Skip to content

Commit 2645017

Browse files
mjudeikismjudeikis
committed
republish old tags
1 parent 6ac88b0 commit 2645017

1 file changed

Lines changed: 178 additions & 0 deletions

File tree

‎.github/workflows/republish-images.yaml‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
# Ad-hoc workflow to republish release images that were purged from GHCR
2+
# when the GitHub organization was renamed (kube-bind -> kbind-dev).
3+
#
4+
# Run it manually:
5+
# gh workflow run republish-images.yaml -f tags="v0.7.0 v0.7.1 v0.8.0 v0.8.1"
6+
#
7+
# For each tag it checks out the tag and rebuilds/pushes/signs the multi-arch
8+
# (linux/amd64 + linux/arm64) konnector and backend images the same way the
9+
# Image workflow did at those tags. It deliberately does NOT push the
10+
# `latest` tag so old releases don't overwrite it.
11+
name: Republish release images
12+
13+
on:
14+
workflow_dispatch:
15+
inputs:
16+
tags:
17+
description: 'Space-separated release tags to republish'
18+
required: true
19+
default: 'v0.7.0 v0.7.1 v0.8.0 v0.8.1'
20+
push_charts:
21+
description: 'Also republish Helm charts (deploy/charts/*)'
22+
type: boolean
23+
default: true
24+
25+
permissions:
26+
contents: read
27+
packages: write
28+
id-token: write
29+
30+
jobs:
31+
matrix:
32+
runs-on: ubuntu-latest
33+
outputs:
34+
tags: ${{ steps.set.outputs.tags }}
35+
steps:
36+
- id: set
37+
run: echo "tags=$(echo '${{ inputs.tags }}' | jq -cR 'split(" ") | map(select(length > 0))')" >> "$GITHUB_OUTPUT"
38+
39+
republish:
40+
needs: matrix
41+
runs-on: ubuntu-latest
42+
strategy:
43+
fail-fast: false
44+
matrix:
45+
tag: ${{ fromJSON(needs.matrix.outputs.tags) }}
46+
steps:
47+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
48+
with:
49+
ref: ${{ matrix.tag }}
50+
# Full history + tags so `make ldflags` (git describe) works.
51+
fetch-depth: 0
52+
53+
- uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
54+
with:
55+
# Only used by `make ldflags` (go mod edit -json); the image builds
56+
# use the Go toolchain baked into each tag's Dockerfile.
57+
go-version: stable
58+
check-latest: true
59+
60+
# Remove non-semver tags (cli/*, sdk/*) so git describe picks the right one.
61+
- name: Delete non-semver tags
62+
run: 'git tag -d $(git tag -l | grep -v "^v")'
63+
64+
- name: Set up Docker Buildx
65+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
66+
67+
- uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
68+
69+
- name: Install Helm
70+
if: ${{ inputs.push_charts }}
71+
uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
72+
with:
73+
version: 'v3.12.0'
74+
75+
- name: Login to GitHub Container Registry
76+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
77+
with:
78+
registry: ghcr.io
79+
username: ${{ github.actor }}
80+
password: ${{ secrets.GITHUB_TOKEN }}
81+
82+
- name: Compute build env
83+
run: |
84+
{
85+
echo "LDFLAGS=$(make ldflags)"
86+
echo "TAG_SHA=$(git rev-parse HEAD)"
87+
} >> "$GITHUB_ENV"
88+
89+
- name: Build and push konnector image
90+
uses: docker/build-push-action@v6
91+
id: build-konnector
92+
with:
93+
context: .
94+
file: ./Dockerfile.konnector
95+
platforms: linux/amd64,linux/arm64
96+
push: true
