Skip to content

Commit 4d9bc1d

Browse files
anithapriyanatarajantekton-robot
anithapriyanatarajan
authored and
tekton-robot
committed
nightly release with gh actions
1 parent a2198ad commit 4d9bc1d

File tree

6 files changed

+357
-59
lines changed

6 files changed

+357
-59
lines changed

‎.github/workflows/nightly-builds.yaml

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
name: Tekton Nightly Build
2+
3+
on:
4+
schedule:
5+
# Run at 03:00 UTC daily
6+
- cron: "0 3 * * *"
7+
workflow_dispatch:
8+
inputs:
9+
kubernetes_version:
10+
description: 'Kubernetes version to test with'
11+
required: false
12+
default: 'v1.33.0'
13+
nightly_bucket:
14+
description: 'Nightly bucket for builds'
15+
required: false
16+
default: 'gs://tekton-releases-nightly/pipeline'
17+
type: string
18+
19+
env:
20+
KUBERNETES_VERSION: ${{ inputs.kubernetes_version || 'v1.33.0' }}
21+
REGISTRY: ghcr.io
22+
PACKAGE: github.com/${{ github.repository }}
23+
BUCKET: ${{ inputs.nightly_bucket || 'gs://tekton-releases-nightly/pipeline' }}
24+
IMAGE_REGISTRY_PATH: ${{ github.repository }}
25+
IMAGE_REGISTRY_USER: tekton-robot
26+
27+
jobs:
28+
build:
29+
name: Nightly Build (K8s ${{ inputs.kubernetes_version || 'v1.33.0' }})
30+
runs-on: ubuntu-latest
31+
32+
permissions:
33+
contents: read
34+
packages: write
35+
id-token: write
36+
37+
steps:
38+
- name: Checkout repository
39+
uses: actions/checkout@v4
40+
with:
41+
fetch-depth: 0
42+
43+
- name: Generate version info
44+
id: version
45+
run: |
46+
latest_sha=${{ github.sha }}
47+
date_tag=$(date +v%Y%m%d-${latest_sha:0:7})
48+
echo "version_tag=${date_tag}" >> "$GITHUB_OUTPUT"
49+
echo "latest_sha=${latest_sha}" >> "$GITHUB_OUTPUT"
50+
51+
- name: Set up Kind cluster
52+
uses: helm/[email protected]
53+
with:
54+
node_image: kindest/node:${{ env.KUBERNETES_VERSION }}
55+
cluster_name: tekton-nightly
56+
57+
- name: Set up Tekton
58+
uses: tektoncd/actions/setup-tektoncd@main
59+
with:
60+
pipeline_version: latest
61+
setup_registry: "true"
62+
patch_etc_hosts: "true"
63+
64+
- name: Configure Tekton Git Resolver
65+
env:
66+
GITHUB_TOKEN: ${{ secrets.GHCR_TOKEN || github.token }}
67+
run: |
68+
# Create Git authentication secret with proper Tekton annotations
69+
kubectl create secret generic git-resolver-secret \
70+
--from-literal=token="${GITHUB_TOKEN}" \
71+
-n tekton-pipelines-resolvers || true
72+
73+
kubectl annotate secret git-resolver-secret \
74+
tekton.dev/git-0=github.com \
75+
-n tekton-pipelines-resolvers || true
76+
77+
kubectl create secret generic git-resolver-secret \
78+
--from-literal=token="${GITHUB_TOKEN}" \
79+
-n default || true
80+
81+
kubectl annotate secret git-resolver-secret \
82+
tekton.dev/git-0=github.com \
83+
-n default || true
84+
85+
kubectl patch configmap git-resolver-config -n tekton-pipelines-resolvers --patch='
86+
data:
87+
api-token-secret-name: "git-resolver-secret"
88+
api-token-secret-key: "token"
89+
' || true
90+
91+
kubectl patch configmap feature-flags -n tekton-pipelines --patch='
92+
data:
93+
enable-cel-in-whenexpression: "true"
94+
' || true
95+
96+
- name: Install tkn CLI
97+
uses: tektoncd/actions/setup-tektoncd-cli@main
98+
with:
99+
version: latest
100+
101+
- name: Apply Build Pipeline Definition
