Skip to content

fix(ci): Include GitHub release workflow with proper permissions #1523

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
javirln merged 2 commits into from
Nov 14, 2024
Merged

fix(ci): Include GitHub release workflow with proper permissions #1523

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
86fe8aa
fix(ci): Include GitHub release workflow with proper permissions
javirln Nov 14, 2024
8a1c110
remove comment
javirln Nov 14, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions .github/workflows/build_and_package.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,3 +145,14 @@ jobs:
if: ${{ cancelled() }}
run: |
chainloop attestation reset --trigger cancellation

github-release:
if: github.ref_type == 'tag' # Guard to make sure we are releasing once
uses: chainloop-dev/chainloop/.github/workflows/release.yaml@main
with:
tag: ${{ github.ref_name }}
secrets:
chainloop_token: ${{ secrets.CHAINLOOP_TOKEN }}
permissions:
packages: write
contents: write
23 changes: 13 additions & 10 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,9 @@ on:
tag:
type: string
required: true
secrets:
chainloop_token:
required: true

jobs:
# This reusable workflow inspects if the given workflow_name exists on Chainloop. If the Workflow does not exist
Expand All @@ -19,7 +22,7 @@ jobs:
project: "chainloop"
workflow_name: "chainloop-vault-release"
secrets:
api_token: ${{ secrets.CHAINLOOP_TOKEN }}
api_token: ${{ secrets.chainloop_token }}

release:
name: Record release from GitHub
Expand All @@ -30,7 +33,7 @@ jobs:
packages: write
contents: write
env:
CHAINLOOP_TOKEN: ${{ secrets.CHAINLOOP_TOKEN }}
CHAINLOOP_TOKEN: ${{ secrets.chainloop_token }}
CHAINLOOP_WORKFLOW_NAME: ${{ needs.onboard_workflow.outputs.workflow_name }}
CHAINLOOP_PROJECT: ${{ needs.onboard_workflow.outputs.project_name }}
GH_TOKEN: ${{ github.token }}
Expand Down Expand Up @@ -65,14 +68,14 @@ jobs:
gh release download $tag -A tar.gz -D /tmp
chainloop attestation add --value "/tmp/chainloop-$version.tar.gz"

# Include control-plane image
chainloop attestation add --value "ghcr.io/chainloop-dev/chainloop/control-plane:$tag"
# Include control-plane image
chainloop attestation add --value "ghcr.io/chainloop-dev/chainloop/control-plane:$tag"

# Include cas image
chainloop attestation add --value "ghcr.io/chainloop-dev/chainloop/artifact-cas:$tag"
# Include cas image
chainloop attestation add --value "ghcr.io/chainloop-dev/chainloop/artifact-cas:$tag"

# Include cli image
chainloop attestation add --value "ghcr.io/chainloop-dev/chainloop/cli:$tag"
# Include cli image
chainloop attestation add --value "ghcr.io/chainloop-dev/chainloop/cli:$tag"

- name: Finish and Record Attestation
id: attestation-push
Expand All @@ -99,7 +102,7 @@ jobs:
if: ${{ success() }}
run: |
chainloop_release_url="## Chainloop Attestation"$'\n'"[View the attestation of this release](https://app.chainloop.dev/attestation/${{ steps.attestation-push.outputs.attestation_sha }})"
current_notes=$(gh release view ${{ github.ref_name }} --json body -q '.body')
current_notes=$(gh release view ${{inputs.tag}} --json body -q '.body')

if echo "$current_notes" | grep -q "## Chainloop Attestation"; then
# Replace the existing Chainloop Attestation section with the new URL
Expand All @@ -110,4 +113,4 @@ jobs:
fi

# Update the release notes and ignore if it fails since we might be lacking permissions to update the release notes
gh release edit ${{ github.ref_name }} -n "$modified_notes" || echo -n "Not enough permissions to edit the release notes. Skipping..."
gh release edit ${{inputs.tag}} -n "$modified_notes" || echo -n "Not enough permissions to edit the release notes. Skipping..."
Loading