Skip to content

Commit 25ef22d

Browse files
yousef-cohereyousef-cohere
committed
feat: update GitHub workflows for Cohere release process
- Removed GCP authentication steps from the peerpods-chart_image.yaml workflow. - Added new workflows: publish-cohere-release.yaml for handling semver-tagged releases and publish-cohere.yaml for publishing artifacts on pushes to the cohere branch. - Updated values.yaml to reflect new image repository and tag for the cloud-api-adaptor and peerpod-ctrl, aligning with the new release strategy.
1 parent e646472 commit 25ef22d

4 files changed

Lines changed: 329 additions & 33 deletions

File tree

‎.github/workflows/peerpods-chart_image.yaml‎

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -155,25 +155,6 @@ jobs:
155155
--password-stdin
156156
echo "Helm authenticated with ghcr.io"
157157
158-
- name: Authenticate to GCP
159-
if: ${{ contains(steps.registry.outputs.registry, 'docker.pkg.dev') }}
160-
uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
161-
with:
162-
workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
163-
service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
164-
165-
- name: Authenticate Helm with Artifact Registry
166-
if: ${{ contains(steps.registry.outputs.registry, 'docker.pkg.dev') }}
167-
env:
168-
REGISTRY: ${{ steps.registry.outputs.registry }}
169-
run: |
170-
AR_HOST=$(echo "${REGISTRY}" | cut -d'/' -f1)
171-
echo "Authenticating Helm with ${AR_HOST}..."
172-
gcloud auth print-access-token | helm registry login "${AR_HOST}" \
173-
--username oauth2accesstoken \
174-
--password-stdin
175-
echo "Helm authenticated with ${AR_HOST}"
176-
177158
- name: Update Helm dependencies
178159
run: |
179160
echo "Updating Helm dependencies..."

