[DRY RUN] Release NIC 3.6.1 from release-3.6 by @pdabelf5 #129
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
name: Release NIC | |
run-name: ${{ inputs.dry_run && '[DRY RUN] ' || '' }}Release NIC ${{ inputs.nic_version }} from ${{ inputs.release_branch }} by @${{ github.actor }} | |
on: | |
workflow_dispatch: | |
inputs: | |
nic_version: | |
description: "Version to release" | |
required: true | |
type: string | |
source_tag: | |
description: "Source tag to release" | |
required: false | |
type: string | |
chart_version: | |
description: "Helm Chart version to release" | |
required: false | |
type: string | |
cnab_version: | |
description: "CNAB version for Azure Marketplace" | |
required: false | |
type: string | |
release_branch: | |
description: "Branch to release from" | |
required: true | |
type: string | |
dry_run: | |
description: "Dry Run?" | |
type: boolean | |
default: false | |
skip_step: | |
description: "Comma separated list of jobs to skip" | |
# publish-helm-chart,operator,release-oss,release-plus,certify-openshift-images,aws-marketplace,azure-marketplace,gcp-marketplace,azure-upload,github-release,release-image-notification | |
type: string | |
required: false | |
defaults: | |
run: | |
shell: bash | |
permissions: | |
contents: read | |
jobs: | |
variables: | |
name: Set Variables | |
runs-on: ubuntu-22.04 | |
permissions: | |
contents: read | |
outputs: | |
source_tag: ${{ steps.vars.outputs.stable_tag }} | |
short_tag: ${{ steps.vars.outputs.short_tag }} | |
go_code_md5: ${{ steps.vars.outputs.go_code_md5 }} | |
binary_cache_sign_hit: ${{ steps.binary-cache-sign.outputs.cache-hit }} | |
steps: | |
- name: Checkout Repository | |
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
with: | |
fetch-depth: 0 | |
ref: ${{ inputs.release_branch }} | |
- name: Output Variables | |
id: vars | |
run: | | |
if [ -n "${{ inputs.source_tag }}" ]; then | |
echo "stable_tag=${{ inputs.source_tag }}" >> $GITHUB_OUTPUT | |
else | |
./.github/scripts/variables.sh stable_tag >> $GITHUB_OUTPUT | |
fi | |
tag=${{ inputs.nic_version }} | |
echo "short_tag=${tag%.*}" >> $GITHUB_OUTPUT | |
./.github/scripts/variables.sh go_code_md5 >> $GITHUB_OUTPUT | |
cat $GITHUB_OUTPUT | |
- name: Fetch Cached Signed Binary Artifacts | |
id: binary-cache-sign | |
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 | |
with: | |
path: ${{ github.workspace }}/tarballs | |
key: nginx-ingress-release-${{ steps.vars.outputs.go_code_md5 }} | |
lookup-only: true | |
tag: | |
name: Create Tag on release branch in NIC repo | |
runs-on: ubuntu-22.04 | |
permissions: | |
contents: write | |
steps: | |
- name: Checkout NIC repo | |
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
with: | |
ref: ${{ inputs.release_branch }} | |
fetch-depth: 0 | |
- name: Create new release Tag | |
run: | | |
git config --global user.email "[email protected]" | |
git config --global user.name "NGINX Kubernetes Team" | |
branch="${{ inputs.release_branch }}" | |
tag="v${{ inputs.nic_version }}" | |
if ! git rev-parse --verify refs/tags/${tag}; then | |
echo "Adding tag ${tag}." | |
git tag -a ${tag} -m "Version ${tag#v*}" | |
echo "Pushing to tag ${tag} to branch ${branch}" | |
if ! ${{ inputs.dry_run }}; then | |
git push origin "${tag}" | |
else | |
echo "DRY RUN not making any changes" | |
git push --dry-run origin "${tag}" | |
fi | |
else | |
echo "Warning: Tag ${tag} already exists. Not making any changes" | |
fi | |
env: | |
GITHUB_TOKEN: ${{ secrets.NGINX_PAT }} | |
release-oss: | |
if: ${{ ! cancelled() && ! failure() && ! contains(inputs.skip_step, 'release-oss') }} | |
name: Release Docker OSS | |
needs: [variables] | |
uses: ./.github/workflows/oss-release.yml | |
with: | |
gcr_release_registry: true | |
ecr_public_registry: true | |
dockerhub_public_registry: true | |
quay_public_registry: true | |
github_public_registry: true | |
