mirror of
https://github.com/argoproj/argo-cd
synced 2026-04-21 17:07:16 +00:00
chore: generate attestations during a release (#12484)
* chore: generate attestations during a release Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> enable attestation for dockerhub Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> release assests no longer compressed Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> renamed attestion for cli Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> updated docs to reflect non compressed cli binaries Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> use quay username for provenance generator Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> add check for TARGET_VERSION Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> fixed typo Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> updated go to 1.19 Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> update cosign and slsa-github-generators Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> update docs for cosignv2.0.0 Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> remove docker registry from release Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> * negate tags for v2.4,v2.5,v2.6 for release Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> * bug fix for release notes Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> --------- Signed-off-by: Justin Marquis <34fathombelow@protonmail.com> Signed-off-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com> Co-authored-by: Michael Crenshaw <350466+crenshaw-dev@users.noreply.github.com>
This commit is contained in:
Justin Marquis
GitHub
parent
70ac450b92
commit
17b81807b6
10 changed files with 833 additions and 577 deletions
38
.github/workflows/README.md
vendored
Normal file
38
.github/workflows/README.md
vendored
Normal file
|
|
@ -0,0 +1,38 @@
|
|||
# Workflows
|
||||
|
||||
| Workflow | Description |
|
||||
|--------------------|----------------------------------------------------------------|
|
||||
| ci-build.yaml | Build, lint, test, codegen, build-ui, analyze, e2e-test |
|
||||
| codeql.yaml | CodeQL analysis |
|
||||
| image-reuse.yaml | Build, push, and Sign container images |
|
||||
| image.yaml | Build container image for PR's & publish for push events |
|
||||
| pr-title-check.yaml| Lint PR for semantic information |
|
||||
| init-release.yaml | Build manifests and version then create a PR for release branch|
|
||||
| release.yaml | Build images, cli-binaries, provenances, and post actions |
|
||||
| update-snyk.yaml | Scheduled snyk reports |
|
||||
|
||||
# Reusable workflows
|
||||
|
||||
## image-reuse.yaml
|
||||
|
||||
- The resuable workflow can be used to publish or build images with multiple container registries(Quay,GHCR, dockerhub), and then sign them with cosign when an image is published.
|
||||
- A GO version `must` be specified e.g. 1.19
|
||||
- The image name for each registry *must* contain the tag. Note: multiple tags are allowed for each registry using a CSV type.
|
||||
- Multiple platforms can be specified e.g. linux/amd64,linux/arm64
|
||||
- Images are not published by default. A boolean value must be set to `true` to push images.
|
||||
- An optional target can be specified.
|
||||
|
||||
| Inputs | Description | Type | Required | Defaults |
|
||||
|-------------------|-------------------------------------|-------------|----------|-----------------|
|
||||
| go-version | Version of Go to be used | string | true | none |
|
||||
| quay_image_name | Full image name and tag | CSV, string | false | none |
|
||||
| ghcr_image_name | Full image name and tag | CSV, string | false | none |
|
||||
| docker_image_name | Full image name and tag | CSV, string | false | none |
|
||||
| platforms | Platforms to build (linux/amd64) | CSV, string | false | linux/amd64 |
|
||||
| push | Whether to push image/s to registry | boolean | false | false |
|
||||
| target | Target build stage | string | false | none |
|
||||
|
||||
| Outputs | Description | Type |
|
||||
|-------------|------------------------------------------|-------|
|
||||
|image-digest | Image digest of image container created | string|
|
||||
|
||||
153
.github/workflows/image-reuse.yaml
vendored
Normal file
153
.github/workflows/image-reuse.yaml
vendored
Normal file
|
|
@ -0,0 +1,153 @@
|
|||
name: Publish and Sign Container Image
|
||||
on:
|
||||
workflow_call:
|
||||
inputs:
|
||||
go-version:
|
||||
required: true
|
||||
type: string
|
||||
quay_image_name:
|
||||
required: false
|
||||
type: string
|
||||
ghcr_image_name:
|
||||
required: false
|
||||
type: string
|
||||
docker_image_name:
|
||||
required: false
|
||||
type: string
|
||||
platforms:
|
||||
required: true
|
||||
type: string
|
||||
default: linux/amd64
|
||||
push:
|
||||
required: true
|
||||
type: boolean
|
||||
default: false
|
||||
target:
|
||||
required: false
|
||||
type: string
|
||||
|
||||
secrets:
|
||||
quay_username:
|
||||
required: false
|
||||
quay_password:
|
||||
required: false
|
||||
ghcr_username:
|
||||
required: false
|
||||
ghcr_password:
|
||||
required: false
|
||||
docker_username:
|
||||
required: false
|
||||
docker_password:
|
||||
required: false
|
||||
|
||||
outputs:
|
||||
image-digest:
|
||||
description: "sha256 digest of container image"
|
||||
value: ${{ jobs.publish.outputs.image-digest }}
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
publish:
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write # Used to push images to `ghcr.io` if used.
|
||||
id-token: write # Needed to create an OIDC token for keyless signing
|
||||
runs-on: ubuntu-22.04
|
||||
outputs:
|
||||
image-digest: ${{ steps.image.outputs.digest }}
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.3.0
|
||||
with:
|
||||
fetch-depth: 0
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
if: ${{ github.ref_type == 'tag'}}
|
||||
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
|
||||
if: ${{ github.ref_type != 'tag'}}
|
||||
|
||||
- name: Setup Golang
|
||||
uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
|
||||
with:
|
||||
go-version: ${{ inputs.go-version }}
|
||||
|
||||
- name: Install cosign
|
||||
uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65 # v3.0.1
|
||||
with:
|
||||
cosign-release: 'v2.0.0'
|
||||
|
||||
- uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0
|
||||
- uses: docker/setup-buildx-action@15c905b16b06416d2086efa066dd8e3a35cc7f98 # v2.4.0
|
||||
|
||||
- name: Setup tags for container image as a CSV type
|
||||
run: |
|
||||
IMAGE_TAGS=$(for str in \
|
||||
${{ inputs.quay_image_name }} \
|
||||
${{ inputs.ghcr_image_name }} \
|
||||
${{ inputs.docker_image_name}}; do
|
||||
echo -n "${str}",;done | sed 's/,$//')
|
||||
|
||||
echo $IMAGE_TAGS
|
||||
echo "TAGS=$IMAGE_TAGS" >> $GITHUB_ENV
|
||||
|
||||
- name: Setup image namespace for signing, strip off the tag
|
||||
run: |
|
||||
TAGS=$(for tag in \
|
||||
${{ inputs.quay_image_name }} \
|
||||
${{ inputs.ghcr_image_name }} \
|
||||
${{ inputs.docker_image_name}}; do
|
||||
echo -n "${tag}" | awk -F ":" '{print $1}' -;done)
|
||||
|
||||
echo $TAGS
|
||||
echo 'SIGNING_TAGS<<EOF' >> $GITHUB_ENV
|
||||
echo $TAGS >> $GITHUB_ENV
|
||||
echo 'EOF' >> $GITHUB_ENV
|
||||
|
||||
- name: Login to Quay.io
|
||||
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
|
||||
with:
|
||||
registry: quay.io
|
||||
username: ${{ secrets.quay_username }}
|
||||
password: ${{ secrets.quay_password }}
|
||||
if: ${{ inputs.quay_image_name && inputs.push }}
|
||||
|
||||
- name: Login to GitHub Container Registry
|
||||
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
|
||||
with:
|
||||
registry: ghcr.io
|
||||
username: ${{ secrets.ghcr_username }}
|
||||
password: ${{ secrets.ghcr_password }}
|
||||
if: ${{ inputs.ghcr_image_name && inputs.push }}
|
||||
|
||||
- name: Login to dockerhub Container Registry
|
||||
uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
|
||||
with:
|
||||
username: ${{ secrets.docker_username }}
|
||||
password: ${{ secrets.docker_password }}
|
||||
if: ${{ inputs.docker_image_name && inputs.push }}
|
||||
|
||||
- name: Build and push container image
|
||||
id: image
|
||||
uses: docker/build-push-action@37abcedcc1da61a57767b7588cb9d03eb57e28b3 #v3.3.0
|
||||
with:
|
||||
context: .
