Skip to content

fix: retry Kubernetes scale conflicts #12

fix: retry Kubernetes scale conflicts

fix: retry Kubernetes scale conflicts #12

Workflow file for this run

name: Release
on:
push:
tags:
- "v[0-9]+.[0-9]+.[0-9]+"
permissions:
contents: read
jobs:
validate:
name: Release metadata
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Check tag and synchronized versions
run: |
scripts/check-version.sh
version="${GITHUB_REF_NAME#v}"
chart_version="$(awk '/^version:/ {print $2; exit}' charts/devboxes/Chart.yaml)"
test "$version" = "$chart_version"
grep -Fq "## [$version]" CHANGELOG.md
create-release:
name: Create GitHub release
needs: validate
runs-on: ubuntu-latest
permissions:
contents: write
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: taiki-e/create-gh-release-action@eba8ea96c86cca8a37f1b56e94b4d13301fba651 # v1
with:
changelog: CHANGELOG.md
cli:
name: CLI ${{ matrix.target }}
needs: create-release
strategy:
fail-fast: false
matrix:
include:
- target: x86_64-unknown-linux-gnu
os: ubuntu-latest
build-tool: cargo
- target: aarch64-unknown-linux-gnu
os: ubuntu-latest
build-tool: cross
- target: x86_64-apple-darwin
os: macos-latest
build-tool: cargo
- target: aarch64-apple-darwin
os: macos-latest
build-tool: cargo
runs-on: ${{ matrix.os }}
permissions:
contents: write
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: taiki-e/upload-rust-binary-action@f0d45ae91ee7b8ee928de7a9d04d893a08bcbec6 # v1
with:
bin: devbox
package: devbox-cli
manifest-path: cli/Cargo.toml
target: ${{ matrix.target }}
build-tool: ${{ matrix.build-tool }}
locked: true
checksum: sha256
images:
name: ${{ matrix.component }} image
needs: validate
strategy:
fail-fast: false
matrix:
component: [controller, workspace]
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
attestations: write
id-token: write
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
- uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
- name: Resolve version
id: version
run: echo "value=${GITHUB_REF_NAME#v}" >> "$GITHUB_OUTPUT"
- name: Build and push
id: push
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
with:
context: ${{ matrix.component }}
platforms: linux/amd64,linux/arm64
push: true
tags: |
ghcr.io/${{ github.repository_owner }}/devboxes-${{ matrix.component }}:${{ steps.version.outputs.value }}
ghcr.io/${{ github.repository_owner }}/devboxes-${{ matrix.component }}:latest
labels: |
org.opencontainers.image.source=https://github.com/${{ github.repository }}
org.opencontainers.image.revision=${{ github.sha }}
org.opencontainers.image.version=${{ steps.version.outputs.value }}
org.opencontainers.image.licenses=Apache-2.0
cache-from: type=gha,scope=${{ matrix.component }}
cache-to: type=gha,mode=max,scope=${{ matrix.component }}
provenance: mode=max
sbom: true
- name: Attest image provenance
uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
with:
subject-name: ghcr.io/${{ github.repository_owner }}/devboxes-${{ matrix.component }}
subject-digest: ${{ steps.push.outputs.digest }}
push-to-registry: true
helm:
name: Helm chart
needs: validate
runs-on: ubuntu-latest
permissions:
contents: read
packages: write
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
with:
version: v4.2.2
- name: Check chart version
run: |
tag_version="${GITHUB_REF_NAME#v}"
chart_version="$(helm show chart charts/devboxes | awk '/^version:/ {print $2}')"
test "$tag_version" = "$chart_version"
- name: Log in to GHCR
run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io --username "${{ github.actor }}" --password-stdin
- name: Package and publish chart
run: |
helm package charts/devboxes --destination /tmp
helm push "/tmp/devboxes-${GITHUB_REF_NAME#v}.tgz" oci://ghcr.io/${{ github.repository_owner }}/charts
published-images:
name: Published images
needs: images
runs-on: ubuntu-latest
permissions:
contents: read
packages: read
attestations: read
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Verify anonymous pulls, platforms, SBOMs, and provenance
env:
DEVBOXES_VERSION: ${{ github.ref_name }}
GH_TOKEN: ${{ github.token }}
run: |
DEVBOXES_VERSION="${DEVBOXES_VERSION#v}" scripts/verify-published-images.sh
published-chart:
name: Published chart (Helm ${{ matrix.major }})
needs: helm
runs-on: ubuntu-latest
strategy:
fail-fast: false
matrix:
include:
- major: 3
version: v3.21.3
- major: 4
version: v4.2.2
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
with:
version: ${{ matrix.version }}
- name: Pull and render the public OCI chart
env:
DEVBOXES_VERSION: ${{ github.ref_name }}
run: |
version="${DEVBOXES_VERSION#v}"
helm pull oci://ghcr.io/${{ github.repository_owner }}/charts/devboxes \
--version "$version" \
--destination /tmp
helm template devboxes "/tmp/devboxes-$version.tgz" \
--namespace devboxes \
--set workspace.sshService.type=NodePort \
--set workspace.sshService.host=192.0.2.10 \
--set ingress.enabled=true \
--set ingress.className=nginx \
--set ingress.tls.enabled=true \
--set ingress.tls.secretName=devboxes-tls \
--set controller.externalUrl=https://devboxes.example.com \
--set controller.cookieSecure=true \
--set podDisruptionBudget.enabled=true \
> /tmp/devboxes-published.yaml
grep -Fq "ghcr.io/${{ github.repository_owner }}/devboxes-controller:$version" /tmp/devboxes-published.yaml
grep -Fq "ghcr.io/${{ github.repository_owner }}/devboxes-workspace:$version" /tmp/devboxes-published.yaml
- name: Strictly validate published Kubernetes resources
run: >-
docker run --rm -i ghcr.io/yannh/kubeconform:v0.7.0
-strict -summary
< /tmp/devboxes-published.yaml
published-e2e:
name: Published clean-cluster lifecycle
needs: [cli, published-images, published-chart]
runs-on: ubuntu-latest
timeout-minutes: 30
permissions:
contents: read
packages: read
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
with:
version: v4.2.2
- name: Install kind
run: |
go install sigs.k8s.io/kind@v0.31.0
echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
- name: Run lifecycle through released CLI, chart, and images
env:
DEVBOXES_VERSION: ${{ github.ref_name }}
run: |
DEVBOXES_VERSION="${DEVBOXES_VERSION#v}" scripts/published-e2e.sh
release-gate:
name: Release gate
needs: published-e2e
runs-on: ubuntu-latest
steps:
- run: echo "Published release artifacts passed every release gate."