source_tag: ${{ needs.variables.outputs.source_tag }} | |
target_tag: ${{ inputs.nic_version }} | |
short_target_tag: ${{ needs.variables.outputs.short_tag }} | |
dry_run: ${{ inputs.dry_run }} | |
permissions: | |
contents: read | |
id-token: write | |
packages: write | |
secrets: inherit | |
release-plus: | |
if: ${{ ! cancelled() && ! failure() && ! contains(inputs.skip_step, 'release-plus') }} | |
name: Release Docker Plus | |
needs: [variables] | |
uses: ./.github/workflows/plus-release.yml | |
with: | |
gcr_release_registry: true | |
nginx_registry: true | |
gcr_mktpl_registry: true | |
ecr_mktpl_registry: true | |
az_mktpl_registry: true | |
source_tag: ${{ needs.variables.outputs.source_tag }} | |
target_tag: ${{ inputs.nic_version }} | |
short_target_tag: ${{ needs.variables.outputs.short_tag }} | |
dry_run: ${{ inputs.dry_run }} | |
permissions: | |
contents: read | |
id-token: write | |
secrets: inherit | |
publish-helm-chart: | |
if: ${{ ! cancelled() && ! failure() && ! inputs.dry_run && ! contains(inputs.skip_step, 'publish-helm-chart') }} | |
name: Publish Helm Chart | |
uses: ./.github/workflows/publish-helm.yml | |
with: | |
branch: ${{ inputs.release_branch }} | |
ic_version: ${{ inputs.nic_version }} | |
chart_version: ${{ inputs.chart_version }} | |
nginx_helm_repo: true | |
permissions: | |
contents: write # for pushing to Helm Charts repository | |
packages: write # for helm to push to GHCR | |
secrets: inherit | |
certify-openshift-images: | |
if: ${{ ! cancelled() && ! failure() && ! inputs.dry_run && ! contains(inputs.skip_step, 'certify-openshift-images') }} | |
name: Certify OpenShift UBI images | |
runs-on: ubuntu-22.04 | |
needs: [release-oss] | |
steps: | |
- name: Checkout Repository | |
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
with: | |
ref: ${{ inputs.release_branch }} | |
- name: Certify UBI OSS images in quay | |
uses: ./.github/actions/certify-openshift-image | |
continue-on-error: true | |
with: | |
image: quay.io/nginx/nginx-ingress:${{ inputs.nic_version }}-ubi | |
project_id: ${{ secrets.CERTIFICATION_PROJECT_ID }} | |
pyxis_token: ${{ secrets.PYXIS_API_TOKEN }} | |
operator: | |
if: ${{ ! cancelled() && ! failure() && ! inputs.dry_run && ! contains(inputs.skip_step, 'operator') && !contains(inputs.skip_step, 'publish-helm-chart') }} | |
name: Trigger PR for Operator | |
runs-on: ubuntu-22.04 | |
needs: [publish-helm-chart] | |
steps: | |
- name: | |
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 | |
with: | |
github-token: ${{ secrets.NGINX_PAT }} | |
script: | | |
await github.rest.actions.createWorkflowDispatch({ | |
owner: context.repo.owner, | |
repo: 'nginx-ingress-helm-operator', | |
workflow_id: 'sync-chart.yml', | |
ref: 'main', | |
inputs: { | |
chart_version: '${{ inputs.chart_version }}' | |
}, | |
}) | |
gcp-marketplace: | |
if: ${{ ! cancelled() && ! failure() && ! inputs.dry_run && ! contains(inputs.skip_step, 'gcp-marketplace') }} | |
name: Trigger PR for GCP Marketplace | |
runs-on: ubuntu-22.04 | |
needs: [publish-helm-chart] | |
steps: | |
- name: | |
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 | |
with: | |
github-token: ${{ secrets.NGINX_PAT }} | |
script: | | |
await github.rest.actions.createWorkflowDispatch({ | |
owner: context.repo.owner, | |
repo: 'kubernetes-ingress-gcp', | |
workflow_id: 'sync-chart.yml', | |
ref: 'main', | |
inputs: { | |
chart_version: '${{ inputs.chart_version }}' | |
}, | |
}) | |
azure-marketplace: | |
if: ${{ ! cancelled() && ! failure() && ! inputs.dry_run && ! contains(inputs.skip_step, 'azure-marketplace') }} | |
name: Trigger CNAB Build for Azure Marketplace | |
runs-on: ubuntu-22.04 | |
needs: [publish-helm-chart] | |
steps: | |
- name: | |
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 | |
with: | |
github-token: ${{ secrets.NGINX_PAT }} | |
script: | | |
await github.rest.actions.createWorkflowDispatch({ | |
