From 91aa52c76a1de2c74ba93bb4c5df52a914637a0d Mon Sep 17 00:00:00 2001 From: Guilherme Cassolato Date: Sat, 20 Jun 2026 12:00:13 +0200 Subject: [PATCH 1/2] Use build.yaml for release configuration instead of make/release.mk Replaces the make/release.mk approach with reading configuration from build.yaml. This makes build.yaml the single source of truth for release configuration. Changes: - Adds 'version' and 'authorinoVersion' fields to build.yaml - Makefile reads VERSION, AUTHORINO_VERSION, and CHANNELS from build.yaml if present - Uses simple grep/sed parsing to avoid yq dependency at variable definition time - Removes make/release.mk (no longer needed) - Falls back to defaults (git SHA, 'latest') if build.yaml doesn't exist This allows release branches to automatically use the correct versions from build.yaml for 'make verify-manifests' and 'make verify-bundle' in CI, while dev branches without build.yaml continue to work with default values. Signed-off-by: Guilherme Cassolato --- .github/workflows/build-images-branches.yaml | 47 ++++++++++++++++++-- Makefile | 29 +++++++++++- 2 files changed, 71 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build-images-branches.yaml b/.github/workflows/build-images-branches.yaml index f392880d..92488bb3 100644 --- a/.github/workflows/build-images-branches.yaml +++ b/.github/workflows/build-images-branches.yaml @@ -8,12 +8,53 @@ on: workflow_dispatch: {} jobs: + detect-config: + name: Detect build configuration + runs-on: ubuntu-latest + outputs: + operatorVersion: ${{ steps.config.outputs.operatorVersion }} + authorinoVersion: ${{ steps.config.outputs.authorinoVersion }} + authorinoImage: ${{ steps.config.outputs.authorinoImage }} + channels: ${{ steps.config.outputs.channels }} + defaultChannel: ${{ steps.config.outputs.defaultChannel }} + steps: + - name: Check out code + uses: actions/checkout@v4 + - name: Read configuration from build.yaml + id: config + run: | + BUILD_FILE="build.yaml" + if [ -f "$BUILD_FILE" ]; then + echo "build.yaml found, extracting configuration" + # Read values using grep/sed (same approach as Makefile, with trimming) + OPERATOR_VERSION=$(grep -E '^\s+version:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*version:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//' || echo "0.0.0") + AUTHORINO_VERSION=$(grep -E '^\s+authorinoVersion:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*authorinoVersion:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//' || echo "latest") + AUTHORINO_IMAGE=$(grep -E '^\s+authorinoImage:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*authorinoImage:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//' || echo "quay.io/kuadrant/authorino:latest") + CHANNELS="stable" + DEFAULT_CHANNEL="stable" + else + echo "build.yaml not found, using default values" + OPERATOR_VERSION="0.0.0" + AUTHORINO_VERSION="latest" + AUTHORINO_IMAGE="quay.io/kuadrant/authorino:latest" + CHANNELS="" + DEFAULT_CHANNEL="" + fi + echo "operatorVersion=${OPERATOR_VERSION}" >> $GITHUB_OUTPUT + echo "authorinoVersion=${AUTHORINO_VERSION}" >> $GITHUB_OUTPUT + echo "authorinoImage=${AUTHORINO_IMAGE}" >> $GITHUB_OUTPUT + echo "channels=${CHANNELS}" >> $GITHUB_OUTPUT + echo "defaultChannel=${DEFAULT_CHANNEL}" >> $GITHUB_OUTPUT + build-branches: name: Calls build-images-base workflow + needs: detect-config uses: ./.github/workflows/build-images-base.yaml secrets: inherit with: - operatorVersion: 0.0.0 + operatorVersion: ${{ needs.detect-config.outputs.operatorVersion }} operatorTag: ${{ github.ref_name }} - authorinoVersion: latest - relatedImageAuthorino: quay.io/kuadrant/authorino:latest + authorinoVersion: ${{ needs.detect-config.outputs.authorinoVersion }} + relatedImageAuthorino: ${{ needs.detect-config.outputs.authorinoImage }} + channels: ${{ needs.detect-config.outputs.channels }} + defaultChannel: ${{ needs.detect-config.outputs.defaultChannel }} diff --git a/Makefile b/Makefile index 6aba8baa..75d968e1 100644 --- a/Makefile +++ b/Makefile @@ -21,9 +21,35 @@ LOCALBIN ?