Skip to content
name: Create new osctrl release
on:
push:
branches: [ $default-branch ]
# Publish semver tags as releases.
tags: [ 'v*.*.*' ]
env:
GOLANG_VERSION: 1.21.3
OSQUERY_VERSION: 5.12.1
jobs:
build_and_test:
runs-on: ubuntu-22.04
strategy:
matrix:
components: ['tls', 'admin', 'api', 'cli']
goos: ['linux', 'darwin', 'windows']
goarch: ['amd64', 'arm64']
steps:
########################### Checkout code ###########################
- name: Checkout code
uses: actions/[email protected]
with:
fetch-depth: 2
########################### Generate SHA1 commit hash ###########################
# https://newbedev.com/getting-current-branch-and-commit-hash-in-github-action
- name: Declare GIT hash and branch
id: vars
shell: bash
run: |
echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
echo "branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
########################### Build osctrl ###########################
- name: Build osctrl binaries
# Build all osctrl components for linux for all archs
# Build all osctrl components for darwin for all archs
# Build osctrl cli for windows for all archs
if: matrix.goos == 'linux' || matrix.goos == 'darwin' || (matrix.goos == 'windows' && matrix.components == 'cli')
uses: ./.github/actions/build/binaries
with:
go_os: "${{ matrix.goos }}"
go_arch: "${{ matrix.goarch }}"
osctrl_component: "${{ matrix.components }}"
commit_sha: "${{ steps.vars.outputs.sha_short }}"
commit_branch: "${{ steps.vars.outputs.branch }}"
golang_version: "${{ env.GOLANG_VERSION }}"
########################### Test binaries ###########################
# - name: Run tests
# id: bin_tests
# uses: .github/actions/test/binaries
# with:
# go_os: "${{ matrix.goos }}"
# go_arch: "${{ matrix.goarch }}"
# osctrl_component: "${{ matrix.components }}"
# commit_sha: "${{ steps.vars.outputs.sha_short }}"
# commit_branch: "${{ steps.vars.outputs.branch }}"
# golang_version: "${{ env.GOLANG_VERSION }}"
create_deb_packages:
needs: [build_and_test]
runs-on: ubuntu-22.04
strategy:
matrix:
components: ['tls', 'admin', 'api', 'cli']
goos: ['linux']
goarch: ['amd64', 'arm64']
steps:
########################### Checkout code ###########################
- name: Checkout code
uses: actions/[email protected]
with:
fetch-depth: 2
########################### Generate SHA1 commit hash ###########################
# https://newbedev.com/getting-current-branch-and-commit-hash-in-github-action
- name: Declare GIT hash and branch
id: vars
shell: bash
run: |
echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
echo "branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
########################### Build DEB packages ###########################
- name: Build osctrl DEB packages
uses: ./.github/actions/build/dpkg
with:
go_os: ${{ matrix.goos }}
go_arch: ${{ matrix.goarch }}
osctrl_component: ${{ matrix.components }}
commit_sha: ${{ steps.vars.outputs.sha_short }}
osquery_version: ${{ env.OSQUERY_VERSION }}
create_docker_images:
needs: [build_and_test]
runs-on: ubuntu-22.04
strategy:
matrix:
components: ['tls', 'admin', 'api', 'cli']
goos: ['linux']
goarch: ['amd64', 'arm64']
steps:
########################### Checkout code ###########################
- name: Checkout code
uses: actions/[email protected]
with:
fetch-depth: 2
########################### Generate SHA1 commit hash ###########################
# https://newbedev.com/getting-current-branch-and-commit-hash-in-github-action
- name: Declare GIT hash and branch
id: vars
shell: bash
run: |
echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
echo "branch=$(echo ${GITHUB_REF_NAME})" >> $GITHUB_OUTPUT
echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
########################### Build Docker containers ###########################
- name: Build and deploy osctrl Docker containers
uses: ./.github/actions/build/docker
id: build_docker_containers
with:
#### golang env vars ####
go_os: ${{ matrix.goos }}
