chore: separate layer signing from layer publishing

Author: apiarian-datadog

.gitlab/datasources/flavors.yaml

@@ -3,6 +3,7 @@ flavors:
     arch: amd64
     alpine: 0
     fips: 0
+    needs_layer_sign: true
     needs_layer_publish: true
     suffix: amd64
     layer_name_base_suffix: ""
@@ -13,6 +14,7 @@ flavors:
     arch: arm64
     alpine: 0
     fips: 0
+    needs_layer_sign: true
     needs_layer_publish: true
     suffix: arm64
     layer_name_base_suffix: "-ARM"
@@ -23,20 +25,23 @@ flavors:
     arch: amd64
     alpine: 1
     fips: 0
+    needs_layer_sign: false
     needs_layer_publish: false
     suffix: amd64-alpine
 
   - name: arm64, alpine
     arch: arm64
     alpine: 1
     fips: 0
+    needs_layer_sign: false
     needs_layer_publish: false
     suffix: arm64-alpine
 
   - name: amd64, fips
     arch: amd64
     alpine: 0
     fips: 1
+    needs_layer_sign: true
     needs_layer_publish: false
     suffix: amd64-fips
     max_layer_compressed_size_mb: 21
@@ -46,6 +51,7 @@ flavors:
     arch: arm64
     alpine: 0
     fips: 1
+    needs_layer_sign: true
     needs_layer_publish: false
     suffix: arm64-fips
     max_layer_compressed_size_mb: 19
@@ -55,13 +61,15 @@ flavors:
     arch: amd64
     alpine: 1
     fips: 1
+    needs_layer_sign: false
     needs_layer_publish: false
     suffix: amd64-fips-alpine
 
   - name: arm64, fips, alpine
     arch: arm64
     alpine: 1
     fips: 1
+    needs_layer_sign: false
     needs_layer_publish: false
     suffix: arm64-fips-alpine
 

.gitlab/templates/pipeline.yaml.tpl

@@ -124,8 +124,7 @@ check layer size ({{ $flavor.name }}):
 
 {{ end }} # end max_layer_compressed_size_mb
 
-{{ if $flavor.needs_layer_publish }}
-
+{{ if $flavor.needs_layer_sign }}
 sign layer ({{ $flavor.name }}):
   stage: sign
   tags: ["arch:amd64"]
@@ -150,6 +149,9 @@ sign layer ({{ $flavor.name }}):
     {{ end }}
   script:
     - .gitlab/scripts/sign_layers.sh prod
+{{ end }} # end needs_layer_sign
+
+{{ if $flavor.needs_layer_publish }}
 
 {{ range $environment_name, $environment := (ds "environments").environments }}
 
@@ -300,15 +302,11 @@ layer bundle:
   tags: ["arch:amd64"]
   needs:
     {{ range (ds "flavors").flavors }}
-    {{ if .needs_layer_publish }}
     - layer ({{ .name }})
-    {{ end }} # end needs_layer_publish
     {{ end }} # end flavors
   dependencies:
     {{ range (ds "flavors").flavors }}
-    {{ if .needs_layer_publish }}
     - layer ({{ .name }})
-    {{ end }} # end needs_layer_publish
     {{ end }} # end flavors
   artifacts:
     expire_in: 1 hr
@@ -328,13 +326,13 @@ signed layer bundle:
     - if: '$CI_COMMIT_TAG =~ /^v.*/'
   needs:
     {{ range (ds "flavors").flavors }}
-    {{ if .needs_layer_publish }}
+    {{ if .needs_layer_sign }}
     - sign layer ({{ .name }})
     {{ end }} # end needs_layer_publish
     {{ end }} # end flavors
   dependencies:
     {{ range (ds "flavors").flavors }}
-    {{ if .needs_layer_publish }}
+    {{ if .needs_layer_sign }}
     - sign layer ({{ .name }})
     {{ end }} # end needs_layer_publish
     {{ end }} # end flavors