631 lines
24 KiB
Python
631 lines
24 KiB
Python
#!/usr/bin/env python3
|
|
"""Deterministic release pipeline helper for StellaOps.
|
|
|
|
This script builds service containers, generates SBOM and provenance artefacts,
|
|
signs them with cosign, and writes a channel-specific release manifest.
|
|
|
|
The workflow expects external tooling to be available on PATH:
|
|
- docker (with buildx)
|
|
- cosign
|
|
- helm
|
|
- npm / node (for the UI build)
|
|
- dotnet SDK (for BuildX plugin publication)
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import argparse
|
|
import datetime as dt
|
|
import hashlib
|
|
import json
|
|
import os
|
|
import pathlib
|
|
import re
|
|
import shlex
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
from collections import OrderedDict
|
|
from typing import Any, Dict, Iterable, List, Mapping, MutableMapping, Optional, Sequence
|
|
|
|
REPO_ROOT = pathlib.Path(__file__).resolve().parents[3]
|
|
DEFAULT_CONFIG = REPO_ROOT / "ops/devops/release/components.json"
|
|
|
|
class CommandError(RuntimeError):
|
|
pass
|
|
|
|
def run(cmd: Sequence[str], *, cwd: Optional[pathlib.Path] = None, env: Optional[Mapping[str, str]] = None, capture: bool = True) -> str:
|
|
"""Run a subprocess command, returning stdout (text)."""
|
|
process_env = os.environ.copy()
|
|
if env:
|
|
process_env.update(env)
|
|
result = subprocess.run(
|
|
list(cmd),
|
|
cwd=str(cwd) if cwd else None,
|
|
env=process_env,
|
|
check=False,
|
|
capture_output=capture,
|
|
text=True,
|
|
)
|
|
if process_env.get("STELLAOPS_RELEASE_DEBUG"):
|
|
sys.stderr.write(f"[debug] {' '.join(shlex.quote(c) for c in cmd)}\n")
|
|
if capture:
|
|
sys.stderr.write(result.stdout)
|
|
sys.stderr.write(result.stderr)
|
|
if result.returncode != 0:
|
|
stdout = result.stdout if capture else ""
|
|
stderr = result.stderr if capture else ""
|
|
raise CommandError(f"Command failed ({result.returncode}): {' '.join(cmd)}\nSTDOUT:\n{stdout}\nSTDERR:\n{stderr}")
|
|
|
|
return result.stdout if capture else ""
|
|
|
|
|
|
def load_json_config(path: pathlib.Path) -> Dict[str, Any]:
|
|
with path.open("r", encoding="utf-8") as handle:
|
|
return json.load(handle)
|
|
|
|
|
|
def ensure_directory(path: pathlib.Path) -> pathlib.Path:
|
|
path.mkdir(parents=True, exist_ok=True)
|
|
return path
|
|
|
|
|
|
def compute_sha256(path: pathlib.Path) -> str:
|
|
sha = hashlib.sha256()
|
|
with path.open("rb") as handle:
|
|
for chunk in iter(lambda: handle.read(1024 * 1024), b""):
|
|
sha.update(chunk)
|
|
return sha.hexdigest()
|
|
|
|
|
|
def format_scalar(value: Any) -> str:
|
|
if isinstance(value, bool):
|
|
return "true" if value else "false"
|
|
if value is None:
|
|
return "null"
|
|
if isinstance(value, (int, float)):
|
|
return str(value)
|
|
text = str(value)
|
|
if text == "":
|
|
return '""'
|
|
if re.search(r"[\s:#\-\[\]\{\}]", text):
|
|
return json.dumps(text, ensure_ascii=False)
