👷 ci: PR autotagging, CHANGELOG autoupdate, goreleaser

.github/actions/start_ccm_e2e/action.yml

@@ -32,7 +32,7 @@ runs:
   using: "composite"
   steps:
     - name: ⬇️ Checkout CAPOSC
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         repository: 'outscale/cluster-api-provider-outscale'
         path: "cluster-api-provider-outscale"

.github/workflows/auto-changelog.yaml

@@ -0,0 +1,22 @@
+name: 📝 Changelog
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+    steps:
+      - name: ⬇️ Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: 📝 Changelog
+        uses: outscale/.github/post-release@dfa747ea77f97fdc5a0bf745e4933a8d68631f89 # v1.1.2
+        with:
+          changelog: docs/CHANGELOG.md

.github/workflows/build.yml

@@ -26,7 +26,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: ⬇️ Checkout repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
     - name: 🔎 Docker Lint
       run: bash -c "make dockerlint"
     - name: 🔎 golangci-lint
@@ -36,8 +38,6 @@ jobs:
       shell: bash
     - name: Test
       run: bash -c "make test"
-    - name: Image
-      run: bash -c "make build-image"
     - name: 🔎 Check docs
       run: bash -c "make check-helm-docs"
     - name: 🔎 Check manifest

.github/workflows/codeql.yml

@@ -28,7 +28,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4

.github/workflows/compliance.yml

@@ -13,6 +13,6 @@ jobs:
     steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
     - name: Plumber
-      uses: outscale/.github/pipeline-compliance@d1bf523f2ce3fccb0784dfd03ca3cd5e0b906be8 # main
+      uses: outscale/.github/pipeline-compliance@7c476168e128fc5886b1019a61964f45e42e2452 # v1.1.1
       with:
         github-token: ${{ secrets.PLUMBER_TOKEN }}

.github/workflows/e2e_test.yml

@@ -26,35 +26,51 @@ jobs:
     runs-on: [self-hosted, linux]
     steps:
     - name: ⬇️ Checkout
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
     - name: ⬇️ Install kubectl
-      uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5
+      uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5.1.0
       with:
-        version: v1.34.2
+        version: v1.34.9
     - name: ⬇️ Install Helm
-      uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
+      uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
     - name: ⬇️ Install Python
       uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
     - name: ⬇️ Install Go
       uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version-file: 'go.mod'
+    - name: ⬇️ Set up Docker Buildx
+      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
     - name: 🔐 Set AK/SK name based on runner region
       run: .github/scripts/runneraksk.sh
     - name: 🧹 Frieza
-      uses: outscale/frieza-github-actions/frieza-clean@68ffd39d7e181f3548369e332242b329b04a3182 # master
+      uses: outscale/frieza-github-actions/frieza-clean@1d8b83bc64d2230a0c3bc9f018ba6c0c67df98e8 # v0.15.0+hotfix.0
       with:
         access_key: ${{ secrets[env.OSC_ACCESS_KEY_NAME] }}
         secret_key: ${{ secrets[env.OSC_SECRET_KEY_NAME] }}
         region: ${{ env.OSC_REGION }}
         exclude_resource_types: access_key
-    - name: 📦 Build and push Docker image
+    - name: 🐳 Login to Harbor
+      uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+      with:
+        registry: ${{ vars.REGISTRY }}
+        username: admin
+        password: ${{ secrets.HARBOR_ADMIN_PASSWORD }}
+    - name: 📦 Run GoReleaser
+      uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+      with:
+        version: 'v2.15.4'
+        args: release --clean --snapshot
+    - name: 📦 Push the Docker image
       run: |
-        docker login ${{ vars.REGISTRY }} -u admin -p ${{ secrets.HARBOR_ADMIN_PASSWORD }}
-        make buildx-image image-tag image-push
+        make image-tag image-push
       env:
-        REGISTRY_IMAGE: ${{ vars.REGISTRY }}/outscale/cloud-provider-osc
-        VERSION: ${{ format('{0}.{1}', github.sha, github.run_attempt) }}
+        IMAGE: "outscale/cloud-provider-osc"
+        IMAGE_TAG: "${{ github.sha }}-amd64"
+        REGISTRY_IMAGE: "${{ vars.REGISTRY }}/outscale/cloud-provider-osc"
+        REGISTRY_TAG: ${{ github.sha }}
     ## Create VPC Cluster
     - name: 🧪 Test on VPC cluster
       uses: ./.github/actions/start_ccm_e2e
@@ -66,5 +82,5 @@ jobs:
         oks_secret_key: ${{ secrets.OKS_SECRET_KEY }}
         oks_region: ${{ vars.OKS_REGION }}
         image_name: ${{ vars.OMI_NAME }}
-        version: ${{ format('{0}.{1}', github.sha, github.run_attempt) }}
+        version: ${{ github.sha }}
         registry: ${{ vars.REGISTRY }}

