Publish v20.6.1. [release]

.circleci/config.yml

@@ -1,14 +1,21 @@
 version: 2.1
 
 orbs:
-  cimg: circleci/cimg@0.3.3
+  cimg: circleci/cimg@dev:d365891f2c6242fdc77cd40f9bf4589dcaa3d162
+  aws-cli: circleci/aws-cli@4.1.0
   slack: circleci/slack@4.12.1
   gh: circleci/github-cli@2.2.0
 
+aws-image-tag:
+  aws-image: &aws-image cimg/aws:2023.07.1
+
 parameters:
   cron:
     type: boolean
     default: false
+  check_all:
+    type: boolean
+    default: false
 
 workflows:
   automated-wf:
@@ -21,25 +28,51 @@ workflows:
     when:
       not: << pipeline.parameters.cron >>
     jobs:
-      - cimg/build-and-deploy:
-          name: "Staging"
+      - cimg-build:
+          docker-namespace: ccitest
+          docker-repository: node
+          filters:
+            branches:
+              ignore:
+                - main
+          context: cimg-publishing
+      - cimg-staging:
           docker-namespace: ccitest
           docker-repository: node
-          publish-branch: test
+          target-namespace: ccitest
+          target-repository: cimg-orb
+          organization: circleci-images
           filters:
             branches:
               ignore:
                 - main
+          requires:
+            - cimg-build
+          context: cimg-publishing
+      - cimg-verify:
+          docker-namespace: ccitest
+          docker-repository: node
+          target-namespace: ccitest
+          target-repository: cimg-orb
+          filters:
+            branches:
+              ignore:
+                - main
+          requires:
+            - cimg-staging
           post-steps:
             - slack/notify:
                 branch_pattern: release-v.+
                 event: pass
                 mentions: "@jalexchen"
                 template: basic_success_1
           context: cimg-publishing
-      - cimg/build-and-deploy:
-          name: "Deploy"
+      - cimg-deploy:
+          docker-namespace: ccitest
           docker-repository: node
+          target-namespace: cimg
+          target-repository: node
+          organization: circleci-images
           filters:
             branches:
               only:
@@ -95,3 +128,138 @@ jobs:
             sudo chmod +x nodeFeed.sh
             git submodule update --init --recursive
             ./nodeFeed.sh
+
+  cimg-build:
+    docker:
+      - image: *aws-image
+    parameters:
+      docker-namespace:
+        type: string
+      docker-repository:
+        type: string
+    steps:
+      - checkout
+      - setup_remote_docker
+      - cimg/build-images:
+          docker-namespace: <<parameters.docker-namespace>>
+          docker-repository: <<parameters.docker-repository>>
+      - cimg/capture-metadata:
+          docker-namespace: <<parameters.docker-namespace>>
+          docker-repository: <<parameters.docker-repository>>
+      - aws-cli/setup:
+          region: ${AWS_DEFAULT_REGION}
+          role_arn: arn:aws:iam::483285841698:role/cpe-images-bucket-write
+          role_session_name: "write-to-s3"
+      - cimg/copy-to-s3:
+          docker-namespace: cimg
+          docker-repository: cimg-orb
+
+  cimg-staging:
+    docker:
+      - image: *aws-image
+    parameters:
+      docker-namespace:
+        type: string
+      docker-repository:
+        type: string
+      target-namespace:
+        type: string
+      target-repository:
+        type: string
+      organization:
+        type: string
+    steps:
+      - attach_workspace:
+          at: /tmp/registry
+      - aws-cli/setup:
+          region: ${AWS_DEFAULT_REGION}
+          role_arn: arn:aws:iam::483285841698:role/cpe-kms-sign
+          role_session_name: "sign-docker-images"
+      - cimg/sign-images:
+          docker-namespace: <<parameters.docker-namespace>>
+          docker-repository: <<parameters.docker-repository>>
+          organization: <<parameters.organization>>
+      - cimg/copy-images:
+          docker-namespace: <<parameters.docker-namespace>>
+          docker-repository: <<parameters.docker-repository>>
+          target-namespace: <<parameters.target-namespace>>
+          target-repository: <<parameters.target-namespace>>
+
+  cimg-verify:
+    docker:
+      - image: *aws-image
+    parameters:
+      docker-namespace:
+        type: string
+      docker-repository:
+        type: string
+      target-namespace:
+        type: string
+      target-repository:
+        type: string
+    steps:
+      - checkout
+      - aws-cli/setup:
+          region: ${AWS_DEFAULT_REGION}
+          role_arn: arn:aws:iam::483285841698:role/cpe-images-bucket-read
+          role_session_name: "read-from-s3"
+      - when:
+          condition:
+            not: <<pipeline.parameters.check_all>>
+          steps:
+            - attach_workspace:
+                at: /tmp/registry
+            - cimg/verify-signature:
+                docker-namespace: <<parameters.docker-namespace>>
+                docker-repository: <<parameters.docker-repository>>
+                target-namespace: <<parameters.target-namespace>>
+                target-repository: <<parameters.target-namespace>>
+      - when:
+          condition: <<pipeline.parameters.check_all>>
+          steps:
+            - cimg/capture-metadata:
+                docker-namespace: <<parameters.docker-namespace>>
+                docker-repository: <<parameters.docker-repository>>
+            - cimg/verify-all-signatures:
+                docker-namespace: <<parameters.docker-namespace>>
+                docker-repository: <<parameters.docker-repository>>
+
+  cimg-deploy:
+    docker:
+      - image: *aws-image
+    parameters:
+      docker-namespace:
+        type: string
+      docker-repository:
+        type: string
+      target-namespace:
+        type: string
+      target-repository:
+        type: string
+      organization:
+        type: string
+    steps:
+      - checkout
+      - run:
+          name: Check if release commit
+          command: |
+            if ! git log -1 --pretty=%s | grep "\[release]\"; then
+              echo "Not a release commit. Skipping publishing"
+              circleci step halt
+            fi
+      - cimg/capture-metadata:
+          docker-namespace: <<parameters.docker-namespace>>
+          docker-repository: <<parameters.docker-repository>>
+      - aws-cli/setup:
+          region: ${AWS_DEFAULT_REGION}
+          role_arn: arn:aws:iam::483285841698:role/cpe-kms-sign
+          role_session_name: "sign-docker-images"
+      - cimg/copy-images:
+          docker-namespace: <<parameters.docker-namespace>>
+          docker-repository: <<parameters.docker-repository>>
+          target-namespace: <<parameters.target-namespace>>
+          target-repository: <<parameters.target-namespace>>
+      - cimg/sign-images:
+          docker-namespace: <<parameters.docker-namespace>>
+          docker-repository: <<parameters.docker-repository>>
+          organization: <<parameters.organization>>