|
|
return text
|
|
|
|
|
|
def _yaml_lines(value: Any, indent: int = 0) -> List[str]:
|
|
pad = " " * indent
|
|
if isinstance(value, Mapping):
|
|
lines: List[str] = []
|
|
for key, val in value.items():
|
|
if isinstance(val, (Mapping, list)):
|
|
lines.append(f"{pad}{key}:")
|
|
lines.extend(_yaml_lines(val, indent + 1))
|
|
else:
|
|
lines.append(f"{pad}{key}: {format_scalar(val)}")
|
|
if not lines:
|
|
lines.append(f"{pad}{{}}")
|
|
return lines
|
|
if isinstance(value, list):
|
|
lines = []
|
|
if not value:
|
|
lines.append(f"{pad}[]")
|
|
return lines
|
|
for item in value:
|
|
if isinstance(item, (Mapping, list)):
|
|
lines.append(f"{pad}-")
|
|
lines.extend(_yaml_lines(item, indent + 1))
|
|
else:
|
|
lines.append(f"{pad}- {format_scalar(item)}")
|
|
return lines
|
|
return [f"{pad}{format_scalar(value)}"]
|
|
|
|
|
|
def dump_yaml(data: Mapping[str, Any]) -> str:
|
|
lines: List[str] = _yaml_lines(data)
|
|
return "\n".join(lines) + "\n"
|
|
|
|
|
|
def utc_now_iso() -> str:
|
|
return dt.datetime.now(tz=dt.timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
|
|
|
|
|
|
def sanitize_calendar(version: str, explicit: Optional[str]) -> str:
|
|
if explicit:
|
|
return explicit
|
|
# Expect version like 2025.10.0-edge or 2.4.1
|
|
parts = re.findall(r"\d+", version)
|
|
if len(parts) >= 2:
|
|
return f"{parts[0]}.{parts[1]}"
|
|
return dt.datetime.now(tz=dt.timezone.utc).strftime("%Y.%m")
|
|
|
|
|
|
class ReleaseBuilder:
|
|
def __init__(
|
|
self,
|
|
*,
|
|
repo_root: pathlib.Path,
|
|
config: Mapping[str, Any],
|
|
version: str,
|
|
channel: str,
|
|
calendar: str,
|
|
release_date: str,
|
|
git_sha: str,
|
|
output_dir: pathlib.Path,
|
|
push: bool,
|
|
dry_run: bool,
|
|
registry_override: Optional[str] = None,
|
|
platforms_override: Optional[Sequence[str]] = None,
|
|
skip_signing: bool = False,
|
|
cosign_key_ref: Optional[str] = None,
|
|
cosign_password: Optional[str] = None,
|
|
cosign_identity_token: Optional[str] = None,
|
|
tlog_upload: bool = True,
|
|
) -> None:
|
|
self.repo_root = repo_root
|
|
self.config = config
|
|
self.version = version
|
|
self.channel = channel
|
|
self.calendar = calendar
|
|
self.release_date = release_date
|
|
self.git_sha = git_sha
|
|
self.output_dir = ensure_directory(output_dir)
|
|
self.push = push
|
|
self.dry_run = dry_run
|
|
self.registry = registry_override or config.get("registry")
|
|
if not self.registry:
|
|
raise ValueError("Config missing 'registry'")
|
|
platforms = list(platforms_override) if platforms_override else config.get("platforms")
|
|
if not platforms:
|
|
platforms = ["linux/amd64", "linux/arm64"]
|
|
self.platforms = list(platforms)
|
|
self.source_date_epoch = str(int(dt.datetime.fromisoformat(release_date.replace("Z", "+00:00")).timestamp()))
|
|
self.artifacts_dir = ensure_directory(self.output_dir / "artifacts")
|
|