owner: context.repo.owner, | |
repo: 'kubernetes-ingress-azure', | |
workflow_id: 'build-cnab.yml', | |
ref: 'main', | |
inputs: { | |
chart_version: '${{ inputs.chart_version }}', | |
ic_version: '${{ inputs.nic_version }}', | |
cnab_version: '${{ inputs.cnab_version }}' | |
}, | |
}) | |
aws-marketplace: | |
if: ${{ ! cancelled() && ! failure() && ! inputs.dry_run && ! contains(inputs.skip_step, 'aws-marketplace') }} | |
name: Publish to AWS Marketplace | |
runs-on: ubuntu-22.04 | |
needs: [release-plus] | |
permissions: | |
contents: read | |
id-token: write | |
strategy: | |
fail-fast: false | |
matrix: | |
include: | |
- image: 709825985650.dkr.ecr.us-east-1.amazonaws.com/nginx/nginx-plus-ingress:${{ inputs.nic_version }}-mktpl | |
product_id: AWS_PRODUCT_ID | |
- image: 709825985650.dkr.ecr.us-east-1.amazonaws.com/nginx/nginx-plus-ingress-nap:${{ inputs.nic_version }}-mktpl | |
product_id: AWS_NAP_WAF_PRODUCT_ID | |
- image: 709825985650.dkr.ecr.us-east-1.amazonaws.com/nginx/nginx-plus-ingress-dos:${{ inputs.nic_version }}-mktpl | |
product_id: AWS_NAP_DOS_PRODUCT_ID | |
- image: 709825985650.dkr.ecr.us-east-1.amazonaws.com/nginx/nginx-plus-ingress-dos-nap:${{ inputs.nic_version }}-mktpl | |
product_id: AWS_NAP_WAF_DOS_PRODUCT_ID | |
steps: | |
- name: Checkout Repository | |
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
with: | |
ref: ${{ inputs.release_branch }} | |
- name: Configure AWS Credentials | |
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2 | |
with: | |
aws-region: us-east-1 | |
role-to-assume: ${{ secrets.AWS_ROLE_MARKETPLACE }} | |
- name: Publish to AWS Marketplace | |
uses: nginxinc/aws-marketplace-publish@be512a7ae9666098bc4429a1afa27a11be6a3995 # v1.0.3 | |
with: | |
version: ${{ inputs.nic_version }} | |
product-id: ${{ secrets[matrix.product_id] }} | |
registry: ${{ matrix.image }} | |
release-notes: https://github.com/nginxinc/kubernetes-ingress/releases/tag/v${{ inputs.nic_version }} | |
description: | | |
Best-in-class traffic management solution for services in Amazon EKS. | |
This is the official implementation of NGINX Ingress Controller (based on NGINX Plus) from NGINX. | |
usage-instructions: | | |
This container requires Kubernetes and can be deployed to EKS. | |
Review the installation instructions https://docs.nginx.com/nginx-ingress-controller/installation/ and utilize the deployment resources available https://github.com/nginxinc/kubernetes-ingress/tree/v${{ inputs.nic_version }}/deployments | |
Use this image instead of building your own. | |
binaries: | |
name: Process Binaries | |
runs-on: ubuntu-22.04 | |
needs: [variables] | |
permissions: | |
contents: read | |
id-token: write # for cosign to sign artifacts | |
steps: | |
- name: Checkout Repository | |
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
with: | |
ref: ${{ inputs.release_branch }} | |
- name: Fetch Binary Artifacts from Cache | |
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 | |
with: | |
path: ${{ github.workspace }}/dist | |
key: nginx-ingress-${{ needs.variables.outputs.go_code_md5 }} | |
if: ${{ needs.variables.outputs.binary_cache_sign_hit != 'true' }} | |
- name: Download Syft | |
id: syft | |
uses: anchore/sbom-action/download-syft@e8d2a6937ecead383dfe75190d104edd1f9c5751 # v0.16.0 | |
if: ${{ needs.variables.outputs.binary_cache_sign_hit != 'true' }} | |
- name: Install Cosign | |
uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0 | |
if: ${{ needs.variables.outputs.binary_cache_sign_hit != 'true' }} | |
- name: Create Tarballs | |
run: | | |
./.github/scripts/create-release-tarballs.sh dist ${{ inputs.nic_version }} | |
env: | |
SYFT_BIN: ${{ steps.syft.outputs.cmd }} | |
if: ${{ needs.variables.outputs.binary_cache_sign_hit != 'true' }} | |
- name: Store Tarball Artifacts in Cache | |
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 | |
with: | |
