From bf23a5966dff8251664c3d9c626b018c7f71fb04 Mon Sep 17 00:00:00 2001 From: Diego Braga Date: Wed, 5 Aug 2026 12:58:21 +0200 Subject: [PATCH 1/3] ci(release-tag): use shared reusable multi-platform build --- .github/workflows/release-tag.yaml | 56 ++++++------------------------ 1 file changed, 11 insertions(+), 45 deletions(-) diff --git a/.github/workflows/release-tag.yaml b/.github/workflows/release-tag.yaml index 2b5b63e..9729cab 100644 --- a/.github/workflows/release-tag.yaml +++ b/.github/workflows/release-tag.yaml @@ -1,10 +1,10 @@ -# Canonical Krateo COMPONENT (code-repo) release workflow — THE single way every krateo-* -# code repo builds & pushes its image and (if it owns CRDs) publishes them. Identical -# byte-for-byte across ALL component repos (no per-repo config); everything is derived from -# the repo itself. +# Krateo COMPONENT (code-repo) release workflow. The `build` job now calls the SHARED reusable +# multi-platform image build (krateo-platformops/.github) — one source of truth, no per-repo drift +# (the multi-arch build can never regress to a single-arch image again). The `crds` job stays +# component-specific. # -# • build — ONE multi-platform image (linux/amd64 + linux/arm64) via docker/build-push-action@v7 -# (QEMU + buildx), tagged from the pushed git tag. Image = ghcr.io/. +# • build — ONE multi-platform image (linux/amd64 + linux/arm64) via the shared reusable +# workflow. Image = ghcr.io/. # • crds — only acts for CRD-owning repos: runs `make generate` (the single agnostic entry # point each CRD repo exposes; repos without it skip cleanly), then opens a PR into # the component's chart repo (braghettos/-chart) refreshing crds-subchart/, @@ -15,50 +15,16 @@ on: push: tags: ["[0-9]+.[0-9]+.[0-9]+"] -env: - GHCR_REPO: ghcr.io/${{ github.repository }} - jobs: build: - name: Build & push image (multi-platform) - runs-on: ubuntu-latest + # Shared multi-platform build (linux/amd64 + linux/arm64) — see + # krateo-platformops/.github/.github/workflows/component-image-build.yaml + uses: krateo-platformops/.github/.github/workflows/component-image-build.yaml@main permissions: contents: read packages: write - steps: - - name: Checkout - uses: actions/checkout@v5 - - - name: Docker meta - id: meta - uses: docker/metadata-action@v6 - with: - images: ${{ env.GHCR_REPO }} - - - name: Login to GHCR - uses: docker/login-action@v4 - with: - registry: ghcr.io - username: ${{ github.repository_owner }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Set up QEMU - uses: docker/setup-qemu-action@v3 - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 - - # ONE job, multi-platform manifest list built with buildx (arm64 via QEMU emulation). - - name: Build and push (linux/amd64, linux/arm64) - uses: docker/build-push-action@v7 - with: - platforms: linux/amd64,linux/arm64 - push: true - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - - - name: Inspect image - run: docker buildx imagetools inspect ${{ env.GHCR_REPO }}:${{ steps.meta.outputs.version }} + with: + context: . crds: name: Generate & publish crds-subchart From 455adbc3992902198973085a1a62d14025ccedca Mon Sep 17 00:00:00 2001 From: Diego Braga Date: Wed, 5 Aug 2026 13:54:48 +0200 Subject: [PATCH 2/3] ci(release-pullrequest): use shared reusable build + go-checks Co-Authored-By: Claude Opus 4.8 Claude-Session: https://claude.ai/code/session_01LJsLqtryCgWwEt8FnPE1se --- .github/workflows/release-pullrequest.yaml | 74 ++++------------------ 1 file changed, 14 insertions(+), 60 deletions(-) diff --git a/.github/workflows/release-pullrequest.yaml b/.github/workflows/release-pullrequest.yaml index d958d34..63d7855 100644 --- a/.github/workflows/release-pullrequest.yaml +++ b/.github/workflows/release-pullrequest.yaml @@ -1,3 +1,6 @@ +# PR CI via shared reusable workflows (krateo-platformops/.github): a validate-only multi-platform +# image build (component-image-build, push: false) + Go checks (component-go-checks: unit tests) +# run from the repo-root module. One source of truth, and go/-fold-safe. name: release-pullrequest on: @@ -5,68 +8,19 @@ on: branches: - main -env: - GHCR_REPO: ghcr.io/${{ github.repository }} - jobs: build: - name: Build and Push - strategy: - matrix: - runner: [ubuntu-22.04-arm, ubuntu-22.04] - include: - - runner: ubuntu-22.04-arm - platform: linux/arm64 - - runner: ubuntu-22.04 - platform: linux/amd64 - runs-on: ${{ matrix.runner }} - + uses: krateo-platformops/.github/.github/workflows/component-image-build.yaml@main permissions: contents: read packages: write - - steps: - - name: Prepare - run: | - platform=${{ matrix.platform }} - echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV - - - name: Docker meta - id: meta - uses: docker/metadata-action@v6 - with: - images: ${{ env.GHCR_REPO }} - - - name: Login to GHCR - uses: docker/login-action@v4 - with: - registry: ghcr.io - username: ${{ github.repository_owner }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v4 - - - name: Build and NOT push - id: build - uses: docker/build-push-action@v7 - with: - platforms: ${{ matrix.platform }} - push: false - labels: ${{ steps.meta.outputs.labels }} - - test: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v6 - - uses: actions/setup-go@v6 - with: - go-version: 'stable' - - name: Gather dependencies - run: go mod download - - name: Run coverage - run: go test -race -tags=unit,integration -p 1 -timeout 30m -coverprofile=coverage.txt -covermode=atomic ./... -coverpkg=./... - - name: Upload coverage to Codecov - uses: codecov/codecov-action@v6 - with: - token: ${{ secrets.CODECOV_TOKEN }} \ No newline at end of file + with: + context: . + push: false + + checks: + uses: krateo-platformops/.github/.github/workflows/component-go-checks.yaml@main + with: + module: . + crd_drift: false + secrets: inherit From acc0f67800d17dbcf83534b848d1911e841d07a0 Mon Sep 17 00:00:00 2001 From: Diego Braga Date: Wed, 5 Aug 2026 14:42:14 +0200 Subject: [PATCH 3/3] ci(release-pullrequest): preserve original go test args via test_args --- .github/workflows/release-pullrequest.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/release-pullrequest.yaml b/.github/workflows/release-pullrequest.yaml index 63d7855..e72f6a5 100644 --- a/.github/workflows/release-pullrequest.yaml +++ b/.github/workflows/release-pullrequest.yaml @@ -23,4 +23,6 @@ jobs: with: module: . crd_drift: false + test_args: >- + -race -tags=unit,integration -p 1 -timeout 30m -coverprofile=coverage.txt -covermode=atomic ./... -coverpkg=./... secrets: inherit