cloudflare/cloudflared
Publicmirrored from https://github.com/cloudflare/cloudflaredAvailable
.ci/release.gitlab-ci.yml
133lines · modecode
| 1 | include: |
| 2 | - local: .ci/commons.gitlab-ci.yml |
| 3 | |
| 4 | ###################################### |
| 5 | ### Build and Push DockerHub Image ### |
| 6 | ###################################### |
| 7 | - component: $CI_SERVER_FQDN/cloudflare/ci/docker-image/build-push-image@~latest |
| 8 | inputs: |
| 9 | stage: release |
| 10 | jobPrefix: docker-hub |
| 11 | runOnMR: false |
| 12 | runOnBranches: '^master$' |
| 13 | runOnChangesTo: ['RELEASE_NOTES'] |
| 14 | needs: |
| 15 | - generate-version-file |
| 16 | - release-cloudflared-to-r2 |
| 17 | commentImageRefs: false |
| 18 | runner: vm-linux-x86-4cpu-8gb |
| 19 | # Based on if the CI reference is protected or not the CI component will |
| 20 | # either use _BRANCH or _PROD, therefore, to prevent the pipelines from failing |
| 21 | # we simply set both to the same value. |
| 22 | DOCKER_USER_BRANCH: &docker-hub-user svcgithubdockerhubcloudflar045 |
| 23 | DOCKER_PASSWORD_BRANCH: &docker-hub-password gitlab/cloudflare/tun/cloudflared/_dev/dockerhub/svc_password/data |
| 24 | DOCKER_USER_PROD: *docker-hub-user |
| 25 | DOCKER_PASSWORD_PROD: *docker-hub-password |
| 26 | EXTRA_DIB_ARGS: --overwrite |
| 27 | |
| 28 | .default-release-job: &release-job-defaults |
| 29 | stage: release |
| 30 | image: $BUILD_IMAGE |
| 31 | cache: |
| 32 | paths: |
| 33 | - .cache/pip |
| 34 | variables: &release-job-variables |
| 35 | PIP_CACHE_DIR: "$CI_PROJECT_DIR/.cache/pip" |
| 36 | # KV Vars |
| 37 | KV_NAMESPACE: 380e19aa04314648949b6ad841417ebe |
| 38 | KV_ACCOUNT: &cf-account 5ab4e9dfbd435d24068829fda0077963 |
| 39 | # R2 Vars |
| 40 | R2_BUCKET: cloudflared-pkgs |
| 41 | R2_ACCOUNT_ID: *cf-account |
| 42 | # APT and RPM Repository Vars |
| 43 | GPG_PUBLIC_KEY_URL: "https://pkg.cloudflare.com/cloudflare-ascii-pubkey.gpg" |
| 44 | PKG_URL: "https://pkg.cloudflare.com/cloudflared" |
| 45 | BINARY_NAME: cloudflared |
| 46 | secrets: |
| 47 | KV_API_TOKEN: |
| 48 | vault: gitlab/cloudflare/tun/cloudflared/_dev/cfd_kv_api_token/data@kv |
| 49 | file: false |
| 50 | API_KEY: |
| 51 | vault: gitlab/cloudflare/tun/cloudflared/_dev/cfd_github_api_key/data@kv |
| 52 | file: false |
| 53 | R2_CLIENT_ID: |
| 54 | vault: gitlab/cloudflare/tun/cloudflared/_dev/_terraform_atlantis/r2_api_token/client_id@kv |
| 55 | file: false |
| 56 | R2_CLIENT_SECRET: |
| 57 | vault: gitlab/cloudflare/tun/cloudflared/_dev/_terraform_atlantis/r2_api_token/client_secret@kv |
| 58 | file: false |
| 59 | LINUX_SIGNING_PUBLIC_KEY: |
| 60 | vault: gitlab/cloudflare/tun/cloudflared/_dev/gpg_v1/public_key@kv |
| 61 | file: false |
| 62 | LINUX_SIGNING_PRIVATE_KEY: |
| 63 | vault: gitlab/cloudflare/tun/cloudflared/_dev/gpg_v1/private_key@kv |
| 64 | file: false |
| 65 | LINUX_SIGNING_PUBLIC_KEY_2: |
| 66 | vault: gitlab/cloudflare/tun/cloudflared/_dev/gpg_v2/public_key@kv |
| 67 | file: false |
| 68 | LINUX_SIGNING_PRIVATE_KEY_2: |
| 69 | vault: gitlab/cloudflare/tun/cloudflared/_dev/gpg_v2/private_key@kv |
| 70 | file: false |
| 71 | |
| 72 | ########################################### |
| 73 | ### Push Cloudflared Binaries to Github ### |
| 74 | ########################################### |
| 75 | release-cloudflared-to-github: |
| 76 | <<: *release-job-defaults |
| 77 | rules: |
| 78 | - !reference [.default-rules, run-on-release] |
| 79 | needs: |
| 80 | - ci-image-get-image-ref |
| 81 | - linux-packaging |
| 82 | - linux-packaging-fips |
| 83 | - macos-build-and-sign-cloudflared |
| 84 | - windows-package-sign |
| 85 | script: |
| 86 | - ./.ci/scripts/release-target.sh github-release |
| 87 | |
| 88 | ######################################### |
| 89 | ### Upload Cloudflared Binaries to R2 ### |
| 90 | ######################################### |
| 91 | release-cloudflared-to-r2: |
| 92 | <<: *release-job-defaults |
| 93 | rules: |
| 94 | - !reference [.default-rules, run-on-release] |
| 95 | needs: |
| 96 | - ci-image-get-image-ref |
| 97 | - linux-packaging # We only release non-FIPS binaries to R2 |
| 98 | - release-cloudflared-to-github |
| 99 | script: |
| 100 | - ./.ci/scripts/release-target.sh r2-linux-release |
| 101 | |
| 102 | ################################################# |
| 103 | ### Upload Cloudflared Nightly Binaries to R2 ### |
| 104 | ################################################# |
| 105 | release-cloudflared-nightly-to-r2: |
| 106 | <<: *release-job-defaults |
| 107 | rules: |
| 108 | - !reference [.default-rules, run-on-master] |
| 109 | variables: |
| 110 | <<: *release-job-variables |
| 111 | R2_BUCKET: cloudflared-pkgs-next |
| 112 | GPG_PUBLIC_KEY_URL: "https://next.pkg.cloudflare.com/cloudflare-ascii-pubkey.gpg" |
| 113 | PKG_URL: "https://next.pkg.cloudflare.com/cloudflared" |
| 114 | needs: |
| 115 | - ci-image-get-image-ref |
| 116 | - linux-packaging # We only release non-FIPS binaries to R2 |
| 117 | script: |
| 118 | - ./.ci/scripts/release-target.sh r2-linux-release |
| 119 | |
| 120 | ############################# |
| 121 | ### Generate Version File ### |
| 122 | ############################# |
| 123 | generate-version-file: |
| 124 | <<: *release-job-defaults |
| 125 | rules: |
| 126 | - !reference [.default-rules, run-on-release] |
| 127 | needs: |
| 128 | - ci-image-get-image-ref |
| 129 | script: |
| 130 | - make generate-docker-version |
| 131 | artifacts: |
| 132 | paths: |
| 133 | - versions |
| 134 | |