Update out of order with main

.github/workflows/helm-ci.yml

@@ -0,0 +1,14 @@
+name: helm-ci
+
+on: pull_request
+
+jobs:
+  call-lint:
+    uses: grafana/helm-charts/.github/workflows/linter.yml@main
+    with:
+      filter_regex_include: .*operations/helm/.*
+  call-lint-test:
+    uses: grafana/helm-charts/.github/workflows/lint-test.yaml@main
+    with:
+      ct_configfile: operations/helm/ct.yaml
+      ct_check_version_increment: false

.github/workflows/helm-release.yaml

@@ -0,0 +1,19 @@
+name: helm-release
+
+on:
+  push:
+    branches:
+      - main
+      - "release-[0-9]+.[0-9]+"
+
+jobs:
+  call-update-helm-repo:
+    uses: grafana/helm-charts/.github/workflows/update-helm-repo.yaml@main
+    with:
+      charts_dir: operations/helm/charts
+      cr_configfile: operations/helm/cr.yaml
+      ct_configfile: operations/helm/ct.yaml
+    secrets:
+      helm_repo_token: ${{ secrets.GH_BOT_ACCESS_TOKEN }}
+      # See https://github.com/grafana/helm-charts/blob/main/INTERNAL.md about this key
+      gpg_key_base64: ${{ secrets.HELM_SIGN_KEY_BASE64 }}

.github/workflows/publish-technical-documentation-next.yml

@@ -0,0 +1,39 @@
+name: "publish-technical-documentation-next"
+
+on:
+  push:
+    branches:
+    - "main"
+    paths:
+    - "docs/sources/**"
+  workflow_dispatch:
+jobs:
+  test:
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: "Check out code"
+      uses: "actions/checkout@v3"
+    - name: "Build website"
+      run: |
+        docker run -v ${PWD}/docs/sources:/hugo/content/docs/mimir/latest -e HUGO_REFLINKSERRORLEVEL=ERROR --rm grafana/docs-base:latest /bin/bash -c 'make hugo'
+
+  sync:
+    runs-on: "ubuntu-latest"
+    needs: "test"
+    steps:
+    - name: "Check out code"
+      uses: "actions/checkout@v3"
+
+    - name: "Clone website-sync Action"
+      run: "git clone --single-branch --no-tags --depth 1 -b master https://grafanabot:${{ secrets.GH_BOT_ACCESS_TOKEN }}@github.com/grafana/website-sync ./.github/actions/website-sync"
+
+    - name: "Publish to website repository (next)"
+      uses: "./.github/actions/website-sync"
+      id: "publish-next"
+      with:
+        repository: "grafana/website"
+        branch: "master"
+        host: "github.com"
+        github_pat: "${{ secrets.GH_BOT_ACCESS_TOKEN }}"
+        source_folder: "docs/sources"
+        target_folder: "content/docs/mimir/next"

.github/workflows/publish-technical-documentation.yml → .github/workflows/publish-technical-documentation-release.yml

@@ -1,9 +1,8 @@
-name: "publish-technical-documentation"
+name: "publish-technical-documentation-release"
 
 on:
   push:
     branches:
-    - "main"
     - "release-*"
     tags:
     - "mimir-[0-9]+.[0-9]+.[0-9]+"
@@ -38,49 +37,29 @@ jobs:
     - name: "Install Actions from library"
       run: "npm install --production --prefix ./actions"
 
-    - name: "Determine technical documentation version"
-      uses: "./actions/docs-target"
-      id: "target"
+    - name: "Determine if there is a matching release tag"
+      id: "has-matching-release-tag"
+      uses: "./actions/has-matching-release-tag"
       with:
         ref_name: "${{ github.ref_name }}"
+        release_tag_regexp: "^mimir-(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)$"
+        release_branch_regexp: "^release-(0|[1-9]\\d*)\\.(0|[1-9]\\d*)$"
 
-    - name: "Determine latest release tag"
-      id: "latest-released"
-      shell: "bash"
-      run: |
-        tag="$(git tag --sort=-v:refname | grep -E '^mimir-(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$' | head -n1)"
-        echo "::set-output name=tag::${tag}"
-
-    - name: "Determine latest release tag target"
+    - name: "Determine technical documentation version"
+      if: "steps.has-matching-release-tag.outputs.bool == 'true'"
       uses: "./actions/docs-target"
-      id: "latest-released-target"
+      id: "target"
       with:
-        ref_name: "${{ steps.latest-released.outputs.tag }}"
+        ref_name: "${{ github.ref_name }}"
 
