Skip to content

Commit b0d7bbf

Browse files
yousef-cohereyousef-cohere
authored
Merge pull request #21 from cohere-ai/cohere-release
Cohere release
2 parents 749bc77 + f3711c3 commit b0d7bbf

6 files changed

Lines changed: 517 additions & 41 deletions

File tree

‎.github/workflows/peerpods-chart_image.yaml‎

Lines changed: 8 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -60,10 +60,15 @@ jobs:
6060
fetch-depth: 0
6161

6262
- name: Install yq
63+
# Keep in sync with the pin in publish-cohere-release.yaml.
64+
env:
65+
YQ_VERSION: v4.44.3
66+
YQ_SHA256: a2c097180dd884a8d50c956ee16a9cec070f30a7947cf4ebf87d5f36213e9ed7
6367
run: |
64-
echo "Installing yq..."
65-
sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
66-
sudo chmod +x /usr/local/bin/yq
68+
curl -fsSLo /tmp/yq "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64"
69+
echo "${YQ_SHA256} /tmp/yq" | sha256sum --check --strict
70+
sudo install -m 0755 /tmp/yq /usr/local/bin/yq
71+
rm /tmp/yq
6772
yq --version
6873
6974
- name: Read versions from Chart.yaml and versions.yaml
@@ -155,25 +160,6 @@ jobs:
155160
--password-stdin
156161
echo "Helm authenticated with ghcr.io"
157162
158-
- name: Authenticate to GCP
159-
if: ${{ contains(steps.registry.outputs.registry, 'docker.pkg.dev') }}
160-
uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
161-
with:
162-
workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
163-
service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
164-
165-
- name: Authenticate Helm with Artifact Registry
166-
if: ${{ contains(steps.registry.outputs.registry, 'docker.pkg.dev') }}
167-
env:
168-
REGISTRY: ${{ steps.registry.outputs.registry }}
169-
run: |
170-
AR_HOST=$(echo "${REGISTRY}" | cut -d'/' -f1)
171-
echo "Authenticating Helm with ${AR_HOST}..."
172-
gcloud auth print-access-token | helm registry login "${AR_HOST}" \
173-
--username oauth2accesstoken \
174-
--password-stdin
175-
echo "Helm authenticated with ${AR_HOST}"
176-
177163
- name: Update Helm dependencies
178164
run: |
179165
echo "Updating Helm dependencies..."

‎.github/workflows/publish-cohere-release.yaml‎

Lines changed: 283 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,283 @@
1+
---
2+
# Publish semver-tagged Cohere-fork release artifacts to GHCR.
3+
#
4+
# Triggered by GitHub Releases targeting the `cohere` branch. The release tag
5+
# becomes the image/chart tag verbatim, with one normalisation: a leading "v"
6+
# is stripped for the chart (Helm/OCI requires SemVer with no prefix).
7+
#
8+
# Release process:
9+
# 1. Bump src/cloud-api-adaptor/install/charts/peerpods/Chart.yaml `version`
10+
# to the new SemVer (e.g. 0.1.4-cohere.2). Merge to cohere.
11+
# 2. Create a GitHub Release on the cohere branch with tag `v0.1.4-cohere.2`
12+
# (or `0.1.4-cohere.2` — both work). Publishing the release fires this.
13+
#
14+
# Tags produced (release `v0.1.4-cohere.2`):
15+
# ghcr.io/cohere-ai/cloud-api-adaptor/cloud-api-adaptor:v0.1.4-cohere.2
16+
# ghcr.io/cohere-ai/cloud-api-adaptor/peerpod-ctrl:v0.1.4-cohere.2
17+
# ghcr.io/cohere-ai/cloud-api-adaptor/charts/peerpods:0.1.4-cohere.2
18+
#
19+
# The chart is self-contained: values.yaml is patched at package time so
20+
# image.tag and resourceCtrl.image.tag default to the release tag. A bare
21+
# `helm install` without overrides gets matching images.
22+
#
23+
# `latest-cohere` is NOT touched — that floats with the cohere branch tip via
24+
# publish-cohere.yaml. Consumers pin to the semver tag for stable releases.
25+
name: Publish (cohere release)
26+
27+
on:
28+
release:
29+
types: [published]
30+
workflow_dispatch:
31+
inputs:
32+
tag:
33+
description: 'Release tag to (re)publish (e.g. v0.1.4-cohere.2). Must already exist as a git tag on cohere.'
34+
required: true
35+
type: string
36+
37+
concurrency:
38+
group: publish-cohere-release-${{ github.event.release.tag_name || inputs.tag }}
39+
cancel-in-progress: false
40+
41+
permissions: {}
42+
43+
env:
44+
REGISTRY: ghcr.io/cohere-ai/cloud-api-adaptor
45+
46+
jobs:
47+
tags:
48+
name: Compute tags
49+
runs-on: ubuntu-24.04
50+
# Only fire for releases cut from the cohere branch. Manual dispatch always runs.
51+
if: >-
52+
github.event_name == 'workflow_dispatch' ||
53+
github.event.release.target_commitish == 'cohere'
54+
outputs:
55+
git_ref: ${{ steps.t.outputs.git_ref }}
56+
image_tag: ${{ steps.t.outputs.image_tag }}
57+
chart_version: ${{ steps.t.outputs.chart_version }}
58+
steps:
59+
- name: Derive tags from release
60+
id: t
61+
env:
62+
RAW_TAG: ${{ github.event.release.tag_name || inputs.tag }}
63+
run: |
64+
# Image tags keep the v prefix verbatim; chart strips it (OCI SemVer).
65+
chart_version="${RAW_TAG#v}"
66+
{
67+
echo "git_ref=${RAW_TAG}"
68+
echo "image_tag=${RAW_TAG}"
69+
echo "chart_version=${chart_version}"
70+
} >> "$GITHUB_OUTPUT"
71+
72+
caa:
73+
name: Build CAA image (release, amd64)
74+
needs: tags
75+
runs-on: ubuntu-24.04
76+
permissions:
77+
contents: read # checkout the release tag
78+
packages: write # push image manifests to GHCR
79+
defaults:
80+
run:
81+
working-directory: src/cloud-api-adaptor
82+
steps:
83+
- name: Checkout
84+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
85+
with:
86+
fetch-depth: 0
87+
persist-credentials: false
88+
ref: ${{ needs.tags.outputs.git_ref }}
89+
90+
- name: Read Go version from versions.yaml
91+
run: |
92+
command -v yq || sudo snap install yq
93+
go_version="$(yq '.tools.golang' versions.yaml)"
94+
[ -n "$go_version" ]
95+
echo "GO_VERSION=${go_version}" >> "$GITHUB_ENV"
96+
97+
- name: Setup Go ${{ env.GO_VERSION }}
98+
uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
99+
with:
100+
go-version: ${{ env.GO_VERSION }}
101+
cache-dependency-path: "**/go.sum"
102+
cache: false
103+
104+
- name: Set up Docker Buildx
105+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
106+
107+
- name: Login to GHCR
108+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
109+
with:
110+
registry: ghcr.io
111+
username: ${{ github.repository_owner }}
112+
password: ${{ secrets.GITHUB_TOKEN }}
113+
114+
- name: Build and push release image
115+
uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4.0.0
116+
env:
117+
REGISTRY: ${{ env.REGISTRY }}
118+
RELEASE_TAGS: ${{ needs.tags.outputs.image_tag }}
119+
with:
120+
timeout_minutes: 60
121+
retry_wait_seconds: 120
122+
max_attempts: 3
123+
command: |
124+
cd src/cloud-api-adaptor && \
125+
ARCHES=linux/amd64 \
126+
RELEASE_BUILD=true \
127+
RELEASE_TAGS="${RELEASE_TAGS}" \
128+
make image registry="${REGISTRY}"
129+
130+
peerpod-ctrl:
131+
name: Build peerpod-ctrl image (amd64)
132+
needs: tags
133+
runs-on: ubuntu-24.04
134+
permissions:
135+
contents: read # checkout the release tag
136+
packages: write # push image manifests to GHCR
137+
steps:
138+
- name: Checkout
139+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
140+
with:
141+
fetch-depth: 0
142+
persist-credentials: false
143+
ref: ${{ needs.tags.outputs.git_ref }}
144+
145+
- name: Set up Docker Buildx
