Skip to content

Commit d66f873

Browse files
dereknoladereknola
authored
[Release-1.31] GHA Artifacts + Testing Backports July 2025 (#12610)
* Move to more secure split trivy workflow based on labels, not comments (#12592) Signed-off-by: Derek Nola <derek.nola@suse.com> * Add basic fuzz test Signed-off-by: Derek Nola <derek.nola@suse.com> * Add retry around common timeout for hardened docker test (#12601) Signed-off-by: Derek Nola <derek.nola@suse.com> * Remove ghcr build cache (#12602) Signed-off-by: Derek Nola <derek.nola@suse.com> * Migrate K3s Release Artifacts to GHA (#12606) Signed-off-by: Derek Nola <derek.nola@suse.com> --------- Signed-off-by: Derek Nola <derek.nola@suse.com>
1 parent 05e0f84 commit d66f873

10 files changed

Lines changed: 324 additions & 155 deletions

File tree

‎.drone.yml‎

Lines changed: 0 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -49,28 +49,6 @@ steps:
4949
event:
5050
- push
5151
- tag
52-
53-
- name: github_binary_release
54-
image: plugins/github-release
55-
settings:
56-
api_key:
57-
from_secret: github_token
58-
prerelease: true
59-
checksum:
60-
- sha256
61-
checksum_file: CHECKSUMsum-amd64.txt
62-
checksum_flatten: true
63-
files:
64-
- "dist/artifacts/*"
65-
when:
66-
instance:
67-
- drone-publish.k3s.io
68-
ref:
69-
- refs/head/master
70-
- refs/tags/*
71-
event:
72-
- tag
73-
7452
- name: docker-publish
7553
image: plugins/docker
7654
settings:
@@ -189,27 +167,6 @@ steps:
189167
- name: docker
190168
path: /var/run/docker.sock
191169

192-
- name: github_binary_release
193-
image: plugins/github-release
194-
settings:
195-
api_key:
196-
from_secret: github_token
197-
prerelease: true
198-
checksum:
199-
- sha256
200-
checksum_file: CHECKSUMsum-arm64.txt
201-
checksum_flatten: true
202-
files:
203-
- "dist/artifacts/*"
204-
when:
205-
instance:
206-
- drone-publish.k3s.io
207-
ref:
208-
- refs/head/master
209-
- refs/tags/*
210-
event:
211-
- tag
212-
213170
- name: docker-publish
214171
image: plugins/docker
215172
settings:
@@ -304,28 +261,6 @@ steps:
304261
volumes:
305262
- name: docker
306263
path: /var/run/docker.sock
307-
308-
- name: github_binary_release
309-
image: plugins/github-release:linux-arm
310-
settings:
311-
api_key:
312-
from_secret: github_token
313-
prerelease: true
314-
checksum:
315-
- sha256
316-
checksum_file: CHECKSUMsum-arm.txt
317-
checksum_flatten: true
318-
files:
319-
- "dist/artifacts/*"
320-
when:
321-
instance:
322-
- drone-publish.k3s.io
323-
ref:
324-
- refs/head/master
325-
- refs/tags/*
326-
event:
327-
- tag
328-
329264
- name: docker-publish
330265
image: plugins/docker:linux-arm
331266
settings:

‎.github/workflows/build-k3s.yaml‎

Lines changed: 2 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -19,20 +19,9 @@ on:
1919
description: 'Upload contents of build/out, used to build the k3s image externally'
2020
required: false
2121
default: false
22-
cache:
23-
type: string
24-
description: 'Cache mode: "read", "write", or empty for no cache'
25-
required: false
26-
default: ''
27-
28-
# Note that is workflow requires the following permissions:
29-
# contents: read
30-
# If using the cache: write option, you will need:
31-
# packages: write
32-
# If using the cache: read option, you will need:
33-
# packages: read
34-
3522