‎.github/workflows/publish-cohere-release.yaml‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
---
2+
# Publish semver-tagged Cohere-fork release artifacts to GHCR.
3+
#
4+
# Triggered by GitHub Releases targeting the `cohere` branch. The release tag
5+
# becomes the image/chart tag verbatim, with one normalisation: a leading "v"
6+
# is stripped for the chart (Helm/OCI requires SemVer with no prefix).
7+
#
8+
# Release process:
9+
# 1. Bump src/cloud-api-adaptor/install/charts/peerpods/Chart.yaml `version`
10+
# to the new SemVer (e.g. 0.1.4-cohere.2). Merge to cohere.
11+
# 2. Create a GitHub Release on the cohere branch with tag `v0.1.4-cohere.2`
12+
# (or `0.1.4-cohere.2` — both work). Publishing the release fires this.
13+
#
14+
# Tags produced (release `v0.1.4-cohere.2`):
15+
# ghcr.io/cohere-ai/cloud-api-adaptor/cloud-api-adaptor:v0.1.4-cohere.2
16+
# ghcr.io/cohere-ai/cloud-api-adaptor/peerpod-ctrl:v0.1.4-cohere.2
17+
# ghcr.io/cohere-ai/cloud-api-adaptor/charts/peerpods:0.1.4-cohere.2
18+
#
19+
# `latest-cohere` is NOT touched — that floats with the cohere branch tip via
20+
# publish-cohere.yaml. Consumers pin to the semver tag for stable releases.
21+
name: Publish (cohere release)
22+
23+
on:
24+
release:
25+
types: [published]
26+
workflow_dispatch:
27+
inputs:
28+
tag:
29+
description: 'Release tag to (re)publish (e.g. v0.1.4-cohere.2). Must already exist as a git tag on cohere.'
30+
required: true
31+
type: string
32+
33+
concurrency:
34+
group: publish-cohere-release-${{ github.event.release.tag_name || inputs.tag }}
35+
cancel-in-progress: false
36+
37+
permissions: {}
38+
39+
env:
40+
REGISTRY: ghcr.io/cohere-ai/cloud-api-adaptor
41+
42+
jobs:
43+
tags:
44+
name: Compute tags
45+
runs-on: ubuntu-24.04
46+
# Only fire for releases cut from the cohere branch. Manual dispatch always runs.
47+
if: >-
48+
github.event_name == 'workflow_dispatch' ||
49+
github.event.release.target_commitish == 'cohere'
50+
outputs:
51+
git_ref: ${{ steps.t.outputs.git_ref }}
52+
image_tag: ${{ steps.t.outputs.image_tag }}
53+
chart_version: ${{ steps.t.outputs.chart_version }}
54+
steps:
55+
- name: Derive tags from release
56+
id: t
57+
env:
58+
RAW_TAG: ${{ github.event.release.tag_name || inputs.tag }}
59+
run: |
60+
# Image tags keep the v prefix verbatim; chart strips it (OCI SemVer).
61+
chart_version="${RAW_TAG#v}"
62+
echo "git_ref=${RAW_TAG}" >> "$GITHUB_OUTPUT"
63+
echo "image_tag=${RAW_TAG}" >> "$GITHUB_OUTPUT"
64+
echo "chart_version=${chart_version}" >> "$GITHUB_OUTPUT"
65+
66+
caa:
67+
name: Build CAA image (release, amd64)
68+
needs: tags
69+
runs-on: ubuntu-24.04
70+
permissions:
71+
contents: read # checkout the release tag
72+
packages: write # push image manifests to GHCR
73+
defaults:
74+
run:
75+
working-directory: src/cloud-api-adaptor
76+
steps:
77+
- name: Checkout
78+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
79+
with:
80+
fetch-depth: 0
81+
persist-credentials: false
82+
ref: ${{ needs.tags.outputs.git_ref }}
83+
84+
- name: Read Go version from versions.yaml
85+
run: |
86+
command -v yq || sudo snap install yq
87+
go_version="$(yq '.tools.golang' versions.yaml)"
88+
[ -n "$go_version" ]
89+
echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
90+
91+
- name: Setup Go ${{ env.GO_VERSION }}
92+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
93+
with:
94+
go-version: ${{ env.GO_VERSION }}
95+
cache-dependency-path: "**/go.sum"
96+
cache: false
97+
98+
- name: Set up Docker Buildx
99+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
100+
101+
- name: Login to GHCR
102+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
103+
with:
104+
registry: ghcr.io
105+
username: ${{ github.repository_owner }}
106+
password: ${{ secrets.GITHUB_TOKEN }}
107+
108+
- name: Build and push release image
109+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
110+
env:
111+
REGISTRY: ${{ env.REGISTRY }}
112+
RELEASE_TAGS: ${{ needs.tags.outputs.image_tag }}
113+
with:
114+
timeout_minutes: 60
115+
retry_wait_seconds: 120
116+
max_attempts: 3
117+
command: |
118+
cd src/cloud-api-adaptor && \
119+
ARCHES=linux/amd64 \
120+
RELEASE_BUILD=true \
121+
RELEASE_TAGS="${RELEASE_TAGS}" \
122+
make image registry="${REGISTRY}"
123+
124+
peerpod-ctrl:
125+
name: Build peerpod-ctrl image
126+
needs: tags
127+
uses: ./.github/workflows/peerpod-ctrl_image.yaml
128+
with:
129+
registry: ghcr.io/cohere-ai/cloud-api-adaptor
130+
git_ref: ${{ needs.tags.outputs.git_ref }}
131+
image_tags: ${{ needs.tags.outputs.image_tag }}
132+
permissions:
133+
contents: read # passed to reusable workflow for checkout
134+
packages: write # passed to reusable workflow for GHCR push
135+
secrets:
136+
# See publish-cohere.yaml for why we pass GITHUB_TOKEN to QUAY_PASSWORD.
137+
QUAY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
138+
139+
chart:
140+
name: Publish peerpods Helm chart
141+
needs: tags
142+
uses: ./.github/workflows/peerpods-chart_image.yaml
143+
with:
144+
git_ref: ${{ needs.tags.outputs.git_ref }}
145+
chart_version: ${{ needs.tags.outputs.chart_version }}
146+
permissions:
147+
contents: read # checkout the release tag
148+
packages: write # push chart artifact to GHCR
149+
id-token: write # OIDC token for actions/attest sigstore signing
150+
attestations: write # write build provenance attestations
151+
artifact-metadata: write # actions/attest writes attestation metadata