|
||||
platforms: ${{ inputs.platforms }}
|
||||
push: ${{ inputs.push }}
|
||||
tags: ${{ env.TAGS }}
|
||||
target: ${{ inputs.target }}
|
||||
provenance: false
|
||||
sbom: false
|
||||
|
||||
- name: Sign container images
|
||||
run: |
|
||||
for signing_tag in $SIGNING_TAGS; do
|
||||
cosign sign \
|
||||
-a "repo=${{ github.repository }}" \
|
||||
-a "workflow=${{ github.workflow }}" \
|
||||
-a "sha=${{ github.sha }}" \
|
||||
-y \
|
||||
"$signing_tag"@${{ steps.image.outputs.digest }}
|
||||
done
|
||||
if: ${{ inputs.push }}
|
||||
136
.github/workflows/image.yaml
vendored
136
.github/workflows/image.yaml
vendored
|
|
@ -9,97 +9,105 @@ on:
|
|||
- master
|
||||
types: [ labeled, unlabeled, opened, synchronize, reopened ]
|
||||
|
||||
env:
|
||||
GOLANG_VERSION: '1.19'
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref }}
|
||||
cancel-in-progress: true
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
publish:
|
||||
set-vars:
|
||||
permissions:
|
||||
contents: write # for git to push upgrade commit if not already deployed
|
||||
packages: write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
|
||||
contents: read
|
||||
if: github.repository == 'argoproj/argo-cd'
|
||||
runs-on: ubuntu-22.04
|
||||
env:
|
||||
GOPATH: /home/runner/work/argo-cd/argo-cd
|
||||
outputs:
|
||||
image-tag: ${{ steps.image.outputs.tag}}
|
||||
platforms: ${{ steps.platforms.outputs.platforms }}
|
||||
steps:
|
||||
- uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
|
||||
with:
|
||||
go-version: ${{ env.GOLANG_VERSION }}
|
||||
- uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
|
||||
with:
|
||||
path: src/github.com/argoproj/argo-cd
|
||||
|
||||
# get image tag
|
||||
- run: echo "tag=$(cat ./VERSION)-${GITHUB_SHA::8}" >> $GITHUB_OUTPUT
|
||||
working-directory: ./src/github.com/argoproj/argo-cd
|
||||
- name: Set image tag for ghcr
|
||||
run: echo "tag=$(cat ./VERSION)-${GITHUB_SHA::8}" >> $GITHUB_OUTPUT
|
||||
id: image
|
||||
|
||||
# login
|
||||
- run: |
|
||||
docker login ghcr.io --username $USERNAME --password-stdin <<< "$PASSWORD"
|
||||
docker login quay.io --username "$DOCKER_USERNAME" --password-stdin <<< "$DOCKER_TOKEN"
|
||||
if: github.event_name == 'push'
|
||||
env:
|
||||
USERNAME: ${{ github.actor }}
|
||||
PASSWORD: ${{ secrets.GITHUB_TOKEN }}
|
||||
DOCKER_USERNAME: ${{ secrets.RELEASE_QUAY_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.RELEASE_QUAY_TOKEN }}
|
||||
|
||||
# build
|
||||
- uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0
|
||||
- uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v2.5.0
|
||||
- run: |
|
||||
- name: Determine image platforms to use
|
||||
id: platforms
|
||||
run: |
|
||||
IMAGE_PLATFORMS=linux/amd64
|
||||
if [[ "${{ github.event_name }}" == "push" || "${{ contains(github.event.pull_request.labels.*.name, 'test-arm-image') }}" == "true" ]]
|
||||
if [[ "${{ github.event_name }}" == "push" || "${{ contains(github.event.pull_request.labels.*.name, 'test-multi-image') }}" == "true" ]]
|
||||
then
|
||||
IMAGE_PLATFORMS=linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
|
||||
fi
|
||||
echo "Building image for platforms: $IMAGE_PLATFORMS"
|
||||
docker buildx build --platform $IMAGE_PLATFORMS --sbom=false --provenance=false --push="${{ github.event_name == 'push' }}" \
|
||||
-t ghcr.io/argoproj/argo-cd/argocd:${{ steps.image.outputs.tag }} \
|
||||
-t quay.io/argoproj/argocd:latest .
|
||||
working-directory: ./src/github.com/argoproj/argo-cd
|
||||
echo "platforms=$IMAGE_PLATFORMS" >> $GITHUB_OUTPUT
|
||||
|
||||
# sign container images
|
||||
- name: Install cosign
|
||||
uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65 # v3.0.1
|
||||
with:
|
||||
cosign-release: 'v1.13.1'
|
||||
build-only:
|
||||
needs: [set-vars]
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
|
||||
id-token: write # for creating OIDC tokens for signing.
|
||||
if: ${{ github.repository == 'argoproj/argo-cd' && github.event_name != 'push' }}
|
||||
uses: ./.github/workflows/image-reuse.yaml
|
||||
with:
|
||||
# Note: cannot use env variables to set go-version (https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations)
|
||||
go-version: 1.19
|
||||
platforms: ${{ needs.set-vars.outputs.platforms }}
|
||||
push: false
|
||||
|
||||
- name: Install crane to get digest of image
|
||||
uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c
|
||||
build-and-publish:
|
||||
needs: [set-vars]
|
||||
permissions:
|
||||
contents: read
|
||||
packages: write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
|
||||
id-token: write # for creating OIDC tokens for signing.
|
||||
if: ${{ github.repository == 'argoproj/argo-cd' && github.event_name == 'push' }}
|
||||
uses: ./.github/workflows/image-reuse.yaml
|
||||
with:
|
||||
quay_image_name: quay.io/argoproj/argocd:latest
|
||||
ghcr_image_name: ghcr.io/argoproj/argo-cd:${{ needs.set-vars.outputs.image-tag }}
|
||||
# Note: cannot use env variables to set go-version (https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations)
|
||||
go-version: 1.19
|
||||
platforms: ${{ needs.set-vars.outputs.platforms }}
|
||||
push: true
|
||||
secrets:
|
||||
quay_username: ${{ secrets.RELEASE_QUAY_USERNAME }}
|
||||
quay_password: ${{ secrets.RELEASE_QUAY_TOKEN }}
|
||||
ghcr_username: ${{ github.actor }}
|
||||
ghcr_password: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Get digest of image
|
||||
run: |
|
||||
echo "IMAGE_DIGEST=$(crane digest quay.io/argoproj/argocd:latest)" >> $GITHUB_ENV
|
||||
build-and-publish-provenance:
|
||||
needs: [build-and-publish]
|
||||
permissions:
|
||||
actions: read # for detecting the Github Actions environment.
|
||||
id-token: write # for creating OIDC tokens for signing.
|
||||
packages: write # for uploading attestations. (https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#known-issues)
|
||||
if: ${{ github.repository == 'argoproj/argo-cd' && github.event_name != 'push' }}
|
||||
# Must be refernced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
|
||||
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.5.0
|
||||
with:
|
||||
image: quay.io/argoproj/argocd
|
||||
digest: ${{ needs.build-and-publish.outputs.image-digest }}
|
||||
secrets:
|
||||
registry-username: ${{ secrets.RELEASE_QUAY_USERNAME }}
|
||||
registry-password: ${{ secrets.RELEASE_QUAY_TOKEN }}
|
||||
|
||||
- name: Sign Argo CD latest image
|
||||
run: |
|
||||
cosign sign --key env://COSIGN_PRIVATE_KEY quay.io/argoproj/argocd@${{ env.IMAGE_DIGEST }}
|
||||
# Displays the public key to share.
|
||||
cosign public-key --key env://COSIGN_PRIVATE_KEY
|
||||
env:
|
||||
COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
|
||||
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
|
||||
if: ${{ github.event_name == 'push' }}
|
||||
|
||||
# deploy
|
||||
Deploy:
|
||||
needs: [build-and-publish]
|
||||
permissions:
|
||||
contents: write # for git to push upgrade commit if not already deployed
|
||||
packages: write # for pushing packages to GHCR, which is used by cd.apps.argoproj.io to avoid polluting Quay with tags
|
||||
if: ${{ github.repository == 'argoproj/argo-cd' && github.event_name == 'push' }}
|
||||
runs-on: ubuntu-22.04
|
||||
steps:
|
||||
- uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
|
||||
- run: git clone "https://$TOKEN@github.com/argoproj/argoproj-deployments"
|
||||
if: github.event_name == 'push'
|
||||
env:
|
||||
TOKEN: ${{ secrets.TOKEN }}
|
||||
- run: |
|
||||
docker run -u $(id -u):$(id -g) -v $(pwd):/src -w /src --rm -t ghcr.io/argoproj/argo-cd/argocd:${{ steps.image.outputs.tag }} kustomize edit set image quay.io/argoproj/argocd=ghcr.io/argoproj/argo-cd/argocd:${{ steps.image.outputs.tag }}
|
||||
docker run -u $(id -u):$(id -g) -v $(pwd):/src -w /src --rm -t ghcr.io/argoproj/argo-cd/argocd:${{ needs.set-vars.outputs.image-tag }} kustomize edit set image quay.io/argoproj/argocd=ghcr.io/argoproj/argo-cd/argocd:${{ needs.set-vars.outputs.image-tag }}
|
||||
git config --global user.email 'ci@argoproj.com'
|
||||
git config --global user.name 'CI'
|
||||
git diff --exit-code && echo 'Already deployed' || (git commit -am 'Upgrade argocd to ${{ steps.image.outputs.tag }}' && git push)
|
||||
if: github.event_name == 'push'
|
||||
git diff --exit-code && echo 'Already deployed' || (git commit -am 'Upgrade argocd to ${{ needs.set-vars.outputs.image-tag }}' && git push)
|
||||
working-directory: argoproj-deployments/argocd
|
||||
# TODO: clean up old images once github supports it: https://github.community/t5/How-to-use-Git-and-GitHub/Deleting-images-from-GitHub-Package-Registry/m-p/41202/thread-id/9811
|
||||
|
|
|
|||
70
.github/workflows/init-release.yaml
vendored
Normal file
70
.github/workflows/init-release.yaml
vendored
Normal file
|
|
@ -0,0 +1,70 @@
|
|||
name: Init ArgoCD Release
|
||||
on:
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
TARGET_BRANCH:
|
||||
description: 'TARGET_BRANCH to checkout (e.g. release-2.5)'
|
||||
required: true
|
||||
type: string
|
||||
|
||||
TARGET_VERSION:
|
||||
description: 'TARGET_VERSION to build manifests (e.g. 2.5.0-rc1) Note: the `v` prefix is not used'
|
||||
required: true
|
||||
type: string
|
||||
|
||||
permissions: {}
|
||||
|
||||
jobs:
|
||||
prepare-release:
|
||||
permissions:
|
||||
contents: write # for peter-evans/create-pull-request to create branch
|
||||
pull-requests: write # for peter-evans/create-pull-request to create a PR
|
||||
name: Automatically generate version and manifests on ${{ inputs.TARGET_BRANCH }}
|
||||
runs-on: ubuntu-22.04
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
|
||||
with:
|
||||
fetch-depth: 0
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
ref: ${{ inputs.TARGET_BRANCH }}
|
||||
|
||||
- name: Check if TARGET_VERSION is well formed.