self.sboms_dir = ensure_directory(self.artifacts_dir / "sboms")
|
|
self.provenance_dir = ensure_directory(self.artifacts_dir / "provenance")
|
|
self.signature_dir = ensure_directory(self.artifacts_dir / "signatures")
|
|
self.metadata_dir = ensure_directory(self.artifacts_dir / "metadata")
|
|
self.temp_dir = pathlib.Path(tempfile.mkdtemp(prefix="stellaops-release-"))
|
|
self.skip_signing = skip_signing
|
|
self.tlog_upload = tlog_upload
|
|
self.cosign_key_ref = cosign_key_ref or os.environ.get("COSIGN_KEY_REF")
|
|
self.cosign_identity_token = cosign_identity_token or os.environ.get("COSIGN_IDENTITY_TOKEN")
|
|
password = cosign_password if cosign_password is not None else os.environ.get("COSIGN_PASSWORD", "")
|
|
self.cosign_env = {
|
|
"COSIGN_PASSWORD": password,
|
|
"COSIGN_EXPERIMENTAL": "1",
|
|
"COSIGN_ALLOW_HTTP_REGISTRY": os.environ.get("COSIGN_ALLOW_HTTP_REGISTRY", "1"),
|
|
"COSIGN_DOCKER_MEDIA_TYPES": os.environ.get("COSIGN_DOCKER_MEDIA_TYPES", "1"),
|
|
}
|
|
|
|
# ----------------
|
|
# Build steps
|
|
# ----------------
|
|
def run(self) -> Dict[str, Any]:
|
|
components_result = []
|
|
if self.dry_run:
|
|
print("⚠️ Dry-run enabled; commands will be skipped")
|
|
self._prime_buildx_plugin()
|
|
for component in self.config.get("components", []):
|
|
result = self._build_component(component)
|
|
components_result.append(result)
|
|
helm_meta = self._package_helm()
|
|
compose_meta = self._digest_compose_files()
|
|
manifest = self._compose_manifest(components_result, helm_meta, compose_meta)
|
|
return manifest
|
|
|
|
def _prime_buildx_plugin(self) -> None:
|
|
plugin_cfg = self.config.get("buildxPlugin")
|
|
if not plugin_cfg:
|
|
return
|
|
project = plugin_cfg.get("project")
|
|
if not project:
|
|
return
|
|
out_dir = ensure_directory(self.temp_dir / "buildx")
|
|
if not self.dry_run:
|
|
run([
|
|
"dotnet",
|
|
"publish",
|
|
project,
|
|
"-c",
|
|
"Release",
|
|
"-o",
|
|
str(out_dir),
|
|
])
|
|
cas_dir = ensure_directory(self.temp_dir / "cas")
|
|
run([
|
|
"dotnet",
|
|
str(out_dir / "StellaOps.Scanner.Sbomer.BuildXPlugin.dll"),
|
|
"handshake",
|
|
"--manifest",
|
|
str(out_dir),
|
|
"--cas",
|
|
str(cas_dir),
|
|
])
|
|
|
|
def _component_tags(self, repo: str) -> List[str]:
|
|
base = f"{self.registry}/{repo}"
|
|
tags = [f"{base}:{self.version}"]
|
|
if self.channel:
|
|
tags.append(f"{base}:{self.channel}")
|
|
return tags
|
|
|
|
def _component_ref(self, repo: str, digest: str) -> str:
|
|
return f"{self.registry}/{repo}@{digest}"
|
|
|
|
def _build_component(self, component: Mapping[str, Any]) -> Mapping[str, Any]:
|
|
name = component["name"]
|
|
repo = component.get("repository", name)
|
|
kind = component.get("kind", "dotnet-service")
|
|
dockerfile = component.get("dockerfile")
|
|
if not dockerfile:
|
|
raise ValueError(f"Component {name} missing dockerfile")
|
|
context = component.get("context", ".")