23+
permissions:
24+
contents: read
3625

3726
jobs:
3827
build:
@@ -67,14 +56,6 @@ jobs:
6756
echo "dirty=${DIRTY}"
6857
} >> "$GITHUB_OUTPUT"
6958
70-
- name: Login to GitHub Container Registry
71-
if: inputs.cache == 'write'
72-
uses: docker/login-action@v3
73-
with:
74-
registry: ghcr.io
75-
username: ${{ github.repository_owner }}
76-
password: ${{ secrets.GITHUB_TOKEN }}
77-
7859
- name: Build K3s Binary Native
7960
if: inputs.arch == 'arm64' || inputs.arch == 'amd64'
8061
env:
@@ -91,8 +72,6 @@ jobs:
9172
TREE_STATE=${{ steps.git_vars.outputs.tree_state }}
9273
COMMIT=${{ steps.git_vars.outputs.commit }}
9374
DIRTY=${{ steps.git_vars.outputs.dirty }}
94-
cache-from: ${{ inputs.cache != '' && format('type=registry,ref=ghcr.io/{0}:cache-{1}', github.repository, inputs.arch) || '' }}
95-
cache-to: ${{ inputs.cache == 'write' && format('type=registry,ref=ghcr.io/{0}:cache-{1},mode=max', github.repository, inputs.arch) || '' }}
9675
push: false
9776
provenance: mode=min
9877
outputs: type=local,dest=.

‎.github/workflows/e2e.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ jobs:
3535
uses: ./.github/workflows/build-k3s.yaml
3636
with:
3737
upload-image: true
38-
cache: ${{ github.ref == 'refs/heads/master' && 'write' || 'read' }}
3938
build-arm64:
4039
uses: ./.github/workflows/build-k3s.yaml
4140
permissions:
@@ -44,7 +43,6 @@ jobs:
4443
with:
4544
arch: arm64
4645
upload-image: true
47-
cache: ${{ github.ref == 'refs/heads/master' && 'write' || 'read' }}
4846
e2e:
4947
name: "E2E Tests"
5048
needs: build

‎.github/workflows/integration.yaml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,9 @@ env:
2929

3030
jobs:
3131
build:
32-
permissions:
33-
contents: read
34-
packages: read
3532
uses: ./.github/workflows/build-k3s.yaml
3633
with:
3734
os: linux
38-
cache: read
3935
build-windows:
4036
uses: ./.github/workflows/build-k3s.yaml
4137
with:

‎.github/workflows/release.yml‎

Lines changed: 96 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,23 +13,20 @@ jobs:
1313
name: Build Binary (amd64)
1414
uses: ./.github/workflows/build-k3s.yaml
1515
with:
16-
cache: '' # No cache for release builds
1716
upload-build: true
1817

1918
build-arm64:
2019
name: Build Binary (arm64)
2120
uses: ./.github/workflows/build-k3s.yaml
2221
with:
2322
arch: arm64
24-
cache: '' # No cache for release builds
2523
upload-build: true
2624

2725
build-arm:
2826
name: Build Binary (arm)
2927
uses: ./.github/workflows/build-k3s.yaml
3028
with:
3129
arch: arm
32-
cache: '' # No cache for release builds
3330
upload-build: true
3431

3532
push-release-image:
@@ -52,7 +49,7 @@ jobs:
5249
username: ${{ github.repository_owner }}
5350
password: ${{ secrets.GITHUB_TOKEN }}
5451

55-
- name: COnfigure image tags
52+
- name: Configure image tags
5653
id: tag_config
5754
run: |
5855
TAG=${GITHUB_REF#refs/tags/}
@@ -74,7 +71,8 @@ jobs:
7471
id: meta
7572
uses: docker/metadata-action@v5
7673
with:
77-
images: ghcr.io/${{ github.repository_owner }}/k3s
74+
images: |
75+
ghcr.io/${{ github.repository_owner }}/k3s
7876
flavor: latest=false
7977
tags: ${{ steps.tag_config.outputs.tag_spec }}
8078

