Skip to content

build(deps): bump earthly/actions-setup from 1.0.7 to 1.0.8 #228

build(deps): bump earthly/actions-setup from 1.0.7 to 1.0.8

build(deps): bump earthly/actions-setup from 1.0.7 to 1.0.8 #228

Workflow file for this run

name: Build and deploy Mutilator
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
on:
push:
env:
GOOGLE_REGISTRY: europe-north1-docker.pkg.dev
EARTHLY_USE_INLINE_CACHE: true
EARTHLY_SAVE_INLINE_CACHE: true
EARTHLY_VERBOSE: true
EARTHLY_FULL_TARGET: true
EARTHLY_OUTPUT: true
jobs:
version:
name: Set variables
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # ratchet:actions/checkout@v3
- name: "Set image version"
id: constants
run: |
export version="$(date +%Y%m%d%H%M%S)-$(git describe --always --dirty --exclude '*')"
echo "VERSION=${version}" >> ${GITHUB_OUTPUT}
outputs:
version: "${{ steps.constants.outputs.VERSION }}"
build:
name: Build and push
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
packages: write
checks: write
pull-requests: write
needs:
- version
env:
VERSION: "${{ needs.version.outputs.version }}"
steps:
- uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # ratchet:actions/checkout@v3
- name: Install cosign
uses: sigstore/cosign-installer@11086d25041f77fe8fe7b9ea4e48e3b9192b8f19 # ratchet:sigstore/cosign-installer@main
with:
cosign-release: 'v2.1.1'
- name: Verify runner image
run: cosign verify --certificate-oidc-issuer https://accounts.google.com --certificate-identity keyless@distroless.iam.gserviceaccount.com gcr.io/distroless/static-debian11:nonroot
- id: "auth"
if: github.ref == 'refs/heads/main'
name: "Authenticate to Google Cloud"
uses: "google-github-actions/auth@v1.1.1" # ratchet:google-github-actions/auth@v1.0.0
with:
workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}
service_account: "gh-mutilator@nais-io.iam.gserviceaccount.com"
token_format: "access_token"
- name: Login to Google Artifact Registry
if: github.ref == 'refs/heads/main'
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # ratchet:docker/login-action@v2
with:
registry: ${{ env.GOOGLE_REGISTRY }}
username: "oauth2accesstoken"
password: "${{ steps.auth.outputs.access_token }}"
- name: Login to GitHub Packages Docker Registry
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # ratchet:docker/login-action@v2
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Install earthly
uses: earthly/actions-setup@be3fe0c1f84e9776b5a184d21bf7a4a779ea2e6b # ratchet:earthly/actions-setup@v1
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
use-cache: true
- name: Build and possibly push mutilator
env:
EARTHLY_PUSH: "${{ github.ref == 'refs/heads/main' }}"
run: |
earthly config global.cache_size_pct 50
earthly +docker --VERSION=${VERSION} --REGISTRY=${GOOGLE_REGISTRY}
- name: Retrieve image digest
id: imgdigest
if: github.ref == 'refs/heads/main'
run: |
docker pull ${{ env.GOOGLE_REGISTRY }}/nais-io/nais/images/mutilator:${VERSION}
echo "digest=$(docker inspect ${{ env.GOOGLE_REGISTRY }}/nais-io/nais/images/mutilator:${VERSION} | jq -r '.[].RepoDigests[0]')" >> $GITHUB_OUTPUT
- name: Sign the container image
if: github.ref == 'refs/heads/main'
run: cosign sign --yes ${{ steps.imgdigest.outputs.digest }}
- name: Create SBOM
if: github.ref == 'refs/heads/main'
uses: aquasecurity/trivy-action@fbd16365eb88e12433951383f5e99bd901fc618f # ratchet:aquasecurity/trivy-action@master
with:
scan-type: 'image'
format: 'cyclonedx'
output: 'cyclone.sbom.json'
image-ref: ${{ steps.imgdigest.outputs.digest }}
- name: Attest image
if: github.ref == 'refs/heads/main'
run: cosign attest --yes --predicate cyclone.sbom.json --type cyclonedx ${{ steps.imgdigest.outputs.digest }}
- name: Publish Test Results
uses: EnricoMi/publish-unit-test-result-action@v2
if: always()
with:
files: |
target/nextest/ci/*.xml
chart:
permissions:
contents: 'read'
id-token: 'write'
name: Build and push chart
runs-on: ubuntu-latest
needs:
- version
steps:
- uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # ratchet:actions/checkout@v3
- id: "auth"
if: github.ref == 'refs/heads/main'
name: "Authenticate to Google Cloud"
uses: "google-github-actions/auth@v1.1.1" # ratchet:google-github-actions/auth@v1.0.0
with:
workload_identity_provider: ${{ secrets.NAIS_IO_WORKLOAD_IDENTITY_PROVIDER }}
service_account: "gh-mutilator@nais-io.iam.gserviceaccount.com"
token_format: "access_token"
- name: Login to Google Artifact Registry
if: github.ref == 'refs/heads/main'
uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # ratchet:docker/login-action@v2
with:
registry: ${{ env.GOOGLE_REGISTRY }}
username: "oauth2accesstoken"
password: "${{ steps.auth.outputs.access_token }}"
- name: 'Set up Cloud SDK'
uses: 'google-github-actions/setup-gcloud@e30db14379863a8c79331b04a9969f4c1e225e0b' # ratchet:google-github-actions/setup-gcloud@v1
- uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78 # ratchet:azure/setup-helm@v3
name: 'Setup Helm'
with:
version: '3.8.0'
- name: Set versions
run: |-
for chart in charts/*; do
yq e '.version = "${{ needs.version.outputs.version }}"' --inplace "${chart}/Chart.yaml"
yq e '.image.tag = "${{ needs.version.outputs.version }}"' --inplace "${chart}/values.yaml"
done
- name: Build Chart
run: |-
for chart in charts/*; do
helm package "$chart"
done
- name: Push Chart
if: github.ref == 'refs/heads/main'
run: |-
for chart in *.tgz; do
helm push "$chart" oci://${{ env.GOOGLE_REGISTRY }}/nais-io/nais/feature
done
rollout:
name: Rollout
if: github.actor != 'dependabot[bot]' && github.ref == 'refs/heads/main'
needs:
- version
- build
- chart
runs-on: fasit-deploy
permissions:
id-token: write
steps:
- uses: nais/fasit-deploy@badff0705af8a57bcf0ab172895273da09ae5959 # ratchet:nais/fasit-deploy@v2
with:
chart: oci://${{ env.GOOGLE_REGISTRY }}/nais-io/nais/feature/mutilator
version: ${{ needs.version.outputs.version }}
feature_name: mutilator