|
|
iid_file = self.temp_dir / f"{name}.iid"
|
|
metadata_file = self.metadata_dir / f"{name}.metadata.json"
|
|
|
|
build_args = {
|
|
"VERSION": self.version,
|
|
"CHANNEL": self.channel,
|
|
"GIT_SHA": self.git_sha,
|
|
"SOURCE_DATE_EPOCH": self.source_date_epoch,
|
|
}
|
|
docker_cfg = self.config.get("docker", {})
|
|
if kind == "dotnet-service":
|
|
build_args.update({
|
|
"PROJECT": component["project"],
|
|
"ENTRYPOINT_DLL": component["entrypoint"],
|
|
"SDK_IMAGE": docker_cfg.get("sdkImage", "mcr.microsoft.com/dotnet/nightly/sdk:10.0"),
|
|
"RUNTIME_IMAGE": docker_cfg.get("runtimeImage", "gcr.io/distroless/dotnet/aspnet:latest"),
|
|
})
|
|
elif kind == "angular-ui":
|
|
build_args.update({
|
|
"NODE_IMAGE": docker_cfg.get("nodeImage", "node:20.14.0-bookworm"),
|
|
"NGINX_IMAGE": docker_cfg.get("nginxImage", "nginx:1.27-alpine"),
|
|
})
|
|
else:
|
|
raise ValueError(f"Unsupported component kind {kind}")
|
|
|
|
tags = self._component_tags(repo)
|
|
build_cmd = [
|
|
"docker",
|
|
"buildx",
|
|
"build",
|
|
"--file",
|
|
dockerfile,
|
|
"--metadata-file",
|
|
str(metadata_file),
|
|
"--iidfile",
|
|
str(iid_file),
|
|
"--progress",
|
|
"plain",
|
|
"--platform",
|
|
",".join(self.platforms),
|
|
]
|
|
for key, value in build_args.items():
|
|
build_cmd.extend(["--build-arg", f"{key}={value}"])
|
|
for tag in tags:
|
|
build_cmd.extend(["--tag", tag])
|
|
build_cmd.extend([
|
|
"--attest",
|
|
"type=sbom",
|
|
"--attest",
|
|
"type=provenance,mode=max",
|
|
])
|
|
if self.push:
|
|
build_cmd.append("--push")
|
|
else:
|
|
build_cmd.append("--load")
|
|
build_cmd.append(context)
|
|
|
|
if not self.dry_run:
|
|
run(build_cmd, cwd=self.repo_root)
|
|
|
|
digest = iid_file.read_text(encoding="utf-8").strip() if iid_file.exists() else ""
|
|
image_ref = self._component_ref(repo, digest) if digest else ""
|
|
|
|
bundle_info = self._sign_image(name, image_ref, tags)
|
|
sbom_info = self._generate_sbom(name, image_ref)
|
|
provenance_info = self._attach_provenance(name, image_ref)
|
|
|
|
component_entry = OrderedDict()
|
|
component_entry["name"] = name
|
|
if digest:
|
|
component_entry["image"] = image_ref
|
|
component_entry["tags"] = tags
|
|
if sbom_info:
|
|
component_entry["sbom"] = sbom_info
|
|
if provenance_info:
|
|
component_entry["provenance"] = provenance_info
|
|
if bundle_info:
|
|
component_entry["signature"] = bundle_info
|
|
if metadata_file.exists():
|
|
component_entry["metadata"] = str(metadata_file.relative_to(self.output_dir.parent)) if metadata_file.is_relative_to(self.output_dir.parent) else str(metadata_file)
|
|
return component_entry
|
|
|
|
def _sign_image(self, name: str, image_ref: str, tags: Sequence[str]) -> Optional[Mapping[str, Any]]:
|
|
if self.skip_signing:
|
|
return None
|
|
if not image_ref:
|
|
return None
|
|
if not (self.cosign_key_ref or self.cosign_identity_token):
|
|
raise ValueError("Signing requested but no cosign key or identity token provided. Use --skip-signing to bypass.")