path: ${{ github.workspace }}/tarballs | |
key: nginx-ingress-release-${{ needs.variables.outputs.go_code_md5 }} | |
if: ${{ needs.variables.outputs.binary_cache_sign_hit != 'true' }} | |
azure-upload: | |
if: ${{ ! cancelled() && ! failure() && ! contains(inputs.skip_step, 'azure-upload') }} | |
name: Upload packages to Azure | |
runs-on: ubuntu-22.04 | |
needs: [variables, binaries] | |
permissions: | |
id-token: write | |
contents: read | |
steps: | |
- name: Checkout Repository | |
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
with: | |
ref: ${{ inputs.release_branch }} | |
- name: Fetch Cached Tarball Artifacts | |
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 | |
with: | |
key: nginx-ingress-release-${{ needs.variables.outputs.go_code_md5 }} | |
path: ${{ github.workspace }}/tarballs | |
fail-on-cache-miss: true | |
- name: Azure login | |
uses: azure/login@6c251865b4e6290e7b78be643ea2d005bc51f69a # v2.1.1 | |
with: | |
client-id: ${{ secrets.AZURE_CLIENT_ID }} | |
tenant-id: ${{ secrets.AZURE_TENANT_ID }} | |
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} | |
- name: Azure Upload Release Packages | |
uses: azure/CLI@965c8d7571d2231a54e321ddd07f7b10317f34d9 # v2.0.0 | |
with: | |
inlineScript: | | |
for i in $(find tarballs -type f); do | |
echo -n "Uploading ${i} to kubernetes-ingress/v${{ inputs.nic_version }}/${i##*/} ... " | |
if ${{ ! inputs.dry_run}}; then | |
az storage blob upload --auth-mode=login -f "$i" -c ${{ secrets.AZURE_BUCKET_NAME }} \ | |
--account-name ${{ secrets.AZURE_STORAGE_ACCOUNT }} --overwrite -n kubernetes-ingress/v${{ inputs.nic_version }}/${i##*/} | |
echo "done" | |
else | |
echo "skipped, dry_run." | |
fi | |
done | |
github-release: | |
if: ${{ ! cancelled() && ! failure() && ! contains(inputs.skip_step, 'github-release') }} | |
name: Publish release to GitHub | |
runs-on: ubuntu-22.04 | |
needs: [variables, binaries, release-oss, release-plus, azure-upload] | |
permissions: | |
contents: write # to modify the release | |
issues: write # to close milestone | |
actions: read # for slack notification | |
steps: | |
- name: Checkout Repository | |
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
with: | |
ref: ${{ inputs.release_branch }} | |
- name: Fetch Cached Tarball Artifacts | |
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2 | |
with: | |
key: nginx-ingress-release-${{ needs.variables.outputs.go_code_md5 }} | |
path: ${{ github.workspace }}/tarballs | |
fail-on-cache-miss: true | |
- name: Upload Release Assets | |
env: | |
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
# clobber overwrites existing assets of the same name | |
run: | | |
if ! ${{ inputs.dry_run }}; then | |
gh release upload --clobber v${{ inputs.nic_version }} \ | |
$(find ./tarballs -type f) | |
else | |
echo "Skipping adding binaries to Github Release, DRY_RUN" | |
fi | |
- name: Close Release Milestone | |
env: | |
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
run: | | |
milestone_number=$(gh api \ | |
-H "Accept: application/vnd.github.v3+json" \ | |
/repos/${{ github.repository }}/milestones \ | |
| jq --arg version "v${{ inputs.nic_version }}" -r \ | |
'.[] | select(.title == $version) | .number') | |
if [ -n "${milestone_number}" ]; then | |
if ! ${{ inputs.dry_run }}; then | |
gh api --method PATCH -H "Accept: application/vnd.github.v3+json" \ | |
/repos/${{ github.repository }}/milestones/${milestone_number} \ | |
-f "title=v${{ inputs.nic_version }}" \ | |
-f "state=closed"; | |
else | |
echo "Skipping closing Github Release milestone, DRY_RUN" | |
fi | |
else | |
echo "Github Milestone not available, closed already." | |
fi | |
- name: Get Github release id | |
id: release-id | |
env: | |
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
run: | | |
release_id=$(gh api \ | |
-H "Accept: application/vnd.github.v3+json" \ | |
-H "X-GitHub-Api-Version: 2022-11-28" \ | |
