Bump framework (#3013) #280
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| # Bump the CI | |
| push: | |
| tags: | |
| - v* | |
| env: | |
| FORCE_COLOR: 1 | |
| EARTHLY_TOKEN: ${{ secrets.EARTHLY_TOKEN }} | |
| permissions: read-all | |
| jobs: | |
| get-core-matrix: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - run: | | |
| sudo apt update && sudo apt install -y jq | |
| - id: set-matrix | |
| run: | | |
| content=`cat ./.github/flavors.json | jq -r 'map(select(.arch == "amd64" and .variant == "core"))'` | |
| # the following lines are only required for multi line json | |
| content="${content//'%'/'%25'}" | |
| content="${content//$'\n'/'%0A'}" | |
| content="${content//$'\r'/'%0D'}" | |
| # end of optional handling for multi line json | |
| echo "::set-output name=matrix::{\"include\": $content }" | |
| get-uki-matrix: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - run: | | |
| sudo apt update && sudo apt install -y jq | |
| - id: set-matrix | |
| run: | | |
| content=`cat ./.github/flavors.json | jq -r 'map(select(.arch == "amd64" and (.flavor == "fedora" or (.flavor == "ubuntu" and (.flavorRelease == "24.04")))))'` | |
| # the following lines are only required for multi line json | |
| content="${content//'%'/'%25'}" | |
| content="${content//$'\n'/'%0A'}" | |
| content="${content//$'\r'/'%0D'}" | |
| # end of optional handling for multi line json | |
| echo "::set-output name=matrix::{\"include\": $content }" | |
| # The matrix for standard (provider) images | |
| get-standard-matrix: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| matrix: ${{ steps.set-matrix.outputs.matrix }} | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - run: | | |
| sudo apt update && sudo apt install -y jq wget | |
| - name: Install earthly | |
| uses: Luet-lab/luet-install-action@cec77490c3f2416d7d07a47cfab04d448641d7ce # v1.1 | |
| with: | |
| repository: quay.io/kairos/packages | |
| packages: utils/earthly | |
| - id: set-matrix | |
| run: | | |
| docker run --name luet quay.io/luet/base && docker cp luet:/usr/bin/luet ./ | |
| chmod +x luet | |
| sudo mv luet /usr/bin/luet | |
| # Construct an array like this from the found versions: | |
| earthly --platform=linux/amd64 +extract-framework-profile | |
| # fetch "k3s-openrc" versions | |
| sudo luet --config framework-profile.yaml search -o json k8s/k3s | jq '.packages | map(select(.name == "k3s-openrc")) | map(.version) | unique' > k3s_openrc.json | |
| # fetch alpine flavors | |
| jq 'map(select(.arch == "amd64" and .variant == "standard" and .model == "generic" and .flavor == "alpine"))' .github/flavors.json > flavors_openrc.json | |
| # generate combinations | |
| jq -s '. | [combinations | .[0] + {"k3s_version": .[1]}]' flavors_openrc.json k3s_openrc.json > combinations_openrc.json | |
| # fetch "k3s-systemd" versions | |
| sudo luet --config framework-profile.yaml search -o json k8s/k3s | jq '.packages | map(select(.name == "k3s-systemd")) | map(.version) | unique' > k3s_systemd.json | |
| # fetch non-alpine flavors | |
| jq 'map(select(.arch == "amd64" and .variant == "standard" and .model == "generic" and .flavor != "alpine"))' .github/flavors.json > flavors_systemd.json | |
| # generate combinations | |
| jq -s '. | [combinations | .[0] + {"k3s_version": .[1]}]' flavors_systemd.json k3s_systemd.json > combinations_systemd.json | |
| # merge the two combinations | |
| content=$(jq -s 'add' combinations_openrc.json combinations_systemd.json) | |
| # the following lines are only required for multi line json | |
| content="${content//'%'/'%25'}" | |
| content="${content//$'\n'/'%0A'}" | |
| content="${content//$'\r'/'%0D'}" | |
| # end of optional handling for multi line json | |
| echo "::set-output name=matrix::{\"include\": $content }" | |
| build-core: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - get-core-matrix | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| actions: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJson(needs.get-core-matrix.outputs.matrix) }} | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@main | |
| - name: Release space from worker | |
| run: | | |
| echo "Listing top largest packages" | |
| pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr) | |
| head -n 30 <<< "${pkgs}" | |
| echo | |
| df -h | |
| echo | |
| sudo apt-get remove -y '^llvm-.*|^libllvm.*' || true | |
| sudo apt-get remove --auto-remove android-sdk-platform-tools || true | |
| sudo apt-get purge --auto-remove android-sdk-platform-tools || true | |
| sudo rm -rf /usr/local/lib/android | |
| sudo apt-get remove -y '^dotnet-.*|^aspnetcore-.*' || true | |
| sudo rm -rf /usr/share/dotnet | |
| sudo apt-get remove -y '^mono-.*' || true | |
| sudo apt-get remove -y '^ghc-.*' || true | |
| sudo apt-get remove -y '.*jdk.*|.*jre.*' || true | |
| sudo apt-get remove -y 'php.*' || true | |
| sudo apt-get remove -y hhvm || true | |
| sudo apt-get remove -y powershell || true | |
| sudo apt-get remove -y firefox || true | |
| sudo apt-get remove -y monodoc-manual || true | |
| sudo apt-get remove -y msbuild || true | |
| sudo apt-get remove -y microsoft-edge-stable || true | |
| sudo apt-get remove -y '^google-.*' || true | |
| sudo apt-get remove -y azure-cli || true | |
| sudo apt-get remove -y '^mongo.*-.*|^postgresql-.*|^mysql-.*|^mssql-.*' || true | |
| sudo apt-get remove -y '^gfortran-.*' || true | |
| sudo apt-get remove -y '^gcc-*' || true | |
| sudo apt-get remove -y '^g++-*' || true | |
| sudo apt-get remove -y '^cpp-*' || true | |
| sudo apt-get autoremove -y | |
| sudo apt-get clean | |
| echo | |
| echo "Listing top largest packages" | |
| pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr) | |
| head -n 30 <<< "${pkgs}" | |
| echo | |
| sudo rm -rfv build || true | |
| sudo rm -rf /usr/local/lib/android # will release about 10 GB if you don't need Android | |
| sudo rm -rf /usr/share/dotnet # will release about 20GB if you don't need .NET | |
| df -h | |
| - name: Login to Quay Registry | |
| run: echo ${{ secrets.QUAY_PASSWORD }} | docker login -u ${{ secrets.QUAY_USERNAME }} --password-stdin quay.io | |
| - name: Install earthly | |
| uses: Luet-lab/luet-install-action@cec77490c3f2416d7d07a47cfab04d448641d7ce # v1.1 | |
| with: | |
| repository: quay.io/kairos/packages | |
| packages: utils/earthly | |
| - name: Build 🔧 | |
| run: | | |
| earthly +all \ | |
| --VARIANT=${{ matrix.variant }} \ | |
| --FAMILY=${{ matrix.family }} \ | |
| --FLAVOR=${{ matrix.flavor }} \ | |
| --FLAVOR_RELEASE=${{ matrix.flavorRelease }} \ | |
| --MODEL=${{ matrix.model }} \ | |
| --BASE_IMAGE=${{ matrix.baseImage }} | |
| sudo mv build release | |
| - name: Push to quay | |
| env: | |
