mirror of https://github.com/fluxcd/flux2.git
ci: Refactor GitHub workflows
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>pull/3236/head
Stefan Prodan
2 years ago
parent
6f6c097980
commit
bb1078d610
@ -0,0 +1,50 @@
|
||||
# Flux GitHub Workflows
|
||||
|
||||
## End-to-end Testing
|
||||
|
||||
The e2e workflows run a series of tests to ensure that the Flux CLI and
|
||||
the GitOps Toolkit controllers work well all together.
|
||||
The tests are written in Go, Bash, Make and Terraform.
|
||||
|
||||
| Workflow | Jobs | Runner | Role |
|
||||
|--------------------|----------------------|----------------|-----------------------------------------------|
|
||||
| e2e.yaml | e2e-amd64-kubernetes | GitHub Ubuntu | integration testing with Kubernetes Kind<br/> |
|
||||
| e2e-arm64.yaml | e2e-arm64-kubernetes | Equinix Ubuntu | integration testing with Kubernetes Kind<br/> |
|
||||
| e2e-bootstrap.yaml | e2e-boostrap-github | GitHub Ubuntu | integration testing with GitHub API<br/> |
|
||||
| e2e-azure.yaml | e2e-amd64-aks | GitHub Ubuntu | integration testing with Azure API<br/> |
|
||||
| scan.yaml | scan-fossa | GitHub Ubuntu | license scanning<br/> |
|
||||
| scan.yaml | scan-snyk | GitHub Ubuntu | vulnerability scanning<br/> |
|
||||
| scan.yaml | scan-codeql | GitHub Ubuntu | vulnerability scanning<br/> |
|
||||
|
||||
## Components Update
|
||||
|
||||
The components update workflow scans the GitOps Toolkit controller repositories for new releases,
|
||||
amd when it finds a new controller version, the workflow performs the following steps:
|
||||
- Updates the controller API package version in `go.mod`.
|
||||
- Patches the controller CRDs version in the `manifests/crds` overlay.
|
||||
- Patches the controller Deployment version in `manifests/bases` overlay.
|
||||
- Opens a Pull Request against the `main` branch.
|
||||
- Triggers the e2e test suite to run for the opened PR.
|
||||
|
||||
|
||||
| Workflow | Jobs | Runner | Role |
|
||||
|-------------|-------------------|---------------|-----------------------------------------------------|
|
||||
| update.yaml | update-components | GitHub Ubuntu | update the GitOps Toolkit APIs and controllers<br/> |
|
||||
|
||||
## Release
|
||||
|
||||
The release workflow is triggered by a semver Git tag and performs the following steps:
|
||||
- Generates the Flux install manifests (YAML).
|
||||
- Generates the OpenAPI validation schemas for the GitOps Toolkit CRDs (JSON).
|
||||
- Generates a Software Bill of Materials (SPDX JSON).
|
||||
- Builds the Flux CLI binaries and the multi-arch container images.
|
||||
- Pushes the container images to GitHub Container Registry and DockerHub.
|
||||
- Signs the sbom, the binaries checksum and the container images with Cosign and GitHub OIDC.
|
||||
- Uploads the sbom, binaries, checksums and install manifests to GitHub Releases.
|
||||
- Pushes the install manifests as OCI artifacts to GitHub Container Registry and DockerHub.
|
||||
- Signs the OCI artifacts with Cosign and GitHub OIDC.
|
||||
|
||||
| Workflow | Jobs | Runner | Role |
|
||||
|--------------|------------------------|---------------|------------------------------------------------------|
|
||||
| release.yaml | release-flux-cli | GitHub Ubuntu | build, push and sign the CLI release artifacts<br/> |
|
||||
| release.yaml | release-flux-manifests | GitHub Ubuntu | build, push and sign the Flux install manifests<br/> |
|
||||
@ -1,75 +0,0 @@
|
||||
name: release-manifests
|
||||
on:
|
||||
release:
|
||||
types: [published]
|
||||
workflow_dispatch:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
build-push:
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
id-token: write # needed for keyless signing
|
||||
packages: write # needed for ghcr access
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
- name: Setup Kustomize
|
||||
uses: fluxcd/pkg/actions/kustomize@main
|
||||
- name: Setup Flux CLI
|
||||
uses: ./action/
|
||||
- name: Prepare
|
||||
id: prep
|
||||
run: |
|
||||
VERSION=$(flux version --client | awk '{ print $NF }')
|
||||
echo ::set-output name=VERSION::${VERSION}
|
||||
- name: Login to GHCR
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: fluxcdbot
|
||||
password: ${{ secrets.GHCR_TOKEN }}
|
||||
- name: Login to DockerHub
|
||||
uses: docker/login-action@v2
|
||||
with:
|
||||
username: fluxcdbot
|
||||
password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
|
||||
- name: Push manifests to GHCR
|
||||
run: |
|
||||
mkdir -p ./ghcr.io/flux-system
|
||||
flux install --registry=ghcr.io/fluxcd \
|
||||
--components-extra=image-reflector-controller,image-automation-controller \
|
||||
--export > ./ghcr.io/flux-system/gotk-components.yaml
|
||||
|
||||
cd ./ghcr.io && flux push artifact \
|
||||
oci://ghcr.io/fluxcd/flux-manifests:${{ steps.prep.outputs.VERSION }} \
|
||||
--path="./flux-system" \
|
||||
--source=${{ github.repositoryUrl }} \
|
||||
--revision="${{ github.ref_name }}/${{ github.sha }}"
|
||||
- name: Push manifests to DockerHub
|
||||
run: |
|
||||
mkdir -p ./docker.io/flux-system
|
||||
flux install --registry=docker.io/fluxcd \
|
||||
--components-extra=image-reflector-controller,image-automation-controller \
|
||||
--export > ./docker.io/flux-system/gotk-components.yaml
|
||||
|
||||
cd ./docker.io && flux push artifact \
|
||||
oci://docker.io/fluxcd/flux-manifests:${{ steps.prep.outputs.VERSION }} \
|
||||
--path="./flux-system" \
|
||||
--source=${{ github.repositoryUrl }} \
|
||||
--revision="${{ github.ref_name }}/${{ github.sha }}"
|
||||
- uses: sigstore/cosign-installer@main
|
||||
- name: Sign manifests
|
||||
env:
|
||||
COSIGN_EXPERIMENTAL: 1
|
||||
run: |
|
||||
cosign sign ghcr.io/fluxcd/flux-manifests:${{ steps.prep.outputs.VERSION }}
|
||||
cosign sign docker.io/fluxcd/flux-manifests:${{ steps.prep.outputs.VERSION }}
|
||||
- name: Tag manifests
|
||||
run: |
|
||||
flux tag artifact oci://ghcr.io/fluxcd/flux-manifests:${{ steps.prep.outputs.VERSION }} \
|
||||
--tag latest
|
||||
|
||||
flux tag artifact oci://docker.io/fluxcd/flux-manifests:${{ steps.prep.outputs.VERSION }} \
|
||||
--tag latest
|
||||
Loading…
Reference in New Issue