Skip to content

charts/atlas-operator: bump chart version to 0.7.26 (#346) #42

charts/atlas-operator: bump chart version to 0.7.26 (#346)

charts/atlas-operator: bump chart version to 0.7.26 (#346) #42

# Copyright 2023 The Atlas Operator Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
name: CD - Operator Release
on:
push:
branches:
- master
paths:
- 'charts/atlas-operator/Chart.yaml'
workflow_dispatch:
concurrency:
group: operator-release
cancel-in-progress: false
jobs:
detect-version:
name: Detect Version Change
runs-on: ubuntu-slim
outputs:
semver: ${{ steps.check.outputs.semver }}
should_release: ${{ steps.check.outputs.should_release }}
version: ${{ steps.check.outputs.version }}
steps:
- name: Checkout
uses: actions/checkout@v4
with:
fetch-depth: 0
- name: Check if tag already exists
id: check
run: |
VERSION=$(yq '.appVersion' charts/atlas-operator/Chart.yaml)
TAG="v${VERSION}"
echo "semver=${VERSION}" >> $GITHUB_OUTPUT
echo "version=${TAG}" >> $GITHUB_OUTPUT
echo "Detected version: ${TAG}"
if git rev-parse "refs/tags/${TAG}" >/dev/null 2>&1; then
echo "Tag ${TAG} already exists, skipping release"
echo "should_release=false" >> $GITHUB_OUTPUT
else
echo "Tag ${TAG} does not exist, proceeding with release"
echo "should_release=true" >> $GITHUB_OUTPUT
fi
helm-test:
needs: [detect-version]
if: needs.detect-version.outputs.should_release == 'true'
uses: ./.github/workflows/ci-test-helm.yaml
docker-build:
name: Build and Push Image
needs: [detect-version]
if: needs.detect-version.outputs.should_release == 'true'
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
- name: Login to DockerHub
uses: docker/login-action@v1
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Fetch Atlas version
id: atlas
run: |
# All distributions are built from the same version
# so we only need to fetch it once.
echo "version=$(curl -s https://release.ariga.io/atlas/atlas-linux-amd64-latest.version)" >> $GITHUB_OUTPUT
- name: Docker meta
id: meta
uses: docker/metadata-action@v4
with:
images: ${{ secrets.DOCKERHUB_USERNAME }}/atlas-operator
tags: |
type=sha,format=short,prefix=sha-
labels: |
io.ariga.atlas.version=${{ steps.atlas.outputs.version }}
org.opencontainers.image.title=atlas-operator
org.opencontainers.image.description=Atlas Operator
org.opencontainers.image.url=https://atlasgo.io
org.opencontainers.image.vendor=Ariga
org.opencontainers.image.source=https://github.com/ariga/atlas-operator/blob/master/Dockerfile
- name: Build and push
uses: docker/build-push-action@v4
with:
context: .
build-args: |
ATLAS_VERSION=extended-latest
OPERATOR_VERSION=${{ needs.detect-version.outputs.version }}
file: ./Dockerfile
platforms: linux/amd64,linux/arm64
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
push: true
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@7b7aa264d83dc58691451798b4d117d53d21edfe
with:
image-ref: ${{ fromJSON(steps.meta.outputs.json).tags[0] }}
format: 'template'
template: '@/contrib/sarif.tpl'
output: 'trivy-results.sarif'
severity: 'CRITICAL,HIGH,MEDIUM'
- name: Upload Trivy scan results to GitHub Security tab
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'
release:
name: Create Release
needs: [detect-version, docker-build, helm-test]
runs-on: ubuntu-latest
permissions:
contents: write
packages: write
defaults:
run:
working-directory: charts/
env:
IMAGE: ${{ secrets.DOCKERHUB_USERNAME }}/atlas-operator
VERSION: ${{ needs.detect-version.outputs.version }}
steps:
- uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v2
- name: Setup Helm
uses: azure/setup-helm@v4
- name: Login to DockerHub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
- name: Login to ghcr.io using helm
run: |
echo ${{ secrets.GITHUB_TOKEN }} | helm registry login ghcr.io --username ${{ github.repository_owner }} --password-stdin
- name: Tag and push Docker image
run: |
docker buildx imagetools create \
--tag "${IMAGE}:${{ needs.detect-version.outputs.semver }}" \
"${IMAGE}:sha-${GITHUB_SHA::7}"
- name: Package & push Helm chart
run: |
helm package atlas-operator
helm push atlas-operator-${{ needs.detect-version.outputs.semver }}.tgz oci://ghcr.io/ariga/charts
- name: Create and push tag
run: |
git config user.name "github-actions[bot]"
git config user.email "github-actions[bot]@users.noreply.github.com"
git tag -a "$VERSION" -m "Release $VERSION"
git push origin "$VERSION"
echo "Created and pushed tag: $VERSION"
- name: Create GitHub Release
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
run: |
gh release create "$VERSION" \
--title "$VERSION" \
--verify-tag \
--generate-notes