Synclatestargo #2
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Image | |
| on: | |
| push: | |
| branches: | |
| - master | |
| pull_request: | |
| branches: | |
| - master | |
| types: [ labeled, unlabeled, opened, synchronize, reopened ] | |
| env: | |
| GOLANG_VERSION: '1.18' | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| publish: | |
| permissions: | |
| contents: write # for git to push upgrade commit if not already deployed | |
| packages: write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags | |
| if: github.repository == 'argoproj/argo-cd' | |
| runs-on: ubuntu-22.04 | |
| env: | |
| GOPATH: /home/runner/work/argo-cd/argo-cd | |
| steps: | |
| - uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0 | |
| with: | |
| go-version: ${{ env.GOLANG_VERSION }} | |
| - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 | |
| with: | |
| path: src/github.com/argoproj/argo-cd | |
| # get image tag | |
| - run: echo "tag=$(cat ./VERSION)-${GITHUB_SHA::8}" >> $GITHUB_OUTPUT | |
| working-directory: ./src/github.com/argoproj/argo-cd | |
| id: image | |
| # login | |
| - run: | | |
| docker login ghcr.io --username $USERNAME --password-stdin <<< "$PASSWORD" | |
| docker login quay.io --username "$DOCKER_USERNAME" --password-stdin <<< "$DOCKER_TOKEN" | |
| if: github.event_name == 'push' | |
| env: | |
| USERNAME: ${{ github.actor }} | |
| PASSWORD: ${{ secrets.GITHUB_TOKEN }} | |
| DOCKER_USERNAME: ${{ secrets.RELEASE_QUAY_USERNAME }} | |
| DOCKER_TOKEN: ${{ secrets.RELEASE_QUAY_TOKEN }} | |
| # build | |
| - uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0 | |
| - uses: docker/setup-buildx-action@8c0edbc76e98fa90f69d9a2c020dcb50019dc325 # v2.2.1 | |
| - run: | | |
| IMAGE_PLATFORMS=linux/amd64 | |
| if [[ "${{ github.event_name }}" == "push" || "${{ contains(github.event.pull_request.labels.*.name, 'test-arm-image') }}" == "true" ]] | |
| then | |
| IMAGE_PLATFORMS=linux/amd64,linux/arm64,linux/s390x,linux/ppc64le | |
| fi | |
| echo "Building image for platforms: $IMAGE_PLATFORMS" | |
| docker buildx build --platform $IMAGE_PLATFORMS --sbom=false --provenance=false --push="${{ github.event_name == 'push' }}" \ | |
| -t ghcr.io/argoproj/argo-cd/argocd:${{ steps.image.outputs.tag }} \ | |
| -t quay.io/argoproj/argocd:latest . | |
| working-directory: ./src/github.com/argoproj/argo-cd | |
| # sign container images | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@9becc617647dfa20ae7b1151972e9b3a2c338a2b # v2.8.1 | |
| with: | |
| cosign-release: 'v1.13.1' | |
| - name: Install crane to get digest of image | |
| uses: imjasonh/setup-crane@e82f1b9a8007d399333baba4d75915558e9fb6a4 | |
| - name: Get digest of image | |
| run: | | |
| echo "IMAGE_DIGEST=$(crane digest quay.io/argoproj/argocd:latest)" >> $GITHUB_ENV | |
| - name: Sign Argo CD latest image | |
| run: | | |
| cosign sign --key env://COSIGN_PRIVATE_KEY quay.io/argoproj/argocd@${{ env.IMAGE_DIGEST }} | |
| # Displays the public key to share. | |
| cosign public-key --key env://COSIGN_PRIVATE_KEY | |
| env: | |
| COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}} | |
| COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}} | |
| if: ${{ github.event_name == 'push' }} | |
| # deploy | |
| - run: git clone "https://$TOKEN@github.com/argoproj/argoproj-deployments" | |
| if: github.event_name == 'push' | |
| env: | |
| TOKEN: ${{ secrets.TOKEN }} | |
| - run: | | |
| docker run -u $(id -u):$(id -g) -v $(pwd):/src -w /src --rm -t ghcr.io/argoproj/argo-cd/argocd:${{ steps.image.outputs.tag }} kustomize edit set image quay.io/argoproj/argocd=ghcr.io/argoproj/argo-cd/argocd:${{ steps.image.outputs.tag }} | |
| git config --global user.email 'ci@argoproj.com' | |
| git config --global user.name 'CI' | |
| git diff --exit-code && echo 'Already deployed' || (git commit -am 'Upgrade argocd to ${{ steps.image.outputs.tag }}' && git push) | |
| if: github.event_name == 'push' | |
| working-directory: argoproj-deployments/argocd | |
| # TODO: clean up old images once github supports it: https://git.luolix.topmunity/t5/How-to-use-Git-and-GitHub/Deleting-images-from-GitHub-Package-Registry/m-p/41202/thread-id/9811 |