|
||||
run: |
|
||||
set -xue
|
||||
# Target version must not contain 'v' prefix
|
||||
if echo "${{ inputs.TARGET_VERSION }}" | grep -e '^v'; then
|
||||
echo "::error::Target version '${{ TARGET_VERSION }}' should not begin with a 'v' prefix, refusing to continue." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Create VERSION information
|
||||
run: |
|
||||
set -ue
|
||||
echo "Bumping version from $(cat VERSION) to ${{ inputs.TARGET_VERSION }}"
|
||||
echo "${{ inputs.TARGET_VERSION }}" > VERSION
|
||||
|
||||
# We install kustomize in the dist directory
|
||||
- name: Add dist to PATH
|
||||
run: |
|
||||
echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
|
||||
|
||||
- name: Generate new set of manifests
|
||||
run: |
|
||||
set -ue
|
||||
make install-codegen-tools-local
|
||||
make manifests-local VERSION=${{ inputs.TARGET_VERSION }}
|
||||
git diff
|
||||
|
||||
- name: Create pull request
|
||||
uses: peter-evans/create-pull-request@2b011faafdcbc9ceb11414d64d0573f37c774b04 # v4.2.3
|
||||
with:
|
||||
commit-message: "Bump version to ${{ inputs.TARGET_VERSION }}"
|
||||
title: "Bump version to ${{ inputs.TARGET_VERSION }} on ${{ inputs.TARGET_BRANCH }} branch"
|
||||
body: Updating VERSION and manifests to ${{ inputs.TARGET_VERSION }}
|
||||
branch: update-version
|
||||
branch-suffix: random
|
||||
signoff: true
|
||||
labels: release
|
||||
|
||||
|
||||
465
.github/workflows/release.yaml
vendored
465
.github/workflows/release.yaml
vendored
|
|
@ -1,46 +1,62 @@
|
|||
name: Create ArgoCD release
|
||||
name: Publish ArgoCD Release
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- "release-v*"
|
||||
- "!release-v1.5*"
|
||||
- "!release-v1.4*"
|
||||
- "!release-v1.3*"
|
||||
- "!release-v1.2*"
|
||||
- "!release-v1.1*"
|
||||
- "!release-v1.0*"
|
||||
- "!release-v0*"
|
||||
- 'v*'
|
||||
- '!v2.4*'
|
||||
- '!v2.5*'
|
||||
- '!v2.6*'
|
||||
|
||||
permissions: {}
|
||||
|
||||
env:
|
||||
GOLANG_VERSION: '1.19'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
GOLANG_VERSION: '1.19' # Note: go-version must also be set in job argocd-image.with.go-version
|
||||
|
||||
jobs:
|
||||
prepare-release:
|
||||
argocd-image:
|
||||
permissions:
|
||||
contents: write # To push changes to release branch
|
||||
name: Perform automatic release on trigger ${{ github.ref }}
|
||||
contents: read
|
||||
id-token: write # for creating OIDC tokens for signing.
|
||||
packages: write # used to push images to `ghcr.io` if used.
|
||||
if: github.repository == 'argoproj/argo-cd'
|
||||
uses: ./.github/workflows/image-reuse.yaml
|
||||
with:
|
||||
quay_image_name: quay.io/argoproj/argocd:${{ github.ref_name }}
|
||||
# Note: cannot use env variables to set go-version (https://docs.github.com/en/actions/using-workflows/reusing-workflows#limitations)
|
||||
go-version: 1.19
|
||||
platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le
|
||||
push: true
|
||||
secrets:
|
||||
quay_username: ${{ secrets.RELEASE_QUAY_USERNAME }}
|
||||
quay_password: ${{ secrets.RELEASE_QUAY_TOKEN }}
|
||||
|
||||
argocd-image-provenance:
|
||||
needs: [argocd-image]
|
||||
permissions:
|
||||
actions: read # for detecting the Github Actions environment.
|
||||
id-token: write # for creating OIDC tokens for signing.
|
||||
packages: write # for uploading attestations. (https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#known-issues)
|
||||
# Must be refernced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
|
||||
if: github.repository == 'argoproj/argo-cd'
|
||||
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@v1.5.0
|
||||
with:
|
||||
image: quay.io/argoproj/argocd
|
||||
digest: ${{ needs.argocd-image.outputs.image-digest }}
|
||||
secrets:
|
||||
registry-username: ${{ secrets.RELEASE_QUAY_USERNAME }}
|
||||
registry-password: ${{ secrets.RELEASE_QUAY_TOKEN }}
|
||||
|
||||
goreleaser:
|
||||
needs:
|
||||
- argocd-image
|
||||
- argocd-image-provenance
|
||||
permissions:
|
||||
contents: write # used for uploading assets
|
||||
if: github.repository == 'argoproj/argo-cd'
|
||||
runs-on: ubuntu-22.04
|
||||
env:
|
||||
# The name of the tag as supplied by the GitHub event
|
||||
SOURCE_TAG: ${{ github.ref }}
|
||||
# The image namespace where Docker image will be published to
|
||||
IMAGE_NAMESPACE: quay.io/argoproj
|
||||
# Whether to create & push image and release assets
|
||||
DRY_RUN: false
|
||||
# Whether a draft release should be created, instead of public one
|
||||
DRAFT_RELEASE: false
|
||||
# Whether to update homebrew with this release as well
|
||||
# Set RELEASE_HOMEBREW_TOKEN secret in repository for this to work - needs
|
||||
# access to public repositories
|
||||
UPDATE_HOMEBREW: false
|
||||
# Name of the GitHub user for Git config
|
||||
GIT_USERNAME: argo-bot
|
||||
# E-Mail of the GitHub user for Git config
|
||||
GIT_EMAIL: argoproj@gmail.com
|
||||
outputs:
|
||||
hashes: ${{ steps.hash.outputs.hashes }}
|
||||
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@24cb9080177205b6e8c946b17badbe402adc938f # v3.4.0
|
||||
|
|
@ -48,223 +64,94 @@ jobs:
|
|||
fetch-depth: 0
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Check if the published tag is well formed and setup vars
|
||||
- name: Fetch all tags
|
||||
run: git fetch --force --tags
|
||||
|
||||
- name: Set GORELEASER_PREVIOUS_TAG # Workaround, GoReleaser uses 'git-describe' to determine a previous tag. Our tags are created in realease branches.
|
||||
run: |
|
||||
set -xue
|
||||
# Target version must match major.minor.patch and optional -rcX suffix
|
||||
# where X must be a number.
|
||||
TARGET_VERSION=${SOURCE_TAG#*release-v}
|
||||
if ! echo "${TARGET_VERSION}" | egrep '^[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)*$'; then
|
||||
echo "::error::Target version '${TARGET_VERSION}' is malformed, refusing to continue." >&2
|
||||
exit 1
|
||||
if echo ${{ github.ref_name }} | grep -E -- '-rc1+$';then
|
||||
echo "GORELEASER_PREVIOUS_TAG=$(git -c 'versionsort.suffix=-rc' tag --list --sort=version:refname | tail -n 2 | head -n 1)" >> $GITHUB_ENV
|
||||
else
|
||||
echo "This is not the first release on the branch, Using GoReleaser defaults"
|
||||
fi
|
||||
|
||||
# Target branch is the release branch we're going to operate on
|
||||
# Its name is 'release-<major>.<minor>'
|
||||
TARGET_BRANCH="release-${TARGET_VERSION%\.[0-9]*}"
|
||||
|
||||
# The release tag is the source tag, minus the release- prefix
|
||||
RELEASE_TAG="${SOURCE_TAG#*release-}"
|
||||
|
||||
# Whether this is a pre-release (indicated by -rc suffix)
|
||||
PRE_RELEASE=false
|
||||
if echo "${RELEASE_TAG}" | egrep -- '-rc[0-9]+$'; then
|
||||
PRE_RELEASE=true
|
||||
fi
|
||||
|
||||
# We must not have a release trigger within the same release branch,
|
||||
# because that means a release for this branch is already running.
|
||||
if git tag -l | grep "release-v${TARGET_VERSION%\.[0-9]*}" | grep -v "release-v${TARGET_VERSION}"; then
|
||||
echo "::error::Another release for branch ${TARGET_BRANCH} is currently in progress."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Ensure that release do not yet exist
|
||||
if git rev-parse ${RELEASE_TAG}; then
|
||||
echo "::error::Release tag ${RELEASE_TAG} already exists in repository. Refusing to continue."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Make the variables available in follow-up steps
|
||||
echo "TARGET_VERSION=${TARGET_VERSION}" >> $GITHUB_ENV
|
||||
echo "TARGET_BRANCH=${TARGET_BRANCH}" >> $GITHUB_ENV
|
||||
echo "RELEASE_TAG=${RELEASE_TAG}" >> $GITHUB_ENV
|
||||
echo "PRE_RELEASE=${PRE_RELEASE}" >> $GITHUB_ENV
|
||||
|
||||
- name: Check if our release tag has a correct annotation
|
||||
run: |
|
||||
set -ue
|
||||
# Fetch all tag information as well
|
||||
git fetch --prune --tags --force
|
||||
|
||||
echo "=========== BEGIN COMMIT MESSAGE ============="
|
||||
git show ${SOURCE_TAG}
|
||||
echo "============ END COMMIT MESSAGE =============="
|
||||
|
||||
# Quite dirty hack to get the release notes from the annotated tag
|
||||
# into a temporary file.
|
||||
RELEASE_NOTES=$(mktemp -p /tmp release-notes.XXXXXX)
|
||||
|
||||
prefix=true
|
||||
begin=false
|
||||
git show ${SOURCE_TAG} | while read line; do
|
||||
# Whatever is in commit history for the tag, we only want that
|
||||
# annotation from our tag. We discard everything else.
|
||||
if test "$begin" = "false"; then
|
||||
if echo "$line" | grep -q "tag ${SOURCE_TAG#refs/tags/}"; then begin="true"; fi
|
||||
continue
|
||||
fi
|
||||
if test "$prefix" = "true"; then
|
||||
if test -z "$line"; then prefix=false; fi
|
||||
else
|
||||
if echo "$line" | egrep -q '^commit [0-9a-f]+'; then
|
||||
break
|
||||
fi
|
||||
echo "$line" >> ${RELEASE_NOTES}
|
||||
fi
|
||||
done
|
||||
|
||||
# For debug purposes
|
||||
echo "============BEGIN RELEASE NOTES================="
|
||||
cat ${RELEASE_NOTES}
|
||||
echo "=============END RELEASE NOTES=================="
