"failed to push ghcr.io/..." on PR #31

0xE282B0 · 2023-10-13T12:02:06Z

When opening a PR the pipeline fails to push to GitHub container registry due to missing permissions. Either fix permissions or avoid pushing images on PRs.

#30 ERROR: failed to push ghcr.io/kwasm/kwasm-operator:pr-30: unexpected status from POST request to https://ghcr.io/v2/kwasm/kwasm-operator/blobs/uploads/: 403 Forbidden
------
 > exporting to image:
------
ERROR: failed to solve: failed to push ghcr.io/kwasm/kwasm-operator:pr-30: unexpected status from POST request to https://ghcr.io/v2/kwasm/kwasm-operator/blobs/uploads/: 403 Forbidden
Error: buildx failed with: ERROR: failed to solve: failed to push ghcr.io/kwasm/kwasm-operator:pr-30: unexpected status from POST request to https://ghcr.io/v2/kwasm/kwasm-operator/blobs/uploads/: 403 Forbidden

This commit brings new automation via new GitHub actions. Testing ======= Unit and function tests, plus linters are now run on PR and each change done to the `main` branch. Container image building ============================ The container image will be built only from the contents of the `main` branch or with the contents referenced by a tag that follows the `v*` naming convention. Prior to this commit, images were built also for PR branches, which caused issues like KWasm#31 The following tags are going to be used: - `latest`: rolling tag pointing to `main` - `v<version>`: a tagged release of the operator Prior to this change the stable releases had a really long (and a bit strange) tag: `:kwasm-operator-<version>`. SBOM generation =============== As part of the release process, SBOM files are generated for the container images (x86_64, arm64). The SBOM files are generated using syft. Cosign integration ================== Each artifact produced by the automation pipeline (container images, SBOM files) are now signed by cosign. Signing is done using Sigstore's keyless mode. Changelog generation ==================== Release drafter is now used to automatically build a changelog of the upcoming release. The changelog is built by looking at the commits subjects. As a result of that, it would be great to have all the contributions follow git semantic commits guidelines. We should probably document that into the contribution guidelines. GitHub Release ============== A GitHub release will be created whenever a `v*` tag is pushed. The name of the GitHub Release will be `v<version>`. The GitHub release will contain the information generated by the `release-drafter` action. The release will also feature several artifacts like the SBOMs and the signatures of the container images (+ SBOMS). These can be used by end users to verify the integrity of all the assets we produce inside of our release pipeline. Prior to this commit, no GitHub Release was created for the operator itself. There was just one release for the helm chart. Helm chart release ================== When the contents of the `charts/` directory are changed, the GitHub action will create a new GitHub release called `kwasm-operator-chart-<version>`. This is done to differentiate it from the GitHub Release of the operator. The action creates also a git tag named `kwasm-operator-chart-<version>`. Before this tag was named `kwasm-operator-<version>`. Signed-off-by: Flavio Castelli <[email protected]>

This commit brings new automation via new GitHub actions. Important: all the GitHub actions are now referenced by their shasum. This provides a better security posture. Next to the shasum, there's a comment stating the "human" tag of the action. Dependabot can keep both information (shasum, human tag) in sync. Testing ======= Unit and function tests, plus linters are now run on PR and each change done to the `main` branch. Container image building ============================ The container image will be built only from the contents of the `main` branch or with the contents referenced by a tag that follows the `v*` naming convention. Prior to this commit, images were built also for PR branches, which caused issues like KWasm#31 The following tags are going to be used: - `latest`: rolling tag pointing to `main` - `v<version>`: a tagged release of the operator Prior to this change the stable releases had a really long (and a bit strange) tag: `:kwasm-operator-<version>`. SBOM generation =============== As part of the release process, SBOM files are generated for the container images (x86_64, arm64). The SBOM files are generated using syft. Cosign integration ================== Each artifact produced by the automation pipeline (container images, SBOM files) are now signed by cosign. Signing is done using Sigstore's keyless mode. Changelog generation ==================== Release drafter is now used to automatically build a changelog of the upcoming release. The changelog is built by looking at the commits subjects. As a result of that, it would be great to have all the contributions follow git semantic commits guidelines. We should probably document that into the contribution guidelines. GitHub Release ============== A GitHub release will be created whenever a `v*` tag is pushed. The name of the GitHub Release will be `v<version>`. The GitHub release will contain the information generated by the `release-drafter` action. The release will also feature several artifacts like the SBOMs and the signatures of the container images (+ SBOMS). These can be used by end users to verify the integrity of all the assets we produce inside of our release pipeline. Prior to this commit, no GitHub Release was created for the operator itself. There was just one release for the helm chart. Helm chart release ================== When the contents of the `charts/` directory are changed, the GitHub action will create a new GitHub release called `kwasm-operator-chart-<version>`. This is done to differentiate it from the GitHub Release of the operator. The action creates also a git tag named `kwasm-operator-chart-<version>`. Before this tag was named `kwasm-operator-<version>`. Signed-off-by: Flavio Castelli <[email protected]>

