squakez commented on code in PR #6777:
URL: https://github.com/apache/camel-k/pull/6777#discussion_r3871870500
##########
.github/actions/release-nightly/action.yml:
##########
@@ -110,30 +111,66 @@ runs:
run: |
NOTEST=1 make VERSION=${{ env.VERSION }} IMAGE_NAME=${{ env.IMAGE_NAME
}} BUNDLE_IMAGE_NAME=docker.io/testcamelk/camel-k-bundle bundle-push
- - name: Install SBOM generator
+ - name: Install assurance tools
shell: bash
run: |
- go install
github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
- echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-
- - name: Generate SBOM
+ source script/release-assurance-tools.env
+ go install
github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@${CYCLONEDX_GOMOD_REF}
+ go install github.com/anchore/syft/cmd/syft@${SYFT_REF}
+ go install github.com/sigstore/cosign/v3/cmd/cosign@${COSIGN_REF}
+ echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+ go version -m "$(go env GOPATH)/bin/cyclonedx-gomod" | grep -F
"github.com/CycloneDX/cyclonedx-gomod ${CYCLONEDX_GOMOD_VERSION}"
+ reported_syft_version=$("$(go env GOPATH)/bin/syft" --version | awk
'{print $NF}')
+ test "$reported_syft_version" = "${SYFT_VERSION#v}"
+ go version -m "$(go env GOPATH)/bin/cosign" | grep -F
"github.com/sigstore/cosign/v3 ${COSIGN_VERSION}"
+
+ - name: Generate module SBOM
shell: bash
- run: cyclonedx-gomod mod -licenses -json -output sbom.json
+ run: cyclonedx-gomod mod -licenses -json -noserial -notimestamp -output
sbom.json
- - name: Commit and push nightly branch
+ - name: Prepare nightly release commit
shell: bash
env:
CI_USER: "github-actions[bot]"
CI_EMAIL: "41898282+github-actions[bot]@users.noreply.github.com"
- CI_TOKEN: ${{ inputs.secretGithubToken }}
run: |
git config --local user.email "$CI_EMAIL"
git config --local user.name "$CI_USER"
git add docs/charts/
git commit -am 'chore(ci): ${{ env.TAG }} release updates' || echo "No
nightly release updates changes to commit"
echo "COMMIT_ID=$(git rev-parse HEAD)" >> $GITHUB_ENV
- git tag ${{ env.TAG }} $(git rev-parse HEAD)
- git push
"https://$CI_USER:[email protected]/$GITHUB_REPOSITORY.git"; tag ${{ env.TAG
}} -f || echo "No nightly release updates changes to push"
+
+ - name: Generate release assurance
+ shell: bash
+ env:
+ SYFT_CHECK_FOR_APP_UPDATE: "false"
+ run: |
+ source script/release-assurance-tools.env
+ export SYFT_VERSION
+ bash script/generate_release_assurance.sh \
+ "${{ env.VERSION }}" \
+ "${{ env.TAG }}" \
+ "${{ env.BUILD_SOURCE_SHA }}" \
+ "${{ env.COMMIT_ID }}" \
+ "$CYCLONEDX_GOMOD_VERSION"
+
+ - name: Sign and attest release assurance
+ shell: bash
+ env:
+ COSIGN_YES: "true"
+ run: |
+ bash script/attest_release_assurance.sh \
+ release-assurance.json \
+ release-assurance.sigstore.json
+
+ - name: Publish nightly tag
+ shell: bash
+ env:
+ CI_USER: "github-actions[bot]"
+ CI_TOKEN: ${{ inputs.secretGithubToken }}
+ run: |
+ git tag -f "${{ env.TAG }}" "${{ env.COMMIT_ID }}"
+ git push
"https://$CI_USER:[email protected]/$GITHUB_REPOSITORY.git"; "refs/tags/${{
env.TAG }}" --force
Review Comment:
We miss the `|| echo "No nightly release updates changes to push"` - I think
we could skip the release if no change, but without this one the action will
result in error. We should have a different mechanism to control it cleanly or
keep it the `echo` to let the action continue.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
