ci: add support for tagging and release creation

Signed-off-by: Nathan Klick <[email protected]>

.github/workflows/flow-release-legacy-images.yaml

@@ -72,6 +72,11 @@ defaults:
  run:
  shell: bash
 
+permissions:
+ id-token: write
+ contents: read
+ packages: write
+
 jobs:
  versions:
  name: Upstream Versions
@@ -80,11 +85,38 @@ jobs:
  explicit-runner-version: ${{ github.event.inputs.runner-version }}
  explicit-hooks-version: ${{ github.event.inputs.runner-container-hooks-version }}
 
+ safety-checks:
+ name: Safety Checks
+ runs-on: [self-hosted, Linux, medium, ephemeral]
+ needs:
+ - versions
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0
+ with:
+ egress-policy: audit
+
+ - name: Install GH CLI
+ uses: sersoft-gmbh/setup-gh-cli-action@2d02c06e284b7d55e954d6d6406e7a886f45a818 # v2.0.1
+ with:
+ github-token: ${{ secrets.GITHUB_TOKEN }}
+
+ - name: Authorize GH CLI
+ run: echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
+
+ - name: Check for Existing Releases
+ run: |
+ if gh release view v${{ needs.versions.outputs.runner }} >/dev/null 2>&1; then
+ echo "::error title=Release Version::Release v${{ needs.versions.outputs.runner }} already exists and may not be redeployed."
+ exit 1
+ fi
+
  legacy-image:
  name: Legacy Image
  uses: ./.github/workflows/zxc-build-legacy-images.yaml
  needs:
  - versions
+ - safety-checks
  strategy:
  matrix:
  base-os-image:
@@ -100,4 +132,98 @@ jobs:
  build-default-image: ${{ github.event.inputs.build-default-image == 'true' }}
  build-dind-image: ${{ github.event.inputs.build-dind-image == 'true' }}
  build-dind-rootless-image: ${{ github.event.inputs.build-dind-rootless-image == 'true' }}
- dry-run-enabled: ${{ github.event.inputs.dry-run-enabled == 'true' }}
+ dry-run-enabled: ${{ github.event.inputs.dry-run-enabled == 'true' || github.ref_name != 'main' }}
+
+ update-version:
+ name: Update Version
+ runs-on: [self-hosted, Linux, medium, ephemeral]
+ needs:
+ - versions
+ - legacy-image
+ if: ${{ github.event.inputs.dry-run-enabled != 'true' && github.ref_name == 'main' }}
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0
+ with:
+ egress-policy: audit
+
+ - name: Checkout Code
+ uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ with:
+ fetch-depth: 0
+ token: ${{ secrets.GH_ACCESS_TOKEN }}
+
+ - name: Import GPG key
+ id: gpg_key
+ uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
+ with:
+ gpg_private_key: ${{ secrets.GPG_KEY_CONTENTS }}
+ passphrase: ${{ secrets.GPG_KEY_PASSPHRASE }}
+ git_config_global: true
+ git_user_signingkey: true
+ git_commit_gpgsign: true
+ git_tag_gpgsign: false
+
+ - name: Update Version Descriptor
+ working-directory: legacy/runner
+ run: printf "RUNNER_VERSION=%s\nRUNNER_CONTAINER_HOOKS_VERSION=%s\n" "${{ needs.versions.outputs.runner }}" "${{ needs.versions.outputs.hooks }}" >VERSION
+
+ - name: Commit Changes
+ uses: actions-js/push@5a7cbd780d82c0c937b5977586e641b2fd94acc5 # v1.5
+ with:
+ github_token: ${{ secrets.GH_ACCESS_TOKEN }}
+ author_name: ${{ vars.GIT_USER_NAME }}
+ author_email: ${{ vars.GIT_USER_EMAIL }}
+ message: "chore(release): v${{ needs.versions.outputs.runner }} [skip ci]"
+
+ finalize-release:
+ name: Finalize Release
+ runs-on: [self-hosted, Linux, medium, ephemeral]
+ needs:
+ - versions
+ - update-version
+ steps:
+ - name: Harden Runner
+ uses: step-security/harden-runner@0d381219ddf674d61a7572ddd19d7941e271515c # v2.9.0
+ with:
+ egress-policy: audit
+
+ - name: Checkout Code
+ uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+ with:
+ ref: ${{ github.ref_name }}
+ fetch-depth: 0
+ token: ${{ secrets.GH_ACCESS_TOKEN }}
+
+ - name: Import GPG key
+ id: gpg_key
+ uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
+ with:
+ gpg_private_key: ${{ secrets.GPG_KEY_CONTENTS }}
+ passphrase: ${{ secrets.GPG_KEY_PASSPHRASE }}
+ git_config_global: true
+ git_user_signingkey: true
+ git_commit_gpgsign: true
+ git_tag_gpgsign: true
+
+ - name: Install GH CLI
+ uses: sersoft-gmbh/setup-gh-cli-action@2d02c06e284b7d55e954d6d6406e7a886f45a818 # v2.0.1
+ with:
+ github-token: ${{ secrets.GITHUB_TOKEN }}
+
+ - name: Authorize GH CLI
+ run: echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
+
+ - name: Fetch Upstream Release Info
+ run: |
+ RELEASE_URL="$(gh release view v${{ needs.versions.outputs.runner }} --json url -R actions/runner | jq -r '.url')"
+ gh release view v${{ needs.versions.outputs.runner }} --json body -R actions/runner | jq -r '.body' > .github/RELEASE_BODY.md
+ printf "\n\n### _Release Notes have been imported from the [%s](%s) release in the upstream repository._\n\n" "v${{ needs.versions.outputs.runner }}" "${RELEASE_URL}" >> .github/RELEASE_BODY.md
+
+ - name: Create Release
+ uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1.14.0
+ with:
+ token: ${{ secrets.GH_ACCESS_TOKEN }}
+ commit: ${{ github.ref_name }}
+ tag: v${{ needs.versions.outputs.runner }}
+ bodyFile: .github/RELEASE_BODY.md

legacy/runner/VERSION

@@ -1,2 +1,2 @@
-RUNNER_VERSION=2.317.0
+RUNNER_VERSION=2.316.0
 RUNNER_CONTAINER_HOOKS_VERSION=0.6.1