‎.github/workflows/publish-cohere.yaml‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
---
2+
# Publish Cohere-fork artifacts to GHCR on every push to `cohere`.
3+
#
4+
# Builds the *release* CAA image only (no libvirt); upstream's reusable
5+
# caa_build_and_push.yaml has a hardcoded matrix that builds dev+release in
6+
# parallel, so we inline the release path here to avoid wasting an hour of CI
7+
# on a libvirt build we don't ship. peerpod-ctrl and the chart still call the
8+
# upstream reusables — they're single-build with no dev variant.
9+
#
10+
# Tags produced (push to cohere):
11+
# ghcr.io/cohere-ai/cloud-api-adaptor/cloud-api-adaptor:latest-cohere
12+
# ghcr.io/cohere-ai/cloud-api-adaptor/cloud-api-adaptor:<12-char-sha>
13+
# ghcr.io/cohere-ai/cloud-api-adaptor/peerpod-ctrl:latest-cohere
14+
# ghcr.io/cohere-ai/cloud-api-adaptor/peerpod-ctrl:<12-char-sha>
15+
# ghcr.io/cohere-ai/cloud-api-adaptor/charts/peerpods:0.0.0-dev-cohere
16+
#
17+
# The chart always publishes to the floating `0.0.0-dev-cohere` tag here —
18+
# mirroring upstream's `0.0.0-dev` convention for main-branch pushes — so we
19+
# never silently overwrite a real Chart.yaml version. Real SemVer chart tags
20+
# (e.g. 0.1.4-cohere.2) are produced by publish-cohere-release.yaml on release
21+
# events and match the GH Release tag, not Chart.yaml on disk at push time.
22+
name: Publish (cohere)
23+
24+
on:
25+
push:
26+
branches: [cohere, cohere-release] # TODO: remove cohere-release before merge
27+
workflow_dispatch:
28+
29+
concurrency:
30+
group: publish-cohere-${{ github.ref }}
31+
cancel-in-progress: false
32+
33+
permissions: {}
34+
35+
env:
36+
REGISTRY: ghcr.io/cohere-ai/cloud-api-adaptor
37+
38+
jobs:
39+
tags:
40+
name: Compute tags
41+
runs-on: ubuntu-24.04
42+
outputs:
43+
release_tags: ${{ steps.t.outputs.release_tags }}
44+
image_tags: ${{ steps.t.outputs.image_tags }}
45+
steps:
46+
- name: Derive tag list from commit SHA
47+
id: t
48+
env:
49+
SHA: ${{ github.sha }}
50+
run: |
51+
short="${SHA:0:12}"
52+
echo "release_tags=latest-cohere,${short}" >> "$GITHUB_OUTPUT"
53+
echo "image_tags=latest-cohere,${short}" >> "$GITHUB_OUTPUT"
54+
55+
caa:
56+
name: Build CAA image (release, amd64)
57+
needs: tags
58+
runs-on: ubuntu-24.04
59+
permissions:
60+
contents: read # checkout the cohere ref
61+
packages: write # push image manifests to GHCR
62+
defaults:
63+
run:
64+
working-directory: src/cloud-api-adaptor
65+
steps:
66+
- name: Checkout
67+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
68+
with:
69+
fetch-depth: 0
70+
persist-credentials: false
71+
ref: ${{ github.sha }}
72+
73+
- name: Read Go version from versions.yaml
74+
run: |
75+
command -v yq || sudo snap install yq
76+
go_version="$(yq '.tools.golang' versions.yaml)"
77+
[ -n "$go_version" ]
78+
echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
79+
80+
- name: Setup Go ${{ env.GO_VERSION }}
81+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
82+
with:
83+
go-version: ${{ env.GO_VERSION }}
84+
cache-dependency-path: "**/go.sum"
85+
cache: false
86+
87+
- name: Set up Docker Buildx
88+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
89+
90+
- name: Login to GHCR
91+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
92+
with:
93+
registry: ghcr.io
94+
username: ${{ github.repository_owner }}
95+
password: ${{ secrets.GITHUB_TOKEN }}
96+
97+
- name: Build and push release image
98+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
99+
env:
100+
REGISTRY: ${{ env.REGISTRY }}
101+
RELEASE_TAGS: ${{ needs.tags.outputs.release_tags }}
102+
with:
103+
timeout_minutes: 60
104+
retry_wait_seconds: 120
105+
max_attempts: 3
106+
command: |
107+
cd src/cloud-api-adaptor && \
108+
ARCHES=linux/amd64 \
109+
RELEASE_BUILD=true \
110+
RELEASE_TAGS="${RELEASE_TAGS}" \
111+
make image registry="${REGISTRY}"
112+
113+
peerpod-ctrl:
114+
name: Build peerpod-ctrl image
115+
needs: tags
116+
uses: ./.github/workflows/peerpod-ctrl_image.yaml
117+
with:
118+
registry: ghcr.io/cohere-ai/cloud-api-adaptor
119+
git_ref: ${{ github.sha }}
120+
image_tags: ${{ needs.tags.outputs.image_tags }}
121+
permissions:
122+
contents: read # passed to reusable workflow for checkout
123+
packages: write # passed to reusable workflow for GHCR push
124+
secrets:
125+
# QUAY_PASSWORD is required by the reusable workflow's contract. The quay
126+
# login step is gated on `startsWith(inputs.registry, 'quay.io')` so this
127+
# token is never sent to quay; we pass GITHUB_TOKEN as a harmless dummy.
128+
QUAY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
129+
130+
chart:
131+
name: Publish peerpods Helm chart
132+
uses: ./.github/workflows/peerpods-chart_image.yaml
133+
with:
134+
git_ref: ${{ github.sha }}
135+
# Floating dev tag — mirrors upstream's `0.0.0-dev` convention for
136+
# main-branch pushes. Real SemVer is reserved for release events.
137+
chart_version: "0.0.0-dev-cohere"
138+
permissions:
139+
contents: read # checkout the cohere ref
140+
packages: write # push chart artifact to GHCR
141+
id-token: write # OIDC token for actions/attest sigstore signing
142+
attestations: write # write build provenance attestations
143+
artifact-metadata: write # actions/attest writes attestation metadata

0 commit comments

Comments
 (0)