|
|
signature_path = self.signature_dir / f"{name}.signature"
|
|
cmd = ["cosign", "sign", "--yes"]
|
|
if self.cosign_key_ref:
|
|
cmd.extend(["--key", self.cosign_key_ref])
|
|
if self.cosign_identity_token:
|
|
cmd.extend(["--identity-token", self.cosign_identity_token])
|
|
if not self.tlog_upload:
|
|
cmd.append("--tlog-upload=false")
|
|
cmd.append("--allow-http-registry")
|
|
cmd.append(image_ref)
|
|
if self.dry_run:
|
|
return None
|
|
run(cmd, env=self.cosign_env)
|
|
signature_data = run([
|
|
"cosign",
|
|
"download",
|
|
"signature",
|
|
"--allow-http-registry",
|
|
image_ref,
|
|
])
|
|
signature_path.write_text(signature_data, encoding="utf-8")
|
|
signature_ref = run([
|
|
"cosign",
|
|
"triangulate",
|
|
"--allow-http-registry",
|
|
image_ref,
|
|
]).strip()
|
|
return OrderedDict(
|
|
(
|
|
("signature", OrderedDict((
|
|
("path", str(signature_path.relative_to(self.output_dir.parent)) if signature_path.is_relative_to(self.output_dir.parent) else str(signature_path)),
|
|
("ref", signature_ref),
|
|
("tlogUploaded", self.tlog_upload),
|
|
))),
|
|
)
|
|
)
|
|
|
|
def _generate_sbom(self, name: str, image_ref: str) -> Optional[Mapping[str, Any]]:
|
|
if not image_ref or self.dry_run:
|
|
return None
|
|
sbom_path = self.sboms_dir / f"{name}.cyclonedx.json"
|
|
run([
|
|
"docker",
|
|
"sbom",
|
|
image_ref,
|
|
"--format",
|
|
"cyclonedx-json",
|
|
"--output",
|
|
str(sbom_path),
|
|
])
|
|
entry = OrderedDict((
|
|
("path", str(sbom_path.relative_to(self.output_dir.parent)) if sbom_path.is_relative_to(self.output_dir.parent) else str(sbom_path)),
|
|
("sha256", compute_sha256(sbom_path)),
|
|
))
|
|
if self.skip_signing:
|
|
return entry
|
|
attach_cmd = [
|
|
"cosign",
|
|
"attach",
|
|
"sbom",
|
|
"--sbom",
|
|
str(sbom_path),
|
|
"--type",
|
|
"cyclonedx",
|
|
]
|
|
if self.cosign_key_ref:
|
|
attach_cmd.extend(["--key", self.cosign_key_ref])
|
|
attach_cmd.append("--allow-http-registry")
|
|
attach_cmd.append(image_ref)
|
|
run(attach_cmd, env=self.cosign_env)
|
|
reference = run(["cosign", "triangulate", "--type", "sbom", "--allow-http-registry", image_ref]).strip()
|
|
entry["ref"] = reference
|
|
return entry
|
|
|
|
def _attach_provenance(self, name: str, image_ref: str) -> Optional[Mapping[str, Any]]:
|
|
if not image_ref or self.dry_run:
|
|
return None
|
|
predicate = OrderedDict()
|
|
predicate["buildDefinition"] = OrderedDict(
|
|
(
|
|
("buildType", "https://git.stella-ops.org/stellaops/release"),
|
|
("externalParameters", OrderedDict((
|
|
("component", name),
|
|
("version", self.version),
|
|
("channel", self.channel),
|
|
))),
|
|
)
|
|
)
|
|
predicate["runDetails"] = OrderedDict(
|
|
(
|
|
("builder", OrderedDict((("id", "https://github.com/actions"),))),
|
|
("metadata", OrderedDict((("finishedOn", self.release_date),))),
|
|
)
|
|
)
|
|
predicate_path = self.provenance_dir / f"{name}.provenance.json"
|
|
with predicate_path.open("w", encoding="utf-8") as handle:
|
|
json.dump(predicate, handle, indent=2, sort_keys=True)
|
|
handle.write("\n")
|
|
entry = OrderedDict((
|
|
("path", str(predicate_path.relative_to(self.output_dir.parent)) if predicate_path.is_relative_to(self.output_dir.parent) else str(predicate_path)),
|
|
("sha256", compute_sha256(predicate_path)),
|
|
))
|
|
if self.skip_signing:
|
|
return entry
|
|
cmd = [
|
|
"cosign",
|
|
