Skip to content

Use build.yaml for release configuration in CI workflows #325

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
guicassolato wants to merge 2 commits into
base: main
Choose a base branch
from
+90 −7
Open

Use build.yaml for release configuration in CI workflows #325

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
91aa52c
Use build.yaml for release configuration instead of make/release.mk
guicassolato Jun 20, 2026
7a17cac
Address CodeRabbit review suggestions
guicassolato Jun 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
67 changes: 63 additions & 4 deletions .github/workflows/build-images-branches.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,13 +7,72 @@ on:
- "!main"
workflow_dispatch: {}

permissions:
contents: read

jobs:
detect-config:
name: Detect build configuration
runs-on: ubuntu-latest
Comment thread
coderabbitai[bot] marked this conversation as resolved.
permissions:
contents: read
outputs:
operatorVersion: ${{ steps.config.outputs.operatorVersion }}
authorinoVersion: ${{ steps.config.outputs.authorinoVersion }}
authorinoImage: ${{ steps.config.outputs.authorinoImage }}
channels: ${{ steps.config.outputs.channels }}
defaultChannel: ${{ steps.config.outputs.defaultChannel }}
steps:
- name: Check out code
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
persist-credentials: false
- name: Read configuration from build.yaml
id: config
run: |
BUILD_FILE="build.yaml"
if [ -f "$BUILD_FILE" ]; then
echo "build.yaml found, extracting configuration"
# Read values using grep/sed (same approach as Makefile, with trimming)
# Use parameter expansion for fallback when fields are missing
OPERATOR_VERSION=$(grep -E '^\s+version:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*version:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//')
AUTHORINO_VERSION=$(grep -E '^\s+authorinoVersion:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*authorinoVersion:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//')
AUTHORINO_IMAGE=$(grep -E '^\s+authorinoImage:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*authorinoImage:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//')
CHANNELS=$(grep -E '^\s+channels:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*channels:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//')
DEFAULT_CHANNEL=$(grep -E '^\s+defaultChannel:' "$BUILD_FILE" 2>/dev/null | sed -E 's/.*defaultChannel:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$//')
# Apply fallbacks for empty values
OPERATOR_VERSION=${OPERATOR_VERSION:-0.0.0}
AUTHORINO_VERSION=${AUTHORINO_VERSION:-latest}
AUTHORINO_IMAGE=${AUTHORINO_IMAGE:-quay.io/kuadrant/authorino:latest}
CHANNELS=${CHANNELS:-stable}
DEFAULT_CHANNEL=${DEFAULT_CHANNEL:-stable}
else
echo "build.yaml not found, using default values"
OPERATOR_VERSION="0.0.0"
AUTHORINO_VERSION="latest"
AUTHORINO_IMAGE="quay.io/kuadrant/authorino:latest"
CHANNELS=""
DEFAULT_CHANNEL=""
fi
echo "operatorVersion=${OPERATOR_VERSION}" >> $GITHUB_OUTPUT
echo "authorinoVersion=${AUTHORINO_VERSION}" >> $GITHUB_OUTPUT
echo "authorinoImage=${AUTHORINO_IMAGE}" >> $GITHUB_OUTPUT
echo "channels=${CHANNELS}" >> $GITHUB_OUTPUT
echo "defaultChannel=${DEFAULT_CHANNEL}" >> $GITHUB_OUTPUT

build-branches:
name: Calls build-images-base workflow
needs: detect-config
uses: ./.github/workflows/build-images-base.yaml
secrets: inherit
# Only pass secrets actually required by build-images-base.yaml (principle of least privilege)
# These are used for docker login to push images to the container registry
secrets:
IMG_REGISTRY_USERNAME: ${{ secrets.IMG_REGISTRY_USERNAME }}
IMG_REGISTRY_TOKEN: ${{ secrets.IMG_REGISTRY_TOKEN }}
Comment on lines +69 to +71

@coderabbitai coderabbitai Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Checking reusable workflow secret declarations..."
fd -a "build-images-base.yaml" .github/workflows --exec sed -n '1,220p' {}

echo
echo "Looking for workflow_call secret declarations..."
rg -n -C3 'workflow_call|secrets:|IMG_REGISTRY_USERNAME|IMG_REGISTRY_TOKEN' .github/workflows/build-images-base.yaml

Repository: Kuadrant/authorino-operator

Length of output: 9680

Reusable-workflow secret contract is broken.

The build-images-base.yaml workflow uses IMG_REGISTRY_USERNAME and IMG_REGISTRY_TOKEN secrets in its jobs, but does not declare them under on.workflow_call.secrets. When the caller passes these secrets (lines 69–71), the workflow will fail validation or at runtime.