|
||||
|
||||
# Too short release notes are suspicious. We need at least 100 bytes.
|
||||
relNoteLen=$(stat -c '%s' $RELEASE_NOTES)
|
||||
if test $relNoteLen -lt 100; then
|
||||
echo "::error::No release notes provided in tag annotation (or tag is not annotated)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check for magic string '## Quick Start' in head of release notes
|
||||
if ! head -2 ${RELEASE_NOTES} | grep -iq '## Quick Start'; then
|
||||
echo "::error::Release notes seem invalid, quick start section not found."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# We store path to temporary release notes file for later reading, we
|
||||
# need it when creating release.
|
||||
echo "RELEASE_NOTES=${RELEASE_NOTES}" >> $GITHUB_ENV
|
||||
|
||||
- name: Setup Golang
|
||||
uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
|
||||
with:
|
||||
go-version: ${{ env.GOLANG_VERSION }}
|
||||
|
||||
- name: Setup Git author information
|
||||
- name: Set environment variables for ldflags
|
||||
id: set_ldflag
|
||||
run: |
|
||||
set -ue
|
||||
git config --global user.email "${GIT_EMAIL}"
|
||||
git config --global user.name "${GIT_USERNAME}"
|
||||
echo "KUBECTL_VERSION=$(go list -m k8s.io/client-go | head -n 1 | rev | cut -d' ' -f1 | rev)" >> $GITHUB_ENV
|
||||
echo "GIT_TREE_STATE=$(if [ -z "`git status --porcelain`" ]; then echo "clean" ; else echo "dirty"; fi)" >> $GITHUB_ENV
|
||||
|
||||
- name: Checkout corresponding release branch
|
||||
run: |
|
||||
set -ue
|
||||
echo "Switching to release branch '${TARGET_BRANCH}'"
|
||||
if ! git checkout ${TARGET_BRANCH}; then
|
||||
echo "::error::Checking out release branch '${TARGET_BRANCH}' for target version '${TARGET_VERSION}' (tagged '${RELEASE_TAG}') failed. Does it exist in repo?"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Create VERSION information
|
||||
run: |
|
||||
set -ue
|
||||
echo "Bumping version from $(cat VERSION) to ${TARGET_VERSION}"
|
||||
echo "${TARGET_VERSION}" > VERSION
|
||||
git commit -m "Bump version to ${TARGET_VERSION}" VERSION
|
||||
|
||||
- name: Generate new set of manifests
|
||||
run: |
|
||||
set -ue
|
||||
make install-codegen-tools-local
|
||||
|
||||
# We install kustomize in the dist directory
|
||||
echo "/home/runner/work/argo-cd/argo-cd/dist" >> $GITHUB_PATH
|
||||
|
||||
make manifests-local VERSION=${TARGET_VERSION}
|
||||
git diff
|
||||
git commit manifests/ -m "Bump version to ${TARGET_VERSION}"
|
||||
|
||||
- name: Create the release tag
|
||||
run: |
|
||||
set -ue
|
||||
echo "Creating release ${RELEASE_TAG}"
|
||||
git tag ${RELEASE_TAG}
|
||||
|
||||
- name: Login to docker repositories
|
||||
- name: Run GoReleaser
|
||||
uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b # v4.2.0
|
||||
id: run-goreleaser
|
||||
with:
|
||||
version: latest
|
||||
args: release --clean --timeout 55m
|
||||
env:
|
||||
DOCKER_USERNAME: ${{ secrets.RELEASE_DOCKERHUB_USERNAME }}
|
||||
DOCKER_TOKEN: ${{ secrets.RELEASE_DOCKERHUB_TOKEN }}
|
||||
QUAY_USERNAME: ${{ secrets.RELEASE_QUAY_USERNAME }}
|
||||
QUAY_TOKEN: ${{ secrets.RELEASE_QUAY_TOKEN }}
|
||||
run: |
|
||||
set -ue
|
||||
docker login quay.io --username "${QUAY_USERNAME}" --password-stdin <<< "${QUAY_TOKEN}"
|
||||
# Remove the following when Docker Hub is gone
|
||||
docker login --username "${DOCKER_USERNAME}" --password-stdin <<< "${DOCKER_TOKEN}"
|
||||
if: ${{ env.DRY_RUN != 'true' }}
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
KUBECTL_VERSION: ${{ env.KUBECTL_VERSION }}
|
||||
GIT_TREE_STATE: ${{ env.GIT_TREE_STATE }}
|
||||
|
||||
- uses: docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18 # v2.1.0
|
||||
- uses: docker/setup-buildx-action@4b4e9c3e2d4531116a6f8ba8e71fc6e2cb6e6c8c # v2.5.0
|
||||
- name: Build and push Docker image for release
|
||||
- name: Generate subject for provenance
|
||||
id: hash
|
||||
env:
|
||||
ARTIFACTS: "${{ steps.run-goreleaser.outputs.artifacts }}"
|
||||
run: |
|
||||
set -ue
|
||||
git clean -fd
|
||||
mkdir -p dist/
|
||||
docker buildx build --platform linux/amd64,linux/arm64,linux/s390x,linux/ppc64le --sbom=false --provenance=false --push -t ${IMAGE_NAMESPACE}/argocd:v${TARGET_VERSION} -t argoproj/argocd:v${TARGET_VERSION} .
|
||||
make release-cli
|
||||
make checksums
|
||||
chmod +x ./dist/argocd-linux-amd64
|
||||
./dist/argocd-linux-amd64 version --client
|
||||
if: ${{ env.DRY_RUN != 'true' }}
|
||||
set -euo pipefail
|
||||
|
||||
hashes=$(echo $ARTIFACTS | jq --raw-output '.[] | {name, "digest": (.extra.Digest // .extra.Checksum)} | select(.digest) | {digest} + {name} | join(" ") | sub("^sha256:";"")' | base64 -w0)
|
||||
if test "$hashes" = ""; then # goreleaser < v1.13.0
|
||||
checksum_file=$(echo "$ARTIFACTS" | jq -r '.[] | select (.type=="Checksum") | .path')
|
||||
hashes=$(cat $checksum_file | base64 -w0)
|
||||
fi
|
||||
echo "hashes=$hashes" >> $GITHUB_OUTPUT
|
||||
|
||||
goreleaser-provenance:
|
||||
needs: [goreleaser]
|
||||
permissions:
|
||||
actions: read # for detecting the Github Actions environment
|
||||
id-token: write # Needed for provenance signing and ID
|
||||
contents: write # Needed for release uploads
|
||||
if: github.repository == 'argoproj/argo-cd'
|
||||
# Must be refernced by a tag. https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#referencing-the-slsa-generator
|
||||
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.5.0
|
||||
with:
|
||||
base64-subjects: "${{ needs.goreleaser.outputs.hashes }}"
|
||||
provenance-name: "argocd-cli.intoto.jsonl"
|
||||
upload-assets: true
|
||||
|
||||
generate-sbom:
|
||||
name: Create Sbom and sign assets
|
||||
needs:
|
||||
- argocd-image
|
||||
- goreleaser
|
||||
permissions:
|
||||
contents: write # Needed for release uploads
|
||||
id-token: write # Needed for signing Sbom
|
||||
if: github.repository == 'argoproj/argo-cd'
|
||||
runs-on: ubuntu-22.04
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
|
||||
with:
|
||||
fetch-depth: 0
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Setup Golang
|
||||
uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
|
||||
with:
|
||||
go-version: ${{ env.GOLANG_VERSION }}
|
||||
|
||||
- name: Install cosign
|
||||
uses: sigstore/cosign-installer@c3667d99424e7e6047999fb6246c0da843953c65 # v3.0.1
|
||||
with:
|
||||
cosign-release: 'v1.13.1'
|
||||
|
||||
- name: Install crane to get digest of image
|
||||
uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c
|
||||
|
||||
- name: Get digest of image
|
||||
run: |
|
||||
echo "IMAGE_DIGEST=$(crane digest quay.io/argoproj/argocd:v${TARGET_VERSION})" >> $GITHUB_ENV
|
||||
|
||||
- name: Sign Argo CD container images and assets
|
||||
run: |
|
||||
cosign sign --key env://COSIGN_PRIVATE_KEY ${IMAGE_NAMESPACE}/argocd@${{ env.IMAGE_DIGEST }}
|
||||
cosign sign-blob --key env://COSIGN_PRIVATE_KEY ./dist/argocd-${TARGET_VERSION}-checksums.txt > ./dist/argocd-${TARGET_VERSION}-checksums.sig
|
||||
# Retrieves the public key to release as an asset
|
||||
cosign public-key --key env://COSIGN_PRIVATE_KEY > ./dist/argocd-cosign.pub
|
||||
env:
|
||||
COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
|
||||
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
|
||||
if: ${{ env.DRY_RUN != 'true' }}
|
||||
|
||||
- name: Read release notes file
|
||||
id: release-notes
|
||||
uses: juliangruber/read-file-action@02bbba9876a8f870efd4ad64e3b9088d3fb94d4b # v1.1.6
|
||||
with:
|
||||
path: ${{ env.RELEASE_NOTES }}
|
||||
|
||||
- name: Push changes to release branch
|
||||
run: |
|
||||
set -ue
|
||||
git push origin ${TARGET_BRANCH}
|
||||
git push origin ${RELEASE_TAG}
|
||||
|
||||
- name: Dry run GitHub release
|
||||
uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
id: create_release
|
||||
with:
|
||||
tag_name: ${{ env.RELEASE_TAG }}
|
||||
release_name: ${{ env.RELEASE_TAG }}
|
||||
draft: ${{ env.DRAFT_RELEASE }}
|
||||
prerelease: ${{ env.PRE_RELEASE }}
|
||||
body: ${{ steps.release-notes.outputs.content }}
|
||||
if: ${{ env.DRY_RUN == 'true' }}
|
||||
cosign-release: 'v2.0.0'
|
||||
|
||||
- name: Generate SBOM (spdx)
|
||||
id: spdx-builder
|
||||
|
|
@ -277,7 +164,7 @@ jobs:
