mirror of
https://github.com/goauthentik/authentik.git
synced 2026-08-30 18:51:39 -07:00
90e7fc9689
ci: bump regclient/actions/regctl-login
Bumps [regclient/actions/regctl-login](https://github.com/regclient/actions) from 78eb729dbdb4ef6480e85ff697b4410e22112583 to f9ceff9bbbc63cd1008e60cec2b27627eedc7322.
- [Release notes](https://github.com/regclient/actions/releases)
- [Changelog](https://github.com/regclient/actions/blob/main/RELEASE.md)
- [Commits](78eb729dbd...f9ceff9bbb)
---
updated-dependencies:
- dependency-name: regclient/actions/regctl-login
dependency-version: f9ceff9bbbc63cd1008e60cec2b27627eedc7322
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
263 lines
12 KiB
YAML
263 lines
12 KiB
YAML
---
|
|
name: Release - On publish
|
|
|
|
on:
|
|
release:
|
|
types: published
|
|
|
|
jobs:
|
|
metadata:
|
|
runs-on: ubuntu-latest
|
|
outputs:
|
|
tag-name: "${{ steps.metadata.outputs.tag-name }}"
|
|
version: "${{ steps.metadata.outputs.version }}"
|
|
version-family: "${{ steps.metadata.outputs.version-family }}"
|
|
release-reason: "${{ steps.metadata.outputs.release-reason }}"
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
|
|
- id: metadata
|
|
name: Compute variables
|
|
run: |
|
|
tag_name="$(echo "$GITHUB_REF" | sed "s;refs/tags/;;")"
|
|
echo "tag-name=$tag_name" >> "$GITHUB_OUTPUT"
|
|
gh release download "$tag_name" --pattern metadata.json
|
|
gh attestation verify metadata.json --owner goauthentik
|
|
echo "version=$(jq -r '.version' < metadata.json)" >> "$GITHUB_OUTPUT"
|
|
echo "version-family=$(jq -r '.version_family' < metadata.json)" >> "$GITHUB_OUTPUT"
|
|
echo "release-reason=$(jq -r '.release_reason' < metadata.json)" >> "$GITHUB_OUTPUT"
|
|
echo "changelog-url=$(jq -r '.changelog_url' < metadata.json)" >> "$GITHUB_OUTPUT"
|
|
publish-containers:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
# Needed to upload container images to ghcr.io
|
|
packages: write
|
|
# Needed for attestation
|
|
id-token: write
|
|
attestations: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
name:
|
|
- server
|
|
- proxy
|
|
- ldap
|
|
- radius
|
|
- rac
|
|
needs:
|
|
- metadata
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
|
|
- uses: regclient/actions/regctl-installer@f9ceff9bbbc63cd1008e60cec2b27627eedc7322
|
|
# logs in to ghcr.io by default
|
|
- uses: regclient/actions/regctl-login@f9ceff9bbbc63cd1008e60cec2b27627eedc7322
|
|
- uses: regclient/actions/regctl-login@f9ceff9bbbc63cd1008e60cec2b27627eedc7322
|
|
with:
|
|
registry: docker.io
|
|
username: "${{ secrets.DOCKER_CORP_USERNAME }}"
|
|
password: "${{ secrets.DOCKER_CORP_PASSWORD }}"
|
|
- name: Download release container artifact
|
|
run: |
|
|
gh release download "${{ needs.metadata.outputs.tag-name }}" --pattern "${{ matrix.name }}.oci.tar"
|
|
gh attestation verify "${{ matrix.name }}.oci.tar" --owner goauthentik
|
|
- id: publish
|
|
name: Publish container
|
|
run: |
|
|
regctl image import "ocidir://${{ matrix.name }}:${{ needs.metadata.outputs.version }}" "${{ matrix.name }}.oci.tar"
|
|
echo "digest=$(regctl image digest "ocidir://${{ matrix.name }}:${{ needs.metadata.outputs.version }}")" >> "$GITHUB_OUTPUT"
|
|
regctl image import "ghcr.io/goauthentik/${{ matrix.name }}:${{ needs.metadata.outputs.version }}" "${{ matrix.name }}.oci.tar"
|
|
regctl image import "docker.io/authentik/${{ matrix.name }}:${{ needs.metadata.outputs.version }}" "${{ matrix.name }}.oci.tar"
|
|
if [ "${{ needs.metadata.outputs.release-reason }}" != "prerelease" ]; then
