11a2fdbdab
* [StepSecurity] Apply security best practices * Keep needed check in precommit --------- Signed-off-by: StepSecurity Bot <bot@stepsecurity.io> Signed-off-by: Sanket Sudake <sanketsudake@gmail.com> Co-authored-by: StepSecurity Bot <bot@stepsecurity.io>
104 lines
3.1 KiB
YAML
104 lines
3.1 KiB
YAML
name: Create Draft release
|
|
on:
|
|
push:
|
|
tags:
|
|
- v1.**
|
|
- v2.**
|
|
|
|
env:
|
|
KIND_VERSION: v0.23.0
|
|
KIND_NODE_IMAGE_TAG: v1.25.16
|
|
KIND_CLUSTER_NAME: kind
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
create-draft-release:
|
|
permissions:
|
|
contents: write # for goreleaser/goreleaser-action to create a GitHub release
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Harden Runner
|
|
uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f # v2.10.2
|
|
with:
|
|
egress-policy: audit
|
|
|
|
- name: Check out code
|
|
uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
|
|
with:
|
|
fetch-depth: 0
|
|
|
|
- name: Setup go
|
|
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
|
|
with:
|
|
go-version-file: "go.mod"
|
|
cache: true
|
|
|
|
- name: Get the version
|
|
id: get_version
|
|
run: echo "VERSION=${GITHUB_REF/refs\/tags\//}" >> $GITHUB_OUTPUT
|
|
|
|
- name: Install GoReleaser
|
|
uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
|
|
with:
|
|
install-only: true
|
|
version: "~> v2"
|
|
|
|
- name: Kind Cluster
|
|
uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
|
|
with:
|
|
node_image: kindest/node:${{ env.KIND_NODE_IMAGE_TAG }}
|
|
version: ${{ env.KIND_VERSION }}
|
|
config: kind.yaml
|
|
cluster_name: ${{ env.KIND_CLUSTER_NAME }}
|
|
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0
|
|
|
|
- name: Login to ghcr.io
|
|
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.repository_owner }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Login to docker.io
|
|
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
|
|
with:
|
|
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
|
password: ${{ secrets.DOCKERHUB_TOKEN }}
|
|
|
|
- name: Install Cosign
|
|
uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
|
|
with:
|
|
cosign-release: "v2.2.1"
|
|
|
|
- name: Check cosign install!
|
|
run: cosign version
|
|
|
|
- name: Write cosign signing key to disk
|
|
run: 'echo "$KEY" > cosign.key'
|
|
shell: bash
|
|
env:
|
|
KEY: ${{ secrets.COSIGN_PRIVATE_KEY }}
|
|
|
|
- name: Generate yaml for manifest, Minikube and Openshift installation
|
|
run: ${GITHUB_WORKSPACE}/hack/build-yaml.sh $VERSION
|
|
env:
|
|
VERSION: ${{ steps.get_version.outputs.VERSION }}
|
|
shell: bash
|
|
|
|
- name: Run GoReleaser
|
|
uses: goreleaser/goreleaser-action@286f3b13b1b49da4ac219696163fb8c1c93e1200 # v6.0.0
|
|
with:
|
|
version: "~> v2"
|
|
args: release
|
|
env:
|
|
COSIGN_PWD: ${{ secrets.COSIGN_PWD }}
|
|
GORELEASER_CURRENT_TAG: ${{ steps.get_version.outputs.VERSION }}
|
|
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
DOCKER_CLI_EXPERIMENTAL: "enabled"
|
|
|
|
#ToDo - Verify and upload releases
|