ci: Add release docker images release pipeline

.github/workflows/ci.yml

@@ -68,7 +68,7 @@ jobs:
 
   ci:
     name: ci
-    uses: idirze/workflows/.github/workflows/helm-lint.yml@main
+    uses: okdp/gh-workflows/.github/workflows/helm-lint-template.yml@v1
 
 
 

.github/workflows/docker-rebuild.yml

@@ -0,0 +1,49 @@
+#
+# Copyright 2024 tosit.io
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: docker-rebuild 
+
+on:
+  ### Periodically rebuild all the images to fix os security vulnerabilities
+  schedule:
+    # At 05:00 AM, only on Tuesday
+    #- cron: "0 5 * * 2"
+    # https://crontab.cronhub.io/
+    # At 05:"0 AM, only on Tuesday
+    - cron: "0 5 * * 2"
+  # The release should be created manually (or with user token=pr approval/merge) in order to trigger the event
+  ### https://github.com/orgs/community/discussions/25281
+  ### Instead of using the event, we call the workflow from release-please workflow (more secure)
+  #release:
+  #  types: [published]
+
+  workflow_dispatch:
+
+# https://docs.github.com/en/actions/using-jobs/using-concurrency
+concurrency:
+  # Only cancel in-progress jobs or runs for the current workflow - matches against branch & tags
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  packages: write
+
+jobs:
+
+  rebuild-docker-image:
+    uses: okdp/gh-workflows/.github/workflows/docker-publish-template.yml@v1
+    secrets: inherit
+

.github/workflows/release-please.yml

@@ -27,18 +27,12 @@ permissions:
   contents: write
   pull-requests: write
 
-# https://docs.github.com/en/actions/using-jobs/using-concurrency
-concurrency:
-  # Only cancel in-progress jobs or runs for the current workflow - matches against branch & tags
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 defaults:
   run:
     shell: bash
 
 jobs:
   release-please:
-    uses: idirze/workflows/.github/workflows/helm-release-please.yml@main
+    uses: okdp/gh-workflows/.github/workflows/helm-docker-release-please.yml@v1
     secrets: inherit
 

docker/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "superset",
+  "version": "4.0.2-1.0.0",
+  "description": "Superset docker image",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/okdp/superset"
+  },
+  "homepage": "https://okdp.io/",
+  "license": "Apache-2.0"
+}

helm/superset/README.md

@@ -23,7 +23,7 @@ NOTE: This file is generated by helm-docs: https://github.com/norwoodj/helm-docs
 
 # superset
 
-![Version: 0.12.10-rc1](https://img.shields.io/badge/Version-0.12.10--rc1-informational?style=flat-square)
+![Version: 0.12.10-rc.1](https://img.shields.io/badge/Version-0.12.10--rc.1-informational?style=flat-square)
 
 Apache Superset is a modern, enterprise-ready business intelligence web application
 
@@ -40,8 +40,7 @@ Objectively, the chart provides the following features:
 ## TL;DR
 
 ```console
-$ helm repo add odkp http://okdp.github.io/charts
-$ helm install my-superset odkp/superset
+$ helm install my-release oci://quay.io/okdp/charts/superset --version 0.12.10-rc.1
 ```
 
 ## Requirements
@@ -61,20 +60,12 @@ Use can use the [following command](https://superset.apache.org/docs/configurati
 $ openssl rand -base64 42
 ```
 
-To deploy the chart with a release name `my-release`:
-
-1. First, add the okdp helm charts repository:
-
-```console
-$ helm repo add okdp https://okdp.github.io/charts
-```
-
-2. Then, install the chart with the release name `my-release`:
+To install the chart with the release name `my-release`:
 
 ```console
-$ helm upgrade --cleanup-on-fail --install \
-      --version 0.12.10-rc1 \
-      --set okdp.superset.superset_secret_key=$(openssl rand -base64 42) my-release okdp/superset
+$ helm upgrade --cleanup-on-fail --install my-release oci://quay.io/okdp/charts/superset \
+      --version 0.12.10-rc.1 \
+      --set okdp.superset.superset_secret_key=$(openssl rand -base64 42)
 ```
 
 ## Customizing the values
@@ -87,9 +78,9 @@ The chart provides two main sections:
 You can ccustomize the sample [values file](./sample-values.yaml) with your own Oauth2/OpenId provider, Oauth groups mappings, ingress endpoint and deploy the chart like the following:
 
 ```console
-$ helm upgrade --cleanup-on-fail --install \
-      --version 0.12.10-rc1 \
-      --values sample-values.yaml my-release okdp/superset
+$ helm upgrade --cleanup-on-fail --install my-release oci://quay.io/okdp/charts/superset \
+      --version 0.12.10-rc.1 \
+      --values sample-values.yaml
 ```
 
 ## Values

helm/superset/sample-values.yaml

@@ -75,6 +75,10 @@ okdp:
       }
 
 superset:
+  image:
+    repository: quay.io/okdp/okdp-superset
+    tag: 4.0.2-1.0.0
+    pullPolicy: IfNotPresent
   supersetNode:
     # Connections to an existing database and cache
     connections:

helm/superset/values.yaml

@@ -35,7 +35,7 @@ okdp:
     #
     # See also <a href='https://superset.apache.org/docs/configuration/configuring-superset/#superset_configpy'>Superset configuration.</a>
     # @section -- OKDP Specifc configuration
-    superset_secret_key: ""
+    superset_secret_key: "bnAL0bMMkEeQuw5ZOsFNrO5FGRmBFJwYIlkU3qoFU0txlvFJkLurRw9k"
     # -- Define superset extra configuration as python code
     # @notationType -- python
     # @section -- OKDP Specifc configuration

release-please-config.json

@@ -1,18 +1,65 @@
 {
+  "separate-pull-requests": true,
+  "include-v-in-tag": true,
   "packages": {
     "helm/superset": {
+      "component": "helm-okdp-superset",
+      "initial-version": "0.12.10-1.0.0",
+      "extra-label": "helm",
+      "tag-separator": "/",
       "changelog-path": "CHANGELOG.md",
       "release-type": "helm",
       "changelog-type": "default",
       "bump-minor-pre-major": false,
       "bump-patch-for-minor-pre-major": false,
       "draft": false,
       "prerelease": false,
-      "initial-version": "0.12.10-rc.1",
-      "include-component-in-tag": true,
-      "include-v-in-tag": true
+      "include-component-in-tag": true
+    },
+    "docker": {
+      "component": "okdp-superset",
+      "initial-version": "4.0.2-1.0.0",
+      "extra-label": "docker",
+      "changelog-path": "CHANGELOG.md",
+      "release-type": "node",
+      "changelog-type": "default",
+      "bump-minor-pre-major": false,
+      "bump-patch-for-minor-pre-major": false,
+      "draft": false,
+      "prerelease": false,
+      "include-component-in-tag": false
     }
   },
+  "changelog-sections": [
+    {
+      "type": "feat",
+      "section": "Features"
+    },
+    {
+      "type": "fix",
+      "section": "Bug Fixes"
+    },
+    {
+      "type": "docs",
+      "section": "Documentation",
+      "hidden": false
+    },
+    {
+      "type": "refactor",
+      "section": "Refactoring",
+      "hidden": false
+    },
+    {
+      "type": "test",
+      "section": "Tests",
+      "hidden": true
+    },
+    {
+      "type": "ci",
+      "section": "Continuous Integration",
+      "hidden": true
+    }
+  ],
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json"
 }