ci: publish signed cluster OCI artifact

Author: jfroy

.github/workflows/cluster-release.yaml

@@ -0,0 +1,93 @@
+---
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
+name: Cluster Release
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - .github/workflows/cluster-release.yaml
+      - kubernetes/**
+
+concurrency:
+  group: cluster-release-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  OCI_REPOSITORY: ghcr.io/${{ github.repository }}/cluster
+
+jobs:
+  release:
+    name: Build, Sign, and Publish
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require main ref
+        if: github.ref != 'refs/heads/main'
+        run: |
+          echo "Cluster releases must run from refs/heads/main" >&2
+          exit 1
+
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Flux CLI
+        uses: fluxcd/flux2/action@889be9d6cc8afa8ed639e1e1ba4ab678e3b38d8c # v2.9.4
+        with:
+          token: ${{ github.token }}
+          version: 2.9.4
+
+      - name: Setup Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: v3.1.3
+
+      - name: Login to GHCR
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Publish immutable artifact
+        id: publish
+        env:
+          ARTIFACT_DIR: ${{ runner.temp }}/cluster-artifact
+        run: |
+          mkdir -p "${ARTIFACT_DIR}/kubernetes"
+          cp -a kubernetes/. "${ARTIFACT_DIR}/kubernetes/"
+          result="$(flux push artifact "oci://${OCI_REPOSITORY}:${GITHUB_SHA}" \
+            --path "${ARTIFACT_DIR}" \
+            --source "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" \
+            --revision "${GITHUB_REF_NAME}@sha1:${GITHUB_SHA}" \
+            --reproducible \
+            --output json)"
+          digest="$(jq -er '.digest' <<< "${result}")"
+          echo "digest=${digest}" >> "${GITHUB_OUTPUT}"
+
+      - name: Sign and verify artifact
+        env:
+          DIGEST: ${{ steps.publish.outputs.digest }}
+        run: |
+          cosign sign --yes --new-bundle-format=true "${OCI_REPOSITORY}@${DIGEST}"
+          cosign verify \
+            --new-bundle-format=true \
+            --certificate-identity "${GITHUB_SERVER_URL}/${GITHUB_WORKFLOW_REF}" \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+            "${OCI_REPOSITORY}@${DIGEST}"
+
+      - name: Promote artifact
+        env:
+          DIGEST: ${{ steps.publish.outputs.digest }}
+        run: |
+          flux tag artifact "oci://${OCI_REPOSITORY}@${DIGEST}" --tag latest