|
|
regctl image import "ghcr.io/goauthentik/${{ matrix.name }}:${{ needs.metadata.outputs.version-family }}" "${{ matrix.name }}.oci.tar"
|
|
regctl image import "docker.io/authentik/${{ matrix.name }}:${{ needs.metadata.outputs.version-family }}" "${{ matrix.name }}.oci.tar"
|
|
fi
|
|
# we need to re-login for the attestation to go through
|
|
- uses: docker/login-action@v4
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.actor }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
- uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6
|
|
with:
|
|
subject-name: "ghcr.io/goauthentik/${{ matrix.name }}"
|
|
subject-digest: "${{ steps.publish.outputs.digest }}"
|
|
push-to-registry: true
|
|
publish-docs-container:
|
|
needs:
|
|
- metadata
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
# Needed to upload container images to ghcr.io
|
|
packages: write
|
|
# Needed for attestation
|
|
id-token: write
|
|
attestations: write
|
|
# Needed for checkout
|
|
contents: read
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
|
|
- name: Set up QEMU
|
|
uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
|
|
- name: Set up Docker Buildx
|
|
uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
|
|
- name: Login to GitHub Container Registry
|
|
uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
|
|
with:
|
|
registry: ghcr.io
|
|
username: ${{ github.repository_owner }}
|
|
password: ${{ secrets.GITHUB_TOKEN }}
|
|
- id: build
|
|
name: Build Docker Image
|
|
uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
|
|
with:
|
|
tags: |
|
|
ghcr.io/goauthentik/docs:${{ needs.metadata.outputs.version }}
|
|
ghcr.io/goauthentik/docs:${{ needs.metadata.outputs.version-family }}
|
|
file: website/Dockerfile
|
|
push: true
|
|
platforms: linux/amd64,linux/arm64
|
|
context: .
|
|
- uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v3
|
|
with:
|
|
subject-name: ghcr.io/goauthentik/docs
|
|
subject-digest: "${{ steps.build.outputs.digest }}"
|
|
push-to-registry: true
|
|
upload-aws-cfn-template:
|
|
permissions:
|
|
# Needed for AWS login
|
|
id-token: write
|
|
contents: read
|
|
needs:
|
|
- metadata
|
|
- publish-containers
|
|
env:
|
|
AWS_REGION: eu-central-1
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
|
|
- uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
|
|
with:
|
|
role-to-assume: "arn:aws:iam::016170277896:role/github_goauthentik_authentik"
|
|
aws-region: ${{ env.AWS_REGION }}
|
|
- name: Upload template
|
|
run: |
|
|
aws s3 cp --acl=public-read lifecycle/aws/template.yaml s3://authentik-cloudformation-templates/authentik.ecs.${{ github.ref }}.yaml
|
|
aws s3 cp --acl=public-read lifecycle/aws/template.yaml s3://authentik-cloudformation-templates/authentik.ecs.${{ needs.metadata.outputs.tag-name }}.yaml
|
|
if [ "$(gh release list --json tagName,isLatest --jq '.[] | select(.tagName=="${{ needs.metadata.outputs.tag-name }} ") | .isLatest')" = "true" ]; then
|
|
aws s3 cp --acl=public-read lifecycle/aws/template.yaml s3://authentik-cloudformation-templates/authentik.ecs.latest.yaml
|
|
fi
|
|
sentry-release:
|
|
needs:
|
|
- publish-containers
|
|
- metadata
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- name: Get static files from docker image
|
|
run: |
|
|
image="ghcr.io/goauthentik/server:${{ needs.metadata.outputs.version }}"
|
|
docker pull "$image"
|
|
container=$(docker container create "$image")
|
|
docker cp ${container}:web/ .