"attest",
|
|
"--predicate",
|
|
str(predicate_path),
|
|
"--type",
|
|
"https://slsa.dev/provenance/v1",
|
|
]
|
|
if self.cosign_key_ref:
|
|
cmd.extend(["--key", self.cosign_key_ref])
|
|
if not self.tlog_upload:
|
|
cmd.append("--tlog-upload=false")
|
|
cmd.append("--allow-http-registry")
|
|
cmd.append(image_ref)
|
|
run(cmd, env=self.cosign_env)
|
|
ref = run([
|
|
"cosign",
|
|
"triangulate",
|
|
"--type",
|
|
"https://slsa.dev/provenance/v1",
|
|
"--allow-http-registry",
|
|
image_ref,
|
|
]).strip()
|
|
entry["ref"] = ref
|
|
return entry
|
|
|
|
# ----------------
|
|
# Helm + compose
|
|
# ----------------
|
|
def _package_helm(self) -> Optional[Mapping[str, Any]]:
|
|
helm_cfg = self.config.get("helm")
|
|
if not helm_cfg:
|
|
return None
|
|
chart_path = helm_cfg.get("chartPath")
|
|
if not chart_path:
|
|
return None
|
|
chart_dir = self.repo_root / chart_path
|
|
output_dir = ensure_directory(self.output_dir / "helm")
|
|
archive_path = output_dir / f"stellaops-{self.version}.tgz"
|
|
if not self.dry_run:
|
|
cmd = [
|
|
"helm",
|
|
"package",
|
|
str(chart_dir),
|
|
"--destination",
|
|
str(output_dir),
|
|
"--version",
|
|
self.version,
|
|
"--app-version",
|
|
self.version,
|
|
]
|
|
run(cmd)
|
|
packaged = next(output_dir.glob("*.tgz"), None)
|
|
if packaged and packaged != archive_path:
|
|
packaged.rename(archive_path)
|
|
digest = compute_sha256(archive_path) if archive_path.exists() else None
|
|
if archive_path.exists() and archive_path.is_relative_to(self.output_dir):
|
|
manifest_path = str(archive_path.relative_to(self.output_dir))
|
|
elif archive_path.exists() and archive_path.is_relative_to(self.output_dir.parent):
|
|
manifest_path = str(archive_path.relative_to(self.output_dir.parent))
|
|
else:
|
|
manifest_path = f"helm/{archive_path.name}"
|
|
return OrderedDict((
|
|
("name", "stellaops"),
|
|
("version", self.version),
|
|
("path", manifest_path),
|
|
("sha256", digest),
|
|
))
|
|
|
|
def _digest_compose_files(self) -> List[Mapping[str, Any]]:
|
|
compose_cfg = self.config.get("compose", {})
|
|
files = compose_cfg.get("files", [])
|
|
entries: List[Mapping[str, Any]] = []
|
|
for rel_path in files:
|
|
src = self.repo_root / rel_path
|
|
if not src.exists():
|
|
continue
|
|
digest = compute_sha256(src)
|
|
entries.append(OrderedDict((
|
|
("name", pathlib.Path(rel_path).name),
|
|
("path", rel_path),
|
|
("sha256", digest),
|
|
)))
|
|
return entries
|
|
|
|
# ----------------
|
|
# Manifest assembly
|
|
# ----------------
|
|
def _compose_manifest(
|
|
self,
|
|
components: List[Mapping[str, Any]],
|
|
helm_meta: Optional[Mapping[str, Any]],
|
|
compose_meta: List[Mapping[str, Any]],
|
|
) -> Dict[str, Any]:
|
|
manifest = OrderedDict()
|
|
manifest["release"] = OrderedDict((
|
|
("version", self.version),
|
|
("channel", self.channel),
|
|
("date", self.release_date),
|
|
("calendar", self.calendar),
|
|
))
|
|
manifest["components"] = components
|
|
if helm_meta:
|
|
manifest["charts"] = [helm_meta]
|
|
if compose_meta:
|
|
manifest["compose"] = compose_meta
|
|
return manifest
|
|
|
|
|
|
def parse_args(argv: Optional[Sequence[str]] = None) -> argparse.Namespace:
|
|
parser = argparse.ArgumentParser(description="Build StellaOps release artefacts deterministically")
|
|
parser.add_argument("--config", type=pathlib.Path, default=DEFAULT_CONFIG, help="Path to release config JSON")
