Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

.github: Add release verification job #10538

Merged
merged 2 commits into from
Feb 5, 2025
Merged

.github: Add release verification job #10538

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
51be371
.github: Add release verification job
timflannagan Jan 28, 2025
df0884a
.github: Remove debug artifact in release.yaml
timflannagan Jan 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 64 additions & 4 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,15 @@
name: Release
on:
workflow_dispatch:
inputs:
validate:
type: boolean
default: false
description: "Validate the release artifacts"
version:
type: string
required: false
description: "Override the default version (e.g. v0.0.0-manual-<git-sha>)"
Comment on lines +4 to +12
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Successful run in my fork using these inputs: https://github.com/timflannagan/kgateway/actions/runs/13058904781/job/36436798507.

push:
tags:
- 'v*'
Expand Down Expand Up @@ -33,13 +42,17 @@ jobs:
- name: Set the release related variables
id: set_vars
run: |
GIT_TAG=$(git describe --tags --abbrev=0 --always)
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was breaking workflow_dispatch triggers as GIT_TAG returned a VERSION that isn't valid semver. Decided to mirror the main branch tag structure as the default value when the workflow_dispatch input.version option was unspecified.

set -x
GIT_SHA=$(git rev-parse --short HEAD)
GIT_BRANCH=$(git rev-parse --abbrev-ref HEAD | sed -e "s/\//-/g")

# Set version based on event type
if [[ ${{ github.event_name }} == 'workflow_dispatch' ]]; then
VERSION="${GIT_TAG}-${GIT_SHA}"
if [[ -n "${{ inputs.version }}" ]]; then
VERSION="${{ inputs.version }}"
else
VERSION="v0.0.0-manual-${GIT_SHA}"
fi
echo "goreleaser_args=--clean --skip=validate" >> $GITHUB_OUTPUT
elif [[ $GITHUB_REF == refs/tags/* ]]; then
VERSION="${GITHUB_REF#refs/tags/}"
Expand All @@ -48,12 +61,13 @@ jobs:
VERSION="v0.0.0-main"
echo "goreleaser_args=--clean --skip=validate" >> $GITHUB_OUTPUT
elif [[ $GITHUB_REF == refs/pull/* ]]; then
GIT_TAG=$(git describe --tags --abbrev=0)
PR_NUM=$(echo "${GITHUB_REF}" | sed -E 's|refs/pull/([^/]+)/?.*|\1|')
VERSION="${GIT_TAG}-pr.${PR_NUM}-${GIT_SHA}"
echo "goreleaser_args=--snapshot --clean" >> $GITHUB_OUTPUT
else
VERSION="${GIT_TAG}-${GIT_BRANCH}-${GIT_SHA}"
echo "goreleaser_args=--snapshot --clean" >> $GITHUB_OUTPUT
echo "Unknown event type"
exit 1
fi
echo "version=${VERSION}" >> $GITHUB_OUTPUT

Expand Down Expand Up @@ -115,3 +129,49 @@ jobs:
IMAGE_REGISTRY: ${{ env.IMAGE_REGISTRY }}
GORELEASER_ARGS: ${{ needs.setup.outputs.goreleaser_args }}
GORELEASER_CURRENT_TAG: ${{ needs.setup.outputs.version }}

validate:
name: Validate release artifacts
needs: [setup, helm, goreleaser]
if: ${{ startsWith(github.ref, 'refs/tags/') || inputs.validate }}
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skip main branch pushes and PR events. Only validate release artifacts when a new tag is pushed or when this workflow is triggered with a workflow_dispatch that enables the optional "validate" flag.

runs-on: ubuntu-22.04
steps:
- uses: actions/checkout@v4

- uses: actions/setup-go@v5
with:
go-version-file: "go.mod"

- name: Login to ghcr.io
if: ${{ github.event_name != 'pull_request' }}
run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ${{ env.IMAGE_REGISTRY }} -u ${{ github.repository_owner }} --password-stdin

- name: Download module dependencies
run: make mod-download
Comment on lines +149 to +150
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is needed as the make conformance prerequisite target runs go list -json -m sigs.k8s.io/gateway-api | jq -r '.Dir' under-the-hood and the .Dir parameter will not be present if the module dependencies haven't been pulled down first.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The alternative to this is moving the conformance suite in-tree, e.g. test/conformance, and syncing the various *_suite.go files when the GW API is bumped.


- name: Setup kind cluster
run: ./ci/kind/setup-kind.sh
env:
VERSION: ${{ needs.setup.outputs.version }}
SKIP_DOCKER: "true"
CONFORMANCE: "true"
Comment on lines +152 to +157
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I could've re-used the conformance composite action, but I think that composite needs to be refactored to accept better inputs and/or be driven by a Makefile target that creates a kind cluster, optionally loads any locally built images, deploying helm charts, runs the conformance suite, etc.


- name: Install the released chart
run: |
helm install --create-namespace --namespace kgateway-system kgateway \
oci://${{ env.IMAGE_REGISTRY }}/charts/kgateway \
--version ${{ needs.setup.outputs.version }} \
--set controller.image.registry=${{ env.IMAGE_REGISTRY }} \
--set gateway.envoyContainer.image.registry=${{ env.IMAGE_REGISTRY }} \
--set gateway.sdsContainer.image.registry=${{ env.IMAGE_REGISTRY }} \
Comment on lines +164 to +166
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note, this is primarily needed to test the release workflow in forks. We could re-introduce a global.image.registry value in the kgateway values.yaml over time.

--wait --timeout 5m

- name: Wait for the kgateway deployment to be ready
run: |
kubectl wait --for=condition=available --timeout=5m deployment/kgateway -n kgateway-system

- name: Run Conformance Tests
run: make conformance
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We may extend these checks over time too. Ideally we'd validate that our extension APIs work too once the various e2e suites are back online.

shell: bash
env:
VERSION: ${{ needs.setup.outputs.version }}