feat(docs): enhance README and architecture documentation with new features and guides #142

Workflow file for this run

	name: Go Build & Docker Build

	on:
	workflow_dispatch:
	push:
	branches:
	- main
	tags:
	- "*"
	paths:
	- src/*/
	- .github/workflows/**
	pull_request:
	types: [opened, synchronize, reopened]
	branches:
	- main
	paths:
	- src/*/
	- .github/workflows/**

	permissions:
	contents: write
	packages: write
	issues: write
	id-token: write

	env:
	REGISTRY: ghcr.io
	IMAGE_NAME: ${{ github.repository }}

	jobs:
	test:
	name: Unit Tests
	runs-on: ubuntu-latest
	steps:
	# Checkout code
	- name: Checkout repository
	uses: actions/checkout@v5

	# Set up Go environment
	- name: Setup Go
	uses: actions/setup-go@v5
	with:
	go-version-file: "src/go.mod"
	cache: true
	cache-dependency-path: "*/.sum"

	- name: Run tests
	working-directory: "src/"
	run: go test -race -cover -coverprofile=coverage.txt ./...

	- name: Archive code coverage results
	uses: actions/upload-artifact@v4
	with:
	name: code-coverage
	path: "**/coverage.txt"

	code_coverage:
	name: "Code coverage report"
	if: github.event_name == 'pull_request'
	runs-on: ubuntu-latest
	needs: test
	permissions:
	contents: read
	actions: read # to download code coverage results from "test" job
	pull-requests: write # write permission needed to comment on PR

	steps:
	- uses: fgrosse/go-coverage-report@v1.2.0
	with:
	root-package: "github.com/${{ github.repository }}/src"
	coverage-artifact-name: "code-coverage"
	coverage-file-name: "src/coverage.txt"

	prepare:
	name: Prepare build steps
	runs-on: ubuntu-latest
	outputs:
	goreleaser_extra_args: ${{ steps.set.outputs.goreleaser_extra_args }}
	goreleaser_config_file: ${{ steps.set.outputs.goreleaser_config_file }}
	arch_matrix: ${{ steps.set.outputs.arch_matrix }}
	steps:
	- id: set
	run: \|
	if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
	echo "goreleaser_extra_args=" >> "$GITHUB_OUTPUT"
	echo "goreleaser_config_file=.goreleaser.yaml" >> "$GITHUB_OUTPUT"
	echo "arch_matrix=[{\"platform\":\"linux/arm64\",\"os\":\"linux\",\"arch\":\"arm64\"},{\"platform\":\"linux/amd64\",\"os\":\"linux\",\"arch\":\"amd64\"}]" >> "$GITHUB_OUTPUT"
	else
	echo "goreleaser_extra_args=--snapshot" >> "$GITHUB_OUTPUT"
	echo "goreleaser_config_file=.goreleaser.pr.yaml" >> "$GITHUB_OUTPUT"
	echo "arch_matrix=[{\"platform\":\"linux/arm64\",\"os\":\"linux\",\"arch\":\"arm64\"}]" >> "$GITHUB_OUTPUT"
	fi

	goreleaser:
	runs-on: ubuntu-latest
	needs:
	- prepare

	steps:
	- name: Checkout
	uses: actions/checkout@v5
	with:
	fetch-depth: 0

	- name: Set up Go
	uses: actions/setup-go@v5
	with:
	go-version-file: "src/go.mod"
	cache-dependency-path: "*/.sum"
	cache: true

	- name: Install Cosign
	uses: sigstore/cosign-installer@v3

	- name: Run GoReleaser
	uses: goreleaser/goreleaser-action@v6
	with:
	args: release --clean --config ${{ needs.prepare.outputs.goreleaser_config_file }} ${{ needs.prepare.outputs.goreleaser_extra_args }}
	workdir: src/
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Upload arm64 build artifacts
	uses: actions/upload-artifact@v4
	with:
	name: tailscale-k8s-auth-server-linux-arm64
	path: src/dist/tailscale-k8s-auth_server_linux_arm64_v8.0/ts-k8s-srv
	if-no-files-found: error

	- name: Upload amd64 build artifacts
	if: github.event_name == 'tag'
	uses: actions/upload-artifact@v4
	with:
	name: tailscale-k8s-auth-server-linux-amd64
	path: src/dist/tailscale-k8s-auth_server_linux_amd64_v1/ts-k8s-srv
	if-no-files-found: error

	docker-build:
	runs-on: ubuntu-latest
	needs:
	- goreleaser
	- prepare

	strategy:
	fail-fast: false
	matrix:
	include: ${{ fromJson(needs.prepare.outputs.arch_matrix) }}

	steps:
	- name: set environment variables
	id: setenv
	run: \|
	platform=${{ matrix.platform }}
	pair=${platform//\//-}
	echo "platform_pair=${pair}" >> "$GITHUB_OUTPUT"

	image="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
	image="$(echo $image \| tr '[:upper:]' '[:lower:]')"
	echo "full_image_name=${image}" >> "$GITHUB_OUTPUT"

	- name: Setup Docker buildx
	uses: docker/setup-buildx-action@v3

	- name: Login to GitHub Container Registry
	uses: docker/login-action@v3
	with:
	registry: ghcr.io
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Docker meta
	id: meta
	uses: docker/metadata-action@v5
	with:
	images: ${{ steps.setenv.outputs.full_image_name }}

	- name: Checkout
	uses: actions/checkout@v5
	with:
	fetch-depth: 0

	- name: Pull in platform artifact
	uses: actions/download-artifact@v5
	with:
	name: tailscale-k8s-auth-server-linux-${{ matrix.arch }}

	- name: mark artifact as executable
	run: \|
	chmod +x ts-k8s-srv

	- name: Build and push by digest
	id: build
	uses: docker/build-push-action@v6
	with:
	context: .
	platforms: ${{ matrix.platform }}
	labels: ${{ steps.meta.outputs.labels }}
	outputs: type=image,name=${{ steps.setenv.outputs.full_image_name }},push-by-digest=true,name-canonical=true,push=true

	- name: Export digest
	run: \|
	mkdir -p /tmp/digests
	digest="${{ steps.build.outputs.digest }}"
	touch "/tmp/digests/${digest#sha256:}"

	- name: Upload digest
	uses: actions/upload-artifact@v4
	with:
	name: image-digest-${{ steps.setenv.outputs.platform_pair }}
	path: /tmp/digests/*
	if-no-files-found: error
	retention-days: 1

	docker-publish:
	name: Docker Publish
	runs-on: ubuntu-latest
	needs:
	- docker-build
	- test

	if: github.event_name != 'pull_request'

	permissions:
	contents: read
	packages: write
	id-token: write # Required for Cosign to use GitHub OIDC

	steps:
	- name: Install Cosign
	uses: sigstore/cosign-installer@v3

	- name: Set environment variables
	id: publishenv
	run: \|
	image="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
	image="$(echo $image \| tr '[:upper:]' '[:lower:]')"
	echo "full_image_name=${image}" >> "$GITHUB_OUTPUT"

	- name: Download digests
	uses: actions/download-artifact@v5
	with:
	path: /tmp/digests
	pattern: image-digest-*
	merge-multiple: true

	- name: Set up Docker Buildx
	uses: docker/setup-buildx-action@v3

	- name: Docker meta
	id: meta
	uses: docker/metadata-action@v5
	with:
	images: ${{ steps.publishenv.outputs.full_image_name }}

	- name: Log into registry ${{ env.REGISTRY }}
	uses: docker/login-action@v3
	with:
	registry: ${{ env.REGISTRY }}
	username: ${{ github.actor }}
	password: ${{ secrets.GITHUB_TOKEN }}

	- name: Create manifest list and push
	working-directory: /tmp/digests
	run: \|
	docker buildx imagetools create $(jq -cr '.tags \| map("-t " + .) \| join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
	$(printf '${{ steps.publishenv.outputs.full_image_name }}@sha256:%s ' *)

	- name: Sign image manifest with Cosign
	env:
	COSIGN_EXPERIMENTAL: "true"
	run: \|
	echo "Signing image: ${{ steps.publishenv.outputs.full_image_name }}:${{ steps.meta.outputs.version }}"
	cosign sign --yes "${{ steps.publishenv.outputs.full_image_name }}:${{ steps.meta.outputs.version }}"

	- name: Inspect image
	run: \|
	docker buildx imagetools inspect "${{ steps.publishenv.outputs.full_image_name }}:${{ steps.meta.outputs.version }}"

	- name: Verify image signature
	env:
	COSIGN_EXPERIMENTAL: "true"
	run: \|
	tag="${{ steps.meta.outputs.version }}"
	cosign verify \
	--certificate-identity-regexp "https://github.com/${{ github.repository }}/.github/workflows/.*" \
	--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
	"${{ steps.publishenv.outputs.full_image_name }}:${tag}"

Navigation Menu

Uh oh!

feat(docs): enhance README and architecture documentation with new features and guides #142

Workflow file

feat(docs): enhance README and architecture documentation with new features and guides #142

Uh oh!

Workflow file for this run