|
|||
# managers (gomod, yarn, npm).
|
||||
PROJECT_FOLDERS: ".,./ui"
|
||||
# full qualified name of the docker image to be inspected
|
||||
DOCKER_IMAGE: ${{env.IMAGE_NAMESPACE}}/argocd:v${{env.TARGET_VERSION}}
|
||||
DOCKER_IMAGE: quay.io/argoproj/argocd:${{ github.ref_name }}
|
||||
run: |
|
||||
yarn install --cwd ./ui
|
||||
go install github.com/spdx/spdx-sbom-generator/cmd/generator@$SPDX_GEN_VERSION
|
||||
|
|
@ -295,43 +182,101 @@ jobs:
|
|||
fi
|
||||
|
||||
cd /tmp && tar -zcf sbom.tar.gz *.spdx
|
||||
if: ${{ env.DRY_RUN != 'true' }}
|
||||
|
||||
- name: Sign sbom
|
||||
- name: Sign SBOM
|
||||
run: |
|
||||
cosign sign-blob --key env://COSIGN_PRIVATE_KEY /tmp/sbom.tar.gz > /tmp/sbom.tar.gz.sig
|
||||
env:
|
||||
COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
|
||||
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
|
||||
if: ${{ env.DRY_RUN != 'true' }}
|
||||
cosign sign-blob \
|
||||
--output-certificate=/tmp/sbom.tar.gz.pem \
|
||||
--output-signature=/tmp/sbom.tar.gz.sig \
|
||||
-y \
|
||||
/tmp/sbom.tar.gz
|
||||
|
||||
- name: Create GitHub release
|
||||
- name: Upload SBOM and signature assets
|
||||
uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
with:
|
||||
name: ${{ env.RELEASE_TAG }}
|
||||
tag_name: ${{ env.RELEASE_TAG }}
|
||||
draft: ${{ env.DRAFT_RELEASE }}
|
||||
prerelease: ${{ env.PRE_RELEASE }}
|
||||
body: ${{ steps.release-notes.outputs.content }} # Pre-pended to the generated notes
|
||||
files: |
|
||||
dist/argocd-*
|
||||
/tmp/sbom.tar.gz
|
||||
/tmp/sbom.tar.gz.sig
|
||||
if: ${{ env.DRY_RUN != 'true' }}
|
||||
/tmp/sbom.tar.*
|
||||
|
||||
- name: Update homebrew formula
|
||||
env:
|
||||
HOMEBREW_TOKEN: ${{ secrets.RELEASE_HOMEBREW_TOKEN }}
|
||||
uses: dawidd6/action-homebrew-bump-formula@e9b43cd30eec6ea80777e7e22e1526beb1675c18 # v3.9.0
|
||||
post-release:
|
||||
needs:
|
||||
- argocd-image
|
||||
- goreleaser
|
||||
- generate-sbom
|
||||
permissions:
|
||||
contents: write # Needed to push commit to update stable tag
|
||||
pull-requests: write # Needed to create PR for VERSION update.
|
||||
if: github.repository == 'argoproj/argo-cd'
|
||||
runs-on: ubuntu-22.04
|
||||
steps:
|
||||
- name: Checkout code
|
||||
uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3.2.0
|
||||
with:
|
||||
token: ${{env.HOMEBREW_TOKEN}}
|
||||
formula: argocd
|
||||
if: ${{ env.HOMEBREW_TOKEN != '' && env.UPDATE_HOMEBREW == 'true' && env.PRE_RELEASE != 'true' }}
|
||||
fetch-depth: 0
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Delete original request tag from repository
|
||||
- name: Setup Git author information
|
||||
run: |
|
||||
set -ue
|
||||
git push --delete origin ${SOURCE_TAG}
|
||||
if: ${{ always() }}
|
||||
git config --global user.email 'ci@argoproj.com'
|
||||
git config --global user.name 'CI'
|
||||
|
||||
- name: Check if tag is the latest version and not a pre-release
|
||||
run: |
|
||||
set -xue
|
||||
# Fetch all tag information
|
||||
git fetch --prune --tags --force
|
||||
|
||||
LATEST_TAG=$(git -c 'versionsort.suffix=-rc' tag --list --sort=version:refname | tail -n1)
|
||||
|
||||
PRE_RELEASE=false
|
||||
# Check if latest tag is a pre-release
|
||||
if echo $LATEST_TAG | grep -E -- '-rc[0-9]+$';then
|
||||
PRE_RELEASE=true
|
||||
fi
|
||||
|
||||
# Ensure latest tag matches github.ref_name & not a pre-release
|
||||
if [[ $LATEST_TAG == ${{ github.ref_name }} ]] && [[ $PRE_RELEASE != 'true' ]];then
|
||||
echo "TAG_STABLE=true" >> $GITHUB_ENV
|
||||
else
|
||||
echo "TAG_STABLE=false" >> $GITHUB_ENV
|
||||
fi
|
||||
|
||||
- name: Update stable tag to latest version
|
||||
run: |
|
||||
git tag -f stable ${{ github.ref_name }}
|
||||
git push -f origin stable
|
||||
if: ${{ env.TAG_STABLE == 'true' }}
|
||||
|
||||
- name: Check to see if VERSION should be updated on master branch
|
||||
run: |
|
||||
set -xue
|
||||
SOURCE_TAG=${{ github.ref_name }}
|
||||
VERSION_REF="${SOURCE_TAG#*v}"
|
||||
if echo "$VERSION_REF" | grep -E -- '^[0-9]+\.[0-9]+\.0$';then
|
||||
VERSION=$(awk 'BEGIN {FS=OFS="."} {$2++; print}' <<< "${VERSION_REF}")
|
||||
echo "Updating VERSION to: $VERSION"
|
||||
echo "UPDATE_VERSION=true" >> $GITHUB_ENV
|
||||
echo "NEW_VERSION=$VERSION" >> $GITHUB_ENV
|
||||
else
|
||||
echo "Not updating VERSION"
|
||||
echo "UPDATE_VERSION=false" >> $GITHUB_ENV
|
||||
fi
|
||||
|
||||
- name: Update VERSION on master branch
|
||||
run: |
|
||||
echo ${{ env.NEW_VERSION }} > VERSION
|
||||
if: ${{ env.UPDATE_VERSION == 'true' }}
|
||||
|
||||
- name: Create PR to update VERSION on master branch
|
||||
uses: peter-evans/create-pull-request@2b011faafdcbc9ceb11414d64d0573f37c774b04 # v4.2.3
|
||||
with:
|
||||
commit-message: Bump version in master
|
||||
title: "chore: Bump version in master"
|
||||
body: All images built from master should indicate which version we are on track for.
|
||||
signoff: true
|
||||
branch: update-version
|
||||
branch-suffix: random
|
||||
base: master
|
||||
if: ${{ env.UPDATE_VERSION == 'true' }}
|
||||
|
|
|
|||
120
.goreleaser.yaml
Normal file
120
.goreleaser.yaml
Normal file
|
|
@ -0,0 +1,120 @@
|
|||
project_name: argocd
|
||||
|
||||
before:
|
||||
hooks:
|
||||
- go mod download
|
||||
- make build-ui
|
||||
|
||||
builds:
|
||||
- id: argocd-cli
|
||||
main: ./cmd
|
||||
binary: argocd-{{ .Os}}-{{ .Arch}}
|
||||
env:
|
||||
- CGO_ENABLED=0
|
||||
flags:
|
||||
- -v
|
||||
ldflags:
|
||||
- -X github.com/argoproj/argo-cd/v2/common.version={{ .Version }}
|
||||
- -X github.com/argoproj/argo-cd/v2/common.buildDate={{ .Date }}
|
||||
- -X github.com/argoproj/argo-cd/v2/common.gitCommit={{ .FullCommit }}
|
||||
- -X github.com/argoproj/argo-cd/v2/common.gitTreeState={{ .Env.GIT_TREE_STATE }}
|
||||
- -X github.com/argoproj/argo-cd/v2/common.kubectlVersion={{ .Env.KUBECTL_VERSION }}
|
||||
- -extldflags="-static"
|
||||
goos:
|
||||
- linux
|
||||
- darwin
|
||||
- windows
|
||||
goarch:
|
||||
- amd64
|
||||
- arm64
|
||||
- s390x
|
||||
- ppc64le
|
||||
ignore:
|
||||
- goos: darwin
|
||||
goarch: s390x
|
||||
- goos: darmwin
|
||||
goarch: ppc64le
|
||||
- goos: windows
|
||||
goarch: s390x
|
||||
- goos: windows
|
||||
goarch: ppc64le
|
||||
- goos: windows
|
||||
goarch: arm64
|
||||
|
||||
archives:
|
||||
- id: argocd-archive
|
||||
builds:
|
||||
- argocd-cli
|
||||
name_template: |-
|
||||
{{ .ProjectName }}-{{ .Os }}-{{ .Arch }}
|
||||
format: binary
|
||||
|
||||
checksum:
|
||||
name_template: 'cli_checksums.txt'
|
||||
algorithm: sha256
|
||||
|
||||
release:
|
||||
prerelease: auto
|
||||
draft: false
|
||||
header: |
|
||||
## Quick Start
|
||||
|
||||
### Non-HA:
|
||||
|
||||
```shell
|
||||
kubectl create namespace argocd
|
||||
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/{{.Tag}}/manifests/install.yaml
|
||||
```
|
||||
|
||||
### HA:
|
||||
|
||||
```shell
|
||||
kubectl create namespace argocd
|
||||
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/{{.Tag}}/manifests/ha/install.yaml
|
||||
```
|
||||
|
||||
## Release Signatures and Provenance
|
||||
|
||||
All Argo CD container images are signed by cosign. A Provenance is generated for container images and CLI binaries which meet the SLSA Level 3 specifications. See the [documentation](https://argo-cd.readthedocs.io/en/stable/operator-manual/signed-release-assets) on how to verify.
