+
env:
158+
IMAGE_SRC_REPO: ${{ env.QUAY_PRERELEASE_REPO }}
159+
IMAGE_DEST_REPO: ${{ env.QUAY_RELEASE_REPO }}
160+
IMAGE_SRC_TAG: ${{ steps.tags.outputs.promoted_tag }}
161+
IMAGE_DEST_TAG: ${{ steps.tags.outputs.certified_tag }}
162+
163+
# Link updates to pr: all-in-one.yml, helm-updates, sdlc requirements
164+
- name: Generate deployment configurations
165+
uses: ./.github/actions/gen-install-scripts
166+
with:
167+
ENV: prod
168+
IMAGE_URL: ${{ steps.tags.outputs.docker_image_url }}
169+
170+
- name: Bump Helm chart version
171+
run: devbox run -- ./scripts/bump-helm-chart-version.sh
172+
173+
# Prepare SDLC requirement: signatures, sboms, compliance reports
174+
# Note, signed images will live in mongodb/release and mongodb/signature repos
175+
- name: Sign released images
176+
run: |
177+
devbox run -- make sign IMG="${{ steps.tags.outputs.docker_image_url }}" SIGNATURE_REPO="${{ env.DOCKER_RELEASE_REPO }}"
178+
devbox run -- make sign IMG="${{ steps.tags.outputs.quay_image_url }}" SIGNATURE_REPO="${{ env.QUAY_RELEASE_REPO }}"
179+
devbox run -- make sign IMG="${{ steps.tags.outputs.docker_image_url }}" SIGNATURE_REPO="${{ env.DOCKER_SIGNATURE_REPO }}"
180+
devbox run -- make sign IMG="${{ steps.tags.outputs.quay_certified_image_url }}" SIGNATURE_REPO="${{ env.QUAY_RELEASE_REPO }}"
181+
devbox run -- make sign IMG="${{ steps.tags.outputs.quay_certified_image_url }}" SIGNATURE_REPO="${{ env.DOCKER_SIGNATURE_REPO }}"
182+
env:
183+
PKCS11_URI: ${{ secrets.PKCS11_URI }}
184+
GRS_USERNAME: ${{ secrets.GRS_USERNAME }}
185+
GRS_PASSWORD: ${{ secrets.GRS_PASSWORD }}
186+
187+
- name: Generate SBOMs
188+
run: devbox run -- make generate-sboms RELEASED_OPERATOR_IMAGE="${{ env.DOCKER_RELEASE_REPO }}"
189+
190+
- name: Create SDLC report
191+
run: devbox run -- make gen-sdlc-checklist
192+
193+
# Create PR on release branch with all updates generated
194+
- name: Create release branch with updates, tag new updates
195+
env:
196+
GITHUB_TOKEN: ${{ steps.generate_token.outputs.token }}
197+
run: |
198+
git config --global user.name "${{ steps.generate_token.outputs.user-name }}"
199+
git config --global user.email "${{ steps.generate_token.outputs.user-email }}"
200+
201+
export BRANCH="new-release/${VERSION}"
202+
export COMMIT_MESSAGE="feat: release ${VERSION} from release-image workflow"
203+
export RELEASE_DIR="docs/releases/${VERSION}"
204+
205+
git checkout -b "$BRANCH"
206+
207+
mkdir -p "$RELEASE_DIR"
208+
mv deploy "$RELEASE_DIR"/deploy
209+
mv bundle "$RELEASE_DIR"/bundle
210+
mv bundle.Dockerfile "$RELEASE_DIR"/bundle.Dockerfile
211+
212+
git add -f "$RELEASE_DIR"
213+
scripts/create-signed-commit.sh
214+
215+
gh pr create \
216+
--draft \
217+
--head="$BRANCH" \
218+
--title "$COMMIT_MESSAGE" \
219+
--body "This is an autogenerated PR to prepare for the release"
220+
59221
prepare-environment:
60222
name: Set up Environment Variables
61223
runs-on: ubuntu-latest
@@ -151,7 +313,7 @@ jobs:
151313
echo "quay_image_url=$quay_image_url" >> $GITHUB_OUTPUT
152314
echo "quay_certified_image_url=$quay_certified_image_url" >> $GITHUB_OUTPUT
153315
154-
release-image:
316+
release-image1:
155317
runs-on: ubuntu-latest
156318
if: false
157319
environment: release
@@ -205,6 +367,7 @@ jobs:
205367
short_sha="${sha:0:6}"
206368
echo "promoted_tag=promoted-${short_sha}" >> "$GITHUB_OUTPUT"
207369
370+
# Move prerelease images to official release registries in Docker Hub and Quay
208371
- name: Move image to Docker registry release from prerelease
209372
run: devbox run -- ./scripts/move-image.sh
210373
env:
@@ -220,6 +383,15 @@ jobs:
220383
IMAGE_DEST_REPO: ${{ env.QUAY_RELEASE_REPO }}
221384
IMAGE_SRC_TAG: ${{ steps.tags.outputs.promoted_tag }}
222385
IMAGE_DEST_TAG: ${{ github.event.inputs.version }}
386+
387+
# Create Openshift certified images
388+
- name: Create OpenShift certified image on Quay
389+
run: devbox run -- ./scripts/move-image.sh
390+
env:
391+
IMAGE_SRC_REPO: ${{ env.QUAY_PRERELEASE_REPO }}
392+
IMAGE_DEST_REPO: ${{ env.QUAY_RELEASE_REPO }}
393+
IMAGE_SRC_TAG: ${{ steps.tags.outputs.promoted_tag }}
394+
IMAGE_DEST_TAG: ${{ steps.tags.outputs.certified_tag }}
223395

224396
- name: Create deploy configurations
225397
uses: ./.github/actions/gen-install-scripts

0 commit comments

Comments
 (0)