.github: Add release verification job #10538
Conversation
| --set controller.image.registry=${{ env.IMAGE_REGISTRY }} \ | ||
| --set gateway.envoyContainer.image.registry=${{ env.IMAGE_REGISTRY }} \ | ||
| --set gateway.sdsContainer.image.registry=${{ env.IMAGE_REGISTRY }} \ |
There was a problem hiding this comment.
Note, this is primarily needed to test the release workflow in forks. We could re-introduce a global.image.registry value in the kgateway values.yaml over time.
| - name: Download module dependencies | ||
| run: make mod-download |
There was a problem hiding this comment.
This is needed as the make conformance prerequisite target runs go list -json -m sigs.k8s.io/gateway-api | jq -r '.Dir' under-the-hood and the .Dir parameter will not be present if the module dependencies haven't been pulled down first.
There was a problem hiding this comment.
The alternative to this is moving the conformance suite in-tree, e.g. test/conformance, and syncing the various *_suite.go files when the GW API is bumped.
| - name: Setup kind cluster | ||
| run: ./ci/kind/setup-kind.sh | ||
| env: | ||
| VERSION: ${{ needs.setup.outputs.version }} | ||
| SKIP_DOCKER: "true" | ||
| CONFORMANCE: "true" |
There was a problem hiding this comment.
I could've re-used the conformance composite action, but I think that composite needs to be refactored to accept better inputs and/or be driven by a Makefile target that creates a kind cluster, optionally loads any locally built images, deploying helm charts, runs the conformance suite, etc.
| kubectl wait --for=condition=available --timeout=5m deployment/kgateway -n kgateway-system | ||
|
|
||
| - name: Run Conformance Tests | ||
| run: make conformance |
There was a problem hiding this comment.
We may extend these checks over time too. Ideally we'd validate that our extension APIs work too once the various e2e suites are back online.
|
Let's wait until #10540 merges first. |
timflannagan
force-pushed
the
release/validate
branch
2 times, most recently
from
6b909bd to
0535b4e
Compare
Signed-off-by: timflannagan <[email protected]>
timflannagan
force-pushed
the
release/validate
branch
from
0535b4e to
51be371
Compare
|
Sorry for the force pushes. I was testing this out in my fork without creating a temp branch and pushing that to my origin like I usually do. |
| validate: | ||
| name: Validate release artifacts | ||
| needs: [setup, helm, goreleaser] | ||
| if: ${{ startsWith(github.ref, 'refs/tags/') || inputs.validate }} |
There was a problem hiding this comment.
Skip main branch pushes and PR events. Only validate release artifacts when a new tag is pushed or when this workflow is triggered with a workflow_dispatch that enables the optional "validate" flag.
.github/workflows/release.yaml
Outdated
| - name: Print out validate inputs | ||
| run: | | ||
| set -x | ||
| echo "validate: ${{ inputs.validate }}" | ||
| echo "version: ${{ needs.setup.outputs.version }}" |
There was a problem hiding this comment.
Whoops, debug artifacts. I was trying to figure out why this job was being skipped when the validate option was enabled.
The workflow will also receive the inputs in the github.event.inputs context. The information in the inputs context and github.event.inputs context is identical except that the inputs context preserves Boolean values as Booleans instead of converting them to strings. The choice type resolves to a string and is a single selectable option.
TIL.
| inputs: | ||
| validate: | ||
| type: boolean | ||
| default: false | ||
| description: "Validate the release artifacts" | ||
| version: | ||
| type: string | ||
| required: false | ||
| description: "Override the default version (e.g. v0.0.0-manual-<git-sha>)" |
There was a problem hiding this comment.
Successful run in my fork using these inputs: https://github.com/timflannagan/kgateway/actions/runs/13058904781/job/36436798507.
| @@ -33,13 +42,17 @@ jobs: | |||
| - name: Set the release related variables | |||
| id: set_vars | |||
| run: | | |||
| GIT_TAG=$(git describe --tags --abbrev=0 --always) | |||
There was a problem hiding this comment.
This was breaking workflow_dispatch triggers as GIT_TAG returned a VERSION that isn't valid semver. Decided to mirror the main branch tag structure as the default value when the workflow_dispatch input.version option was unspecified.
Signed-off-by: timflannagan <[email protected]>
Description
Add a post-release validation job that verifies that the published images & helm chart are pullable, deployable, etc. and pass the GW API conformance suite. Validated this worked in my fork: https://github.com/timflannagan/kgateway/actions/runs/13017590116/job/36310714915.
Related to #10510.
Closes #10558.
Checklist: