ci: fixes on release.yml and test-build.yml (#1559)

* chore: add CI env to sign commits correctly for release

* ci: fixes on release.yml and test-build.yml

* ci: changes to test release.yml

* ci: remove docker hub login action

* ci: set lacework-releng github token

* ci: set checkout token

* ci: clean up

* ci: clean up

* ci: clean up

.github/workflows/prepare-release.yml

@@ -23,6 +23,7 @@ jobs:
           GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }}
           GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
           GITHUB_TOKEN: ${{ secrets.TOKEN }}
+          CI: true
         run: |
           make prepare
           echo "$GPG_SECRET_KEY" | base64 --decode | gpg --import --no-tty --batch --yes

.github/workflows/release.yml

@@ -4,7 +4,7 @@ on:
   workflow_dispatch:
   push:
     tags:
-      - 'v[0-9]+.[0-9]+.[0-9]+'
+      - 'v*'
 
 jobs:
   release:
@@ -29,16 +29,16 @@ jobs:
         with:
           go-version: 1.21.x
 
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@v3
-
       - name: Login to Docker Hub
         uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
+      - name: Set up Docker Buildx
+        id: buildx
+        uses: docker/setup-buildx-action@v3
+
       - name: Build Artifacts
         run: |
           make prepare
@@ -66,6 +66,9 @@ jobs:
           scripts/release.sh publish
 
       - name: Build/Push Docker Image
+        env:
+          DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+          DOCKERHUB_PASS: ${{ secrets.DOCKERHUB_PASSWORD }}
         run: |
           scripts/release_containers.sh
 

.github/workflows/test-build.yml

@@ -7,13 +7,18 @@ on:
     branches:
       - main
 
-concurrency:
-  group: ${{ github.workflow }}
-
 jobs:
   run-tests:
     runs-on: ubuntu-latest
     steps:
+      # To wait for the existing test-build run to complete
+      - name: Turnstyle
+        uses: softprops/turnstyle@v1
+        with:
+          same-branch-only: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.TOKEN }}
+
       - name: Checkout repository
         uses: actions/checkout@v4
         with:
@@ -86,11 +91,15 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+        with:
+          ref: main
+          token: ${{ secrets.TOKEN }}
 
       - name: Trigger release
         env:
           GPG_SECRET_KEY: ${{ secrets.GPG_SECRET_KEY }}
           GPG_SIGNING_KEY: ${{ secrets.GPG_SIGNING_KEY }}
+          CI: true
         run: |
           echo "$GPG_SECRET_KEY" | base64 --decode | gpg --import --no-tty --batch --yes
           scripts/release.sh trigger

scripts/release.sh

@@ -271,6 +271,7 @@ push_release() {
   log "commiting and pushing the release to github"
   _version_no_tag=$(echo $VERSION | awk -F. '{printf("%d.%d.%d", $1, $2, $3)}')
   if [ "$CI" != "" ]; then
+    log "configuring git user email, user name and signingkey"
     git config --global user.email $git_email
     git config --global user.name $git_user
     git config --global user.signingkey $GPG_SIGNING_KEY
@@ -387,6 +388,7 @@ bump_version() {
 
   log "commiting and pushing the vertion bump to github"
   if [ "$CI" != "" ]; then
+    log "configuring git user email, user name and signingkey"
     git config --global user.email $git_email
     git config --global user.name $git_user
     git config --global user.signingkey $GPG_SIGNING_KEY