/repos/${{ github.repository }}/releases \ | |
| jq --arg version "v${{ inputs.nic_version }}" -r \ | |
'.[] | select(.name == $version) | .id') | |
echo "release_id=${release_id}" >> $GITHUB_OUTPUT | |
- name: Publish Github Release | |
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1 | |
with: | |
script: | | |
const {RELEASE_ID} = process.env | |
const release = (await github.rest.repos.updateRelease({ | |
owner: context.payload.repository.owner.login, | |
repo: context.payload.repository.name, | |
release_id: `${RELEASE_ID}`, | |
draft: false, | |
})) | |
console.log(`Release published: ${release.data.html_url}`) | |
env: | |
RELEASE_ID: ${{ steps.release-id.outputs.release_id }} | |
if: ${{ ! inputs.dry_run }} | |
- name: Send Notification | |
uses: 8398a7/action-slack@28ba43ae48961b90635b50953d216767a6bea486 # v3.16.2 | |
with: | |
status: custom | |
custom_payload: | | |
{ | |
"blocks": [ | |
{ | |
"type": "section", | |
"text": { | |
"type": "mrkdwn", | |
"text": "NGINX Ingress Controller v${{ inputs.nic_version }} is out! Check it out: https://github.com/nginxinc/kubernetes-ingress/releases/tag/v${{ inputs.nic_version }}" | |
} | |
} | |
] | |
} | |
env: | |
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_COMMUNITY }} | |
if: ${{ ! inputs.dry_run }} | |
release-image-notification: | |
if: ${{ ! cancelled() && ! failure() && ! inputs.dry_run && ! contains(inputs.skip_step, 'release-image-notification') }} | |
name: Notify Slack channels about image release | |
runs-on: ubuntu-22.04 | |
needs: [variables, binaries, release-oss, release-plus] | |
permissions: | |
contents: read | |
actions: read | |
strategy: | |
fail-fast: false | |
matrix: | |
image: ["nginx/nginx-ingress:${{ inputs.nic_version }}", "nginx/nginx-ingress:${{ inputs.nic_version }}-ubi", "nginx/nginx-ingress:${{ inputs.nic_version }}-alpine"] | |
steps: | |
- name: Checkout Repository | |
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7 | |
with: | |
ref: ${{ inputs.release_branch }} | |
- name: Get Image manifest digest | |
id: digest | |
run: | | |
digest=$(docker buildx imagetools inspect ${{ matrix.image }} --format '{{ json . }}' | jq -r .manifest.digest) | |
- name: Get Image tag | |
id: tag | |
run: | | |
tag=$(echo ${{ matrix.image }} | cut -d ':' -f 2) | |
- name: Get variables for Slack | |
id: slack | |
run: | | |
echo "message=$(git log -1 --pretty=%s)" >> $GITHUB_OUTPUT | |
echo "date=$(date +%s)" >> $GITHUB_OUTPUT | |
echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT | |
echo "sha_long=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT | |
- name: Send Notification | |
uses: 8398a7/action-slack@28ba43ae48961b90635b50953d216767a6bea486 # v3.16.2 | |
with: | |
status: custom | |
custom_payload: | | |
{ | |
username: "Docker", | |
icon_emoji: ":docker:", | |
mention: "here", | |
attachments: [{ | |
title: `New Docker image was pushed to DockerHub for ${process.env.AS_REPO}`, | |
color: "good", | |
fields: [{ | |
title: "Docker Image", | |
value: `<https://hub.docker.com/r/nginx/nginx-ingress/tags?page=1&ordering=last_updated&name=${{ steps.tag.outputs.tag }}|nginx/nginx-ingress:${{ inputs.nic_version }}>`, | |
short: true | |
}, | |
{ | |
title: "Image digest", | |
value: "${{ steps.digest.outputs.digest }}", | |
short: true | |
}, | |
{ | |
title: "Commit Message", | |
value: `${{ steps.slack.outputs.message }}`, | |
short: true | |
}, | |
{ | |
title: "Commit Hash", | |
value: `<https://github.com/${{ github.repository }}/commit/${{ steps.slack.outputs.sha_long }}|${{ steps.slack.outputs.sha_short }}>`, | |
short: true | |
}], | |
footer: "Update DockerHub Image", | |
footer_icon: "https://raw.githubusercontent.com/docker-library/docs/c350af05d3fac7b5c3f6327ac82fe4d990d8729c/docker/logo.png", | |
ts: ${{ steps.slack.outputs.date }} | |
}] | |
} | |
env: | |
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} |