ui/.github/workflows/release-images.yml at 036f72cd2d48c9e51a707c3a6d91e3534066bc4f · instructlab/ui · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
name: Publish Prod Container Images
on:
  release:
    types: [published]

env:
  GHCR_REGISTRY: ghcr.io
  GHCR_UI_IMAGE_NAME: ${{ github.repository }}/ui
  QUAY_REGISTRY: quay.io
  QUAY_UI_IMAGE_NAME: instructlab-ui/ui

jobs:
  build_and_publish_ui_prod_image:
    name: Push UI container image to GHCR and QUAY
    runs-on: ubuntu-latest
    environment: registry-creds
    permissions:
      packages: write
      contents: write
      attestations: write
      id-token: write

    steps:
      - name: Check out the repo
        uses: actions/checkout@v6

      - name: Log in to the GHCR container image registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.GHCR_REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Log in to the Quay container image registry
        uses: docker/login-action@v3
        with:
          registry: ${{ env.QUAY_REGISTRY }}
          username: ${{ secrets.QUAY_USERNAME }}
          password: ${{ secrets.QUAY_TOKEN }}

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Cache Docker layers
        uses: actions/cache@v5
        with:
          path: /tmp/.buildx-cache
          key: ${{ runner.os }}-buildx-${{ github.sha }}
          restore-keys: |-
            ${{ runner.os }}-buildx-

      - name: Extract metadata (tags, labels) for UI image
        id: ghcr_ui_meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_UI_IMAGE_NAME }}

      - name: Extract metadata (tags, labels) for UI image
        id: quay_ui_meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.QUAY_REGISTRY }}/${{ env.QUAY_UI_IMAGE_NAME }}

      - name: Build and push ui image to ghcr.io
        id: push-ui-ghcr
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.ghcr_ui_meta.outputs.tags }}
          labels: ${{ steps.ghcr_ui_meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64
          cache-from: type=gha
          cache-to: type=gha,mode=max
          file: src/Containerfile

      - name: Generate Prod UI GHCR artifact attestation
        uses: actions/attest-build-provenance@v3
        with:
          subject-name: ${{ env.GHCR_REGISTRY }}/${{ env.GHCR_UI_IMAGE_NAME}}
          subject-digest: ${{ steps.push-ui-ghcr.outputs.digest }}
          push-to-registry: true

      - name: Build and push ui image to quay.io
        id: push-ui-quay
        uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: ${{ steps.quay_ui_meta.outputs.tags }}
          labels: ${{ steps.quay_ui_meta.outputs.labels }}
          platforms: linux/amd64,linux/arm64
          cache-from: type=gha
          cache-to: type=gha,mode=max
          file: src/Containerfile

      - name: Generate PROD UI Quay artifact attestation
        uses: actions/attest-build-provenance@v3
        with:
          subject-name: ${{ env.QUAY_REGISTRY }}/${{ env.QUAY_UI_IMAGE_NAME}}
          subject-digest: ${{ steps.push-ui-quay.outputs.digest }}
          push-to-registry: true

      - name: Re-Checkout main on the repo
        uses: actions/checkout@v6
        with:
          token: ${{ secrets.BOT_PAT }}
          ref: main

      - name: Update coderefs before code changes
        run: |-
          git pull --ff-only

      - name: Update Prod Quay PS image
        id: update_prod_ui_manifest_image
        env:
          RELEASE_TAG: ${{ github.event.release.tag_name }}
        run: |-
          sudo wget https://github.com/mikefarah/yq/releases/download/v4.34.1/yq_linux_amd64 -O /usr/local/bin/yq
          sudo chmod +x /usr/local/bin/yq
          yq -i '
            (.images[] | select(.name == "quay.io/instructlab-ui/ui") | .newTag) = env(RELEASE_TAG)
          ' deploy/k8s/overlays/openshift/prod/kustomization.yaml

      - name: Commit and push bump to Prod UI image manifest
        run: |-
          git config user.name "platform-engineering-bot"
          git config user.email "platform-engineering@redhat.com"
          git add deploy/k8s/overlays/openshift/prod/kustomization.yaml
          git commit -m "[CI AUTOMATION]: Bumping Prod UI image to tag: ${{ github.event.release.tag_name }}" -s
          git push origin main