| COSIGN_YES: true | |
| if: startsWith(github.ref, 'refs/tags/') | |
| run: | | |
| export IMAGE=$(cat release/IMAGE) | |
| docker push "$IMAGE" | |
| image_ref=$(docker image inspect --format='{{index .RepoDigests 0}}' "$IMAGE") | |
| spdx=$(ls release/*.spdx.json) | |
| cosign attach sbom --sbom $spdx $image_ref | |
| cosign sign $image_ref --attachment sbom | |
| # in-toto attestation | |
| cosign attest --type spdx --predicate $spdx $image_ref | |
| - name: Sign ISO sha files | |
| env: | |
| COSIGN_YES: true | |
| run: | | |
| sudo chmod -R 777 release | |
| filename=$(ls release/*.iso.sha256) | |
| cosign sign-blob --yes --output-certificate="${filename}.pem" \ | |
| --output-signature="${filename}.sig" "${filename}" | |
| - name: Prepare files for release | |
| run: | | |
| mkdir trivy-sarif grype-sarif | |
| sudo mv release/*trivy.sarif trivy-sarif/ | |
| sudo mv release/*grype.sarif grype-sarif/ | |
| mkdir reports | |
| mv release/*.json reports/ | |
| cd reports | |
| filename=$(ls *-grype.json | head -n 1) && filename=${filename%%-grype.json} | |
| sudo tar cvf "${filename}-sbom-scan-reports.tar.gz" *.json | |
| mv *.tar.gz ../release/ | |
| cd .. | |
| rm release/IMAGE release/VERSION release/versions.yaml | |
| - name: Release | |
| uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| files: | | |
| release/* | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@396bb3e45325a47dd9ef434068033c6d5bb0d11a # v3 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| sarif_file: 'trivy-sarif' | |
| category: ${{ matrix.flavor }}-trivy | |
| - name: Upload Grype scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@396bb3e45325a47dd9ef434068033c6d5bb0d11a # v3 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| sarif_file: 'grype-sarif' | |
| category: ${{ matrix.flavor }}-grype | |
| build-uki-container-image: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| actions: read | |
| security-events: write | |
| needs: | |
| - get-uki-matrix | |
| strategy: | |
| matrix: ${{ fromJson(needs.get-uki-matrix.outputs.matrix) }} | |
| steps: | |
| - name: Release space from worker | |
| run: | | |
| echo "Listing top largest packages" | |
| pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr) | |
| head -n 30 <<< "${pkgs}" | |
| echo | |
| df -h | |
| echo | |
| sudo apt-get remove -y '^llvm-.*|^libllvm.*' || true | |
| sudo apt-get remove --auto-remove android-sdk-platform-tools || true | |
| sudo apt-get purge --auto-remove android-sdk-platform-tools || true | |
| sudo rm -rf /usr/local/lib/android | |
| sudo apt-get remove -y '^dotnet-.*|^aspnetcore-.*' || true | |
| sudo rm -rf /usr/share/dotnet | |
| sudo apt-get remove -y '^mono-.*' || true | |
| sudo apt-get remove -y '^ghc-.*' || true | |
| sudo apt-get remove -y '.*jdk.*|.*jre.*' || true | |
| sudo apt-get remove -y 'php.*' || true | |
| sudo apt-get remove -y hhvm || true | |
| sudo apt-get remove -y powershell || true | |
| sudo apt-get remove -y firefox || true | |
| sudo apt-get remove -y monodoc-manual || true | |
| sudo apt-get remove -y msbuild || true | |
| sudo apt-get remove -y microsoft-edge-stable || true | |
| sudo apt-get remove -y '^google-.*' || true | |
| sudo apt-get remove -y azure-cli || true | |
| sudo apt-get remove -y '^mongo.*-.*|^postgresql-.*|^mysql-.*|^mssql-.*' || true | |
