Skip to content

Commit dc7d406

Browse files
andrpacandrpac
committed
feat: create release pipeline
1 parent 645a0dc commit dc7d406

File tree

3 files changed

+235
-27
lines changed

3 files changed

+235
-27
lines changed

‎.github/workflows/promote-image.yml

Lines changed: 14 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -21,43 +21,39 @@ jobs:
2121
- name: Checkout PR commit
2222
uses: actions/checkout@v4
2323

24-
# Note, we have to be careful how we retrive the image. The event that pushed
25-
# the image to the ghcr.io repo was mainly a push/schedule that passed all the
26-
# tests. This event has access to github.ref_name. However, the workflow_run
27-
# event does not have access github.ref_name set up.
28-
#
29-
# Therefore, we need to manually specify the branch as main
30-
- name: Prepare image tag
31-
id: set_tag
32-
uses: ./.github/actions/set-tag
33-
with:
34-
branch_name: ${{ github.event.workflow_run.head_branch }}
35-
commit_sha: ${{ github.event.workflow_run.head_sha }}
36-
3724
- name: Log in to the GitHub Container Registry
3825
uses: docker/login-action@v3
3926
with:
4027
registry: ghcr.io
4128
username: ${{ github.actor }}
4229
password: ${{ secrets.GITHUB_TOKEN }}
4330

44-
- name: Pull unofficial image from GitHub Container Registry
45-
run: |
46-
docker pull ${{ env.GHCR_REPO }}:${{ steps.set_tag.outputs.tag }}
47-
4831
- name: Login to Docker registry
4932
uses: docker/login-action@v3
5033
with:
5134
registry: docker.io
5235
username: ${{ secrets.DOCKER_USERNAME }}
5336
password: ${{ secrets.DOCKER_PASSWORD }}
54-
37+
5538
- name: Log in to Quay registry
5639
uses: docker/login-action@v3
5740
with:
5841
registry: quay.io
5942
username: ${{ secrets.QUAY_USERNAME }}
6043
password: ${{ secrets.QUAY_PASSWORD }}
44+
45+
# Note, we have to be careful how we retrive the image. The event that pushed
46+
# the image to the ghcr.io repo was mainly a push/schedule that passed all the
47+
# tests. This event has access to github.ref_name. However, the workflow_run
48+
# event does not have access github.ref_name set up.
49+
#
50+
# Therefore, we need to manually specify the branch as main
51+
- name: Prepare image tag
52+
id: set_tag
53+
uses: ./.github/actions/set-tag
54+
with:
55+
branch_name: ${{ github.event.workflow_run.head_branch }}
56+
commit_sha: ${{ github.event.workflow_run.head_sha }}
6157