* fix: ensure `make test` can be run Prior to this commit, `make test` would fail because one of the Makefile targets was invoking `./bin/controller-gen` with the wrong arguments. To fix the `controller-gen` invocation, the empty `config/crd/bases` directory had to be added. Finally, the invocation of `controller-gen` has been changed to reflect the one generated by latest version of kube-builder. Signed-off-by: Flavio Castelli <[email protected]> * test: fix integration tests Ensure all the tests are passing Signed-off-by: Flavio Castelli <[email protected]> * chore(deps): update to latest stable version of Go Upgrade to Go 1.21 Signed-off-by: Flavio Castelli <[email protected]> * test: make use of golangci Introduce golangci linter Signed-off-by: Flavio Castelli <[email protected]> * fix: address golangci warnings Address the warnings reported by golangci Signed-off-by: Flavio Castelli <[email protected]> * automation: provide multiple actions This commit brings new automation via new GitHub actions. Important: all the GitHub actions are now referenced by their shasum. This provides a better security posture. Next to the shasum, there's a comment stating the "human" tag of the action. Dependabot can keep both information (shasum, human tag) in sync. Testing ======= Unit and function tests, plus linters are now run on PR and each change done to the `main` branch. Container image building ============================ The container image will be built only from the contents of the `main` branch or with the contents referenced by a tag that follows the `v*` naming convention. Prior to this commit, images were built also for PR branches, which caused issues like #31 The following tags are going to be used: - `latest`: rolling tag pointing to `main` - `v<version>`: a tagged release of the operator Prior to this change the stable releases had a really long (and a bit strange) tag: `:kwasm-operator-<version>`. SBOM generation =============== As part of the release process, SBOM files are generated for the container images (x86_64, arm64). The SBOM files are generated using syft. Cosign integration ================== Each artifact produced by the automation pipeline (container images, SBOM files) are now signed by cosign. Signing is done using Sigstore's keyless mode. Changelog generation ==================== Release drafter is now used to automatically build a changelog of the upcoming release. The changelog is built by looking at the commits subjects. As a result of that, it would be great to have all the contributions follow git semantic commits guidelines. We should probably document that into the contribution guidelines. GitHub Release ============== A GitHub release will be created whenever a `v*` tag is pushed. The name of the GitHub Release will be `v<version>`. The GitHub release will contain the information generated by the `release-drafter` action. The release will also feature several artifacts like the SBOMs and the signatures of the container images (+ SBOMS). These can be used by end users to verify the integrity of all the assets we produce inside of our release pipeline. Prior to this commit, no GitHub Release was created for the operator itself. There was just one release for the helm chart. Helm chart release ================== When the contents of the `charts/` directory are changed, the GitHub action will create a new GitHub release called `kwasm-operator-chart-<version>`. This is done to differentiate it from the GitHub Release of the operator. The action creates also a git tag named `kwasm-operator-chart-<version>`. Before this tag was named `kwasm-operator-<version>`. Signed-off-by: Flavio Castelli <[email protected]> * automation: fix dependabot configuration dependabot configuration had an error which prevented its usage. Now we track Docker, Go and GitHub Actions updates. Signed-off-by: Flavio Castelli <[email protected]> --------- Signed-off-by: Flavio Castelli <[email protected]>

