ci: publish signed cluster OCI artifact

Author: jfroy

.github/workflows/cluster-release.yaml

@@ -0,0 +1,103 @@
+---
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
+name: Cluster Release
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+    paths:
+      - .github/workflows/cluster-release.yaml
+      - kubernetes/**
+
+concurrency:
+  group: cluster-release
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  id-token: write
+  packages: write
+
+env:
+  OCI_REPOSITORY: ghcr.io/jfroy/flatops/cluster
+
+jobs:
+  release:
+    if: github.ref == 'refs/heads/main'
+    name: Build, Sign, and Publish
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup Flux CLI
+        uses: fluxcd/flux2/action@889be9d6cc8afa8ed639e1e1ba4ab678e3b38d8c # v2.9.4
+        with:
+          token: ${{ github.token }}
+          version: 2.9.4
+
+      - name: Setup Cosign
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        with:
+          cosign-release: v3.1.3
+
+      - name: Login to GHCR
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Build cluster artifact
+        env:
+          ARTIFACT_DIR: ${{ runner.temp }}/cluster-artifact
+          ARTIFACT_TGZ: ${{ runner.temp }}/cluster-artifact.tgz
+        run: |
+          mkdir -p "${ARTIFACT_DIR}/kubernetes"
+          cp -a kubernetes/. "${ARTIFACT_DIR}/kubernetes/"
+          flux build artifact \
+            --path "${ARTIFACT_DIR}" \
+            --output "${ARTIFACT_TGZ}"
+          tar -tzf "${ARTIFACT_TGZ}" > "${ARTIFACT_TGZ}.files"
+          grep -q 'kubernetes/cluster/ks.yaml$' "${ARTIFACT_TGZ}.files"
+
+      - name: Publish immutable artifact
+        id: publish
+        env:
+          ARTIFACT_DIR: ${{ runner.temp }}/cluster-artifact
+        run: |
+          result="$(flux push artifact "oci://${OCI_REPOSITORY}:${GITHUB_SHA}" \
+            --path "${ARTIFACT_DIR}" \
+            --source "https://github.com/${GITHUB_REPOSITORY}" \
+            --revision "main@sha1:${GITHUB_SHA}" \
+            --annotations "org.opencontainers.image.source=https://github.com/${GITHUB_REPOSITORY}" \
+            --output json)"
+          digest="$(jq -er '.digest' <<< "${result}")"
+          echo "digest=${digest}" >> "${GITHUB_OUTPUT}"
+
+      - name: Sign and verify artifact
+        env:
+          DIGEST: ${{ steps.publish.outputs.digest }}
+        run: |
+          cosign sign --yes "${OCI_REPOSITORY}@${DIGEST}"
+          cosign verify \
+            --certificate-identity "https://github.com/jfroy/flatops/.github/workflows/cluster-release.yaml@refs/heads/main" \
+            --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+            "${OCI_REPOSITORY}@${DIGEST}"
+
+      - name: Promote artifact
+        run: |
+          flux tag artifact "oci://${OCI_REPOSITORY}:${GITHUB_SHA}" --tag latest
+
+      - name: Verify anonymous pull access
+        env:
+          DIGEST: ${{ steps.publish.outputs.digest }}
+          DOCKER_CONFIG: ${{ runner.temp }}/anonymous-docker-config
+        run: |
+          mkdir -p "${DOCKER_CONFIG}" "${RUNNER_TEMP}/pulled-artifact"
+          flux pull artifact "oci://${OCI_REPOSITORY}@${DIGEST}" \
+            --output "${RUNNER_TEMP}/pulled-artifact"