97+
tags: |
98+
ghcr.io/${{ github.repository_owner }}/konnector:${{ matrix.tag }}
99+
ghcr.io/${{ github.repository_owner }}/konnector:${{ env.TAG_SHA }}
100+
build-args: |
101+
LDFLAGS=${{ env.LDFLAGS }}
102+
labels: |
103+
org.opencontainers.image.title=Kube Bind Konnector
104+
org.opencontainers.image.description=Kube Bind konnector component
105+
org.opencontainers.image.source=https://github.com/${{ github.repository }}
106+
org.opencontainers.image.revision=${{ env.TAG_SHA }}
107+
org.opencontainers.image.version=${{ matrix.tag }}
108+
109+
- name: Sign konnector image
110+
env:
111+
COSIGN_EXPERIMENTAL: 'true'
112+
run: |
113+
img="ghcr.io/${{ github.repository_owner }}/konnector@${{ steps.build-konnector.outputs.digest }}"
114+
echo "signing ${img}"
115+
cosign sign ${img} \
116+
--yes \
117+
-a sha=${TAG_SHA} \
118+
-a ref=refs/tags/${{ matrix.tag }} \
119+
-a run_id=${{ github.run_id }} \
120+
-a run_attempt=${{ github.run_attempt }}
121+
122+
- name: Build and push backend image
123+
uses: docker/build-push-action@v6
124+
id: build-backend
125+
with:
126+
context: .
127+
file: ./Dockerfile
128+
platforms: linux/amd64,linux/arm64
129+
push: true
130+
tags: |
131+
ghcr.io/${{ github.repository_owner }}/backend:${{ matrix.tag }}
132+
ghcr.io/${{ github.repository_owner }}/backend:${{ env.TAG_SHA }}
133+
build-args: |
134+
LDFLAGS=${{ env.LDFLAGS }}
135+
labels: |
136+
org.opencontainers.image.title=Kube Bind Backend
137+
org.opencontainers.image.description=Kube Bind backend with integrated Vue.js frontend
138+
org.opencontainers.image.source=https://github.com/${{ github.repository }}
139+
org.opencontainers.image.revision=${{ env.TAG_SHA }}
140+
org.opencontainers.image.version=${{ matrix.tag }}
141+
142+
- name: Sign backend image
143+
env:
144+
COSIGN_EXPERIMENTAL: 'true'
145+
run: |
146+
img="ghcr.io/${{ github.repository_owner }}/backend@${{ steps.build-backend.outputs.digest }}"
147+
echo "signing ${img}"
148+
cosign sign ${img} \
149+
--yes \
150+
-a sha=${TAG_SHA} \
151+
-a ref=refs/tags/${{ matrix.tag }} \
152+
-a run_id=${{ github.run_id }} \
153+
-a run_attempt=${{ github.run_attempt }}
154+
155+
- name: Package and push Helm charts as OCI
156+
if: ${{ inputs.push_charts }}
157+
env:
158+
HELM_EXPERIMENTAL_OCI: '1'
159+
run: |
160+
echo "${{ github.token }}" | helm registry login ghcr.io --username ${{ github.actor }} --password-stdin
161+
162+
CHART_VERSION="${{ matrix.tag }}"
163+
CHART_VERSION="${CHART_VERSION#v}"
164+
165+
for chart_dir in deploy/charts/*/; do
166+
if [ -f "${chart_dir}Chart.yaml" ]; then
167+
chart_name=$(basename "$chart_dir")
168+
echo "Processing chart: $chart_name"
169+
170+
sed -i "s/^version:.*/version: ${CHART_VERSION}/" "${chart_dir}Chart.yaml"
171+
sed -i "s/^appVersion:.*/appVersion: ${CHART_VERSION}/" "${chart_dir}Chart.yaml"
172+
173+
helm package "$chart_dir" --version "${CHART_VERSION}"
174+
helm push "${chart_name}-${CHART_VERSION}.tgz" "oci://ghcr.io/${{ github.repository_owner }}/charts"
175+
176+
echo "Helm chart pushed to oci://ghcr.io/${{ github.repository_owner }}/charts/${chart_name}:${CHART_VERSION}"
177+
fi
178+
done

0 commit comments

Comments
 (0)