0xE282B0 · 2023-12-04T21:17:35Z

Closed by #33

* fix: ensure `make test` can be run Prior to this commit, `make test` would fail because one of the Makefile targets was invoking `./bin/controller-gen` with the wrong arguments. To fix the `controller-gen` invocation, the empty `config/crd/bases` directory had to be added. Finally, the invocation of `controller-gen` has been changed to reflect the one generated by latest version of kube-builder. Signed-off-by: Flavio Castelli <[email protected]> * test: fix integration tests Ensure all the tests are passing Signed-off-by: Flavio Castelli <[email protected]> * chore(deps): update to latest stable version of Go Upgrade to Go 1.21 Signed-off-by: Flavio Castelli <[email protected]> * test: make use of golangci Introduce golangci linter Signed-off-by: Flavio Castelli <[email protected]> * fix: address golangci warnings Address the warnings reported by golangci Signed-off-by: Flavio Castelli <[email protected]> * automation: provide multiple actions This commit brings new automation via new GitHub actions. Important: all the GitHub actions are now referenced by their shasum. This provides a better security posture. Next to the shasum, there's a comment stating the "human" tag of the action. Dependabot can keep both information (shasum, human tag) in sync. Testing ======= Unit and function tests, plus linters are now run on PR and each change done to the `main` branch. Container image building ============================ The container image will be built only from the contents of the `main` branch or with the contents referenced by a tag that follows the `v*` naming convention. Prior to this commit, images were built also for PR branches, which caused issues like KWasm/kwasm-operator#31 The following tags are going to be used: - `latest`: rolling tag pointing to `main` - `v<version>`: a tagged release of the operator Prior to this change the stable releases had a really long (and a bit strange) tag: `:kwasm-operator-<version>`. SBOM generation =============== As part of the release process, SBOM files are generated for the container images (x86_64, arm64). The SBOM files are generated using syft. Cosign integration ================== Each artifact produced by the automation pipeline (container images, SBOM files) are now signed by cosign. Signing is done using Sigstore's keyless mode. Changelog generation ==================== Release drafter is now used to automatically build a changelog of the upcoming release. The changelog is built by looking at the commits subjects. As a result of that, it would be great to have all the contributions follow git semantic commits guidelines. We should probably document that into the contribution guidelines. GitHub Release ============== A GitHub release will be created whenever a `v*` tag is pushed. The name of the GitHub Release will be `v<version>`. The GitHub release will contain the information generated by the `release-drafter` action. The release will also feature several artifacts like the SBOMs and the signatures of the container images (+ SBOMS). These can be used by end users to verify the integrity of all the assets we produce inside of our release pipeline. Prior to this commit, no GitHub Release was created for the operator itself. There was just one release for the helm chart. Helm chart release ================== When the contents of the `charts/` directory are changed, the GitHub action will create a new GitHub release called `kwasm-operator-chart-<version>`. This is done to differentiate it from the GitHub Release of the operator. The action creates also a git tag named `kwasm-operator-chart-<version>`. Before this tag was named `kwasm-operator-<version>`. Signed-off-by: Flavio Castelli <[email protected]> * automation: fix dependabot configuration dependabot configuration had an error which prevented its usage. Now we track Docker, Go and GitHub Actions updates. Signed-off-by: Flavio Castelli <[email protected]> --------- Signed-off-by: Flavio Castelli <[email protected]>

flavio mentioned this issue Nov 28, 2023

Improve automation #33

Merged

0xE282B0 closed this as completed Dec 4, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

"failed to push ghcr.io/..." on PR #31

"failed to push ghcr.io/..." on PR #31

0xE282B0 commented Oct 13, 2023

0xE282B0 commented Dec 4, 2023

"failed to push ghcr.io/..." on PR #31

"failed to push ghcr.io/..." on PR #31

Comments

0xE282B0 commented Oct 13, 2023

0xE282B0 commented Dec 4, 2023