Merge pull request authzed#129 from authzed/support-through-v1.16.1

Support through v1.16.1

.github/workflows/lint.yaml

@@ -37,26 +37,25 @@ jobs:
       - uses: "stefanprodan/kube-tools@v1"
         with:
           command: "kustomize build ./config"
-       # Disabled due to issues with Kustomize, see:
-       # - https://github.com/instrumenta/kubeval-action/pull/3
-       # - https://github.com/instrumenta/kubeval/issues/232
-       # - uses: "instrumenta/kubeval-action@5915e4adba5adccac07cb156b82e54c3fed74921"
-       #   with:
-       #     files: "config"
+      # Disabled due to issues with Kustomize, see:
+      # - https://github.com/instrumenta/kubeval-action/pull/3
+      # - https://github.com/instrumenta/kubeval/issues/232
+      # - uses: "instrumenta/kubeval-action@5915e4adba5adccac07cb156b82e54c3fed74921"
+      #   with:
+      #     files: "config"
       - uses: "authzed/actions/markdown-lint@main"
 
-#  TODO: enable when public
-#  codeql:
-#    name: "Analyze with CodeQL"
-#    runs-on: "ubuntu-latest"
-#    permissions:
-#      actions: "read"
-#      contents: "read"
-#      security-events: "write"
-#    strategy:
-#      fail-fast: false
-#      matrix:
-#        language: ["go"]
-#    steps:
-#      - uses: "actions/checkout@v3"
-#      - uses: "authzed/actions/codeql@main"
+  codeql:
+    name: "Analyze with CodeQL"
+    runs-on: "ubuntu-latest"
+    permissions:
+      actions: "read"
+      contents: "read"
+      security-events: "write"
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["go"]
+    steps:
+      - uses: "actions/checkout@v3"
+      - uses: "authzed/actions/codeql@main"

.github/workflows/release.yaml

@@ -10,6 +10,8 @@ permissions:
 jobs:
   goreleaser:
     runs-on: "ubuntu-latest"
+    env:
+      KUSTOMIZER_ARTIFACT: "oci://ghcr.io/${{github.repository_owner}}/${{github.event.repository.name}}-manifests"
     steps:
       - uses: "actions/checkout@v3"
         with:
@@ -24,6 +26,16 @@ jobs:
           dockerhub_token: "${{ secrets.DOCKERHUB_ACCESS_TOKEN }}"
       - uses: "docker/setup-qemu-action@v1"
       - uses: "docker/setup-buildx-action@v1"
+      - name: "Set operator image in release manifests"
+        uses: "mikefarah/yq@master"
+        with:
+          cmd: |
+            yq eval '.images[0].newTag="${{ github.ref_name }}"' -i ./config/kustomization.yaml
+      - name: "Build release bundle.yaml"
+        uses: "karancode/kustomize-github-action@master"
+        with:
+          kustomize_build_dir: "config"
+          kustomize_output_file: "bundle.yaml"
       - uses: "goreleaser/goreleaser-action@v2"
         with:
           distribution: "goreleaser"
@@ -32,3 +44,11 @@ jobs:
         env:
           GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
           GORELEASER_KEY: "${{ secrets.GORELEASER_KEY }}"
+      - name: "Push release manifests"
+        run: |
+          kustomizer push artifact ${KUSTOMIZER_ARTIFACT}:${{ github.ref_name }} -k ./config \
+            --source=${{ github.repositoryUrl }} \
+            --revision="${{ github.ref_name }}/${{ github.sha }}"
+      - name: "Tag latest release manifests"
+        run: |
+          kustomizer tag artifact ${KUSTOMIZER_ARTIFACT}:${GITHUB_REF_NAME} latest

README.md

@@ -34,10 +34,10 @@ We recommend one of the following:
 - [kind](https://kind.sigs.k8s.io)
 - [minikube](https://minikube.sigs.k8s.io)
 
-Next, you'll install the operator:
+Next, you'll install a [release](https://github.com/authzed/spicedb-operator/releases/) of the operator:
 
 ```console
-kubectl apply --server-side -k github.com/authzed/spicedb-operator/config
+kubectl apply --server-side -f https://github.com/authzed/spicedb-operator/releases/download/v1.1.0/bundle.yaml
 ```
 
 Finally you can create your first cluster:

config/kustomization.yaml

@@ -4,3 +4,6 @@ resources:
   - crds
   - rbac
   - operator.yaml
+images:
+  - name: ghcr.io/authzed/spicedb-operator
+    newTag: latest