102+
run: |
103+
kustomize build tekton | kubectl apply -f -
104+
105+
- name: Create secrets, service account and PVC template
106+
env:
107+
GCS_SERVICE_ACCOUNT_KEY: ${{ secrets.GCS_SERVICE_ACCOUNT_KEY }}
108+
GHCR_TOKEN: ${{ secrets.GHCR_TOKEN || github.token }}
109+
IMAGE_REGISTRY_USER: ${{ env.IMAGE_REGISTRY_USER }}
110+
run: |
111+
# Create GCS service account secret for release bucket access
112+
echo "${GCS_SERVICE_ACCOUNT_KEY}" > /tmp/gcs-key.json
113+
kubectl create secret generic release-secret \
114+
--from-file=release.json=/tmp/gcs-key.json
115+
rm -f /tmp/gcs-key.json
116+
117+
# Create a Kubernetes secret for GHCR authentication.
118+
# This version creates the secret with a custom key name `docker-config.json`
119+
# (instead of the default `.dockerconfigjson`) to match what the publish task expects.
120+
echo "${GHCR_TOKEN}" > /tmp/docker-config.json
121+
kubectl create secret generic release-images-secret \
122+
--from-file=docker-config.json=/tmp/docker-config.json
123+
rm -f /tmp/docker-config.json
124+
125+
# Apply service account configuration with proper RBAC
126+
kubectl apply -f tekton/account.yaml
127+
128+
cat > workspace-template.yaml << EOF
129+
spec:
130+
accessModes:
131+
- ReadWriteOnce
132+
resources:
133+
requests:
134+
storage: 1Gi
135+
EOF
136+
137+
- name: Start Tekton Build Pipeline
138+
run: |
139+
set -euo pipefail # Exit on any error, undefined variables, or pipe failures
140+
141+
echo "Starting Tekton pipeline..."
142+
143+
PIPELINE_RUN=$(tkn pipeline start pipeline-release \
144+
--serviceaccount=release-right-meow \
145+
--param package="${{ env.PACKAGE }}" \
146+
--param gitRevision="${{ steps.version.outputs.latest_sha }}" \
147+
--param versionTag="${{ steps.version.outputs.version_tag }}" \
148+
--param releaseBucket="${{ env.BUCKET }}" \
149+
--param imageRegistry=${{ env.REGISTRY }} \
150+
--param imageRegistryPath="${{ env.IMAGE_REGISTRY_PATH }}" \
151+
--param imageRegistryUser="${{ env.IMAGE_REGISTRY_USER }}" \
152+
--param imageRegistryRegions="" \
153+
--param buildPlatforms="linux/amd64,linux/arm64,linux/s390x,linux/ppc64le" \
154+
--param publishPlatforms="linux/amd64,linux/arm64,linux/s390x,linux/ppc64le,windows/amd64" \
155+
--param koExtraArgs="" \
156+
--param serviceAccountPath=release.json \
157+
--param serviceAccountImagesPath=docker-config.json \
158+
--param releaseAsLatest="true" \
159+
--param runTests="false" \
160+
--workspace name=workarea,volumeClaimTemplateFile=workspace-template.yaml \
161+
--workspace name=release-secret,secret=release-secret \
162+
--workspace name=release-images-secret,secret=release-images-secret \
163+
--tasks-timeout 2h \
164+
--pipeline-timeout 3h \
165+
--output name) || {
166+
echo "Failed to start Tekton pipeline!"
167+
exit 1
168+
}
169+
170+
echo "Pipeline started: ${PIPELINE_RUN}"
171+
tkn pipelinerun logs "${PIPELINE_RUN}" -f
172+
173+
# Check if pipeline succeeded
174+
tkn pipelinerun describe "${PIPELINE_RUN}" --output jsonpath='{.status.conditions[?(@.type=="Succeeded")].status}' | grep -q "True" || {
175+
echo "Pipeline failed!"
176+
tkn pipelinerun describe "${PIPELINE_RUN}"
177+
exit 1
178+
}
179+
180+
echo "✅ Pipeline Run completed successfully!"

