Publish new collection versions from git tags automatically

[geerlingguy]

SUMMARY

Right now the Kubernetes collection release process is fully manual, and therefore prone to error. We've already hit our first minor bump in #29 — having a fully automated process should make the release process more foolproof, and also lighten the load on collection maintainers.

Using a process similar to the one outlined in this post (Automatically building and publishing Ansible Galaxy Collections), we can set up a GitHub Actions workflow called build.yml that would run only on tags, and it would build and publish the collection at the same version as the new tag.

ISSUE TYPE

• Feature Idea

COMPONENT NAME

CI

ADDITIONAL INFORMATION

There are a couple things that I'm slightly worried about, with regard to permissions and an Ansible Galaxy token:

• Namespace-based access controls are too broad ansible/galaxy#2275
• Allow for 'service accounts' or per-project galaxy tokens ansible/galaxy#2276

Until those issues are resolved, the only way to do automated publishing of new release tags would be to have one of the people with access to the Galaxy community namespace/org add their galaxy token to GitHub Actions as a secret... and doing that would expose that user to potential impersonation attacks on Galaxy.

[geerlingguy]

(Also posting related issue geerlingguy/ansible-collection-k8s#6)

[geerlingguy]

Related project that has a GitHub Action: artis3n/ansible_galaxy_collection#49

[geerlingguy]

From @gundalow:

For information, and community. and ansible. collections (which are hosted in https://github.com/ansible-collections/) will use Zuul to publish to Galaxy.

See: ansible-collections/overview#56 (comment)

[geerlingguy]

Here are the instructions—two PRs needed: https://github.com/ansible/project-config/#on-board-new-repo-into-zuul

[geerlingguy]

Created the two required PRs:

1. Add community.kubernetes to tenants.yaml ansible/project-config#591
2. Add community.kubernetes to projects.yaml ansible/project-config#592

Waiting on upstream, and once they're merged and I can confirm Zuul's working, I'll convert the PR on this repo to 'Open' instead of 'Draft'.