release nightly #82
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: release nightly | |
| on: | |
| schedule: | |
| - cron: "15 20 * * *" # 20:15 UTC, every day | |
| workflow_dispatch: {} | |
| env: | |
| container_registry: ghcr.io/edgelesssys | |
| DO_NOT_TRACK: 1 | |
| concurrency: | |
| group: release-nightly | |
| cancel-in-progress: true | |
| jobs: | |
| process-inputs: | |
| name: Process inputs | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| outputs: | |
| EFFECTIVE_VERSION: ${{ steps.nightly-version.outputs.value }} | |
| WITHOUT_V: ${{ steps.version-info.outputs.without_v }} | |
| RELEASE_BRANCH: ${{ steps.version-info.outputs.release_branch }} | |
| WORKING_BRANCH: ${{ steps.branch.outputs.value }} | |
| PREVIOUS_MINOR_TAG: ${{ steps.version-info.outputs.previous_minor_tag }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| fetch-tags: true | |
| - name: Get working branch | |
| id: branch | |
| run: echo "value=$(git branch --show-current)" >> "$GITHUB_OUTPUT" | |
| - name: Determine nightly version | |
| id: nightly-version | |
| run: | | |
| base=$(sed 's/-.*$//' version.txt) | |
| echo "value=v${base}-$(date -u +%Y-%m-%d)" >> "$GITHUB_OUTPUT" | |
| - name: Parse version | |
| id: version-info | |
| uses: ./.github/actions/parse_version | |
| with: | |
| version: ${{ steps.nightly-version.outputs.value }} | |
| cleanup-nightly-drafts: | |
| name: Clean up old nightly draft releases | |
| runs-on: ubuntu-24.04 | |
| needs: process-inputs | |
| permissions: | |
| contents: write | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| steps: | |
| - name: Delete existing nightly draft releases | |
| env: | |
| GH_REPO: ${{ github.repository }} | |
| run: | | |
| gh release list --repo "${GH_REPO}" --limit 10 --json tagName,isDraft \ | |
| | jq -r '.[] | select(.isDraft == true) | .tagName' \ | |
| | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+-[0-9]{4}-[0-9]{2}-[0-9]{2}$' \ | |
| | while IFS= read -r nightly_version; do | |
| echo "Deleting nightly draft release: ${nightly_version}" | |
| gh release delete "${nightly_version}" --repo "${GH_REPO}" --yes | |
| done | |
| release-x86_64-linux: | |
| name: "release-requirement: Build and push artifacts, create nightly draft release" | |
| runs-on: ubuntu-24.04 | |
| needs: [process-inputs, cleanup-nightly-drafts] | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| outputs: | |
| LOG_COLLECTOR_IMAGE: ${{ steps.build.outputs.log_collector_image }} | |
| ARTIFACTS_URL: ${{ steps.build.outputs.s3-bucket-url }} | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ needs.process-inputs.outputs.WORKING_BRANCH }} | |
| persist-credentials: false | |
| - uses: ./.github/actions/release_build_linux | |
| id: build | |
| with: | |
| effective_version: ${{ needs.process-inputs.outputs.EFFECTIVE_VERSION }} | |
| without_v: ${{ needs.process-inputs.outputs.WITHOUT_V }} | |
| working_branch: ${{ needs.process-inputs.outputs.WORKING_BRANCH }} | |
| container_registry: ${{ env.container_registry }} | |
| previous_tag: ${{ needs.process-inputs.outputs.PREVIOUS_MINOR_TAG }} | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| cachix_token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| release-aarch64-darwin: | |
| name: "release-requirement: Build aarch64-darwin CLI" | |
| runs-on: macos-latest | |
| needs: [process-inputs, release-x86_64-linux] | |
| permissions: | |
| contents: write | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ needs.process-inputs.outputs.WORKING_BRANCH }} | |
| persist-credentials: false | |
| - uses: ./.github/actions/release_build_darwin | |
| with: | |
| effective_version: ${{ needs.process-inputs.outputs.EFFECTIVE_VERSION }} | |