‎README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,4 +101,4 @@ We are so excited to have you!
101101
- Look at our
102102
[good first issues](https://github.com/tektoncd/pipeline/issues?q=is%3Aissue+is%3Aopen+label%3A%22good+first+issue%22)
103103
and our
104-
[help wanted issues](https://github.com/tektoncd/pipeline/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22)
104+
[help wanted issues](https://github.com/tektoncd/pipeline/issues?q=is%3Aissue+is%3Aopen+label%3A%22help+wanted%22)

‎tekton/README.md

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ consumers of a project. In that case we'll make a patch release. To make one:
4646

4747
## Nightly releases
4848

49+
### Existing approach:
50+
4951
[The nightly release pipeline](release-pipeline.yaml) is
5052
[triggered nightly by Tekton](https://github.com/tektoncd/plumbing/tree/main/tekton).
5153

@@ -207,3 +209,57 @@ The image which we use for this is built from
207209

208210
_[go-containerregistry#383](https://github.com/google/go-containerregistry/issues/383)
209211
is about publishing a `ko` image, which hopefully we'll be able to move it._
212+
213+
### GitHub Action based approach:
214+
215+
The GitHub Actions workflow provides an alternative approach for automated nightly releases with enhanced CI/CD capabilities and better integration with GitHub infrastructure.
216+
217+
[The nightly release workflow](../.github/workflows/nightly-release.yaml) is triggered daily and uses:
218+
219+
- [release-nightly-pipeline.yaml](release-nightly-pipeline.yaml) - Tekton Pipeline for nightly releases
220+
- [publish-nightly.yaml](publish-nightly.yaml) - Tekton Task for building and publishing nightly images
221+
222+
#### Key Features:
223+
224+
**Automated Scheduling:**
225+
- Runs daily at 03:00 UTC via cron schedule
226+
- Supports manual triggering with customizable parameters
227+
- Intelligent change detection - only releases when there are recent commits (configurable)
228+
229+
**Multi-mode Operation:**
230+
- **Production mode**: For `tektoncd/pipeline` repository with full release capabilities
231+
- **Fork mode**: For testing in forks with isolated buckets and registries
232+
233+
#### Usage:
234+
235+
**Scheduled Release:**
236+
The workflow runs automatically every night and will create a release if:
237+
- There have been commits in the last 25 hours, OR
238+
- Force release is enabled, OR
239+
- It's manually triggered
240+
241+
**Manual Release:**
242+
```bash
243+
# Trigger via GitHub UI or CLI
244+
gh workflow run nightly-release.yaml \
245+
--field kubernetes_version=v1.33.0 \
246+
--field force_release=true \
247+
--field dry_run=false
248+
```
249+
250+
**Fork Testing:**
251+
For testing in forks, the workflow automatically:
252+
- Uses a test bucket pattern: `gs://tekton-releases-nightly-{repo-owner}`
253+
- Publishes to `ghcr.io/{owner}/pipeline/*` instead of production registry
254+
- Skips certain production-only validations
255+
256+
#### Output:
257+
258+
The workflow generates:
259+
- Container images tagged with `vYYYYMMDD-{sha7}` format
260+
- Release YAML manifests uploaded to GCS bucket
261+
- Multi-architecture image support
262+
- Comprehensive build logs and artifacts
263+
264+
This approach provides better observability, easier debugging, and more flexible configuration compared to the traditional Tekton-only pipeline approach.
265+

