Migrate to custom oci registry

Signed-off-by: Bryan Frimin <bryan@probo.com>
2026-05-25 15:01:35 -07:00
parent bd04f1812a
commit d804c72c07
18 changed files with 224 additions and 44 deletions
--- a/.github/workflows/make.yaml
+++ b/.github/workflows/make.yaml
@@ -131,8 +131,9 @@ jobs:
      - uses: "docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd" # v4.0.0
      - uses: "docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121" # v4.1.0
        with:
-          username: "gearnode"
-          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+          registry: artifact.probo.inc
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
      - uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8
        with:
          name: "binary-linux-${{ matrix.arch }}"
@@ -143,7 +144,8 @@ jobs:
        run: |
          docker buildx build \
            --platform "${{ matrix.platform }}" \
-            --tag "ghcr.io/getprobo/probo:snapshot-${{ matrix.arch }}" \
+            --build-arg "BASE_IMAGE=artifact.probo.inc/docker/library/ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b" \
+            --tag "artifact.probo.inc/probo/probo:snapshot-${{ matrix.arch }}" \
            --load \
            .
      - name: "Cache Trivy database"
@@ -155,7 +157,7 @@ jobs:
      - name: "Scan Docker image with Trivy"
        uses: "aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25" # 0.36.0
        with:
-          image-ref: "ghcr.io/getprobo/probo:snapshot-${{ matrix.arch }}"
+          image-ref: "artifact.probo.inc/probo/probo:snapshot-${{ matrix.arch }}"
          format: "table"
          exit-code: 1
          ignore-unfixed: true
--- a/.github/workflows/release-helm.yaml
+++ b/.github/workflows/release-helm.yaml
@@ -0,0 +1,98 @@
+name: "Release helm"
+
+on:
+  push:
+    tags:
+      - "helm/v*"
+
+permissions:
+  contents: "read"
+
+jobs:
+  publish-helm:
+    name: "publish-helm"
+    runs-on: "runs-on=${{ github.run_id }}/runner=2cpu-linux-x64/extras=s3-cache"
+    permissions:
+      contents: "read"
+    steps:
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6
+      - uses: "runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0" # v2
+      - uses: "azure/setup-helm@b9e51907a09c216f16ebe8536097933489208112" # v4.3.0
+        with:
+          version: "3.17.3"
+      - name: "Validate chart version"
+        run: |
+          VERSION="${GITHUB_REF_NAME##*/v}"
+          CHART_VERSION="$(awk '/^version:/ { print $2 }' contrib/helm/charts/probo/Chart.yaml)"
+          if [ "${CHART_VERSION}" != "${VERSION}" ]; then
+            echo "Chart.yaml version (${CHART_VERSION}) does not match tag (${VERSION})"
+            exit 1
+          fi
+      - name: "Log in to Harbor"
+        run: |
+          helm registry login artifact.probo.inc \
+            --username "${{ secrets.HARBOR_USERNAME }}" \
+            --password "${{ secrets.HARBOR_PASSWORD }}"
+      - name: "Package and push Helm chart"
+        run: |
+          VERSION="${GITHUB_REF_NAME##*/v}"
+          CHART_DIR="contrib/helm/charts/probo"
+
+          helm dependency update "${CHART_DIR}"
+          helm package "${CHART_DIR}"
+          helm push "probo-${VERSION}.tgz" oci://artifact.probo.inc/probo
+      - uses: "actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f" # v7
+        with:
+          name: "helm-chart"
+          path: "probo-*.tgz"
+          retention-days: 1
+
+  github-release:
+    name: "github-release"
+    needs: [publish-helm]
+    runs-on: "runs-on=${{ github.run_id }}/runner=2cpu-linux-x64/extras=s3-cache"
+    permissions:
+      contents: "write"
+    steps:
+      - uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6
+        with:
+          fetch-depth: 0
+      - uses: "runs-on/action@742bf56072eb4845a0f94b3394673e4903c90ff0" # v2
+      - uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8
+        with:
+          name: "helm-chart"
+          path: "."
+      - name: "Extract release notes"
+        run: |
+          VERSION="${GITHUB_REF_NAME##*/v}"
+          APP_VERSION="$(awk '/^appVersion:/ { gsub(/"/, "", $2); print $2 }' contrib/helm/charts/probo/Chart.yaml)"
+          awk -v ver="$VERSION" '
+            /^## \[/ { if (found) exit; if ($0 ~ "\\[" ver "\\]") found=1 }
+            found
+          ' contrib/helm/charts/probo/CHANGELOG.md > release-notes.md
+          cat >> release-notes.md << EOF
+
+          ## Install
+
+          \`\`\`bash
+          helm install my-probo oci://artifact.probo.inc/probo/probo --version ${VERSION}
+          \`\`\`
+
+          Defaults to probod image tag \`v${APP_VERSION}\`.
+          EOF
+      - name: "Create GitHub release"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          PRERELEASE_FLAG=""
+          if echo "${GITHUB_REF_NAME}" | grep -qE '(alpha|beta|rc)'; then
+            PRERELEASE_FLAG="--prerelease"
+          fi
+
+          gh release delete "${GITHUB_REF_NAME}" --yes 2>/dev/null || true
+
+          gh release create "${GITHUB_REF_NAME}" \
+            --title "${GITHUB_REF_NAME}" \
+            --notes-file release-notes.md \
+            $PRERELEASE_FLAG \
+            probo-*.tgz
--- a/.github/workflows/release-probod.yaml
+++ b/.github/workflows/release-probod.yaml
@@ -156,13 +156,9 @@ jobs:
      - uses: "docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd" # v4.0.0
      - uses: "docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2" # v4.0.0
        with:
-          username: "gearnode"
-          password: ${{ secrets.DOCKER_HUB_TOKEN }}
-      - uses: "docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2" # v4.0.0
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: artifact.probo.inc
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
      - uses: "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" # v8
        with:
          name: "binary-linux-${{ matrix.arch }}"
@@ -173,7 +169,7 @@ jobs:
        id: tag
        run: |
          VERSION="${GITHUB_REF_NAME##*/v}"
-          echo "image_tag=probod-v${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "image_tag=v${VERSION}" >> "$GITHUB_OUTPUT"
      - name: "Build and push Docker image"
        env:
          PLATFORM: ${{ matrix.platform }}
@@ -182,6 +178,7 @@ jobs:
        run: |
          docker buildx build \
            --platform "${PLATFORM}" \
+            --build-arg "BASE_IMAGE=artifact.probo.inc/docker/library/ubuntu:24.04@sha256:c4a8d5503dfb2a3eb8ab5f807da5bc69a85730fb49b5cfca2330194ebcc41c7b" \
            --label "org.opencontainers.image.title=probod" \
            --label "org.opencontainers.image.description=Probo compliance management platform" \
            --label "org.opencontainers.image.url=https://github.com/getprobo/probo" \
@@ -189,7 +186,7 @@ jobs:
            --label "org.opencontainers.image.version=${GITHUB_REF_NAME}" \
            --label "org.opencontainers.image.revision=${GITHUB_SHA}" \
            --label "org.opencontainers.image.licenses=MIT" \
-            --tag "ghcr.io/getprobo/probo:${IMAGE_TAG}-${ARCH}" \
+            --tag "artifact.probo.inc/probo/probo:${IMAGE_TAG}-${ARCH}" \
            --push \
            .

@@ -208,35 +205,35 @@ jobs:
      - uses: "docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd" # v4.0.0
      - uses: "docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2" # v4.0.0
        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
+          registry: artifact.probo.inc
+          username: ${{ secrets.HARBOR_USERNAME }}
+          password: ${{ secrets.HARBOR_PASSWORD }}
      - uses: "sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad" # v4.0.0
      - name: "Compute image tag"
        id: tag
        run: |
          VERSION="${GITHUB_REF_NAME##*/v}"
-          echo "image_tag=probod-v${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "image_tag=v${VERSION}" >> "$GITHUB_OUTPUT"
      - name: "Create and push manifest"
        env:
          IMAGE_TAG: ${{ steps.tag.outputs.image_tag }}
        run: |
          docker buildx imagetools create \
-            --tag "ghcr.io/getprobo/probo:${IMAGE_TAG}" \
-            --tag "ghcr.io/getprobo/probo:latest" \
-            "ghcr.io/getprobo/probo:${IMAGE_TAG}-amd64" \
-            "ghcr.io/getprobo/probo:${IMAGE_TAG}-arm64"
+            --tag "artifact.probo.inc/probo/probo:${IMAGE_TAG}" \
+            --tag "artifact.probo.inc/probo/probo:latest" \
+            "artifact.probo.inc/probo/probo:${IMAGE_TAG}-amd64" \
+            "artifact.probo.inc/probo/probo:${IMAGE_TAG}-arm64"
      - name: "Get manifest digest"
        id: digest
        env:
          IMAGE_TAG: ${{ steps.tag.outputs.image_tag }}
        run: |
-          DIGEST=$(docker buildx imagetools inspect "ghcr.io/getprobo/probo:${IMAGE_TAG}" --format '{{json .Manifest.Digest}}' | jq -r)
+          DIGEST=$(docker buildx imagetools inspect "artifact.probo.inc/probo/probo:${IMAGE_TAG}" --format '{{json .Manifest.Digest}}' | jq -r)
          echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
      - name: "Sign Docker manifest"
        env:
          DIGEST: ${{ steps.digest.outputs.digest }}
-        run: cosign sign "ghcr.io/getprobo/probo@${DIGEST}" --yes
+        run: cosign sign "artifact.probo.inc/probo/probo@${DIGEST}" --yes

  github-release:
    name: "github-release"
@@ -288,13 +285,13 @@ jobs:
      - name: "Attest Docker image SBOM"
        uses: "actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26" # v4.1.0
        with:
-          subject-name: "ghcr.io/getprobo/probo"
+          subject-name: "artifact.probo.inc/probo/probo"
          subject-digest: ${{ needs.docker-manifest.outputs.digest }}
          sbom-path: "sbom.json"
      - name: "Trivy scan Docker image"
        uses: "aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25" # 0.36.0
        with:
-          image-ref: "ghcr.io/getprobo/probo:${{ needs.docker-manifest.outputs.image_tag }}"
+          image-ref: "artifact.probo.inc/probo/probo:${{ needs.docker-manifest.outputs.image_tag }}"
          format: "sarif"
          output: "trivy-results.sarif"
          exit-code: 1
@@ -318,8 +315,8 @@ jobs:
          cat >> release-notes.md << EOF

          ## Docker Images
-          - \`ghcr.io/getprobo/probo:${IMAGE_TAG}\` (multi-arch: linux/amd64, linux/arm64)
-          - \`ghcr.io/getprobo/probo:latest\` (multi-arch: linux/amd64, linux/arm64)
+          - \`artifact.probo.inc/probo/probo:${IMAGE_TAG}\` (multi-arch: linux/amd64, linux/arm64)
+          - \`artifact.probo.inc/probo/probo:latest\` (multi-arch: linux/amd64, linux/arm64)
          EOF
      - name: "Create GitHub release"
        env: