Verify various version related assumptions during CI

.github/workflows/minimal-app.yml

@@ -19,6 +19,12 @@ env:
   GIT_TAG_PREFIX: minimal-app_v
 
 jobs:
+  verify-versions:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: sh .github/workflows/scripts/verify_minimal_app_releasable.sh
+        name: Verify minimal app is in a state to be released on merge
   build:
     name: build image
     if: github.ref != 'refs/heads/main'
@@ -38,6 +44,7 @@ jobs:
 
   release:
     if: github.ref == 'refs/heads/main'
+    needs: verify-versions
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -52,7 +59,6 @@ jobs:
           VERSION=$(mvn help:evaluate -Dexpression=project.version -q -DforceStdout)
           REGISTRY=$(mvn help:evaluate -Dexpression=docker.registry -q -DforceStdout)
           IMAGE_NAME=$(mvn help:evaluate -Dexpression=image-name -q -DforceStdout)
-          echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
           echo "REGISTRY=$REGISTRY" >> "$GITHUB_OUTPUT"
           echo "TAG_NAME=${{ env.GIT_TAG_PREFIX }}$VERSION" >> "$GITHUB_OUTPUT"
           echo "IMAGE_NAME=$REGISTRY/$IMAGE_NAME:$VERSION" >> "$GITHUB_OUTPUT"

.github/workflows/operator.yml

@@ -15,9 +15,15 @@ on:
 
 env:
   WORKING_DIR: ./operator
-  GIT_TAG_PREFIX: operator_v
 
 jobs:
+  verify-versions:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: sh .github/workflows/scripts/verify_operator_releasable.sh
+        name: Verify operator is in a state to be released on merge
+
   build:
     if: github.ref != 'refs/heads/main'
     runs-on: ubuntu-latest
@@ -32,6 +38,7 @@ jobs:
 
   release:
     if: github.ref == 'refs/heads/main'
+    needs: verify-versions
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -40,10 +47,10 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
+      # set variables used by multiple steps in the job
       - run: |
-          VERSION=$(make get-version)
-          echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "TAG_NAME=${{ env.GIT_TAG_PREFIX }}$VERSION" >> "$GITHUB_OUTPUT"
+          TAG_NAME=$(make get-tag)
+          echo "TAG_NAME=$TAG_NAME" >> "$GITHUB_OUTPUT"
           cat $GITHUB_OUTPUT
         id: naming-selector
         name: generate names for artifacts

.github/workflows/scripts/verify_changes_update_version.sh

@@ -0,0 +1,28 @@
+# Verifies changes to directory have an updated version
+
+if [ -z "$1" ] || [ -z "$2" ]; then
+  echo "Usage: sh $0 [potential_git_tag] <path_to_directory>"
+  exit 1
+fi
+
+set -eux
+
+POTENTIAL_GIT_TAG=$1
+DIRECTORY=$2
+
+main() {
+  # github actions job does not fetch other git objects by default
+  git fetch origin $GITHUB_BASE_REF
+  git fetch --tags
+
+  changes_in_pr=$(git diff origin/$GITHUB_BASE_REF -- $DIRECTORY)
+  if [ -n "$changes_in_pr" ]; then
+    echo "Found changes between current branch and $GITHUB_BASE_REF"
+    if git tag | grep -x "$POTENTIAL_GIT_TAG"; then
+      echo "$POTENTIAL_GIT_TAG was already released. Please increment the version if changes were made to $DIRECTORY."
+      exit 1
+    fi
+  fi
+}
+
+main

.github/workflows/scripts/verify_minimal_app_releasable.sh

@@ -0,0 +1,11 @@
+set -eux
+
+MINIMAL_APP_DIR=minimal-app
+
+verify_version_bump() {
+  version=$(mvn -f minimal-app/pom.xml help:evaluate -Dexpression=project.version -q -DforceStdout)
+  potential_tag="${GIT_TAG_PREFIX}${version}"
+  sh .github/workflows/scripts/verify_changes_update_version.sh $potential_tag $MINIMAL_APP_DIR
+}
+
+verify_version_bump

.github/workflows/scripts/verify_operator_releasable.sh

@@ -0,0 +1,22 @@
+set -eux
+
+OPERATOR_DIR=operator
+OPERATOR_CONTROLLER_YAML=$OPERATOR_DIR/controller/integrationroute-controller.yaml
+
+verify_current_webhook_img() {
+  current_webhook_img=$(make --no-print-directory -C operator/webhook get-image-name)
+  webhook_image_used=$(yq eval '.spec.template.spec.containers[].image' $OPERATOR_CONTROLLER_YAML)
+
+  test -n "$current_webhook_img"
+  test -n "$webhook_image_used"
+
+  test "$webhook_image_used" = "$current_webhook_img" || (echo "Operator is not using current version of webhook image" && exit 1)
+}
+
+verify_version_bump() {
+  potential_tag=$(make --no-print-directory -C $OPERATOR_DIR get-tag)
+  sh .github/workflows/scripts/verify_changes_update_version.sh $potential_tag $OPERATOR_DIR
+}
+
+verify_current_webhook_img
+verify_version_bump