‎tekton/account.yaml

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
apiVersion: v1
2+
kind: ServiceAccount
3+
metadata:
4+
name: release-right-meow
5+
secrets:
6+
- name: release-secret
7+
- name: git-resolver-secret
8+
- name: release-images-secret
9+
10+
---
11+
12+
apiVersion: v1
13+
kind: Secret
14+
metadata:
15+
name: kube-api-secret
16+
annotations:
17+
kubernetes.io/service-account.name: release-right-meow
18+
type: kubernetes.io/service-account-token
19+
20+
---
21+
22+
kind: Role
23+
apiVersion: rbac.authorization.k8s.io/v1
24+
metadata:
25+
name: pipeline-role
26+
rules:
27+
- apiGroups: [""]
28+
resources: ["services", "configmaps", "secrets"]
29+
verbs: ["get", "create", "update", "patch", "list"]
30+
- apiGroups: ["apps"]
31+
resources: ["deployments"]
32+
verbs: ["get", "create", "update", "patch", "list"]
33+
- apiGroups: ["tekton.dev"]
34+
resources: ["pipelines", "pipelineruns", "tasks", "taskruns"]
35+
verbs: ["get", "create", "update", "patch", "list"]
36+
- apiGroups: [""]
37+
resources: ["pods", "pods/log"]
38+
verbs: ["get", "list"]
39+
40+
---
41+
42+
apiVersion: rbac.authorization.k8s.io/v1
43+
kind: RoleBinding
44+
metadata:
45+
name: pipeline-role-binding
46+
roleRef:
47+
apiGroup: rbac.authorization.k8s.io
48+
kind: Role
49+
name: pipeline-role
50+
subjects:
51+
- kind: ServiceAccount
52+
name: release-right-meow

‎tekton/publish.yaml

Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
apiVersion: tekton.dev/v1beta1
1+
apiVersion: tekton.dev/v1
22
kind: Task
33
metadata:
44
name: publish-release
@@ -16,15 +16,15 @@ spec:
1616
description: Extra args to be passed to ko
1717
default: "--preserve-import-paths"
1818
- name: versionTag
19-
description: The vX.Y.Z version that the artifacts should be tagged with (including `v`)
19+
description: The version, vX.Y.Z for stable, vYYYYMMDD-abc1234 for nightly that the artifacts should be tagged with (including `v`).
2020
- name: imageRegistry
2121
description: The target image registry
22-
default: gcr.io
22+
default: ghcr.io
2323
- name: imageRegistryPath
2424
description: The path (project) in the image registry
2525
- name: imageRegistryRegions
2626
description: The target image registry regions
27-
default: "us eu asia"
27+
default: ""
2828
- name: imageRegistryUser
2929
description: Username to be used to login to the container registry
3030
default: "_json_key"
@@ -146,6 +146,9 @@ spec:
146146
#!/usr/bin/env sh
147147
set -ex
148148
149+
# Fix Git ownership issue for the repository directory
150+
git config --global --add safe.directory ${PROJECT_ROOT}
151+
149152
# Use the generated `.ko.yaml`
150153
export KO_CONFIG_PATH=/workspace
151154
cat ${KO_CONFIG_PATH}/.ko.yaml
@@ -198,6 +201,7 @@ spec:
198201
# Rewrite "devel" to params.versionTag
199202
sed -i -e 's/\(pipeline.tekton.dev\/release\): "devel"/\1: "$(params.versionTag)"/g' -e 's/\(app.kubernetes.io\/version\): "devel"/\1: "$(params.versionTag)"/g' -e 's/\(version\): "devel"/\1: "$(params.versionTag)"/g' ${OUTPUT_RELEASE_DIR}/release.yaml
200203
sed -i -e 's/\(pipeline.tekton.dev\/release\): "devel"/\1: "$(params.versionTag)"/g' -e 's/\(app.kubernetes.io\/version\): "devel"/\1: "$(params.versionTag)"/g' -e 's/\(version\): "devel"/\1: "$(params.versionTag)"/g' ${OUTPUT_RELEASE_DIR}/release.notags.yaml
204+
201205
- name: koparse
202206
image: ghcr.io/tektoncd/plumbing/koparse@sha256:1898ef549aaff602d06c049136aaf1c1eacc573846c42bbf42d8dc9258235204
203207
script: |
@@ -273,4 +277,4 @@ spec:
273277
# regional copies of the images in the result - see https://github.com/tektoncd/pipeline/issues/4282
274278
# echo ${REGION}.$IMAGE_WITH_SHA, >> $(results.IMAGES.path)
275279
done
276-
done
280+
done

0 commit comments

Comments
 (0)