@@ -102,3 +100,96 @@ jobs:
102100
build-args: |
103101
DRONE_TAG=${{ github.ref_name }}
104102
103+
upload-release-airgap:
104+
name: Build Airgap Pkg (${{ matrix.arch }})
105+
runs-on: ubuntu-latest # Runs on standard runner, docker pulls with --platform
106+
permissions:
107+
contents: write # Needed to update release with assets
108+
strategy:
109+
matrix:
110+
arch: [amd64, arm64, arm]
111+
112+
steps:
113+
- name: Checkout code
114+
uses: actions/checkout@v4
115+
116+
- name: Set up Docker Buildx
117+
uses: docker/setup-buildx-action@v3
118+
119+
- name: Install Dependencies
120+
run: sudo apt-get update -y && sudo apt-get install -y zstd pigz
121+
122+
- name: Create Airgap Package (${{ matrix.arch }})
123+
run: |
124+
mkdir -p ./dist/artifacts
125+
./scripts/package-airgap ${{ matrix.arch }}
126+
127+
- name: Caculate Airgap sha256sum
128+
run: sha256sum dist/artifacts/k3s-airgap-images-${{ matrix.arch }}* | sed 's|dist/artifacts/||' > dist/artifacts/k3s-airgap-images-${{ matrix.arch }}.sha256sum
129+
130+
- name: Upload Airgap sha256sum
131+
uses: actions/upload-artifact@v4
132+
with:
133+
name: k3s-airgap-images-${{ matrix.arch }}.sha256sum
134+
path: dist/artifacts/k3s-airgap-images-${{ matrix.arch }}.sha256sum
135+
136+
- name: Upload k3s-images.txt to Release
137+
uses: softprops/action-gh-release@v2
138+
# This action is recommended by GITHUB, they don't support a first party action for releases
139+
# See https://github.com/actions/create-release?tab=readme-ov-file#github-action---releases-api
140+
if: ${{ matrix.arch == 'amd64' }}
141+
with:
142+
files: |
143+
dist/artifacts/k3s-images.txt
144+
env:
145+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
146+
147+
- name: Upload Airgap Assets to Release
148+
uses: softprops/action-gh-release@v2
149+
with:
150+
files: |
151+
dist/artifacts/k3s-airgap-images*
152+
env:
153+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
154+
155+
upload-release-assets:
156+
name: Prepare and Upload Release Assets
157+
permissions:
158+
contents: write # Needed to update release with assets
159+
runs-on: ubuntu-latest
160+
needs: [build-amd64, build-arm64, build-arm, upload-release-airgap]
161+
steps:
162+
- name: Checkout code
163+
uses: actions/checkout@v4
164+
165+
- name: "Download Binaries and Airgap sha256sum"
166+
uses: actions/download-artifact@v4
167+
with:
168+
pattern: k3s*
169+
path: ./dist/artifacts
170+
merge-multiple: true
171+
172+
- name: "Combine and format sha256sum files"
173+
run: |
174+
for arch in amd64 arm64 arm; do
175+
output_file="./dist/artifacts/sha256sum-${arch}.txt"
176+
cat ./dist/artifacts/k3s-airgap-images-$arch*.sha256sum >> "$output_file"
177+
rm ./dist/artifacts/k3s-airgap-images-$arch*.sha256sum
178+
if [[ "$arch" == "amd64" ]]; then
179+
cat ./dist/artifacts/k3s.sha256sum >> "$output_file"
180+
rm ./dist/artifacts/k3s.sha256sum # Remove the original file to avoid uploading it
181+
else
182+
cat ./dist/artifacts/k3s-${arch}.sha256sum >> "$output_file"
183+
rm ./dist/artifacts/k3s-${arch}.sha256sum # Remove the original file to avoid uploading it
184+
fi
185+
done
186+
187+
- name: Upload Assets to Release
188+
uses: softprops/action-gh-release@v2.2.1
189+
with:
190+
files: |
191+
dist/artifacts/k3s*
192+
dist/artifacts/sha256sum*
193+
env:
194+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
195+

0 commit comments

Comments
 (0)