     - name: "Clone website-sync Action"
+      if: "steps.has-matching-release-tag.outputs.bool == 'true'"
       run: "git clone --single-branch --no-tags --depth 1 -b master https://grafanabot:${{ secrets.GH_BOT_ACCESS_TOKEN }}@github.com/grafana/website-sync ./.github/actions/website-sync"
 
-    - name: "Publish to website repository (next)"
-      uses: "./.github/actions/website-sync"
-      id: "publish-next"
-      # Only publish on main branch.
-      if: "github.ref == 'refs/heads/main'"
-      with:
-        repository: "grafana/website"
-        branch: "master"
-        host: "github.com"
-        github_pat: "${{ secrets.GH_BOT_ACCESS_TOKEN }}"
-        source_folder: "docs/sources"
-        target_folder: "content/docs/mimir/next"
-
     - name: "Publish to website repository (release)"
+      if: "steps.has-matching-release-tag.outputs.bool == 'true'"
       uses: "./.github/actions/website-sync"
       id: "publish-release"
-      # Only publish if the target of the latest release tag matches the target of this reference.
-      # For release tags the tag and reference are the same.
-      # For release branches, this guard prevents publishing documentation before a tag
-      # has been pushed that has officially "released" that documentation.
-      if: "steps.latest-released-target.outputs.target == steps.target.outputs.target"
       with:
         repository: "grafana/website"
         branch: "master"

.github/workflows/scripts/build-images.sh

@@ -0,0 +1,20 @@
+#!/bin/bash
+# SPDX-License-Identifier: AGPL-3.0-only
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+OUTPUT="$1"
+shift
+
+mkdir "$OUTPUT"
+
+# Build all supplied targets (will be prefixed with push-multiarch- prefix)
+# shellcheck disable=SC2068
+for target in $@
+do
+  DIRNAME="$(dirname "$target")"
+  NAME="$(basename "$DIRNAME")"
+  make BUILD_IN_CONTAINER=false PUSH_MULTIARCH_TARGET="type=oci,dest=$OUTPUT/$NAME.oci" push-multiarch-$target
+done

.github/workflows/scripts/install-docker.sh

@@ -1,7 +1,8 @@
 #!/bin/bash
+# SPDX-License-Identifier: AGPL-3.0-only
 
 set -x
-VER="18.06.3-ce"
+VER="20.10.14"
 curl -L -o /tmp/docker-$VER.tgz https://download.docker.com/linux/static/stable/x86_64/docker-$VER.tgz
 tar -xz -C /tmp -f /tmp/docker-$VER.tgz
 mv /tmp/docker/* /usr/bin

.github/workflows/scripts/push-images.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+# SPDX-License-Identifier: AGPL-3.0-only
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+IMAGES_DIR="$1"
+IMAGE_PREFIX="$2"
+TAG="$3"
+
+# If image is the latest stable git tag, also push :latest image.
+# Do not tag with latest any release candidate (tag ends with "-rc.*").
+EXTRA_TAG=""
+if [[ "$(git tag | grep -E '^mimir-[0-9]+\.[0-9]+\.[0-9]+$' | sort -V | tail -n 1)" == "mimir-${TAG}" ]]; then
+  EXTRA_TAG="latest"
+fi
+
+# Push images from OCI archives to docker registry.
+for image in "$IMAGES_DIR"/*
+do
+  NAME=$(basename ${image%%.oci})
+  # --all uploads all platform images from OCI
+  echo
+  echo "Uploading ${IMAGE_PREFIX}${NAME}:${TAG}"
+  echo
+  skopeo copy --all --retry-times 3 oci-archive:${image} "docker://${IMAGE_PREFIX}${NAME}:${TAG}"
+
+  if [[ -n "${EXTRA_TAG}" ]]; then
+    echo "Tagging with ${EXTRA_TAG}"
+    skopeo copy --all --retry-times 3 "docker://${IMAGE_PREFIX}${NAME}:${TAG}" "docker://${IMAGE_PREFIX}${NAME}:${EXTRA_TAG}"
+  fi
+done

.github/workflows/scripts/run-integration-tests-group.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# SPDX-License-Identifier: AGPL-3.0-only
 
 SCRIPT_DIR=$(cd `dirname $0` && pwd)
 INTEGRATION_DIR=$(realpath "${SCRIPT_DIR}/../../../integration/")

.github/workflows/scripts/run-unit-tests-group.sh

@@ -1,4 +1,5 @@
 #!/bin/bash
+# SPDX-License-Identifier: AGPL-3.0-only
 
 SCRIPT_DIR=$(cd `dirname $0` && pwd)
 MIMIR_DIR=$(realpath "${SCRIPT_DIR}/../../../")