= $(shell pwd)/bin $(LOCALBIN): mkdir -p $(LOCALBIN) +# Build configuration file (created by 'make create-build-file' or 'make prepare-release') +BUILD_CONFIG_FILE ?= build.yaml + +# Read release configuration from build.yaml if present +# This allows release branches to define VERSION, AUTHORINO_VERSION, and CHANNELS +# Uses grep/sed for simple YAML parsing without requiring yq at variable definition time +BUILD_CONFIG_VERSION ?= $(shell test -f $(BUILD_CONFIG_FILE) && grep -E '^\s+version:' $(BUILD_CONFIG_FILE) 2>/dev/null | sed -E 's/.*version:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$$//' || echo "") +BUILD_CONFIG_AUTHORINO_VERSION ?= $(shell test -f $(BUILD_CONFIG_FILE) && grep -E '^\s+authorinoVersion:' $(BUILD_CONFIG_FILE) 2>/dev/null | sed -E 's/.*authorinoVersion:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$$//' || echo "") + # VERSION defines the project version for the bundle. +# Priority: command-line > build.yaml > git SHA +VERSION ?= $(BUILD_CONFIG_VERSION) VERSION ?= $(shell git rev-parse HEAD) +# AUTHORINO_VERSION priority: command-line > build.yaml > 'latest' (set below) +ifndef AUTHORINO_VERSION +ifneq ($(BUILD_CONFIG_AUTHORINO_VERSION),) +AUTHORINO_VERSION = $(BUILD_CONFIG_AUTHORINO_VERSION) +endif +endif + +# CHANNELS defaults to stable if build.yaml has a version field, otherwise left undefined +ifndef CHANNELS +ifneq ($(BUILD_CONFIG_VERSION),) +CHANNELS = stable +DEFAULT_CHANNEL = stable +endif +endif + # Address of the container registry DEFAULT_REGISTRY = quay.io REGISTRY ?= $(DEFAULT_REGISTRY) @@ -100,8 +126,7 @@ endif # Container Engine to be used for building image and with kind CONTAINER_ENGINE ?= docker -# Build file used to store replaces/authorinoImage options. -BUILD_CONFIG_FILE ?= build.yaml +# Default and actual Authorino images DEFAULT_AUTHORINO_IMAGE = $(DEFAULT_REGISTRY)/$(DEFAULT_ORG)/authorino:$(AUTHORINO_IMAGE_TAG) ACTUAL_DEFAULT_AUTHORINO_IMAGE ?= $(shell $(YQ) e -e '.config.authorinoImage' $(BUILD_CONFIG_FILE) || echo $(DEFAULT_AUTHORINO_IMAGE)) From 7a17cac2af9a5b5b529256bba0907fe31ae68a33 Mon Sep 17 00:00:00 2001 From: Guilherme Cassolato Date: Sat, 20 Jun 2026 18:57:37 +0200 Subject: [PATCH 2/2] Address CodeRabbit review suggestions - Fix VERSION fallback logic in Makefile to properly fall back to git SHA when build.yaml is missing - Add permissions blocks for least privilege access (contents: read) - Pin actions/checkout to commit SHA (v4.2.2) and disable persist-credentials - Fix fallback logic for missing fields in build.yaml using parameter expansion - Read channels and defaultChannel from build.yaml instead of hardcoding to 'stable' - Replace 'secrets: inherit' with explicit secret mapping (IMG_REGISTRY_USERNAME, IMG_REGISTRY_TOKEN) - Add comment explaining why only registry secrets are passed Signed-off-by: Guilherme Cassolato --- .github/workflows/build-images-branches.yaml | 32 +++++++++++++++----- Makefile | 3 +- 2 files changed, 26 insertions(+), 9 deletions(-) diff --git a/.github/workflows/build-images-branches.yaml b/.github/workflows/build-images-branches.yaml index 92488bb3..6e4731b6 100644 --- a/.github/workflows/build-images-branches.yaml +++ b/.github/workflows/build-images-branches.yaml @@ -7,10 +7,15 @@ on: - "!main" workflow_dispatch: {} +permissions: + contents: read + jobs: detect-config: name: Detect build configuration runs-on: ubuntu-latest + permissions: + contents: read outputs: operatorVersion: ${{ steps.config.outputs.operatorVersion }} authorinoVersion: ${{ steps.config.outputs.authorinoVersion }} @@ -19,7 +24,9 @@ jobs: defaultChannel: ${{ steps.config.outputs.defaultChannel }} steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false - name: Read configuration from build.yaml id: config run: | @@ -27,11 +34,18 @@ jobs: if [ -f "$BUILD_FILE" ]; then echo "build.yaml found, extracting configuration" # Read values using grep/sed (same approach as Makefile, with trimming) - OPERATOR_VERSION=$(grep -E '^\s+version:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*version:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//' || echo "0.0.0") - AUTHORINO_VERSION=$(grep -E '^\s+authorinoVersion:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*authorinoVersion:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//' || echo "latest") - AUTHORINO_IMAGE=$(grep -E '^\s+authorinoImage:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*authorinoImage:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//' || echo "quay.io/kuadrant/authorino:latest") - CHANNELS="stable" - DEFAULT_CHANNEL="stable" + # Use parameter expansion for fallback when fields are missing + OPERATOR_VERSION=$(grep -E '^\s+version:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*version:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//') + AUTHORINO_VERSION=$(grep -E '^\s+authorinoVersion:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*authorinoVersion:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//') + AUTHORINO_IMAGE=$(grep -E '^\s+authorinoImage:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*authorinoImage:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//') + CHANNELS=$(grep -E '^\s+channels:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*channels:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//') + DEFAULT_CHANNEL=$(grep -E '^\s+defaultChannel:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*defaultChannel:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//') + # Apply fallbacks for empty values + OPERATOR_VERSION=${OPERATOR_VERSION:-0.0.0} + AUTHORINO_VERSION=${AUTHORINO_VERSION:-latest} + AUTHORINO_IMAGE=${AUTHORINO_IMAGE:-quay.io/kuadrant/authorino:latest} + CHANNELS=${CHANNELS:-stable} + DEFAULT_CHANNEL=${DEFAULT_CHANNEL:-stable} else echo "build.yaml not found, using default values" OPERATOR_VERSION="0.0.0" @@ -50,7 +64,11 @@ jobs: name: Calls build-images-base workflow needs: detect-config uses: ./.github/workflows/build-images-base.yaml - secrets: inherit + # Only pass secrets actually required by build-images-base.yaml (principle of least privilege) + # These are used for docker login to push images to the container registry + secrets: + IMG_REGISTRY_USERNAME: ${{ secrets.IMG_REGISTRY_USERNAME }} + IMG_REGISTRY_TOKEN: ${{ secrets.IMG_REGISTRY_TOKEN }} with: operatorVersion: ${{ needs.detect-config.outputs.operatorVersion }} operatorTag: ${{ github.ref_name }} diff --git a/Makefile b/Makefile index 75d968e1..ae86b69c 100644 --- a/Makefile +++ b/Makefile @@ -32,8 +32,7 @@ BUILD_CONFIG_AUTHORINO_VERSION ?= $(shell test -f $(BUILD_CONFIG_FILE) && grep - # VERSION defines the project version for the bundle. # Priority: command-line > build.yaml > git SHA -VERSION ?= $(BUILD_CONFIG_VERSION) -VERSION ?= $(shell git rev-parse HEAD) +VERSION ?= $(if $(strip $(BUILD_CONFIG_VERSION)),$(BUILD_CONFIG_VERSION),$(shell git rev-parse HEAD)) # AUTHORINO_VERSION priority: command-line > build.yaml > 'latest' (set below) ifndef AUTHORINO_VERSION