From 7e6822d7ce3a649a610006417194e592e16042d0 Mon Sep 17 00:00:00 2001 From: Nathan Klick Date: Wed, 31 Jul 2024 15:23:53 -0500 Subject: [PATCH] ci: add support for tagging and release creation Signed-off-by: Nathan Klick --- .../workflows/flow-release-legacy-images.yaml | 128 +++++++++++++++++- legacy/runner/VERSION | 2 +- 2 files changed, 128 insertions(+), 2 deletions(-) diff --git a/.github/workflows/flow-release-legacy-images.yaml b/.github/workflows/flow-release-legacy-images.yaml index 0fe117c..519e47a 100644 --- a/.github/workflows/flow-release-legacy-images.yaml +++ b/.github/workflows/flow-release-legacy-images.yaml @@ -72,6 +72,11 @@ defaults: run: shell: bash +permissions: + id-token: write + contents: read + packages: write + jobs: versions: name: Upstream Versions @@ -80,11 +85,38 @@ jobs: explicit-runner-version: ${{ github.event.inputs.runner-version }} explicit-hooks-version: ${{ github.event.inputs.runner-container-hooks-version }} + safety-checks: + name: Safety Checks + runs-on: [self-hosted, Linux, medium, ephemeral] + needs: + - versions + steps: + - name: Harden Runner + uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0 + with: + egress-policy: audit + + - name: Install GH CLI + uses: sersoft-gmbh/setup-gh-cli-action@2d02c06e284b7d55e954d6d6406e7a886f45a818 # v2.0.1 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Authorize GH CLI + run: echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token + + - name: Check for Existing Releases + run: | + if gh release view v${{ needs.versions.outputs.runner }} >/dev/null 2>&1; then + echo "::error title=Release Version::Release v${{ needs.versions.outputs.runner }} already exists and may not be redeployed." + exit 1 + fi + legacy-image: name: Legacy Image uses: ./.github/workflows/zxc-build-legacy-images.yaml needs: - versions + - safety-checks strategy: matrix: base-os-image: @@ -100,4 +132,98 @@ jobs: build-default-image: ${{ github.event.inputs.build-default-image == 'true' }} build-dind-image: ${{ github.event.inputs.build-dind-image == 'true' }} build-dind-rootless-image: ${{ github.event.inputs.build-dind-rootless-image == 'true' }} - dry-run-enabled: ${{ github.event.inputs.dry-run-enabled == 'true' }} + dry-run-enabled: ${{ github.event.inputs.dry-run-enabled == 'true' || github.ref_name != 'main' }} + + update-version: + name: Update Version + runs-on: [self-hosted, Linux, medium, ephemeral] + needs: + - versions + - legacy-image + if: ${{ github.event.inputs.dry-run-enabled != 'true' && github.ref_name == 'main' }} + steps: + - name: Harden Runner + uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0 + with: + egress-policy: audit + + - name: Checkout Code + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + with: + fetch-depth: 0 + token: ${{ secrets.GH_ACCESS_TOKEN }} + + - name: Import GPG key + id: gpg_key + uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0 + with: + gpg_private_key: ${{ secrets.GPG_KEY_CONTENTS }} + passphrase: ${{ secrets.GPG_KEY_PASSPHRASE }} + git_config_global: true + git_user_signingkey: true + git_commit_gpgsign: true + git_tag_gpgsign: false + + - name: Update Version Descriptor + working-directory: legacy/runner + run: printf "RUNNER_VERSION=%s\nRUNNER_CONTAINER_HOOKS_VERSION=%s\n" "${{ needs.versions.outputs.runner }}" "${{ needs.versions.outputs.hooks }}" >VERSION + + - name: Commit Changes + uses: actions-js/push@5a7cbd780d82c0c937b5977586e641b2fd94acc5 # v1.5 + with: + github_token: ${{ secrets.GH_ACCESS_TOKEN }} + author_name: ${{ vars.GIT_USER_NAME }} + author_email: ${{ vars.GIT_USER_EMAIL }} + message: "chore(release): v${{ needs.versions.outputs.runner }} [skip ci]" + + finalize-release: + name: Finalize Release + runs-on: [self-hosted, Linux, medium, ephemeral] + needs: + - versions + - update-version + steps: + - name: Harden Runner + uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0 + with: + egress-policy: audit + + - name: Checkout Code + uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 + with: + ref: ${{ github.ref_name }} + fetch-depth: 0 + token: ${{ secrets.GH_ACCESS_TOKEN }} + + - name: Import GPG key + id: gpg_key + uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0 + with: + gpg_private_key: ${{ secrets.GPG_KEY_CONTENTS }} + passphrase: ${{ secrets.GPG_KEY_PASSPHRASE }} + git_config_global: true + git_user_signingkey: true + git_commit_gpgsign: true + git_tag_gpgsign: true + + - name: Install GH CLI + uses: sersoft-gmbh/setup-gh-cli-action@2d02c06e284b7d55e954d6d6406e7a886f45a818 # v2.0.1 + with: + github-token: ${{ secrets.GITHUB_TOKEN }} + + - name: Authorize GH CLI + run: echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token + + - name: Fetch Upstream Release Info + run: | + RELEASE_URL="$(gh release view v${{ needs.versions.outputs.runner }} --json url -R actions/runner | jq -r '.url')" + gh release view v${{ needs.versions.outputs.runner }} --json body -R actions/runner | jq -r '.body' > .github/RELEASE_BODY.md + printf "\n\n### _Release Notes have been imported from the [%s](%s) release in the upstream repository._\n\n" "v${{ needs.versions.outputs.runner }}" "${RELEASE_URL}" >> .github/RELEASE_BODY.md + + - name: Create Release + uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0 + with: + token: ${{ secrets.GH_ACCESS_TOKEN }} + commit: ${{ github.ref_name }} + tag: v${{ needs.versions.outputs.runner }} + bodyFile: .github/RELEASE_BODY.md diff --git a/legacy/runner/VERSION b/legacy/runner/VERSION index ce5d582..bbfde24 100644 --- a/legacy/runner/VERSION +++ b/legacy/runner/VERSION @@ -1,2 +1,2 @@ -RUNNER_VERSION=2.317.0 +RUNNER_VERSION=2.316.0 RUNNER_CONTAINER_HOOKS_VERSION=0.6.1