name: Build Images on: workflow_call: inputs: operatorVersion: description: Operator bundle version default: 0.0.0 type: string operatorTag: description: Image tag default: latest type: string authorinoVersion: description: Authorino version used to resolve the git ref for manifests (semver, SHA, branch name, or 'latest') default: latest type: string relatedImageAuthorino: description: Full Authorino image reference to embed in the bundle (e.g. quay.io/kuadrant/authorino:latest or quay.io/kuadrant/authorino@sha256:...) default: quay.io/kuadrant/authorino:latest type: string channels: description: Bundle and catalog channels, comma separated (leave empty to keep existing annotations) default: "" type: string defaultChannel: description: Bundle default channel (leave empty to keep existing annotations) default: "" type: string quayImageExpiry: description: When to expire the built quay images. The time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively, from the time the image is built. default: never type: string workflow_dispatch: inputs: operatorVersion: description: Operator bundle version default: 0.0.0 type: string operatorTag: description: Image tag default: latest type: string authorinoVersion: description: Authorino version used to resolve the git ref for manifests (semver, SHA, branch name, or 'latest') default: latest type: string relatedImageAuthorino: description: Full Authorino image reference to embed in the bundle (e.g. quay.io/kuadrant/authorino:latest or quay.io/kuadrant/authorino@sha256:...) default: quay.io/kuadrant/authorino:latest type: string channels: description: Bundle and catalog channels, comma separated (leave empty to keep existing annotations) default: "" type: string defaultChannel: description: Bundle default channel (leave empty to keep existing annotations) default: "" type: string quayImageExpiry: description: When to expire the built quay images. The time values could be something like 1h, 2d, 3w for hours, days, and weeks, respectively, from the time the image is built. default: never type: string env: IMG_REGISTRY_HOST: quay.io IMG_REGISTRY_ORG: kuadrant OPERATOR_NAME: authorino-operator BUILD_CONFIG_FILE: build.yaml QUAY_IMAGE_EXPIRY: ${{ inputs.quayImageExpiry }} permissions: contents: read jobs: build: name: Build and push operator image runs-on: ubuntu-latest steps: - name: Check out code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4 - name: Set up Docker Buildx uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3 - name: Set up Go uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # ratchet:actions/setup-go@v6 with: go-version-file: go.mod id: go - name: Install yq run: make yq - name: Extract metadata id: meta uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5 with: images: ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/${{ env.OPERATOR_NAME }} tags: | type=raw,value=${{ inputs.operatorTag }} - name: Login to Container Registry uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3 with: registry: ${{ env.IMG_REGISTRY_HOST }} username: ${{ secrets.IMG_REGISTRY_USERNAME }} password: ${{ secrets.IMG_REGISTRY_TOKEN }} - name: Build and push operator image id: build-image uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # ratchet:docker/build-push-action@v6 with: context: . platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le push: true tags: ${{ steps.meta.outputs.tags }} build-args: | OPERATOR_VERSION=${{ inputs.operatorVersion }} GIT_SHA=${{ github.sha }} DIRTY=false DEFAULT_AUTHORINO_IMAGE=${{ inputs.relatedImageAuthorino }} QUAY_IMAGE_EXPIRY=${{ inputs.quayImageExpiry }} provenance: true - name: Print image URL run: | echo "Image(s) pushed:" echo "${{ steps.meta.outputs.tags }}" - name: Install cosign uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # ratchet:sigstore/cosign-installer@v3 - name: Sign image with cosign run: | cosign sign --yes ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/${{ env.OPERATOR_NAME }}@${{ steps.build-image.outputs.digest }} build-bundle: name: Build and push bundle image needs: build runs-on: ubuntu-latest steps: - name: Check out code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4 - name: Install gettext run: sudo apt-get update && sudo apt-get install -y gettext-base - name: Set up Go id: go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # ratchet:actions/setup-go@v5 with: go-version-file: go.mod - name: Set up Docker Buildx uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3 - name: Run make bundle run: | CHANNEL_ARGS="" if [[ -n "${{ inputs.channels }}" ]]; then CHANNEL_ARGS="CHANNELS=${{ inputs.channels }} DEFAULT_CHANNEL=${{ inputs.defaultChannel }}" fi make bundle \ OPERATOR_IMAGE=${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/${{ env.OPERATOR_NAME }}:${{ inputs.operatorTag }} \ REGISTRY=${{ env.IMG_REGISTRY_HOST }} \ ORG=${{ env.IMG_REGISTRY_ORG }} \ IMAGE_TAG=${{ inputs.operatorTag }} \ VERSION=${{ inputs.operatorVersion }} \ AUTHORINO_VERSION=${{ inputs.authorinoVersion }} \ ACTUAL_DEFAULT_AUTHORINO_IMAGE=${{ inputs.relatedImageAuthorino }} \ $CHANNEL_ARGS - name: Git diff run: git --no-pager diff - name: Verify manifests and bundle run: | CHANNEL_ARGS="" if [[ -n "${{ inputs.channels }}" ]]; then CHANNEL_ARGS="CHANNELS=${{ inputs.channels }} DEFAULT_CHANNEL=${{ inputs.defaultChannel }}" fi make verify-manifests verify-bundle \ OPERATOR_IMAGE=${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/${{ env.OPERATOR_NAME }}:${{ inputs.operatorTag }} \ REGISTRY=${{ env.IMG_REGISTRY_HOST }} \ ORG=${{ env.IMG_REGISTRY_ORG }} \ IMAGE_TAG=${{ inputs.operatorTag }} \ VERSION=${{ inputs.operatorVersion }} \ AUTHORINO_VERSION=${{ inputs.authorinoVersion }} \ ACTUAL_DEFAULT_AUTHORINO_IMAGE=${{ inputs.relatedImageAuthorino }} \ $CHANNEL_ARGS - name: Extract metadata id: meta uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5 with: images: ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/${{ env.OPERATOR_NAME }}-bundle tags: | type=raw,value=${{ inputs.operatorTag }} - name: Login to Container Registry uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3 with: registry: ${{ env.IMG_REGISTRY_HOST }} username: ${{ secrets.IMG_REGISTRY_USERNAME }} password: ${{ secrets.IMG_REGISTRY_TOKEN }} - name: Build and push bundle image id: build-image uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # ratchet:docker/build-push-action@v6 with: context: . file: ./bundle.Dockerfile platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le push: true tags: ${{ steps.meta.outputs.tags }} build-args: QUAY_IMAGE_EXPIRY=${{ inputs.quayImageExpiry }} provenance: true - name: Print image URL run: | echo "Image(s) pushed:" echo "${{ steps.meta.outputs.tags }}" - name: Install cosign uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # ratchet:sigstore/cosign-installer@v3 - name: Sign image with cosign run: | cosign sign --yes ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/${{ env.OPERATOR_NAME }}-bundle@${{ steps.build-image.outputs.digest }} build-catalog: name: Build and push catalog image needs: [build, build-bundle] runs-on: ubuntu-latest steps: - name: Check out code uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4 - name: Set up Go id: go uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # ratchet:actions/setup-go@v5 with: go-version-file: go.mod - name: Set up Docker Buildx uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3 - name: Run make catalog run: | make catalog \ BUNDLE_IMG=${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/${{ env.OPERATOR_NAME }}-bundle:${{ inputs.operatorTag }} \ DEFAULT_CHANNEL=${{ inputs.defaultChannel }} - name: Git diff run: git --no-pager diff - name: Extract metadata id: meta uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # ratchet:docker/metadata-action@v5 with: images: ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/${{ env.OPERATOR_NAME }}-catalog tags: | type=raw,value=${{ inputs.operatorTag }} - name: Login to Container Registry uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # ratchet:docker/login-action@v3 with: registry: ${{ env.IMG_REGISTRY_HOST }} username: ${{ secrets.IMG_REGISTRY_USERNAME }} password: ${{ secrets.IMG_REGISTRY_TOKEN }} - name: Build and push catalog image id: build-image uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # ratchet:docker/build-push-action@v6 with: context: ./catalog file: ./catalog/${{ env.OPERATOR_NAME }}-catalog.Dockerfile platforms: linux/amd64,linux/arm64,linux/s390x,linux/ppc64le push: true tags: ${{ steps.meta.outputs.tags }} provenance: true - name: Print image URL run: | echo "Image(s) pushed:" echo "${{ steps.meta.outputs.tags }}" - name: Install cosign uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # ratchet:sigstore/cosign-installer@v3 - name: Sign image with cosign run: | cosign sign --yes ${{ env.IMG_REGISTRY_HOST }}/${{ env.IMG_REGISTRY_ORG }}/${{ env.OPERATOR_NAME }}-catalog@${{ steps.build-image.outputs.digest }}