mcc0nnell commented on code in PR #6777:
URL: https://github.com/apache/camel-k/pull/6777#discussion_r3873075887
##########
.github/actions/release-nightly/action.yml:
##########
@@ -110,30 +111,66 @@ runs:
run: |
NOTEST=1 make VERSION=${{ env.VERSION }} IMAGE_NAME=${{ env.IMAGE_NAME
}} BUNDLE_IMAGE_NAME=docker.io/testcamelk/camel-k-bundle bundle-push
- - name: Install SBOM generator
+ - name: Install assurance tools
shell: bash
run: |
- go install
github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@latest
- echo "$(go env GOPATH)/bin" >> $GITHUB_PATH
-
- - name: Generate SBOM
+ source script/release-assurance-tools.env
+ go install
github.com/CycloneDX/cyclonedx-gomod/cmd/cyclonedx-gomod@${CYCLONEDX_GOMOD_REF}
+ go install github.com/anchore/syft/cmd/syft@${SYFT_REF}
+ go install github.com/sigstore/cosign/v3/cmd/cosign@${COSIGN_REF}
+ echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
+ go version -m "$(go env GOPATH)/bin/cyclonedx-gomod" | grep -F
"github.com/CycloneDX/cyclonedx-gomod ${CYCLONEDX_GOMOD_VERSION}"
+ reported_syft_version=$("$(go env GOPATH)/bin/syft" --version | awk
'{print $NF}')
+ test "$reported_syft_version" = "${SYFT_VERSION#v}"
+ go version -m "$(go env GOPATH)/bin/cosign" | grep -F
"github.com/sigstore/cosign/v3 ${COSIGN_VERSION}"
+
+ - name: Generate module SBOM
shell: bash
- run: cyclonedx-gomod mod -licenses -json -output sbom.json
+ run: cyclonedx-gomod mod -licenses -json -noserial -notimestamp -output
sbom.json
- - name: Commit and push nightly branch
+ - name: Prepare nightly release commit
shell: bash
env:
CI_USER: "github-actions[bot]"
CI_EMAIL: "41898282+github-actions[bot]@users.noreply.github.com"
- CI_TOKEN: ${{ inputs.secretGithubToken }}
run: |
git config --local user.email "$CI_EMAIL"
git config --local user.name "$CI_USER"
git add docs/charts/
git commit -am 'chore(ci): ${{ env.TAG }} release updates' || echo "No
nightly release updates changes to commit"
echo "COMMIT_ID=$(git rev-parse HEAD)" >> $GITHUB_ENV
- git tag ${{ env.TAG }} $(git rev-parse HEAD)
- git push
"https://$CI_USER:[email protected]/$GITHUB_REPOSITORY.git"; tag ${{ env.TAG
}} -f || echo "No nightly release updates changes to push"
+
+ - name: Generate release assurance
+ shell: bash
+ env:
+ SYFT_CHECK_FOR_APP_UPDATE: "false"
+ run: |
+ source script/release-assurance-tools.env
+ export SYFT_VERSION
+ bash script/generate_release_assurance.sh \
+ "${{ env.VERSION }}" \
+ "${{ env.TAG }}" \
+ "${{ env.BUILD_SOURCE_SHA }}" \
+ "${{ env.COMMIT_ID }}" \
+ "$CYCLONEDX_GOMOD_VERSION"
+
+ - name: Sign and attest release assurance
+ shell: bash
+ env:
+ COSIGN_YES: "true"
+ run: |
+ bash script/attest_release_assurance.sh \
+ release-assurance.json \
+ release-assurance.sigstore.json
+
+ - name: Publish nightly tag
+ shell: bash
+ env:
+ CI_USER: "github-actions[bot]"
+ CI_TOKEN: ${{ inputs.secretGithubToken }}
+ run: |
+ git tag -f "${{ env.TAG }}" "${{ env.COMMIT_ID }}"
+ git push
"https://$CI_USER:[email protected]/$GITHUB_REPOSITORY.git"; "refs/tags/${{
env.TAG }}" --force
Review Comment:
Fixed — I restored the previous no-change behavior on the nightly tag push:
|| echo "No nightly release updates changes to push"
That keeps the action from failing when there’s nothing new to publish. I
agree a cleaner explicit control mechanism would be a good follow-up, but this
keeps the current behavior intact for this PR. Thanks for catching it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