.github/workflows/scripts/verify_webhook_releasable.sh

@@ -0,0 +1,10 @@
+set -eux
+
+WEBHOOK_DIR=operator/webhook
+
+verify_version_bump() {
+  potential_tag=$(make --no-print-directory -C $WEBHOOK_DIR get-tag)
+  sh .github/workflows/scripts/verify_changes_update_version.sh $potential_tag $WEBHOOK_DIR
+}
+
+verify_version_bump

.github/workflows/webhook.yml

@@ -14,9 +14,14 @@ on:
 
 env:
   WORKING_DIR: ./operator/webhook
-  GIT_TAG_PREFIX: webhook_v
 
 jobs:
+  verify-versions:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: sh .github/workflows/scripts/verify_webhook_releasable.sh
+        name: Verify webhook is in a state to be released on merge
   test:
     name: unit test
     runs-on: ubuntu-latest
@@ -50,7 +55,7 @@ jobs:
           push: false
 
   release:
-    needs: test
+    needs: [test, verify-versions]
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     defaults:
@@ -63,13 +68,12 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - run: |
-          VERSION=$(make get-version)
           REGISTRY=$(make get-registry)
           IMAGE_NAME=$(make get-image-name)
-          echo "VERSION=$VERSION" >> "$GITHUB_OUTPUT"
+          GIT_TAG=$(make get-tag)
           echo "REGISTRY=$REGISTRY" >> "$GITHUB_OUTPUT"
-          echo "TAG_NAME=${{ env.GIT_TAG_PREFIX }}$VERSION" >> "$GITHUB_OUTPUT"
-          echo "FULL_IMAGE_NAME=$REGISTRY/$IMAGE_NAME:$VERSION" >> "$GITHUB_OUTPUT"
+          echo "TAG_NAME=$GIT_TAG" >> "$GITHUB_OUTPUT"
+          echo "FULL_IMAGE_NAME=$IMAGE_NAME" >> "$GITHUB_OUTPUT"
           cat $GITHUB_OUTPUT
         id: naming-selector
         name: generate names for artifacts

minimal-app/pom.xml

@@ -11,7 +11,7 @@
 
     <groupId>com.octo.keip</groupId>
     <artifactId>minimal-app</artifactId>
-    <version>0.0.2</version>
+    <version>0.0.3</version>
 
     <properties>
         <docker.registry>ghcr.io/octoconsulting</docker.registry>
@@ -118,6 +118,7 @@
                     <to>
                         <image>${docker.registry}/${image-name}</image>
                         <tags>
+                            <tag>latest</tag>
                             <tag>${project.version}</tag>
                         </tags>
                     </to>

operator/Makefile

@@ -1,5 +1,6 @@
-VERSION ?= 0.3.1
-KEIP_INTEGRATION_IMAGE ?= ghcr.io/octoconsulting/keip/minimal-app:0.0.2
+VERSION ?= 0.3.2
+GIT_TAG := operator_v$(VERSION)
+KEIP_INTEGRATION_IMAGE ?= ghcr.io/octoconsulting/keip/minimal-app:latest
 
 KUBECTL := kubectl
 KUBECTL_DELETE := $(KUBECTL) delete --ignore-not-found
@@ -11,9 +12,9 @@ all: metacontroller/deploy controller/deploy
 .PHONY: clean
 clean: controller/undeploy metacontroller/undeploy
 
-.PHONY: get-version
-get-version:
-	@echo $(VERSION)
+.PHONY: get-tag
+get-tag:
+	@echo $(GIT_TAG)
 
 prep-release:
 	rm -rf output

operator/controller/integrationroute-controller.yaml

@@ -50,7 +50,7 @@ spec:
     spec:
       containers:
         - name: webhook
-          image: ghcr.io/octoconsulting/keip/route-webhook:0.6.1
+          image: ghcr.io/octoconsulting/keip/route-webhook:0.6.2
           ports:
             - containerPort: 7080
               name: webhook-http

operator/webhook/Makefile

@@ -1,5 +1,6 @@
-VERSION ?= 0.6.1
+VERSION ?= 0.6.2
 HOST_PORT ?= 7080
+GIT_TAG := webhook_v$(VERSION)
 
 IMG_REGISTRY := ghcr.io/octoconsulting
 IMG_NAME := keip/route-webhook
@@ -9,17 +10,17 @@ PYTHON := python3
 TEST_COVERAGE_DIR := .test_coverage
 TEST_COVERAGE_FILE := $(TEST_COVERAGE_DIR)/.coverage
 
-.PHONY: get-version
-get-version:
-	@echo $(VERSION)
+.PHONY: get-tag
+get-tag:
+	@echo $(GIT_TAG)
 
 .PHONY: get-registry
 get-registry:
 	@echo $(IMG_REGISTRY)
 
 .PHONY: get-image-name
 get-image-name:
-	@echo $(IMG_NAME)
+	@echo $(FULL_IMAGE_NAME)
 
 .PHONY: start-dev
 start-dev-server: