|
|
|
|
@ -24,29 +24,29 @@ jobs:
|
|
|
|
|
- name: Unshallow
|
|
|
|
|
run: git fetch --prune --unshallow
|
|
|
|
|
- name: Setup Go
|
|
|
|
|
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
|
|
|
|
|
uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
|
|
|
|
|
with:
|
|
|
|
|
go-version: 1.23.x
|
|
|
|
|
cache: false
|
|
|
|
|
- name: Setup QEMU
|
|
|
|
|
uses: docker/setup-qemu-action@4574d27a4764455b42196d70a065bc6853246a25 # v3.4.0
|
|
|
|
|
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
|
|
|
|
|
- name: Setup Docker Buildx
|
|
|
|
|
id: buildx
|
|
|
|
|
uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
|
|
|
|
|
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
|
|
|
|
|
- name: Setup Syft
|
|
|
|
|
uses: anchore/sbom-action/download-syft@f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 # v0.18.0
|
|
|
|
|
- name: Setup Cosign
|
|
|
|
|
uses: sigstore/cosign-installer@c56c2d3e59e4281cc41dea2217323ba5694b171e # v3.8.0
|
|
|
|
|
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
|
|
|
|
|
- name: Setup Kustomize
|
|
|
|
|
uses: fluxcd/pkg/actions/kustomize@c964ce7b91949ff4b5e3959db4f1d7bb2e029a49 # main
|
|
|
|
|
- name: Login to GitHub Container Registry
|
|
|
|
|
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
|
|
|
|
|
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
|
|
|
|
|
with:
|
|
|
|
|
registry: ghcr.io
|
|
|
|
|
username: fluxcdbot
|
|
|
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
|
- name: Login to Docker Hub
|
|
|
|
|
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
|
|
|
|
|
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
|
|
|
|
|
with:
|
|
|
|
|
username: fluxcdbot
|
|
|
|
|
password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
|
|
|
|
|
@ -68,7 +68,7 @@ jobs:
|
|
|
|
|
tar -czvf ./output/crd-schemas.tar.gz -C schemas .
|
|
|
|
|
- name: Run GoReleaser
|
|
|
|
|
id: run-goreleaser
|
|
|
|
|
uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
|
|
|
|
|
uses: goreleaser/goreleaser-action@9c156ee8a17a598857849441385a2041ef570552 # v6.3.0
|
|
|
|
|
with:
|
|
|
|
|
version: latest
|
|
|
|
|
args: release --skip=validate
|
|
|
|
|
@ -110,13 +110,13 @@ jobs:
|
|
|
|
|
VERSION=$(flux version --client | awk '{ print $NF }')
|
|
|
|
|
echo "version=${VERSION}" >> $GITHUB_OUTPUT
|
|
|
|
|
- name: Login to GHCR
|
|
|
|
|
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
|
|
|
|
|
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
|
|
|
|
|
with:
|
|
|
|
|
registry: ghcr.io
|
|
|
|
|
username: fluxcdbot
|
|
|
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
|
- name: Login to DockerHub
|
|
|
|
|
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
|
|
|
|
|
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
|
|
|
|
|
with:
|
|
|
|
|
username: fluxcdbot
|
|
|
|
|
password: ${{ secrets.DOCKER_FLUXCD_PASSWORD }}
|
|
|
|
|
@ -144,7 +144,7 @@ jobs:
|
|
|
|
|
--path="./flux-system" \
|
|
|
|
|
--source=${{ github.repositoryUrl }} \
|
|
|
|
|
--revision="${{ github.ref_name }}@sha1:${{ github.sha }}"
|
|
|
|
|
- uses: sigstore/cosign-installer@c56c2d3e59e4281cc41dea2217323ba5694b171e # v3.8.0
|
|
|
|
|
- uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
|
|
|
|
|
- name: Sign manifests
|
|
|
|
|
env:
|
|
|
|
|
COSIGN_EXPERIMENTAL: 1
|
|
|
|
|
@ -165,7 +165,7 @@ jobs:
|
|
|
|
|
actions: read # for detecting the Github Actions environment.
|
|
|
|
|
id-token: write # for creating OIDC tokens for signing.
|
|
|
|
|
contents: write # for uploading attestations to GitHub releases.
|
|
|
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
|
|
|
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0
|
|
|
|
|
with:
|
|
|
|
|
provenance-name: "provenance.intoto.jsonl"
|
|
|
|
|
base64-subjects: "${{ needs.release-flux-cli.outputs.hashes }}"
|
|
|
|
|
@ -177,7 +177,7 @@ jobs:
|
|
|
|
|
actions: read # for detecting the Github Actions environment.
|
|
|
|
|
id-token: write # for creating OIDC tokens for signing.
|
|
|
|
|
packages: write # for uploading attestations.
|
|
|
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
|
|
|
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
|
|
|
|
|
with:
|
|
|
|
|
image: ${{ needs.release-flux-cli.outputs.image_url }}
|
|
|
|
|
digest: ${{ needs.release-flux-cli.outputs.image_digest }}
|
|
|
|
|
@ -191,7 +191,7 @@ jobs:
|
|
|
|
|
actions: read # for detecting the Github Actions environment.
|
|
|
|
|
id-token: write # for creating OIDC tokens for signing.
|
|
|
|
|
packages: write # for uploading attestations.
|
|
|
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.0.0
|
|
|
|
|
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v2.1.0
|
|
|
|
|
with:
|
|
|
|
|
image: ghcr.io/${{ needs.release-flux-cli.outputs.image_url }}
|
|
|
|
|
digest: ${{ needs.release-flux-cli.outputs.image_digest }}
|
|
|
|
|
|
dependabot[bot]
3 days ago
committed by
GitHub