|
||||
|
||||
|
||||
## Upgrading
|
||||
|
||||
If upgrading from a different minor version, be sure to read the [upgrading](https://argo-cd.readthedocs.io/en/stable/operator-manual/upgrading/overview/) documentation.
|
||||
footer: |
|
||||
**Full Changelog**: https://github.com/argoproj/argo-cd/compare/{{ .PreviousTag }}...{{ .Tag }}
|
||||
|
||||
<a href="https://argoproj.github.io/cd/"><img src="https://raw.githubusercontent.com/argoproj/argo-site/master/content/pages/cd/gitops-cd.png" width="25%" ></a>
|
||||
|
||||
|
||||
snapshot: #### To be removed for PR
|
||||
name_template: "2.6.0"
|
||||
|
||||
changelog:
|
||||
use:
|
||||
github
|
||||
sort: asc
|
||||
abbrev: 0
|
||||
groups: # Regex use RE2 syntax as defined here: https://github.com/google/re2/wiki/Syntax.
|
||||
- title: 'Features'
|
||||
regexp: '^.*?feat(\([[:word:]]+\))??!?:.+$'
|
||||
order: 100
|
||||
- title: 'Bug fixes'
|
||||
regexp: '^.*?fix(\([[:word:]]+\))??!?:.+$'
|
||||
order: 200
|
||||
- title: 'Documentation'
|
||||
regexp: '^.*?docs(\([[:word:]]+\))??!?:.+$'
|
||||
order: 300
|
||||
- title: 'Dependency updates'
|
||||
regexp: '^.*?(feat|fix|chore)\(deps?.+\)!?:.+$'
|
||||
order: 400
|
||||
- title: 'Other work'
|
||||
order: 999
|
||||
filters:
|
||||
exclude:
|
||||
- '^test:'
|
||||
- '^.*?Bump(\([[:word:]]+\))?.+$'
|
||||
|
||||
|
||||
# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
|
||||
|
||||
BIN
docs/assets/release-action.png
Normal file
BIN
docs/assets/release-action.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 41 KiB |
|
|
@ -2,112 +2,99 @@
|
|||
|
||||
## Automated release procedure
|
||||
|
||||
Starting from `release-1.6` branch, ArgoCD can be released in an automated fashion
|
||||
using GitHub actions. The release process takes about 20 minutes, sometimes a
|
||||
little less, depending on the performance of GitHub Actions runners.
|
||||
ArgoCD is released in a 2 step automated fashion using GitHub actions. The release process takes about 60 minutes,
|
||||
sometimes a little less, depending on the performance of GitHub Actions runners.
|
||||
|
||||
The target release branch must already exist in the GitHub repository. If you for
|
||||
example want to create a release `v1.7.0`, the corresponding release branch
|
||||
`release-1.7` needs to exist, otherwise, the release cannot be built. Also,
|
||||
example want to create a release `v2.7.0`, the corresponding release branch
|
||||
`release-2.7` needs to exist, otherwise, the release cannot be built. Also,
|
||||
the trigger tag should always be created in the release branch, checked out
|
||||
in your local repository clone.
|
||||
|
||||
Before triggering the release automation, the `CHANGELOG.md` should be updated
|
||||
with the latest information, and this change should be committed and pushed to
|
||||
the GitHub repository to the release branch. Afterward, the automation can be
|
||||
triggered.
|
||||
triggered. This will be automated in the very near future.
|
||||
|
||||
**Manual steps before release creation:**
|
||||
|
||||
* Update `CHANGELOG.md` with changes for this release
|
||||
* Commit & push changes to `CHANGELOG.md`
|
||||
* Prepare release notes (save to some file, or copy from Changelog)
|
||||
|
||||
**The automation will perform the following steps:**
|
||||
**The `Init ARGOCD Release` workflow will perform the following steps:**
|
||||
|
||||
* Update `VERSION` file in the release branch
|
||||
* Update manifests with image tags of the new version in the release branch
|
||||
* Build the Docker image and push to Docker Hub
|
||||
* Create a release tag in the GitHub repository
|
||||
* Create a GitHub release and attach the required assets to it (CLI binaries, ...)
|
||||
* Create a pull request to submit the above changes
|
||||
|
||||
Finally, it will the remove trigger tag from the repository again.
|
||||
**The `Publish ArgoCD Release` workflow will perform the following steps:**
|
||||
|
||||
Automation supports both, GA and pre-releases. The automation is triggered by
|
||||
pushing a tag to the repository. The tag must be in one of the following formats
|
||||
to trigger the GH workflow:
|
||||
* Build, push, and signs the container image to Quay.io
|
||||
* Generate a provenance for the container image
|
||||
* Builds the CLI binaries, release-notes, and then creates a GitHub release and attaches the required assets.
|
||||
* Generate a provenance for the CLI binaries
|
||||
* Generate and sign a sbom
|
||||
* Update the stable tag when applicable
|
||||
* Update `VERSION` file in the master branch when a new release is GA
|
||||
|
||||
* GA: `release-v<MAJOR>.<MINOR>.<PATCH>`
|
||||
* Pre-release: `release-v<MAJOR>.<MINOR>.<PATCH>-rc<RC#>`
|
||||
### Step 1 - Update Version and Manifest
|
||||
|
||||
The tag must be an annotated tag, and it must contain the release notes in the
|
||||
commit message. Please note that Markdown uses `#` character for formatting, but
|
||||
Git uses it as comment char. To solve this, temporarily switch Git's comment char
|
||||
to something else, the `;` character is recommended.
|
||||
1. Ensure that the TARGET_BRANCH already exist.
|
||||
2. Visit the [Release GitHub Action](https://github.com/argoproj/argo-cd/actions/workflows/init-release.yaml)
|
||||
and choose which branch you would like to work from.
|
||||
3. Enter the TARGET_BRANCH to checkout.
|
||||
4. Enter the TARGET_VERSION that will be used to build manifest and `VERSION` file. (e.g `2.7.0-rc1`)
|
||||
|
||||
|
||||
|
||||
1. When the action is completed a pull request will be generated that contains the updated manifest and `Version` file.
|
||||
2. Merge the pull request and proceed to step 2.
|
||||
|
||||
### Step 2 - Tag Release Branch
|
||||
The `Publish ArgoCD Release` workflow is triggered by pushing a tag to the repository.
|
||||
The tag must be in one of the following formats to trigger the GH workflow:
|
||||
|
||||
* GA: `v<MAJOR>.<MINOR>.<PATCH>`
|
||||
* Pre-release: `v<MAJOR>.<MINOR>.<PATCH>-rc<RC#>`
|
||||
|
||||
For example, consider you have configured the Git remote for the repository to
|
||||
`github.com/argoproj/argo-cd` to be named `upstream` and are in your locally
|
||||
checked out repo:
|
||||
checked out repo of the release branch:
|
||||
|
||||
```shell
|
||||
git config core.commentChar ';'
|
||||
git tag -a -F /path/to/release-notes.txt release-v1.6.0-rc2
|
||||
git push upstream release-v1.6.0-rc2
|
||||
git tag -d release-v1.6.0-rc2
|
||||
git config core.commentChar '#'
|
||||
|
||||
git pull upstream release-2.7
|
||||
git tag release-v2.7.0-rc1
|
||||
git push upstream release-v2.7.0-rc1
|
||||
```
|
||||
|
||||
For convenience, there is a shell script in the tree that ensures all the
|
||||
pre-requisites are met and that the trigger is well-formed before pushing
|
||||
it to the GitHub repo.
|
||||
|
||||
In summary, the modifications it does are:
|
||||
|
||||
* Create annotated trigger tag in your local repository
|
||||
* Push the tag to the GitHub repository to trigger the workflow
|
||||
* Remove trigger tag from your local repository
|
||||
!!! tip
|
||||
For convenience, there is a shell script in the tree that ensures all the
|
||||
pre-requisites are met and that the trigger is well-formed before pushing
|
||||
it to the GitHub repo.
|
||||
|
||||
The script can be found at `hack/trigger-release.sh` and is used as follows:
|
||||
|
||||
```shell
|
||||
./hack/trigger-release.sh <version> <remote name> [<release notes path>]
|
||||
./hack/trigger-release.sh <version> <remote name>
|
||||
```
|
||||
|
||||
The `<version>` identifier needs to be specified **without** the `release-`
|
||||
prefix, so just specify it as `v1.6.0-rc2` for example. The `<remote name>`
|
||||
The `<version>` identifier needs to be specified in the format of `v<MAJOR>.<MINOR>.<PATCH>-rc<RC#>`,
|
||||
so just specify it as `v2.7.0-rc1` for example. The `<remote name>`
|
||||
specifies the name of the remote used to push to the GitHub repository.
|
||||
|
||||
If you omit the `<release notes path>`, an editor will pop up asking you to
|
||||
enter the tag's annotation, so you can paste the release notes, save, and exit.
|
||||
It will also take care of temporarily configuring the `core.commentChar` and
|
||||
setting it back to its original state.
|
||||
|
||||
:warning:
|
||||
!!! warning
|
||||
It is strongly recommended to use this script to trigger the workflow
|
||||
instead of manually pushing a tag to the repository.
|
||||
|
||||
Once the trigger tag is pushed to the repo, the GitHub workflow will start
|
||||
execution. You can follow its progress under the `Actions` tab, the name of the
|
||||
action is `Create release`. Don't get confused by the name of the running
|
||||
workflow, it will be the commit message of the latest commit to the `master`
|
||||
branch, this is a limitation of GH actions.
|
||||
execution. You can follow its progress under the [Actions](https://github.com/argoproj/argo-cd/actions/workflows/release.yaml) tab, the name of the action is `Publish ArgoCD Release`. Don't get confused by the name of the running
|
||||
workflow, it will be the last commit message of the latest commit to the release branch.