6258
- name: Prepare tag for promoted image
6359
id: promoted_tag

‎.github/workflows/release-image.yml

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
name: Release Image
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
description: "Release version (e.g., 1.2.3)"
8+
required: true
9+
type: string
10+
authors:
11+
description: "Comma-separated list of the release authors' emails"
12+
required: true
13+
type: string
14+
commit_sha:
15+
description: "Commit SHA to use for the image (e.g. 7c2a91 or latest)"
16+
required: false
17+
default: "latest"
18+
type: string
19+
20+
permissions:
21+
contents: write
22+
pull-requests: write
23+
24+
jobs:
25+
release-image:
26+
runs-on: ubuntu-latest
27+
environment: release
28+
env:
29+
VERSION: ${{ inputs.version }}
30+
AUTHORS: ${{ inputs.authors }}
31+
COMMIT_SHA: ${{ inputs.commit_sha }}
32+
33+
DOCKER_RELEASE_REPO: docker.io/mongodb/mongodb-atlas-kubernetes-operator
34+
DOCKER_PRERELEASE_REPO: docker.io/mongodb/mongodb-atlas-kubernetes-operator-prerelease
35+
DOCKER_SIGNATURE_REPO: docker.io/mongodb/signatures
36+
QUAY_RELEASE_REPO: quay.io/mongodb/mongodb-atlas-kubernetes-operator
37+
QUAY_PRERELEASE_REPO: quay.io/mongodb/mongodb-atlas-kubernetes-operator-prerelease
38+
39+
steps:
40+
- name: Checkout code
41+
uses: actions/checkout@v4
42+
with:
43+
fetch-depth: 0
44+
45+
- name: Generate GitHub App Token
46+
id: generate_token
47+
uses: mongodb/apix-action/token@v8
48+
with:
49+
app-id: ${{ secrets.AKO_RELEASER_APP_ID }}
50+
private-key: ${{ secrets.AKO_RELEASER_RSA_KEY }}
51+
52+
# Login in into all registries
53+
- name: Log in to Docker registry
54+
uses: docker/login-action@v3
55+
with:
56+
registry: docker.io
57+
username: ${{ secrets.DOCKER_USERNAME }}
58+
password: ${{ secrets.OCKER_PASSWORD }}
59+
60+
- name: Log in to Quay registry
61+
uses: docker/login-action@v3
62+
with:
63+
registry: quay.io
64+
username: ${{ secrets.QUAY_USERNAME }}
65+
password: ${{ secrets.QUAY_PASSWORD }}
66+
67+
- name: Log in to Artifactory
68+
uses: docker/login-action@v3
69+
with:
70+
registry: artifactory.corp.mongodb.com
71+
username: ${{ secrets.MDB_ARTIFACTORY_USERNAME }}
72+
password: ${{ secrets.MDB_ARTIFACTORY_PASSWORD }}
73+
74+
- name: Install devbox
75+
uses: jetify-com/[email protected]
76+
77+
- name: Resolve commit SHA and tags
78+
id: tags
79+
run: |
80+
if [ "${{ env.COMMIT_SHA }}" = "latest" ]; then
81+
git fetch origin main
82+
sha=$(git rev-parse origin/main)
83+
else
84+
sha="${{ env.COMMIT_SHA }}"
85+
fi
86+
87+
short_sha="${sha:0:6}"
88+
promoted_tag="promoted-${short_sha}"
89+
release_tag="${{ env.VERSION }}"
90+
certified_tag="certified-${release_tag}"
91+
92+
docker_image_url="${{ env.DOCKER_RELEASE_REPO }}:${release_tag}"
93+
quay_image_url="${{ env.QUAY_RELEASE_REPO }}:${release_tag}"
94+
quay_certified_image_url="${{ env.QUAY_RELEASE_REPO }}:${certified_tag}"
95+
96+
echo "promoted_tag=${promoted_tag}" >> "$GITHUB_OUTPUT"
97+
echo "release_tag=${release_tag}" >> "$GITHUB_OUTPUT"
98+
echo "certified_tag=${certified_tag}" >> "$GITHUB_OUTPUT"
99+
echo "docker_image_url=${docker_image_url}" >> "$GITHUB_OUTPUT"
100+
echo "quay_image_url=${quay_image_url}" >> "$GITHUB_OUTPUT"
101+
echo "quay_certified_image_url=${quay_certified_image_url}" >> "$GITHUB_OUTPUT"
102+
103+
# Move prerelease images to official release registries in Docker Hub and Quay
104+
- name: Promote Docker prerelease image
105+
run: devbox run -- ./scripts/move-image.sh
106+
env:
107+
IMAGE_SRC_REPO: ${{ env.DOCKER_PRERELEASE_REPO }}
108+
IMAGE_DEST_REPO: ${{ env.DOCKER_RELEASE_REPO }}
109+
IMAGE_SRC_TAG: ${{ steps.tags.outputs.promoted_tag }}
110+
IMAGE_DEST_TAG: ${{ steps.tags.outputs.release_tag }}
111+
112+
- name: Promote Quay prerelease image
113+
run: devbox run -- ./scripts/move-image.sh
114+
env:
115+
IMAGE_SRC_REPO: ${{ env.QUAY_PRERELEASE_REPO }}
116+
IMAGE_DEST_REPO: ${{ env.QUAY_RELEASE_REPO }}
117+
IMAGE_SRC_TAG: ${{ steps.tags.outputs.promoted_tag }}
118+
IMAGE_DEST_TAG: ${{ steps.tags.outputs.release_tag }}
119+
120+
# Create Openshift certified images
121+
- name: Create OpenShift certified image on Quay
122+
run: devbox run -- ./scripts/move-image.sh
123+
env:
124+
IMAGE_SRC_REPO: ${{ env.QUAY_PRERELEASE_REPO }}
125+
IMAGE_DEST_REPO: ${{ env.QUAY_RELEASE_REPO }}
126+
IMAGE_SRC_TAG: ${{ steps.tags.outputs.promoted_tag }}
127+
IMAGE_DEST_TAG: ${{ steps.tags.outputs.certified_tag }}
128+
129+
- name: Certify Openshift images
130+
uses: ./.github/actions/certify-openshift-images
131+
with:
132+
registry: quay.io
133+
version: ${{ steps.tags.outputs.certified_tag }}
134+
repository: mongodb/mongodb-atlas-kubernetes-operator
135+
registry_password: ${{ secrets.QUAY_PASSWORD }}
136+
rhcc_project: ${{ secrets.RH_CERTIFICATION_OSPID }}
137+
rhcc_token: ${{ secrets.RH_CERTIFICATION_PYXIS_API_TOKEN }}
138+
submit: true
139+
140+
# Link updates to pr: all-in-one.yml, helm-updates, sdlc requirements
141+
- name: Generate deployment configurations
142+
uses: ./.github/actions/gen-install-scripts
143+
with:
144+
ENV: prod
145+
IMAGE_URL: ${{ steps.tags.outputs.docker_image_url }}
146+
147+
- name: Bump Helm chart version
148+
run: devbox run -- ./scripts/bump-helm-chart-version.sh
149+
150+
# Prepare SDLC requirement: signatures, sboms, compliance reports
151+
# Note, signed images will live in mongodb/release and mongodb/signature repos
152+
- name: Sign released images
153+
run: |
154+
devbox run -- make sign IMG="${{ steps.tags.outputs.docker_image_url }}" SIGNATURE_REPO="${{ env.DOCKER_RELEASE_REPO }}"
155+
devbox run -- make sign IMG="${{ steps.tags.outputs.quay_image_url }}" SIGNATURE_REPO="${{ env.QUAY_RELEASE_REPO }}"
156+
devbox run -- make sign IMG="${{ steps.tags.outputs.docker_image_url }}" SIGNATURE_REPO="${{ env.DOCKER_SIGNATURE_REPO }}"
157+
devbox run -- make sign IMG="${{ steps.tags.outputs.quay_certified_image_url }}" SIGNATURE_REPO="${{ env.QUAY_RELEASE_REPO }}"
158+
devbox run -- make sign IMG="${{ steps.tags.outputs.quay_certified_image_url }}" SIGNATURE_REPO="${{ env.DOCKER_SIGNATURE_REPO }}"
159+
env:
160+
PKCS11_URI: ${{ secrets.PKCS11_URI }}
161+
GRS_USERNAME: ${{ secrets.GRS_USERNAME }}
162+
GRS_PASSWORD: ${{ secrets.GRS_PASSWORD }}
163+
164+
- name: Generate SBOMs
165+
run: devbox run -- make generate-sboms
166+
env:
167+
RELEASED_OPERATOR_IMAGE: ${{ env.DOCKER_RELEASE_REPO }}
168+
169+
- name: Generate SDLC report
170+
run: devbox run -- make gen-sdlc-checklist
171+
172+
# Create pr with all updates
173+
- name: Create pull request for release changes
174+
uses: peter-evans/create-pull-request@v6
175+
with:
176+
token: ${{ steps.generate_token.outputs.token }}
177+
commit-message: "chore(release): updates from new release v${{ env.VERSION }}"
178+
title: "Release v${{ env.VERSION }}"
179+
body: |
180+
This PR was automatically generated by the **release-image** workflow.
181+
182+
Version: `${{ env.VERSION }}`
183+
Authors: ${{ env.AUTHORS }}
184+
base: main
185+
branch: "new-release/${{ env.VERSION }}" # This should avoid for now running all tests till we fix cloud-test-filter.yml
186+
delete-branch: true
187+
draft: true
188+
189+
# Create release assets on GitHub
190+
- name: Create configuration package
191+
run: |
192+
devbox run -- 'set -x'
193+
devbox run -- 'tar czvf atlas-operator-all-in-one-${{ env.VERSION }}.tar.gz -C deploy all-in-one.yaml'
194+
195+
- name: Create GitHub Release and Upload Asset
196+
uses: softprops/action-gh-release@v2
197+
with:
198+
draft: true
199+
prerelease: false
200+
tag_name: ${{ env.VERSION }}
201+
name: ${{ env.VERSION }}
202+
body_path: docs/release-notes/release-notes-template.md
203+
files: ./atlas-operator-all-in-one-${{ env.VERSION }}.tar.gz
204+
token: ${{ steps.generate_token.outputs.token }}