Add the following to build-images-base.yaml under on.workflow_call:

Suggested fix 
on:
  workflow_call:
    inputs:
      # ... existing inputs ...
    secrets:
      IMG_REGISTRY_USERNAME:
        required: true
      IMG_REGISTRY_TOKEN:
        required: true
🧰 Tools
🪛 actionlint (1.7.12)

[error] 70-70: secret "IMG_REGISTRY_USERNAME" is not defined in "./.github/workflows/build-images-base.yaml" reusable workflow. no secret is defined

(workflow-call)

[error] 71-71: secret "IMG_REGISTRY_TOKEN" is not defined in "./.github/workflows/build-images-base.yaml" reusable workflow. no secret is defined

(workflow-call)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/build-images-branches.yaml around lines 69 - 71, The
reusable workflow build-images-base.yaml is missing the secret declarations for
IMG_REGISTRY_USERNAME and IMG_REGISTRY_TOKEN that are being passed from
build-images-branches.yaml. Add a secrets section under on.workflow_call in
build-images-base.yaml that declares both IMG_REGISTRY_USERNAME and
IMG_REGISTRY_TOKEN, marking each as required: true, so the workflow properly
validates and accepts these secrets from the caller.

Source: Linters/SAST tools

with:
operatorVersion: 0.0.0
operatorVersion: ${{ needs.detect-config.outputs.operatorVersion }}
operatorTag: ${{ github.ref_name }}
authorinoVersion: latest
relatedImageAuthorino: quay.io/kuadrant/authorino:latest
authorinoVersion: ${{ needs.detect-config.outputs.authorinoVersion }}
relatedImageAuthorino: ${{ needs.detect-config.outputs.authorinoImage }}
channels: ${{ needs.detect-config.outputs.channels }}
defaultChannel: ${{ needs.detect-config.outputs.defaultChannel }}
30 changes: 27 additions & 3 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,33 @@ LOCALBIN ?= $(shell pwd)/bin
$(LOCALBIN):
mkdir -p $(LOCALBIN)

# Build configuration file (created by 'make create-build-file' or 'make prepare-release')
BUILD_CONFIG_FILE ?= build.yaml

# Read release configuration from build.yaml if present
# This allows release branches to define VERSION, AUTHORINO_VERSION, and CHANNELS
# Uses grep/sed for simple YAML parsing without requiring yq at variable definition time
BUILD_CONFIG_VERSION ?= $(shell test -f $(BUILD_CONFIG_FILE) && grep -E '^\s+version:' $(BUILD_CONFIG_FILE) 2>/dev/null | sed -E 's/.*version:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$$//' || echo "")
BUILD_CONFIG_AUTHORINO_VERSION ?= $(shell test -f $(BUILD_CONFIG_FILE) && grep -E '^\s+authorinoVersion:' $(BUILD_CONFIG_FILE) 2>/dev/null | sed -E 's/.*authorinoVersion:\s*//;s/^[[:space:]]+//;s/[[:space:]]+$$//' || echo "")

# VERSION defines the project version for the bundle.
VERSION ?= $(shell git rev-parse HEAD)
# Priority: command-line > build.yaml > git SHA
VERSION ?= $(if $(strip $(BUILD_CONFIG_VERSION)),$(BUILD_CONFIG_VERSION),$(shell git rev-parse HEAD))

# AUTHORINO_VERSION priority: command-line > build.yaml > 'latest' (set below)
ifndef AUTHORINO_VERSION
ifneq ($(BUILD_CONFIG_AUTHORINO_VERSION),)
AUTHORINO_VERSION = $(BUILD_CONFIG_AUTHORINO_VERSION)
endif
endif

# CHANNELS defaults to stable if build.yaml has a version field, otherwise left undefined
ifndef CHANNELS
ifneq ($(BUILD_CONFIG_VERSION),)
CHANNELS = stable
DEFAULT_CHANNEL = stable
endif
endif

# Address of the container registry
DEFAULT_REGISTRY = quay.io
Expand Down Expand Up @@ -100,8 +125,7 @@ endif
# Container Engine to be used for building image and with kind
CONTAINER_ENGINE ?= docker

# Build file used to store replaces/authorinoImage options.
BUILD_CONFIG_FILE ?= build.yaml
# Default and actual Authorino images
DEFAULT_AUTHORINO_IMAGE = $(DEFAULT_REGISTRY)/$(DEFAULT_ORG)/authorino:$(AUTHORINO_IMAGE_TAG)
ACTUAL_DEFAULT_AUTHORINO_IMAGE ?= $(shell $(YQ) e -e '.config.authorinoImage' $(BUILD_CONFIG_FILE) || echo $(DEFAULT_AUTHORINO_IMAGE))

Expand Down
Loading