42 lines
1.3 KiB
Markdown
42 lines
1.3 KiB
Markdown
# DevOps Release Automation
|
||
|
||
The **release** workflow builds and signs the StellaOps service containers,
|
||
generates SBOM + provenance attestations, and emits a canonical
|
||
`release.yaml`. The logic lives under `ops/devops/release/` and is invoked
|
||
by the new `.gitea/workflows/release.yml` pipeline.
|
||
|
||
## Local dry run
|
||
|
||
```bash
|
||
./ops/devops/release/build_release.py \
|
||
--version 2025.10.0-edge \
|
||
--channel edge \
|
||
--dry-run
|
||
```
|
||
|
||
Outputs land under `out/release/`. Use `--no-push` to run full builds without
|
||
pushing to the registry.
|
||
|
||
## Required tooling
|
||
|
||
- Docker 25+ with Buildx
|
||
- .NET 10 preview SDK (builds container stages and the SBOM generator)
|
||
- Node.js 20 (Angular UI build)
|
||
- Helm 3.16+
|
||
- Cosign 2.2+
|
||
|
||
Supply signing material via environment variables:
|
||
|
||
- `COSIGN_KEY_REF` – e.g. `file:./keys/cosign.key` or `azurekms://…`
|
||
- `COSIGN_PASSWORD` – password protecting the above key
|
||
|
||
The workflow defaults to multi-arch (`linux/amd64,linux/arm64`), SBOM in
|
||
CycloneDX, and SLSA provenance (`https://slsa.dev/provenance/v1`).
|
||
|
||
## UI auth smoke (Playwright)
|
||
|
||
As part of **DEVOPS-UI-13-006** the pipelines will execute the UI auth smoke
|
||
tests (`npm run test:e2e`) after building the Angular bundle. See
|
||
`docs/ops/ui-auth-smoke.md` for the job design, environment stubs, and
|
||
offline runner considerations.
|