Automate release #407

k4leung4 · 2022-02-14T22:57:45Z

Summary

Create a Github Actions Workflow that will mostly automate the cutting of a release

draft a release with specified tag [this uses the gh cli]
kick off cloud build to create artifacts [this uses gcloud cli]; this will also require the creation of a new service account to leverage the oidc login flow, the commands/script to create the service account is included in the PR.

only inputs needed are

release tag
cosign key ring name
cosign key name

The last two parameter can be hardcoded or if it is sensitive, stored as a secret and referenced that way. Let me know if this is desirable and I can update the workflow.

To avoid just anyone starting the workflow to create a release, it is hardcoded to allow one of
"bobcallaway","cpanato","dlorenc","lukehinds" to start it.
Anyone else that starts it will result in an immediate failure.

if this approach makes sense, i plan to check in a reusable workflow into sigstore/sigstore and have fulcio|rekor|cosign all have release workflows using it.

Ticket Link

Fixes

https://github.com/sigstore/public-good-instance/issues/50

Release Note

NONE

cpanato

we already have a release job similar we have for cosign/rekor https://github.com/sigstore/fulcio/tree/main/release do we want to switch that to github actions or keep it in the same way we do for others?

@k4leung4 @dlorenc

k4leung4 · 2022-02-15T16:43:35Z

we already have a release job similar we have for cosign/rekor https://github.com/sigstore/fulcio/tree/main/release do we want to switch that to github actions or keep it in the same way we do for others?

@k4leung4 @dlorenc

Thanks for the comment @cpanato
My intent is to reduce the amount of copy and paste needed to do the release, and provide the option to cut bi-weekly, or monthly minor releases automatically.
This is a change I aim to apply to the other repos [rekor|cosign] as well.

cpanato · 2022-02-15T16:46:35Z

we already have a release job similar we have for cosign/rekor https://github.com/sigstore/fulcio/tree/main/release do we want to switch that to github actions or keep it in the same way we do for others?
@k4leung4 @dlorenc

Thanks for the comment @cpanato My intent is to reduce the amount of copy and paste needed to do the release, and provide the option to cut bi-weekly, or monthly minor releases automatically. This is a change I aim to apply to the other repos [rekor|cosign] as well.

I'm sorry @k4leung4 I did not see the last part of the job, that submits the cloudbuild job 🤦 , so sorry :(

that looks great to me!

cpanato · 2022-02-16T17:17:03Z

.github/workflows/cut-release.yml

+        working-directory: ./src/github.com/sigstore/fulcio
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh release create --repo github.com/sigstore/fulcio --draft ${{ env.GIT_TAG }}


we don't need this, the goreleaser that will run in the cloudbuild job will create the gh release for us

then maybe we can remove the contents permission

thanks for pointing that out.
removed.

cpanato · 2022-02-16T17:18:40Z

hack/github-oidc-setup.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash


this script is needed? i did not see that being used in the release action

apologies for not referencing in the README.
it is needed to setup the oidc access for github actions to authenticate against GCP to kick off the gcloud builds command.

updated README.md to explain it is a one time setup.

lukehinds · 2022-02-17T08:24:12Z

.github/workflows/cut-release.yml

+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v0
+        with:
+          workload_identity_provider: 'projects/498091336538/locations/global/workloadIdentityPools/githubactions/providers/sigstore-fulcio'
+          service_account: 'github-actions-fulcio@projectsigstore.iam.gserviceaccount.com'
+
+      - name: Setup gcloud
+        uses: 'google-github-actions/setup-gcloud@v0'
+        with:
+          project_id: ${{ env.PROJECT_ID }}
+
+      - name: Start cloudbuild job
+        working-directory: ./src/github.com/sigstore/fulcio
+        run: gcloud builds submit --config release/cloudbuild.yaml --substitutions _GIT_TAG=${{ env.GIT_TAG }},_TOOL_ORG=sigstore,_TOOL_REPO=fulcio,_STORAGE_LOCATION=fulcio-releases,_KEY_RING=${{ github.event.inputs.key_ring }},_KEY_NAME=${{ github.event.inputs.key_name }} --project=${{ env.PROJECT_ID }}


Do we need google cloud, is it not something we do in github?

we are building the release using GCP cloudbuild and GCP KMS and the oidc token there as well, this will help to send the job to cloudbuild and not need to run locally

however if we decide to run the release in GitHub actions we will need to refactor somethings, but is possible

I guess a better way to frame the question is if there is a cost involved in running it on GCP. Right now that is OK as big G is footing the bill for us, but that might not always be the case.

it costs $0.016 / build-minute today, plus the costs of storing the secret manager and the KMS key for the cosign private key.

if we revamp this to run on GH actions we will just need to check if we will continue to use the KMS key or we will use another key or move completely to keyless signature.

the refactor to GH should be very straightforward. We just need to make a decision

Let's keep it consistent for now. We had to use gcb initially for the auth to registries, but now that github supports OIDC we can reevaluate moving everything here.

sounds good to me

lukehinds · 2022-02-17T08:25:46Z

also a commit squash / rebase (which every method you prefer) would be good (unless you have some more pending commits)

Signed-off-by: Kenny Leung <kleung@chainguard.dev> update readme. Signed-off-by: Kenny Leung <kleung@chainguard.dev> add missing license header. Signed-off-by: Kenny Leung <kleung@chainguard.dev> remove step to draft release, update readme. Signed-off-by: Kenny Leung <kleung@chainguard.dev>

k4leung4 · 2022-02-21T06:24:52Z

thanks for all the feedback.

commits squashed.

k4leung4 requested a review from cpanato February 14, 2022 22:58

cpanato reviewed Feb 15, 2022

View reviewed changes

cpanato reviewed Feb 16, 2022

View reviewed changes

lukehinds reviewed Feb 17, 2022

View reviewed changes

k4leung4 force-pushed the automate-release branch from 909c207 to 61dc0eb Compare February 21, 2022 06:24

cpanato approved these changes Feb 22, 2022

View reviewed changes

dlorenc merged commit 03c84e2 into sigstore:main Feb 22, 2022

k4leung4 deleted the automate-release branch February 23, 2022 23:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Automate release #407

Automate release #407

k4leung4 commented Feb 14, 2022 •

edited

cpanato left a comment

k4leung4 commented Feb 15, 2022

cpanato commented Feb 15, 2022

cpanato Feb 16, 2022

cpanato Feb 16, 2022

k4leung4 Feb 16, 2022

cpanato Feb 16, 2022

k4leung4 Feb 16, 2022

lukehinds Feb 17, 2022

cpanato Feb 17, 2022

lukehinds Feb 17, 2022

cpanato Feb 17, 2022

dlorenc Feb 18, 2022

cpanato Feb 22, 2022

lukehinds commented Feb 17, 2022

k4leung4 commented Feb 21, 2022

Automate release #407

Automate release #407

Conversation

k4leung4 commented Feb 14, 2022 • edited

Summary

Ticket Link

Release Note

cpanato left a comment

Choose a reason for hiding this comment

k4leung4 commented Feb 15, 2022

cpanato commented Feb 15, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lukehinds commented Feb 17, 2022

k4leung4 commented Feb 21, 2022

k4leung4 commented Feb 14, 2022 •

edited