| sudo apt-get remove -y '^gfortran-.*' || true | |
| sudo apt-get remove -y '^gcc-*' || true | |
| sudo apt-get remove -y '^g++-*' || true | |
| sudo apt-get remove -y '^cpp-*' || true | |
| sudo apt-get autoremove -y | |
| sudo apt-get clean | |
| echo | |
| echo "Listing top largest packages" | |
| pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr) | |
| head -n 30 <<< "${pkgs}" | |
| echo | |
| sudo rm -rfv build || true | |
| df -h | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | |
| - run: | | |
| git fetch --prune --unshallow | |
| - name: Release space from worker | |
| run: | | |
| sudo rm -rf /usr/local/lib/android # will release about 10 GB if you don't need Android | |
| sudo rm -rf /usr/share/dotnet # will release about 20GB if you don't need .NET | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@master | |
| with: | |
| platforms: all | |
| - name: Set up Docker Buildx | |
| id: buildx | |
| uses: docker/setup-buildx-action@master | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@main | |
| - name: Login to Quay Registry | |
| run: echo ${{ secrets.QUAY_PASSWORD }} | docker login -u ${{ secrets.QUAY_USERNAME }} --password-stdin quay.io | |
| - name: Install earthly | |
| uses: Luet-lab/luet-install-action@cec77490c3f2416d7d07a47cfab04d448641d7ce # v1.1 | |
| with: | |
| repository: quay.io/kairos/packages | |
| packages: utils/earthly | |
| - name: Block all traffic to metadata ip # For cloud runners, the metadata ip can interact with our test machines | |
| run: | | |
| sudo iptables -I INPUT -s 169.254.169.254 -j DROP | |
| sudo iptables -I OUTPUT -d 169.254.169.254 -j DROP | |
| - name: Build 🔧 | |
| run: | | |
| earthly --platform=linux/amd64 +base-image \ | |
| --VARIANT=${{ matrix.variant }} \ | |
| --FLAVOR=${{ matrix.flavor }} \ | |
| --FLAVOR_RELEASE="${{ matrix.flavorRelease }}" \ | |
| --BASE_IMAGE=${{ matrix.baseImage }} \ | |
| --MODEL=${{ matrix.model }} \ | |
| --FAMILY=${{ matrix.family }} \ | |
| --BOOTLOADER=systemd-boot | |
| sudo mv build/* . | |
| sudo rm -rf build | |
| - name: Install kairos-agent (for versioneer) | |
| uses: Luet-lab/luet-install-action@cec77490c3f2416d7d07a47cfab04d448641d7ce # v1.1 | |
| with: | |
| repository: quay.io/kairos/packages | |
| packages: system/kairos-agent | |
| - name: Push to quay | |
| env: | |
| COSIGN_YES: true | |
| run: | | |
| SUFFIX="-uki" | |
| IMAGE=$(cat IMAGE) | |
| docker tag $(cat IMAGE) "$IMAGE$SUFFIX" | |
| docker push "$IMAGE$SUFFIX" | |
| image_ref=$(docker image inspect --format='{{index .RepoDigests 0}}' "$IMAGE$SUFFIX") | |
| cosign sign $image_ref | |
| - name: Build UKI ISO | |
| run: | | |
| earthly +uki-iso \ | |
| --BASE_IMAGE=quay.io/kairos/${{ matrix.flavor }}:${{ matrix.flavorRelease }}-${{ matrix.variant }}-${{ matrix.arch }}-${{ matrix.model }}-${{ github.ref_name }}-uki \ | |
| --ENKI_CREATE_CI_KEYS=true | |
| - name: Release | |
| uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| files: | | |
| build/*.efi | |
| build-standard: | |
| runs-on: ubuntu-latest | |
| needs: | |
| - get-standard-matrix | |
| permissions: | |
| id-token: write # OIDC support | |
| contents: write | |
| actions: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: ${{ fromJson(needs.get-standard-matrix.outputs.matrix) }} | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@main | |