20.6/Dockerfile

@@ -10,7 +10,7 @@ FROM cimg/base:2023.07
 
 LABEL maintainer="Community & Partner Engineering Team <community-partner@circleci.com>"
 
-ENV NODE_VERSION 20.6.0
+ENV NODE_VERSION 20.6.1
 
 RUN [[ $(uname -m) == "x86_64" ]] && ARCH="x64" || ARCH="arm64" && \
  	curl -L -o node.tar.xz "https://nodejs.org/dist/v${NODE_VERSION}/node-v${NODE_VERSION}-linux-${ARCH}.tar.xz" && \

20.6/browsers/Dockerfile

@@ -6,7 +6,7 @@
 # the browsers variant. The normal version is based on the node variant of that
 # image. As this IS a Node image, there isn't a node variant.
 
-FROM cimg/node:20.6.0
+FROM cimg/node:20.6.1
 
 LABEL maintainer="CircleCI Community & Partner Engineering Team <community-partner@circleci.com>"
 

ALIASES

@@ -1,2 +1,2 @@
 lts=18.17.1
-current=20.6.0
+current=20.6.1

GEN-CHECK

@@ -1 +1 @@
-GEN_CHECK=(20.6.0=current)
+GEN_CHECK=(20.6.1=current)

build-images.sh

@@ -4,5 +4,5 @@ set -eo pipefail
 
 docker context create cimg
 docker buildx create --use cimg
-docker buildx build --platform=linux/amd64,linux/arm64 --file 20.6/Dockerfile -t cimg/node:20.6.0 -t cimg/node:20.6 --push .
-docker buildx build --platform=linux/amd64 --file 20.6/browsers/Dockerfile -t cimg/node:20.6.0-browsers -t cimg/node:20.6-browsers --push .
+docker buildx build --platform=linux/amd64,linux/arm64 --file 20.6/Dockerfile -t cimg/node:20.6.1 -t cimg/node:20.6 --push .
+docker buildx build --platform=linux/amd64 --file 20.6/browsers/Dockerfile -t cimg/node:20.6.1-browsers -t cimg/node:20.6-browsers --push .

push-images.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
 # Do not edit by hand; please use build scripts/templates to make changes
 set -eo pipefail
-docker buildx imagetools create -t cimg/node:current cimg/node:20.6.0
-docker buildx imagetools create -t cimg/node:current-browsers cimg/node:20.6.0-browsers
+docker buildx imagetools create -t cimg/node:current cimg/node:20.6.1
+docker buildx imagetools create -t cimg/node:current-browsers cimg/node:20.6.1-browsers