|
||||
|
||||
The workflow performs necessary checks so that the release can be successfully
|
||||
built before the build actually starts. It will error when one of the
|
||||
prerequisites is not met, or if the release cannot be built (i.e. already
|
||||
exists, release notes invalid, etc etc). You can see a summary of what has
|
||||
failed in the job's overview page and more detailed errors in the output
|
||||
of the step that has failed.
|
||||
|
||||
:warning:
|
||||
!!! warning
|
||||
You cannot perform more than one release on the same release branch at the
|
||||
same time. For example, both `v1.6.0` and `v1.6.1` would operate on the
|
||||
`release-1.6` branch. If you submit `v1.6.1` while `v1.6.0` is still
|
||||
executing, the release automation will not execute. You have to either
|
||||
cancel `v1.6.0` before submitting `v1.6.1` or wait until it has finished.
|
||||
You can execute releases on different release branches simultaneously, for
|
||||
example, `v1.6.0` and `v1.7.0-rc1`, without problems.
|
||||
same time. For example, both `v2.7.0` and `v2.7.1` would operate on the
|
||||
`release-2.7` branch. You have to either cancel `v2.7.0` before submitting
|
||||
`v2.7.1` or wait until it has finished. You can execute releases on different
|
||||
release branches simultaneously, for example, `v2.7.5` and `v2.8.0-rc1` without problems.
|
||||
|
||||
### Verifying automated release
|
||||
|
||||
|
|
@ -118,119 +105,25 @@ checks to see if the release came out correctly:
|
|||
* Check [https://github.com/argoproj/argo-cd/releases](https://github.com/argoproj/argo-cd/releases)
|
||||
to see if the release has been correctly created and if all required assets
|
||||
are attached.
|
||||
* Check whether the image has been published on DockerHub correctly
|
||||
* Check whether the image has been published on Quay.io correctly
|
||||
|
||||
### If something went wrong
|
||||
|
||||
If something went wrong, damage should be limited. Depending on the steps that
|
||||
have been performed, you will need to manually clean up.
|
||||
|
||||
* Delete the release tag (e.g. `v1.6.0-rc2`) created in the GitHub repository. This
|
||||
will immediately set the release (if created) to `draft` status, invisible to the
|
||||
general public.
|
||||
* Delete the draft release (if created) from the `Releases` page on GitHub
|
||||
* If Docker image has been pushed to DockerHub, delete it
|
||||
* If commits have been performed to the release branch, revert them. Paths that could have been committed to are:
|
||||
* `VERSION`
|
||||
* `manifests/*`
|
||||
* If the container image has been pushed to Quay.io, delete it
|
||||
* Delete the release (if created) from the `Releases` page on GitHub
|
||||
|
||||
### Post-process manual steps
|
||||
### Manual releasing
|
||||
|
||||
For now, the only manual steps left are to
|
||||
The release process does not allow a manual release process. Image signatures and provenance need to be created using GitHub Actions.
|
||||
|
||||
* update stable tag in the GitHub repository to point to new the release (if appropriate)
|
||||
* update the `VERSION` file on `master` if this is a new major release
|
||||
|
||||
These may be automated as well in the future.
|
||||
|
||||
## Manual releasing
|
||||
|
||||
The automatic release process does not interfere with the manual release process, since
|
||||
the trigger tag does not match a normal release tag. If you prefer to perform,
|
||||
manual release or if automatic release is for some reason broken, these are the
|
||||
steps:
|
||||
|
||||
Make sure you are logged into Docker Hub:
|
||||
|
||||
```bash
|
||||
docker login
|
||||
```
|
||||
|
||||
Export the upstream repository and branch name, e.g.:
|
||||
|
||||
```bash
|
||||
REPO=upstream ;# or origin
|
||||
BRANCH=release-1.3
|
||||
```
|
||||
|
||||
Set the `VERSION` environment variable:
|
||||
|
||||
```bash
|
||||
# release candidate
|
||||
VERSION=v1.3.0-rc1
|
||||
# GA release
|
||||
VERSION=v1.3.1
|
||||
```
|
||||
|
||||
Update `VERSION` and manifests with the new version:
|
||||
|
||||
```bash
|
||||
git checkout $BRANCH
|
||||
echo ${VERSION:1} > VERSION
|
||||
make dev-tools-image
|
||||
make manifests IMAGE_TAG=$VERSION
|
||||
git commit -am "Update manifests to $VERSION"
|
||||
git tag $VERSION
|
||||
```
|
||||
|
||||
Build, and push release to Docker Hub
|
||||
|
||||
```bash
|
||||
git clean -fd
|
||||
make release IMAGE_NAMESPACE=argoproj IMAGE_TAG=$VERSION DOCKER_PUSH=true
|
||||
git push $REPO $BRANCH
|
||||
git push $REPO $VERSION
|
||||
```
|
||||
|
||||
Update [GitHub releases](https://github.com/argoproj/argo-cd/releases) with:
|
||||
|
||||
* Getting started (copy from the previous release)
|
||||
* Changelog
|
||||
* Binaries (e.g. `dist/argocd-darwin-amd64`).
|
||||
|
||||
## Update brew formulae (manual)
|
||||
|
||||
If GA, update the Brew formula:
|
||||
|
||||
```bash
|
||||
brew bump-formula-pr argocd --version ${VERSION:1}
|
||||
```
|
||||
|
||||
## Update stable tag (manual)
|
||||
|
||||
If GA, update `stable` tag:
|
||||
|
||||
```bash
|
||||
git tag stable --force && git push $REPO stable --force
|
||||
```
|
||||
|
||||
## Verify release
|
||||
|
||||
Locally:
|
||||
|
||||
```bash
|
||||
kubectl apply -n argocd -f https://raw.githubusercontent.com/argoproj/argo-cd/$VERSION/manifests/install.yaml
|
||||
```
|
||||
|
||||
Follow the [Getting Started Guide](../getting_started/).
|
||||
|
||||
If GA:
|
||||
|
||||
```bash
|
||||
brew upgrade argocd
|
||||
/usr/local/bin/argocd version
|
||||
```
|
||||
|
||||
Sync Argo CD in [https://cd.apps.argoproj.io/applications/argo-cd](https://cd.apps.argoproj.io/applications/argo-cd).
|
||||
|
||||
Deploy the [site](site.md).
|
||||
## Notable files that involve the release process.
|
||||
| File | Description |
|
||||
|------------------------------------|--------------------------------------------------------|
|
||||
|goreleaser.yaml |Config to build CLI binaries, checksums, release-notes |
|
||||
|.github/workflows/image-reuse.yaml |Reusable workflow used to generate container images |
|
||||
|.github/workflows/init-release.yaml |Used to generate manifest and `VERSION` file |
|
||||
|.github/workflows/release.yaml |Build image, CLI binaries, provenances, sbom, post jobs |
|
||||
|./hack/trigger-release.sh |Ensures all pre-requistes are met and pushes the tag |
|
||||
|
|
|
|||
|
|
@ -1,31 +1,113 @@
|
|||
# Verification of Argo CD signatures
|
||||
|
||||
All Argo CD container images are signed by cosign. Checksums are created for the CLI binaries and then signed to ensure integrity.
|
||||
# Verification of Argo CD Artifacts
|
||||
|
||||
## Prerequisites
|
||||
- Cosign [installation instructions](https://docs.sigstore.dev/cosign/installation)
|
||||
- Obtain or have a copy of ```argocd-cosign.pub```, which can be located in the assets section of the [release page](https://github.com/argoproj/argo-cd/releases)
|
||||
|
||||
Once you have installed cosign, you can use ```argocd-cosign.pub``` to verify the signed assets or container images.
|
||||
- cosign `v2.0.0` or higher [installation instructions](https://docs.sigstore.dev/cosign/installation)
|
||||
- slsa-verifier [installation instructions](https://github.com/slsa-framework/slsa-verifier#installation)
|
||||
|
||||
***
|
||||
## Release Assets
|
||||
| Asset | Description |
|
||||
|-------------------------|-------------------------------|
|
||||
| argocd-darwin-amd64 | CLI Binary |
|
||||
| argocd-darwin-arm64 | CLI Binary |
|
||||
| argocd-linux_amd64 | CLI Binary |
|
||||
| argocd-linux_arm64 | CLI Binary |
|
||||
| argocd-linux_ppc64le | CLI Binary |
|
||||
| argocd-linux_s390x | CLI Binary |
|
||||
| argocd-windows_amd64 | CLI Binary |
|
||||
| argocd-cli.intoto.jsonl | Attestation of CLI binaries |
|
||||
| cli_checksums.txt | Checksums of binaries |
|
||||
| sbom.tar.gz | Sbom |
|
||||
| sbom.tar.gz.pem | Certificate used to sign sbom |
|
||||
| sbom.tar.gz.sig | Signature of sbom |
|
||||
|
||||
***
|
||||
## Verification of container images
|
||||
|
||||
```bash
|
||||
cosign verify --key argocd-cosign.pub quay.io/argoproj/argocd:<VERSION>
|
||||
Argo CD container images are signed by [cosign](https://github.com/sigstore/cosign) using identity-based ("keyless") signing and transparency. Executing the following command can be used to verify the signature of a container image:
|
||||
|
||||
Verification for quay.io/argoproj/argocd:<VERSION> --
|
||||
```bash
|
||||
cosign verify \
|
||||
--certificate-identity-regexp https://github.com/argoproj/argo-cd/.github/workflows/image-reuse.yaml@refs/tags/v \
|
||||
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
||||
quay.io/argoproj/argocd:v2.7.0 | jq
|
||||
```
|
||||
The command should output the following if the container image was correctly verified:
|
||||
```bash
|
||||
The following checks were performed on each of these signatures:
|
||||
* The cosign claims were validated
|
||||
* The signatures were verified against the specified public key
|
||||
...
|
||||
- The cosign claims were validated
|
||||
- Existence of the claims in the transparency log was verified offline
|
||||
- Any certificates were verified against the Fulcio roots.