| - name: Release space from worker | |
| run: | | |
| echo "Listing top largest packages" | |
| pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr) | |
| head -n 30 <<< "${pkgs}" | |
| echo | |
| df -h | |
| echo | |
| sudo apt-get remove -y '^llvm-.*|^libllvm.*' || true | |
| sudo apt-get remove --auto-remove android-sdk-platform-tools || true | |
| sudo apt-get purge --auto-remove android-sdk-platform-tools || true | |
| sudo rm -rf /usr/local/lib/android | |
| sudo apt-get remove -y '^dotnet-.*|^aspnetcore-.*' || true | |
| sudo rm -rf /usr/share/dotnet | |
| sudo apt-get remove -y '^mono-.*' || true | |
| sudo apt-get remove -y '^ghc-.*' || true | |
| sudo apt-get remove -y '.*jdk.*|.*jre.*' || true | |
| sudo apt-get remove -y 'php.*' || true | |
| sudo apt-get remove -y hhvm || true | |
| sudo apt-get remove -y powershell || true | |
| sudo apt-get remove -y firefox || true | |
| sudo apt-get remove -y monodoc-manual || true | |
| sudo apt-get remove -y msbuild || true | |
| sudo apt-get remove -y microsoft-edge-stable || true | |
| sudo apt-get remove -y '^google-.*' || true | |
| sudo apt-get remove -y azure-cli || true | |
| sudo apt-get remove -y '^mongo.*-.*|^postgresql-.*|^mysql-.*|^mssql-.*' || true | |
| sudo apt-get remove -y '^gfortran-.*' || true | |
| sudo apt-get remove -y '^gcc-*' || true | |
| sudo apt-get remove -y '^g++-*' || true | |
| sudo apt-get remove -y '^cpp-*' || true | |
| sudo apt-get autoremove -y | |
| sudo apt-get clean | |
| echo | |
| echo "Listing top largest packages" | |
| pkgs=$(dpkg-query -Wf '${Installed-Size}\t${Package}\t${Status}\n' | awk '$NF == "installed"{print $1 "\t" $2}' | sort -nr) | |
| head -n 30 <<< "${pkgs}" | |
| echo | |
| sudo rm -rfv build || true | |
| df -h | |
| - name: Install earthly | |
| uses: Luet-lab/luet-install-action@cec77490c3f2416d7d07a47cfab04d448641d7ce # v1.1 | |
| with: | |
| repository: quay.io/kairos/packages | |
| packages: utils/earthly | |
| - name: Login to Quay Registry | |
| run: echo ${{ secrets.QUAY_PASSWORD }} | docker login -u ${{ secrets.QUAY_USERNAME }} --password-stdin quay.io | |
| - name: Build 🔧 | |
| run: | | |
| earthly +all \ | |
| --VARIANT=${{ matrix.variant }} \ | |
| --FAMILY=${{ matrix.family }} \ | |
| --FLAVOR=${{ matrix.flavor }} \ | |
| --FLAVOR_RELEASE=${{ matrix.flavorRelease }} \ | |
| --MODEL=${{ matrix.model }} \ | |
| --K3S_VERSION=${{ matrix.k3s_version }} \ | |
| --BASE_IMAGE=${{ matrix.baseImage }} | |
| sudo mv build release | |
| - name: Push to quay | |
| if: startsWith(github.ref, 'refs/tags/') | |
| env: | |
| COSIGN_YES: true | |
| run: | | |
| IMAGE=$(cat release/IMAGE) | |
| docker push "$IMAGE" | |
| cosign sign $(docker image inspect --format='{{index .RepoDigests 0}}' "$IMAGE") | |
| - name: Prepare files for release | |
| run: | | |
| mkdir sarif | |
| mv release/*.sarif sarif/ | |
| mkdir reports | |
| mv release/*.json reports/ | |
| cd reports | |
| filename=$(ls *-grype.json | head -n 1) && filename=${filename%%-grype.json} | |
| sudo tar cvf "${filename}-sbom-scan-reports.tar.gz" *.json | |
| mv *.tar.gz ../release/ | |
| cd .. | |
| sudo rm -rf release/VERSION release/IMAGE release/versions.yaml | |
| - name: Release | |
| uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0 | |
| if: startsWith(github.ref, 'refs/tags/') | |
| with: | |
| files: | | |
| release/* |