feat: create a unicorn flavor of gitlab

.github/workflows/lint.yaml

@@ -12,6 +12,7 @@ jobs:
     name: Lint
     permissions:
       contents: read # Allows reading the repo contents
+      id-token: write
 
     steps:
       - name: Checkout
@@ -25,6 +26,8 @@ jobs:
           registry1Username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
           registry1Password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }}
           ghToken: ${{ secrets.GITHUB_TOKEN }}
+          chainguardIdentity: ${{ secrets.CHAINGUARD_IDENTITY }}
+
 
       - name: Install lint deps
         run: |

.github/workflows/tag-and-release.yaml

@@ -28,7 +28,7 @@ jobs:
     timeout-minutes: 40
     strategy:
       matrix:
-        flavor: [upstream, registry1]
+        flavor: [upstream, unicorn, registry1]
         architecture: [amd64, arm64]
         exclude:
           - flavor: registry1
@@ -37,6 +37,8 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
+
 
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
@@ -47,6 +49,7 @@ jobs:
           registry1Username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
           registry1Password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }}
           ghToken: ${{ secrets.GITHUB_TOKEN }}
+          chainguardIdentity: ${{ secrets.CHAINGUARD_IDENTITY }}
 
       - name: Build Package
         run: uds run -f tasks/publish.yaml build-package --set FLAVOR=${{ matrix.flavor }} --no-progress

.github/workflows/test.yaml

@@ -30,6 +30,7 @@ concurrency:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   run-test:
@@ -38,9 +39,11 @@ jobs:
     timeout-minutes: 25
     strategy:
       matrix:
-        flavor: [upstream, registry1]
+        flavor: [upstream, unicorn, registry1]
         type: [install, upgrade]
-
+        exclude:
+          - flavor: unicorn
+            type: upgrade
     steps:
       - name: Checkout repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
@@ -51,6 +54,7 @@ jobs:
           registry1Username: ${{ secrets.IRON_BANK_ROBOT_USERNAME }}
           registry1Password: ${{ secrets.IRON_BANK_ROBOT_PASSWORD }}
           ghToken: ${{ secrets.GITHUB_TOKEN }}
+          chainguardIdentity: ${{ secrets.CHAINGUARD_IDENTITY }}
 
       - name: Test
         uses: defenseunicorns/uds-common/.github/actions/test@76287d41ec5f06ecbdd0a6453877a78675aceffe # v0.11.2

README.md

@@ -77,6 +77,7 @@ Object Storage works a bit differently as there are many kinds of file stores Gi
 | ------ | ----------- | ---------------- |
 | upstream | Uses upstream images within the package. | `zarf package create . -f upstream` |
 | registry1 | Uses images from registry1.dso.mil within the package. | `zarf package create . -f registry1` |
+| unicorn | Uses images from cgr.dev within the package. | `zarf package create . -f unicorn` |
 
 > [!IMPORTANT]
 > **NOTE:** To create the registry1 flavor you will need to be logged into Iron Bank - you can find instructions on how to do this in the [Big Bang Zarf Tutorial](https://docs.zarf.dev/tutorials/6-big-bang/#setup).

values/unicorn-values.yaml

@@ -0,0 +1,71 @@
+gitlab:
+  webservice:
+    image:
+      repository: registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ee
+      tag: v17.2.1
+    workhorse:
+      image: registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ee
+      # renovate: datasource=docker depName=registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ee versioning=semver
+      tag: v17.2.1
+  sidekiq:
+    image:
+      repository: cgr.dev/du-uds-defenseunicorns/gitlab-sidekiq-ee
+      tag: 17.2.1
+  migrations:
+    image:
+      repository: registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ee
+      tag: v17.2.1
+  gitaly:
+    image:
+      repository: registry.gitlab.com/gitlab-org/build/cng/gitaly
+      tag: v17.2.1
+  gitlab-exporter:
+    image:
+      repository: cgr.dev/du-uds-defenseunicorns/gitlab-exporter-fips
+      tag: 17.2.1
+  gitlab-pages:
+    image:
+      repository: registry.gitlab.com/gitlab-org/build/cng/gitlab-pages
+      tag: v17.2.1
+  gitlab-shell:
+    image:
+      repository: cgr.dev/du-uds-defenseunicorns/gitlab-shell-fips
+      tag: 17.2.1
+  praefect:
+    image:
+      repository: cgr.dev/du-uds-defenseunicorns/gitaly-fips
+      tag: 17.2.2
+  toolbox:
+    image:
+      repository: registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ee
+      tag: v17.2.1
+
+global:
+  certificates:
+    image:
+      repository: registry.gitlab.com/gitlab-org/build/cng/certificates
+      tag: v17.2.1
+  gitlabBase:
+    image:
+      repository: cgr.dev/du-uds-defenseunicorns/gitlab-base-fips
+      tag: 17.2.1
+  kubectl:
+    image:
+      repository: registry.gitlab.com/gitlab-org/build/cng/kubectl
+      tag: v17.2.1
+
+registry:
+  image:
+    repository: cgr.dev/du-uds-defenseunicorns/gitlab-container-registry-fips
+    tag: 17.2.1
+
+shared-secrets:
+  selfsign:
+    image:
+      repository: cgr.dev/du-uds-defenseunicorns/cfssl-self-sign-fips
+      tag: 17.1.2
+
+upgradeCheck:
+  image:
+    repository: cgr.dev/du-uds-defenseunicorns/gitlab-base-fips
+    tag: 17.2.1

zarf.yaml

@@ -87,3 +87,29 @@ components:
       - "registry.gitlab.com/gitlab-org/build/cng/kubectl:v17.2.1"
       - "registry.gitlab.com/gitlab-org/build/cng/gitlab-base:v17.2.1"
       - "registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter:v17.2.1"
+
+  - name: gitlab
+    required: true
+    description: "Deploy gitlab with chainguard images"
+    import:
+      path: common
+    only:
+      flavor: unicorn
+    charts:
+      - name: gitlab
+        valuesFiles:
+          - values/unicorn-values.yaml
+    images:
+      - "registry.gitlab.com/gitlab-org/build/cng/certificates:v17.2.1"
+      - "cgr.dev/du-uds-defenseunicorns/cfssl-self-sign-fips:17.1.2"
+      - "registry.gitlab.com/gitlab-org/build/cng/gitaly:v17.2.1" #"cgr.dev/du-uds-defenseunicorns/gitaly-fips:17.2.2"
+      - "cgr.dev/du-uds-defenseunicorns/gitlab-container-registry-fips:17.2.1"
+      - "registry.gitlab.com/gitlab-org/build/cng/gitlab-pages:v17.2.1"
+      - "cgr.dev/du-uds-defenseunicorns/gitlab-shell-fips:17.2.1"
+      - "cgr.dev/du-uds-defenseunicorns/gitlab-sidekiq-ee:17.2.1"
+      - "registry.gitlab.com/gitlab-org/build/cng/gitlab-toolbox-ee:v17.2.1"
+      - "registry.gitlab.com/gitlab-org/build/cng/gitlab-webservice-ee:v17.2.1" #"cgr.dev/du-uds-defenseunicorns/gitlab-webservice-ee:17.2.1"
+      - "registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ee:v17.2.1"
+      - "registry.gitlab.com/gitlab-org/build/cng/kubectl:v17.2.1"
+      - "cgr.dev/du-uds-defenseunicorns/gitlab-base-fips:17.2.1"
+      - "cgr.dev/du-uds-defenseunicorns/gitlab-exporter-fips:17.2.1"