go_arch: ${{ matrix.goarch }}
#### Build vars ####
osctrl_component: ${{ matrix.components }}
commit_sha: ${{ steps.vars.outputs.sha_short }}
#### Dockerhub creds ####
docker_hub_org: ${{ secrets.DOCKER_HUB_ORG }}
docker_hub_username: ${{ secrets.DOCKER_HUB_USERNAME }}
docker_hub_access_token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
push_docker_images:
needs: [create_docker_images]
runs-on: ubuntu-22.04
strategy:
matrix:
components: ['tls', 'admin', 'api', 'cli']
steps:
########################### Checkout code ###########################
- name: Checkout code
uses: actions/[email protected]
with:
fetch-depth: 2
- name: Download digests
uses: actions/download-artifact@v3
with:
name: digests-osctrl-${{ matrix.components }}
path: /tmp/digests
- name: Set up Docker Buildx
uses: docker/[email protected]
- name: Docker meta
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ secrets.DOCKER_HUB_ORG }}/osctrl-${{ matrix.components }}
labels: |
org.opencontainers.image.title=osctrl-${{ matrix.components }}
tags: |
type=sha,prefix=,format=short
type=match,pattern=v(.*),group=1
########################### Log into Dockerhub ###########################
- name: Login to Docker Hub
uses: docker/[email protected]
with:
username: ${{ secrets.DOCKER_HUB_USERNAME }}
password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
- name: Create manifest list and push
working-directory: /tmp/digests
run: |
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
$(printf '${{ secrets.DOCKER_HUB_ORG }}/osctrl-${{ matrix.components }}@sha256:%s ' *)
- name: Export digests and tags for cosign
id: docker_vars
working-directory: /tmp/digests
run: |
echo "digests=$(printf '%s ' *)" >> $GITHUB_OUTPUT
echo "tags=$(jq -cr '.tags | map(\"-t \" + .) | join(\" \")' <<< \"$DOCKER_METADATA_OUTPUT_JSON\")" >> $GITHUB_OUTPUT
########################### Sign Docker images ###########################
- name: Sign osctrl Docker containers
uses: ./.github/actions/tagged_release/docker/codesign
with:
#### Docker vars ####
osctrl_component: ${{ matrix.components }}
docker_tags: ${{ steps.docker_vars.outputs.tags }}
docker_image_digests: ${{ steps.digests.outputs.digests }}
#### Dockerhub creds ####
docker_hub_org: ${{ secrets.DOCKER_HUB_ORG }}
docker_hub_username: ${{ secrets.DOCKER_HUB_USERNAME }}
docker_hub_access_token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
#### Codesign secrets ####
codesign_password: ${{ secrets.COSIGN_PASSWORD }}
codesign_private_key: ${{ secrets.COSIGN_PRIVATE }}
codesign_public_cert: ${{ secrets.COSIGN_PUBLIC }}
- name: Inspect image
run: |
docker buildx imagetools inspect ${{ secrets.DOCKER_HUB_ORG }}/osctrl-${{ matrix.components }}:${{ steps.meta.outputs.version }}
create_release:
needs: [build_and_test,create_deb_packages,push_docker_images]
runs-on: ubuntu-22.04
strategy:
matrix:
components: ['tls', 'admin', 'api', 'cli']
goos: ['linux']
goarch: ['amd64', 'arm64']
steps:
########################### Checkout code ###########################
- name: Checkout code
uses: actions/[email protected]
with:
fetch-depth: 2
########################### Generate SHA1 commit hash ###########################
# https://newbedev.com/getting-current-branch-and-commit-hash-in-github-action
- name: Declare GIT hash and branch
id: vars
shell: bash
run: |
echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_OUTPUT
echo "branch=$(echo ${GITHUB_REF#refs/heads/})" >> $GITHUB_OUTPUT
echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
########################### Create release ###########################
- name: Create a new release with binaries and packages
uses: ./.github/actions/tagged_release/github
with:
go_os: "${{ matrix.goos }}"
go_arch: "${{ matrix.goarch }}"
osctrl_component: "${{ matrix.components }}"
commit_sha: "${{ steps.vars.outputs.sha_short }}"
release_version_tag: "${{ steps.vars.outputs.RELEASE_VERSION }}"