.github/workflows/pr-auto-tagging.yaml

@@ -0,0 +1,18 @@
+name: 🔖 PR autotagging
+
+on:
+  pull_request: null
+
+jobs:
+  autotagging:
+    permissions:
+      contents: read
+      pull-requests: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: ⬇️ Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: 🔖 Tag PR
+        uses: outscale/.github/auto-tagging@dfa747ea77f97fdc5a0bf745e4933a8d68631f89 # v1.1.2

.github/workflows/release-helm.yml

@@ -4,8 +4,8 @@ on:
   push:
     tags:
     - 'v*'
-  workflow_dispatch:  
-    
+  workflow_dispatch:
+
 permissions:
   contents: write
 
@@ -15,27 +15,27 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          fetch-depth: 0
-      - name: Get changelog for release
-        id: changelog
-        uses: mindsers/changelog-reader-action@32aa5b4c155d76c94e4ec883a223c947b2f02656 # v2
+          persist-credentials: false
+      - name: ⬇️ Install helm
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
-          path: "docs/CHANGELOG.md"
-          version: ${{ github.ref_name }}
-      - uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5
+          version: v3.21.1
+      - name: 📦 Run GoReleaser
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
-          version: v3.18.3
-      - name : Create Helm-package
-        run: make helm-package
-      - name: Create Release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
-        if: startsWith(github.ref, 'refs/tags/')
+          version: 'v2.15.4'
+          args: release --clean --config .goreleaser-helm.yaml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: 🐳 Login to Docker Hub
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
-          tag_name: ${{ github.ref_name }}
-          name: Helm Release ${{ github.ref_name }}
-          draft: true
-          prerelease: false
-          body: ${{ steps.changelog.outputs.changes }}
-          files: out-helm/*
+          username: ${{secrets.DOCKER_USER_HELM}}
+          password: ${{secrets.DOCKER_PASSWORD_HELM}}
+      - name : ⬆️ Push to Docker Hub
+        run:
+          make helm-push
+        env:
+          DOCKER_USER: ${{secrets.DOCKER_USER_HELM}}

.github/workflows/release.yml

@@ -15,21 +15,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          fetch-depth: 0
-      - name: Get changelog for release
-        id: changelog
-        uses: mindsers/changelog-reader-action@32aa5b4c155d76c94e4ec883a223c947b2f02656 # v2
+          persist-credentials: false
+      - name: ⬇️ Install Go
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
-          path: "docs/CHANGELOG.md"
-          version: ${{ github.ref_name }}
-      - name: Create Release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
-        if: startsWith(github.ref, 'refs/tags/')
+          go-version-file: 'go.mod'
+      - name: ⬇️ Set up Docker Buildx
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - name: 🐳 Login to Docker Hub
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
-          tag_name: ${{ github.ref_name }}
-          name: Release ${{ github.ref_name }}
-          draft: true
-          prerelease: false
-          body: ${{ steps.changelog.outputs.changes }}
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+      - name: 📦 Run GoReleaser
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        with:
+          version: 'v2.15.4'
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/trivy.yml

@@ -23,23 +23,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: ⬇️ Checkout repository
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-    - name: Image
-      run: |
-        make build-image
-      env:
-        VERSION: ${{ github.sha }}
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
+    - name: 📦 Run GoReleaser
+      uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+      with:
+        version: 'v2.15.4'
+        args: release --clean --snapshot
     - name: 🔎 Trivy-Scan
       uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
       with:
-        image-ref: outscale/cloud-provider-osc:${{ github.sha }}
+        image-ref: outscale/cloud-provider-osc:${{ github.sha }}-amd64
         format: 'sarif'
         output: 'trivy-results.sarif'
         severity: 'CRITICAL,HIGH'
         trivyignores: '.trivyignore'
         version: 'v0.72.0'
     - name: ⬆️ Upload Trivy results
       if: ${{ github.event_name != 'pull_request' }}
-      uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
       with:
         sarif_file: 'trivy-results.sarif'

.gitignore

@@ -58,8 +58,9 @@ vendor/
 .env/
 tests/e2e/single_az_test_e2e_report/
 out-helm/
+dist/
 
 # Ignore docs in the helm package
 deploy/k8s-osc-ccm/CHANGELOG.md
 deploy/k8s-osc-ccm/README.md
-deploy/k8s-osc-ccm/LICENSE
+deploy/k8s-osc-ccm/LICENSE