|
|
parser.add_argument("--version", required=True, help="Release version string (e.g. 2025.10.0-edge)")
|
|
parser.add_argument("--channel", required=True, help="Release channel (edge|stable|lts)")
|
|
parser.add_argument("--calendar", help="Calendar tag (YYYY.MM); defaults derived from version")
|
|
parser.add_argument("--git-sha", default=os.environ.get("GIT_COMMIT", "unknown"), help="Git revision to embed")
|
|
parser.add_argument("--output", type=pathlib.Path, default=REPO_ROOT / "out/release", help="Output directory for artefacts")
|
|
parser.add_argument("--no-push", action="store_true", help="Do not push images (use docker load)")
|
|
parser.add_argument("--dry-run", action="store_true", help="Print steps without executing commands")
|
|
parser.add_argument("--registry", help="Override registry root (e.g. localhost:5000/stellaops)")
|
|
parser.add_argument("--platform", dest="platforms", action="append", metavar="PLATFORM", help="Override build platforms (repeatable)")
|
|
parser.add_argument("--skip-signing", action="store_true", help="Skip cosign signing/attestation steps")
|
|
parser.add_argument("--cosign-key", dest="cosign_key", help="Override COSIGN_KEY_REF value")
|
|
parser.add_argument("--cosign-password", dest="cosign_password", help="Password for cosign key")
|
|
parser.add_argument("--cosign-identity-token", dest="cosign_identity_token", help="Identity token for keyless cosign flows")
|
|
parser.add_argument("--no-transparency", action="store_true", help="Disable Rekor transparency log upload during signing")
|
|
return parser.parse_args(argv)
|
|
|
|
|
|
def write_manifest(manifest: Mapping[str, Any], output_dir: pathlib.Path) -> pathlib.Path:
|
|
# Copy manifest to avoid mutating input when computing checksum
|
|
base_manifest = OrderedDict(manifest)
|
|
yaml_without_checksum = dump_yaml(base_manifest)
|
|
digest = hashlib.sha256(yaml_without_checksum.encode("utf-8")).hexdigest()
|
|
manifest_with_checksum = OrderedDict(base_manifest)
|
|
manifest_with_checksum["checksums"] = OrderedDict((("sha256", digest),))
|
|
final_yaml = dump_yaml(manifest_with_checksum)
|
|
output_path = output_dir / "release.yaml"
|
|
with output_path.open("w", encoding="utf-8") as handle:
|
|
handle.write(final_yaml)
|
|
return output_path
|
|
|
|
|
|
def main(argv: Optional[Sequence[str]] = None) -> int:
|
|
args = parse_args(argv)
|
|
config = load_json_config(args.config)
|
|
release_date = utc_now_iso()
|
|
calendar = sanitize_calendar(args.version, args.calendar)
|
|
builder = ReleaseBuilder(
|
|
repo_root=REPO_ROOT,
|
|
config=config,
|
|
version=args.version,
|
|
channel=args.channel,
|
|
calendar=calendar,
|
|
release_date=release_date,
|
|
git_sha=args.git_sha,
|
|
output_dir=args.output,
|
|
push=not args.no_push,
|
|
dry_run=args.dry_run,
|
|
registry_override=args.registry,
|
|
platforms_override=args.platforms,
|
|
skip_signing=args.skip_signing,
|
|
cosign_key_ref=args.cosign_key,
|
|
cosign_password=args.cosign_password,
|
|
cosign_identity_token=args.cosign_identity_token,
|
|
tlog_upload=not args.no_transparency,
|
|
)
|
|
manifest = builder.run()
|
|
manifest_path = write_manifest(manifest, builder.output_dir)
|
|
print(f"✅ Release manifest written to {manifest_path}")
|
|
return 0
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|