|
|
- name: Create a Sentry.io release
|
|
uses: getsentry/action-release@ff07929a6537bac57790c3451cf4d364aca38528 # v3
|
|
continue-on-error: true
|
|
env:
|
|
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
|
|
SENTRY_ORG: authentik-security-inc
|
|
SENTRY_PROJECT: authentik
|
|
with:
|
|
release: "authentik@${{ needs.metadata.outputs.version }}"
|
|
sourcemaps: "./web/dist"
|
|
url_prefix: "~/static/dist"
|
|
bump-version:
|
|
name: Bump version repository
|
|
needs:
|
|
- metadata
|
|
- publish-containers
|
|
if: ${{ needs.metadata.outputs.release-reason != 'prerelease' }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- id: app-token
|
|
name: Generate app token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v2
|
|
with:
|
|
client-id: ${{ secrets.GH_APP_ID }}
|
|
private-key: ${{ secrets.GH_APP_PRIV_KEY }}
|
|
repositories: version
|
|
- id: get-user-id
|
|
name: Get GitHub app user ID
|
|
run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
GH_TOKEN: "${{ steps.app-token.outputs.token }}"
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
|
|
with:
|
|
repository: "${{ github.repository_owner }}/version"
|
|
token: "${{ steps.app-token.outputs.token }}"
|
|
- name: Bump version
|
|
run: |
|
|
jq \
|
|
--arg version "${{ needs.metadata.outputs.version }}" \
|
|
--arg changelog "See ${{ needs.metadata.outputs.changelog-url }}" \
|
|
--arg changelog_url "${{ needs.metadata.outputs.changelog-url }}" \
|
|
--arg reason "${{ needs.metadata.outputs.release-reason }}" \
|
|
'.stable.version = $version | .stable.changelog = $changelog | .stable.changelog_url = $changelog_url | .stable.reason = $reason' version.json > version.new.json
|
|
mv version.new.json version.json
|
|
- name: Create pull request
|
|
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7
|
|
with:
|
|
token: "${{ steps.app-token.outputs.token }}"
|
|
branch: bump-${{ needs.metadata.outputs.version }}
|
|
commit-message: "version: bump to ${{ needs.metadata.outputs.version }}"
|
|
title: "version: bump to ${{ needs.metadata.outputs.version }}"
|
|
body: "See ${{ needs.metadata.outputs.changelog-url }}"
|
|
delete-branch: true
|
|
signoff: true
|
|
author: "${{ steps.app-token.outputs.app-slug }}[bot] <${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>"
|
|
bump-helm:
|
|
name: Bump Helm version
|
|
needs:
|
|
- metadata
|
|
- publish-containers
|
|
if: ${{ needs.metadata.outputs.release-reason != 'prerelease' }}
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- id: app-token
|
|
name: Generate app token
|
|
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v2
|
|
with:
|
|
client-id: ${{ secrets.GH_APP_ID }}
|
|
private-key: ${{ secrets.GH_APP_PRIV_KEY }}
|
|
repositories: helm
|
|
- id: get-user-id
|
|
name: Get GitHub app user ID
|
|
run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
|
|
env:
|
|
GH_TOKEN: "${{ steps.app-token.outputs.token }}"
|
|
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
|
|
with:
|
|
repository: "${{ github.repository_owner }}/helm"
|
|
token: "${{ steps.app-token.outputs.token }}"
|
|
- name: Bump version
|
|
run: |
|
|
sed -i 's/^version: .*/version: ${{ needs.metadata.outputs.version }}/' charts/authentik/Chart.yaml
|
|
sed -i 's/^appVersion: .*/appVersion: ${{ needs.metadata.outputs.version }}/' charts/authentik/Chart.yaml
|
|
sed -i 's/upgrade to authentik .*/upgrade to authentik ${{ needs.metadata.outputs.version }}/' charts/authentik/Chart.yaml
|
|
sed -E -i 's/[0-9]{4}\.[0-9]{1,2}\.[0-9]+$/${{ needs.metadata.outputs.version }}/' charts/authentik/Chart.yaml
|
|
./scripts/helm-docs.sh
|
|
- name: Create pull request
|
|
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v7
|
|
with:
|
|
token: "${{ steps.app-token.outputs.token }}"
|
|
branch: bump-${{ needs.metadata.outputs.version }}
|
|
commit-message: "charts/authentik: bump to ${{ needs.metadata.outputs.version }}"
|
|
title: "charts/authentik: bump to ${{ needs.metadata.outputs.version }}"
|
|
body: "See ${{ needs.metadata.outputs.changelog-url }}"
|
|
delete-branch: true
|
|
signoff: true
|
|
author: "${{ steps.app-token.outputs.app-slug }}[bot] <${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com>"
|