| without_v: ${{ needs.process-inputs.outputs.WITHOUT_V }} | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| cachix_token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| report-artifacts: | |
| name: Pre-release artifacts | |
| needs: [release-x86_64-linux, release-aarch64-darwin] | |
| permissions: {} | |
| uses: ./.github/workflows/report_artifacts.yml | |
| with: | |
| url: ${{ needs.release-x86_64-linux.outputs.ARTIFACTS_URL }} | |
| vuln-scan: | |
| name: "release-requirement: dependency vulnerability scan" | |
| uses: ./.github/workflows/vuln_scan.yml | |
| secrets: | |
| GITHUB_TOKEN_IN: ${{ secrets.GITHUB_TOKEN }} | |
| CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| permissions: | |
| contents: read | |
| security-events: write | |
| nightly: | |
| name: "release-requirement: e2e nightly" | |
| uses: ./.github/workflows/e2e_nightly.yml | |
| secrets: | |
| GITHUB_TOKEN_IN: ${{ secrets.GITHUB_TOKEN }} | |
| CACHIX_AUTH_TOKEN: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| NUNKI_CI_COMMIT_PUSH_PR: ${{ secrets.NUNKI_CI_COMMIT_PUSH_PR }} | |
| TEAMS_CI_WEBHOOK: ${{ secrets.TEAMS_CI_WEBHOOK }} | |
| CONTRAST_GHCR_READ: ${{ secrets.CONTRAST_GHCR_READ }} | |
| permissions: | |
| contents: read | |
| packages: write | |
| test: | |
| strategy: | |
| matrix: | |
| platform: | |
| - name: Metal-QEMU-SNP | |
| node-installer-target-conf: none | |
| linux-runner: SNP | |
| is-public: true | |
| - name: Metal-QEMU-SNP-GPU | |
| node-installer-target-conf: k3s | |
| linux-runner: SNP-GPU | |
| is-public: false | |
| - name: Metal-QEMU-TDX | |
| node-installer-target-conf: k3s | |
| linux-runner: TDX | |
| is-public: false | |
| - name: Metal-QEMU-TDX-GPU | |
| node-installer-target-conf: none | |
| linux-runner: TDX-GPU | |
| is-public: true | |
| cli-arch: | |
| - x86_64-linux | |
| - aarch64-darwin | |
| fail-fast: false | |
| name: "release-requirement: e2e release on ${{ matrix.platform.name }} (${{ matrix.cli-arch }})" | |
| runs-on: ${{ matrix.cli-arch == 'aarch64-darwin' && 'macos-latest' || matrix.platform.linux-runner }} | |
| # Serialize matrix entries that share a cluster (linux + darwin) to | |
| # avoid clashing on coordinator state and resource cleanup. | |
| concurrency: | |
| group: e2e-release-${{ matrix.platform.name }}-${{ github.run_id }} | |
| cancel-in-progress: false | |
| permissions: | |
| contents: read | |
| packages: read | |
| # Needed for GH OIDC -> GCP WIF federation on the darwin entries. | |
| id-token: write | |
| needs: [process-inputs, release-x86_64-linux, release-aarch64-darwin, nightly] | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| ref: ${{ needs.process-inputs.outputs.WORKING_BRANCH }} | |
| persist-credentials: false | |
| - uses: ./.github/actions/release_e2e_test | |
| with: | |
| version: ${{ needs.process-inputs.outputs.EFFECTIVE_VERSION }} | |
| s3_base_url: ${{ needs.release-x86_64-linux.outputs.ARTIFACTS_URL }} | |
| container_registry: ${{ env.container_registry }} | |
| platform_name: ${{ matrix.platform.name }} | |
| node_installer_target_conf: ${{ matrix.platform.node-installer-target-conf }} | |
| self_hosted: ${{ matrix.cli-arch == 'x86_64-linux' }} | |
| cli_arch: ${{ matrix.cli-arch }} | |
| is_public: ${{ matrix.platform.is-public }} | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| cachix_token: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| wif_provider: ${{ vars.GCP_WIF_PROVIDER }} | |
| sa_email: ${{ vars.GCP_SA_EMAIL }} | |
| tailscale_client_id: ${{ secrets.TAILSCALE_CLIENT_ID }} | |
| tailscale_client_secret: ${{ secrets.TAILSCALE_CLIENT_SECRET }} | |
| log_collector_image: ${{ needs.release-x86_64-linux.outputs.LOG_COLLECTOR_IMAGE }} |