|
||||
[
|
||||
{
|
||||
"critical": {
|
||||
"identity": {
|
||||
"docker-reference": "quay.io/argoproj/argo-cd"
|
||||
},
|
||||
"image": {
|
||||
"docker-manifest-digest": "sha256:63dc60481b1b2abf271e1f2b866be8a92962b0e53aaa728902caa8ac8d235277"
|
||||
},
|
||||
"type": "cosign container image signature"
|
||||
},
|
||||
"optional": {
|
||||
"1.3.6.1.4.1.57264.1.1": "https://token.actions.githubusercontent.com",
|
||||
"1.3.6.1.4.1.57264.1.2": "push",
|
||||
"1.3.6.1.4.1.57264.1.3": "a6ec84da0eaa519cbd91a8f016cf4050c03323b2",
|
||||
"1.3.6.1.4.1.57264.1.4": "Publish ArgoCD Release",
|
||||
"1.3.6.1.4.1.57264.1.5": "argoproj/argo-cd",
|
||||
"1.3.6.1.4.1.57264.1.6": "refs/tags/<version>",
|
||||
...
|
||||
```
|
||||
## Verification of signed assets
|
||||
|
||||
***
|
||||
## Verification of container image attestations
|
||||
|
||||
A [SLSA](https://slsa.dev/) Level 3 provenance is generated using [slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator).
|
||||
|
||||
The following command will verify the signature of an attestation and how it was issued. It will contain the payloadType, payload, and signature.
|
||||
```bash
|
||||
cosign verify-attestation --type slsaprovenance \
|
||||
--certificate-identity-regexp https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v \
|
||||
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
||||
quay.io/argoproj/argocd:v2.7.0 | jq
|
||||
```
|
||||
The payload is a non-falsifiable provenance which is base64 encoded and can be viewed by using the command below:
|
||||
```bash
|
||||
cosign verify-attestation --type slsaprovenance \
|
||||
--certificate-identity-regexp https://github.com/slsa-framework/slsa-github-generator/.github/workflows/generator_container_slsa3.yml@refs/tags/v \
|
||||
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
||||
quay.io/argoproj/argocd:v2.7.0 | jq -r .payload | base64 -d | jq
|
||||
```
|
||||
!!! tip
|
||||
`cosign` or `slsa-verifier` can both be used to verify image attestations.
|
||||
Check the documentation of each binary for detailed instructions.
|
||||
|
||||
***
|
||||
## Verification of CLI artifacts with attestations
|
||||
|
||||
A single attestation (`argocd-cli.intoto.jsonl`) from each release is provided. This can be used with [slsa-verifier](https://github.com/slsa-framework/slsa-verifier#verification-for-github-builders) to verify that a CLI binary was generated using Argo CD workflows on GitHub and ensures it was cryptographically signed.
|
||||
```bash
|
||||
slsa-verifier verify-artifact argocd-linux-amd64 --provenance-path argocd-cli.intoto.jsonl --source-uri github.com/argoproj/argo-cd
|
||||
```
|
||||
## Verifying an artifact and output the provenance
|
||||
|
||||
```bash
|
||||
cosign verify-blob --key cosign.pub --signature $(cat argocd-<VERSION>-checksums.sig) argocd-$VERSION-checksums.txt
|
||||
Verified OK
|
||||
slsa-verifier verify-artifact argocd-linux-amd64 --provenance-path argocd-cli.intoto.jsonl --source-uri github.com/argoproj/argo-cd --print-provenance | jq
|
||||
```
|
||||
## Admission controllers
|
||||
## Verification of Sbom
|
||||
|
||||
Cosign is compatible with several types of admission controllers. Please see the [Cosign documentation](https://docs.sigstore.dev/cosign/overview/#kubernetes-integrations) for supported controllers
|
||||
```bash
|
||||
cosign verify-blob --signature sbom.tar.gz.sig --certificate sbom.tar.gz.pem \
|
||||
--certificate-identity-regexp ^https://github.com/argoproj/argo-cd/.github/workflows/release.yaml@refs/tags/v \
|
||||
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
|
||||
~/Downloads/sbom.tar.gz | jq
|
||||
```
|
||||
|
||||
***
|
||||
## Verification on Kubernetes
|
||||
|
||||
### Policy controllers
|
||||
!!! note
|
||||
We encourage all users to verify signatures and provenances with your admission/policy controller of choice. Doing so will verify that an image was built by us before it's deployed on your Kubernetes cluster.
|
||||
|
||||
Cosign signatures and SLSA provenances are compatible with several types of admission controllers. Please see the [cosign documentation](https://docs.sigstore.dev/cosign/overview/#kubernetes-integrations) and [slsa-github-generator](https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/container/README.md#verification) for supported controllers.
|
||||
|
|
|
|||
|
|
@ -4,33 +4,11 @@
|
|||
|
||||
NEW_TAG="${1}"
|
||||
GIT_REMOTE="${2}"
|
||||
COMMIT_MSG="${3}"
|
||||
origToken=""
|
||||
|
||||
set -ue
|
||||
|
||||
restoreToken() {
|
||||
if test "$origToken" != ""; then
|
||||
echo ">> Restoring original Git comment char"
|
||||
git config core.commentChar "$origToken"
|
||||
fi
|
||||
}
|
||||
|
||||
cleanLocalTriggerTag() {
|
||||
if test "$TRIGGER_TAG" != ""; then
|
||||
echo ">> Remove trigger tag '${TRIGGER_TAG}' from local repository."
|
||||
git tag -d $TRIGGER_TAG
|
||||
fi
|
||||
}
|
||||
|
||||
cleanup() {
|
||||
restoreToken
|
||||
cleanLocalTriggerTag
|
||||
}
|
||||
|
||||
if test "${NEW_TAG}" = "" -o "${GIT_REMOTE}" = ""; then
|
||||
echo "!! Usage: $0 <release tag> <remote> [path to release notes file]" >&2
|
||||
echo "You can use generate-release-notes.sh to generate the release notes file." >&2
|
||||
echo "!! Usage: $0 <release tag> <remote>" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
|
@ -41,8 +19,6 @@ if ! echo "${NEW_TAG}" | egrep -q '^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)*$'; then
|
|||
exit 1
|
||||
fi
|
||||
|
||||
TRIGGER_TAG="release-${NEW_TAG}"
|
||||
|
||||
# Check whether we are in correct branch of local repository
|
||||
RELEASE_BRANCH="${NEW_TAG%\.[0-9]*}"
|
||||
RELEASE_BRANCH="release-${RELEASE_BRANCH#*v}"
|
||||
|
|
@ -55,18 +31,9 @@ fi
|
|||
|
||||
echo ">> Working in release branch '${RELEASE_BRANCH}'"
|
||||
|
||||
# Check for trigger tag existing in local repo
|
||||
if git tag -l | grep -q -E "^${TRIGGER_TAG}$"; then
|
||||
echo "!! Release tag '${TRIGGER_TAG}' already exists in local repository" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check for trigger tag existing in remote repo
|
||||
if git ls-remote ${GIT_REMOTE} refs/tags/${TRIGGER_TAG} | grep -q -E "^${NEW_TAG}$"; then
|
||||
echo "!! Target trigger tag '${TRIGGER_TAG}' already exists in remote '${GIT_REMOTE}'" >&2
|
||||
echo "!! Another operation currently in progress?" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo ">> Ensuring release branch is up to date."
|
||||
# make sure release branch is up to date
|
||||
git pull ${GIT_REMOTE} ${RELEASE_BRANCH}
|
||||
|
||||
# Check for target (version) tag in local repo
|
||||
if git tag -l | grep -q -E "^${NEW_TAG}$"; then
|
||||
|
|
@ -75,35 +42,15 @@ if git tag -l | grep -q -E "^${NEW_TAG}$"; then
|
|||
fi
|
||||
|
||||
# Check for target (version) tag in remote repo
|
||||
if git ls-remote ${GIT_REMOTE} refs/tags/${NEW_TAG} | grep -q -E "^${NEW_TAG}$"; then
|
||||
if git ls-remote ${GIT_REMOTE} refs/tags/${NEW_TAG} | grep -q -E "${NEW_TAG}$"; then
|
||||
echo "!! Target version tag '${NEW_TAG}' already exists in remote '${GIT_REMOTE}'" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo ">> Creating new release '${NEW_TAG}' by pushing '${TRIGGER_TAG}' to '${GIT_REMOTE}'"
|
||||
echo ">> Creating new release '${NEW_TAG}' by pushing '${NEW_TAG}' to '${GIT_REMOTE}'"
|
||||
|
||||
GIT_ARGS=""
|
||||
if test "${COMMIT_MSG}" != ""; then
|
||||
if ! test -f "${COMMIT_MSG}"; then
|
||||
echo "!! Release notes at '${COMMIT_MSG}' do not exist or are not readable." >&2
|
||||
exit 1
|
||||
fi
|
||||
GIT_ARGS="-F ${COMMIT_MSG}"
|
||||
fi
|
||||
# Create new tag in local repository
|
||||
git tag ${NEW_TAG}
|
||||
|
||||
# We need different git comment char than '#', because markdown makes extensive
|
||||
# use of '#' - we chose ';' for our operation.
|
||||
origToken=$(git config core.commentChar || echo '#')
|
||||
echo ">> Saving original Git comment char '${origToken}' and setting it to ';' for this run"
|
||||
if ! git config core.commentChar ';'; then
|
||||
echo "!! Could not set git config commentChar ';'" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
trap cleanup SIGINT EXIT
|
||||
|
||||
# Create trigger tag in local repository
|
||||
git tag -a ${GIT_ARGS} ${TRIGGER_TAG}
|
||||
|
||||
# Push the trigger tag to remote repository
|
||||
git push ${GIT_REMOTE} ${TRIGGER_TAG}
|
||||
# Push the new tag to remote repository
|
||||
git push ${GIT_REMOTE} ${NEW_TAG}
|
||||
|
|
|
|||
Loading…
Reference in a new issue