146+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
147+
148+
- name: Login to GHCR
149+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
150+
with:
151+
registry: ghcr.io
152+
username: ${{ github.repository_owner }}
153+
password: ${{ secrets.GITHUB_TOKEN }}
154+
155+
- name: Build and push
156+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
157+
with:
158+
tags: ${{ env.REGISTRY }}/peerpod-ctrl:${{ needs.tags.outputs.image_tag }}
159+
push: true
160+
context: src
161+
file: src/peerpod-ctrl/Dockerfile
162+
platforms: linux/amd64
163+
build-args: |
164+
GOFLAGS=-tags=gcp
165+
166+
chart:
167+
name: Publish peerpods Helm chart
168+
needs: tags
169+
runs-on: ubuntu-24.04
170+
permissions:
171+
contents: read # checkout the release tag
172+
packages: write # push chart artifact to GHCR
173+
id-token: write # OIDC token for actions/attest sigstore signing
174+
attestations: write # write build provenance attestations
175+
artifact-metadata: write # actions/attest writes attestation metadata
176+
defaults:
177+
run:
178+
working-directory: src/cloud-api-adaptor/install/charts/peerpods
179+
steps:
180+
- name: Checkout
181+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
182+
with:
183+
ref: ${{ needs.tags.outputs.git_ref }}
184+
persist-credentials: false
185+
fetch-depth: 0
186+
187+
- name: Install yq
188+
# Keep in sync with the pin in peerpods-chart_image.yaml.
189+
env:
190+
YQ_VERSION: v4.44.3
191+
YQ_SHA256: a2c097180dd884a8d50c956ee16a9cec070f30a7947cf4ebf87d5f36213e9ed7
192+
run: |
193+
curl -fsSLo /tmp/yq "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64"
194+
echo "${YQ_SHA256} /tmp/yq" | sha256sum --check --strict
195+
sudo install -m 0755 /tmp/yq /usr/local/bin/yq
196+
rm /tmp/yq
197+
yq --version
198+
199+
- name: Patch values.yaml with release image tags
200+
env:
201+
IMAGE_TAG: ${{ needs.tags.outputs.image_tag }}
202+
run: |
203+
yq -i ".image.tag = \"${IMAGE_TAG}\"" values.yaml
204+
yq -i ".resourceCtrl.image.tag = \"${IMAGE_TAG}\"" values.yaml
205+
echo "Patched values.yaml default image tags to ${IMAGE_TAG}"
206+
echo " image.tag: $(yq '.image.tag' values.yaml)"
207+
echo " resourceCtrl.image.tag: $(yq '.resourceCtrl.image.tag' values.yaml)"
208+
209+
- name: Read versions
210+
id: read_version
211+
working-directory: .
212+
env:
213+
CHART_VERSION: ${{ needs.tags.outputs.chart_version }}
214+
run: |
215+
HELM_VERSION="$(yq -e '.tools.helm.version' src/cloud-api-adaptor/versions.yaml)"
216+
HELM_CHECKSUM="$(yq -e '.tools.helm.sha256' src/cloud-api-adaptor/versions.yaml)"
217+
{
218+
echo "helm_version=${HELM_VERSION}"
219+
echo "helm_checksum=${HELM_CHECKSUM}"
220+
} >> "$GITHUB_OUTPUT"
221+
222+
- name: Install Helm
223+
env:
224+
HELM_VERSION: ${{ steps.read_version.outputs.helm_version }}
225+
HELM_CHECKSUM: ${{ steps.read_version.outputs.helm_checksum }}
226+
run: |
227+
curl -fsSL -o helm.tar.gz "https://get.helm.sh/helm-${HELM_VERSION}-linux-amd64.tar.gz"
228+
echo "${HELM_CHECKSUM} helm.tar.gz" | sha256sum --check --strict
229+
tar -xzf helm.tar.gz
230+
sudo mv linux-amd64/helm /usr/local/bin/helm
231+
rm -rf helm.tar.gz linux-amd64
232+
233+
- name: Login to GHCR
234+
uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
235+
with:
236+
registry: ghcr.io
237+
username: ${{ github.actor }}
238+
password: ${{ secrets.GITHUB_TOKEN }}
239+
240+
- name: Authenticate Helm with GHCR
241+
env:
242+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
243+
GITHUB_ACTOR: ${{ github.actor }}
244+
run: |
245+
echo "${GITHUB_TOKEN}" | helm registry login ghcr.io \
246+
--username "${GITHUB_ACTOR}" \
247+
--password-stdin
248+
249+
- name: Update Helm dependencies
250+
run: helm dependency update
251+
252+
- name: Package Helm chart
253+
env:
254+
VERSION: ${{ needs.tags.outputs.chart_version }}
255+
run: |
256+
mkdir -p .cr-release-packages
257+
helm package . --version "${VERSION}" --destination .cr-release-packages
258+
ls -lh .cr-release-packages/
259+
260+
- name: Push Helm chart to OCI registry
261+
id: push_chart
262+
env:
263+
VERSION: ${{ needs.tags.outputs.chart_version }}
264+
REGISTRY: ${{ env.REGISTRY }}/charts
265+
run: |
266+
CHART_PACKAGE=".cr-release-packages/peerpods-${VERSION}.tgz"
267+
helm push "${CHART_PACKAGE}" "oci://${REGISTRY}"
268+
DIGEST=$(helm show chart "oci://${REGISTRY}/peerpods" --version "${VERSION}" 2>&1 | awk '/Digest:/ {print $2}')
269+
270+
if [ -z "${DIGEST}" ]; then
271+
echo "ERROR: Failed to extract digest"
272+
exit 1
273+
fi
274+
275+
echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
276+
echo "Pushed: oci://${REGISTRY}/peerpods:${VERSION} (digest: ${DIGEST})"
277+
278+
- name: Generate attestation
279+
uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.1.0
280+
with:
281+
subject-name: ${{ env.REGISTRY }}/charts/peerpods
282+
subject-digest: ${{ steps.push_chart.outputs.digest }}
283+
push-to-registry: true

0 commit comments

Comments
 (0)