fix: retry Kubernetes scale conflicts #12
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| tags: | |
| - "v[0-9]+.[0-9]+.[0-9]+" | |
| permissions: | |
| contents: read | |
| jobs: | |
| validate: | |
| name: Release metadata | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Check tag and synchronized versions | |
| run: | | |
| scripts/check-version.sh | |
| version="${GITHUB_REF_NAME#v}" | |
| chart_version="$(awk '/^version:/ {print $2; exit}' charts/devboxes/Chart.yaml)" | |
| test "$version" = "$chart_version" | |
| grep -Fq "## [$version]" CHANGELOG.md | |
| create-release: | |
| name: Create GitHub release | |
| needs: validate | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: taiki-e/create-gh-release-action@eba8ea96c86cca8a37f1b56e94b4d13301fba651 # v1 | |
| with: | |
| changelog: CHANGELOG.md | |
| cli: | |
| name: CLI ${{ matrix.target }} | |
| needs: create-release | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - target: x86_64-unknown-linux-gnu | |
| os: ubuntu-latest | |
| build-tool: cargo | |
| - target: aarch64-unknown-linux-gnu | |
| os: ubuntu-latest | |
| build-tool: cross | |
| - target: x86_64-apple-darwin | |
| os: macos-latest | |
| build-tool: cargo | |
| - target: aarch64-apple-darwin | |
| os: macos-latest | |
| build-tool: cargo | |
| runs-on: ${{ matrix.os }} | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: taiki-e/upload-rust-binary-action@f0d45ae91ee7b8ee928de7a9d04d893a08bcbec6 # v1 | |
| with: | |
| bin: devbox | |
| package: devbox-cli | |
| manifest-path: cli/Cargo.toml | |
| target: ${{ matrix.target }} | |
| build-tool: ${{ matrix.build-tool }} | |
| locked: true | |
| checksum: sha256 | |
| images: | |
| name: ${{ matrix.component }} image | |
| needs: validate | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| component: [controller, workspace] | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| attestations: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4 | |
| - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4 | |
| - name: Resolve version | |
| id: version | |
| run: echo "value=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT" | |
| - name: Build and push | |
| id: push | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: ${{ matrix.component }} | |
| platforms: linux/amd64,linux/arm64 | |
| push: true | |
| tags: | | |
| ghcr.io/${{ github.repository_owner }}/devboxes-${{ matrix.component }}:${{ steps.version.outputs.value }} | |
| ghcr.io/${{ github.repository_owner }}/devboxes-${{ matrix.component }}:latest | |
| labels: | | |
| org.opencontainers.image.source=https://github.com/${{ github.repository }} | |
| org.opencontainers.image.revision=${{ github.sha }} | |
| org.opencontainers.image.version=${{ steps.version.outputs.value }} | |
| org.opencontainers.image.licenses=Apache-2.0 | |
| cache-from: type=gha,scope=${{ matrix.component }} | |
| cache-to: type=gha,mode=max,scope=${{ matrix.component }} | |
| provenance: mode=max | |
| sbom: true | |
| - name: Attest image provenance | |
| uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0 | |
| with: | |
| subject-name: ghcr.io/${{ github.repository_owner }}/devboxes-${{ matrix.component }} | |
| subject-digest: ${{ steps.push.outputs.digest }} | |
| push-to-registry: true | |
| helm: | |
| name: Helm chart | |
| needs: validate | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 | |
| with: | |
| version: v4.2.2 | |
| - name: Check chart version | |
| run: | | |
| tag_version="${GITHUB_REF_NAME#v}" | |
| chart_version="$(helm show chart charts/devboxes | awk '/^version:/ {print $2}')" | |
| test "$tag_version" = "$chart_version" | |
| - name: Log in to GHCR | |
| run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io --username "${{ github.actor }}" --password-stdin | |
| - name: Package and publish chart | |
| run: | | |
| helm package charts/devboxes --destination /tmp | |
| helm push "/tmp/devboxes-${GITHUB_REF_NAME#v}.tgz" oci://ghcr.io/${{ github.repository_owner }}/charts | |
| published-images: | |
| name: Published images | |
| needs: images | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: read | |
| attestations: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Verify anonymous pulls, platforms, SBOMs, and provenance | |
| env: | |
| DEVBOXES_VERSION: ${{ github.ref_name }} | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| DEVBOXES_VERSION="${DEVBOXES_VERSION#v}" scripts/verify-published-images.sh | |
| published-chart: | |
| name: Published chart (Helm ${{ matrix.major }}) | |
| needs: helm | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - major: 3 | |
| version: v3.21.3 | |
| - major: 4 | |
| version: v4.2.2 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 | |
| with: | |
| version: ${{ matrix.version }} | |
| - name: Pull and render the public OCI chart | |
| env: | |
| DEVBOXES_VERSION: ${{ github.ref_name }} | |
| run: | | |
| version="${DEVBOXES_VERSION#v}" | |
| helm pull oci://ghcr.io/${{ github.repository_owner }}/charts/devboxes \ | |
| --version "$version" \ | |
| --destination /tmp | |
| helm template devboxes "/tmp/devboxes-$version.tgz" \ | |
| --namespace devboxes \ | |
| --set workspace.sshService.type=NodePort \ | |
| --set workspace.sshService.host=192.0.2.10 \ | |
| --set ingress.enabled=true \ | |
| --set ingress.className=nginx \ | |
| --set ingress.tls.enabled=true \ | |
| --set ingress.tls.secretName=devboxes-tls \ | |
| --set controller.externalUrl=https://devboxes.example.com \ | |
| --set controller.cookieSecure=true \ | |
| --set podDisruptionBudget.enabled=true \ | |
| > /tmp/devboxes-published.yaml | |
| grep -Fq "ghcr.io/${{ github.repository_owner }}/devboxes-controller:$version" /tmp/devboxes-published.yaml | |
| grep -Fq "ghcr.io/${{ github.repository_owner }}/devboxes-workspace:$version" /tmp/devboxes-published.yaml | |
| - name: Strictly validate published Kubernetes resources | |
| run: >- | |
| docker run --rm -i ghcr.io/yannh/kubeconform:v0.7.0 | |
| -strict -summary | |
| < /tmp/devboxes-published.yaml | |
| published-e2e: | |
| name: Published clean-cluster lifecycle | |
| needs: [cli, published-images, published-chart] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| permissions: | |
| contents: read | |
| packages: read | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1 | |
| with: | |
| version: v4.2.2 | |
| - name: Install kind | |
| run: | | |
| go install sigs.k8s.io/kind@v0.31.0 | |
| echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH" | |
| - name: Run lifecycle through released CLI, chart, and images | |
| env: | |
| DEVBOXES_VERSION: ${{ github.ref_name }} | |
| run: | | |
| DEVBOXES_VERSION="${DEVBOXES_VERSION#v}" scripts/published-e2e.sh | |
| release-gate: | |
| name: Release gate | |
| needs: published-e2e | |
| runs-on: ubuntu-latest | |
| steps: | |
| - run: echo "Published release artifacts passed every release gate." |