‎scripts/move-image.sh

Lines changed: 17 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Copyright 2025 MongoDB Inc
33
#
44
# Licensed under the Apache License, Version 2.0 (the "License");
5-
# you may not use this file except in compliance with the License.
5+
# You may not use this file except in compliance with the License.
66
# You may obtain a copy of the License at
77
#
88
# http://www.apache.org/licenses/LICENSE-2.0
@@ -13,7 +13,7 @@
1313
# See the License for the specific language governing permissions and
1414
# limitations under the License.
1515

16-
# This scripts moves an image from a registry to another with retagging
16+
# This script moves a multi-arch image from one registry to another using docker buildx.
1717

1818
set -euo pipefail
1919

@@ -26,12 +26,20 @@ set -euo pipefail
2626
image_src_url="${IMAGE_SRC_REPO}:${IMAGE_SRC_TAG}"
2727
image_dest_url="${IMAGE_DEST_REPO}:${IMAGE_DEST_TAG}"
2828

29-
echo "Checking if ${image_dest_url} already exists..."
29+
echo "Checking if ${image_dest_url} already exists remotely..."
3030
if docker manifest inspect "${image_dest_url}" > /dev/null 2>&1; then
31-
echo "${image_dest_url} already exists. Skipping push."
32-
else
33-
echo "Tagging ${image_src_url} -> ${image_dest_url}"
34-
docker tag "${image_src_url}" "${image_dest_url}"
35-
echo "Pushing to ${image_dest_url}..."
36-
docker push "${image_dest_url}"
31+
echo "Image ${image_dest_url} already exists. Skipping transfer."
32+
exit 0
3733
fi
34+
35+
echo "Transferring multi-arch image:"
36+
echo " From: ${image_src_url}"
37+
echo " To: ${image_dest_url}"
38+
39+
BUILDER_NAME="tmpbuilder-move-image"
40+
41+
echo "Creating temporary buildx builder..."
42+
docker buildx create --name "${BUILDER_NAME}" --use > /dev/null
43+
docker buildx imagetools create "${image_src_url}" --tag "${image_dest_url}"
44+
docker buildx rm "${BUILDER_NAME}" > /dev/null
45+
echo "Successfully moved ${image_src_url} -> ${image_dest_url}"

0 commit comments

Comments
 (0)