Run git config add safe directory before making changes to testing

Signed-off-by: joshvanl <[email protected]>

Signed-off-by: joshvanl <[email protected]>

Option to write generated prow config, and automatically create pull request against jetstack/te...

Signed-off-by: joshvanl <[email protected]>

jetstack/testing when the cert-manager prow config changes

Signed-off-by: joshvanl <me@joshvanl....

files.

Signed-off-by: joshvanl <[email protected]>

Signed-off-by: joshvanl <[email protected]>

Signed-off-by: joshvanl <[email protected]>

Adds Image to prow context, pass context to job generators.

Hard code and pin images for previous release branches

Signed-off-by: joshvanl <[email protected]>

Enable dind for trivy jobs

Signed-off-by: Ashley Davis <[email protected]>

Upgrade bazelbuild image (fix wrong tag)

Signed-off-by: Tim Ramlot <[email protected]>

Upgrade bazelbuild image

Signed-off-by: Tim Ramlot <[email protected]>

Add generator for trivy scan tests

Signed-off-by: Ashley Davis <[email protected]>

Generate tests based on a single branch name

Signed-off-by: Ashley Davis <[email protected]>

This includes generating presubmit/periodic dashboard names, incorporating
branch names into tes...

Fix handling of periodic gen with multiple branches

Signed-off-by: Ashley Davis <[email protected]>

Changes required post release of 1.9

Signed-off-by: Ashley Davis <[email protected]>

Bump gcb versions of go to 1.18

also runs go mod tidy, and temporarily removes a chunk of our verify job

Signed-off-by: Ashley ...

Generate tests

Signed-off-by: Ashley Davis <[email protected]>

Signed-off-by: Ashley Davis <[email protected]>

Adds .vscode to .gitignore

- adds complete presubmit + periodic generation, across different
"modes" including "previous"...

Signed-off-by: Ashley Davis <[email protected]>

Reduce work + simplify output

The path to which we write staged releases is now simpler for tagged
releases, and the release p...

Signed-off-by: irbekrm <[email protected]>

Use `make publish-release` / update builder image

A goal for the make-based build system is that all commands to build and
stage a release are def...

Signed-off-by: Ashley Davis <[email protected]>

in https://github.com/jetstack/testing/pull/680 we created a version of
bazelbuild which install...

Update to smaller logo

Signed-off-by: Ashley Davis <[email protected]>

add logo to harmonize with other org projects

Signed-off-by: Ashley Davis <[email protected]>

Add support for 'makefile-built' artifacts when publishing

Save makestage artifacts at the same location stage artifacts are saved

Use new --key arg for cosign, replacing deprecated -key

The makefile flow tags images with names such as
"cert-manager-acmesolver-amd64:v1.8.0-alpha.2",...

- support for loading zip files
- renames tarballs to 'archives'
- write github release client b...

Signed-off-by: Ashley Davis <[email protected]>

also does some cleanup of makestage, simplifies things, and adds output
of the GCS target path i...

Re-enable container signing and bump cosign version

Doesn't bump to latest cosign version because it failed to install
cleanly, whereas 1.5.2 is sup...

Add makestage command

This is equivalent to cmrel stage but using the new make flow, which
doesn't run cmrel inside GC...

Update cmrel to use the new cert-manager organization on GitHub

Signed-off-by: Richard Wall <[email protected]>

Commit helm chart and prov in one commit

this addresses a race condition caused by github actions

NB: the "old" CreateFile API call had ...

Use Tar name in binaries.NewFile

Signed-off-by: Jake Sanders <[email protected]>

Adds support for cmctl release target

Signed-off-by: joshvanl <[email protected]>

Don't sign yet, plus attempt to shell to cosign version at start + fix install in gcb

Pass a version number when signing manifests

the name of the chart to be signed is included into the generated prov
file and needs to match t...

Signed-off-by: Ashley Davis <[email protected]>

there aren't enough words in the english language to describe
how painful this process was

Sign...

this gives information about the version of cosign being used as well as
providing a soft early ...

Fix some issues with publishing using cmrel

Signed-off-by: Ashley Davis <[email protected]>

the word "content" is used because it's used in the first line of the
oci registry spec:

"The O...

since GOPATH is not set, the install location will default to
`$HOME/go/bin` which resolves to `...

Fix some fails while staging a release

Signed-off-by: Ashley Davis <[email protected]>

Signed-off-by: Ashley Davis <[email protected]>

Add default KMS where possible, and pass keys in gcb publish job

Signed-off-by: Ashley Davis <[email protected]>

Add container signing during publish

Signed-off-by: Ashley Davis <[email protected]>

Allow running actions for publishing separate artifacts independently

Adds a command-line flag for controlling which parts of the publish
process are actually run on ...

Add standalone signing commands

Adds standalone CLI commands for signing helm charts alone or in bundled
manifest files; these c...

Allow specifying manual arch/os combinations when staging

Use contexts when shelling out to docker

also makes the shell commands more generic with an eye to using them for
cosign, and consolidate...

this should be useful for testing, so that we can, say, only build
linux/amd64

Signed-off-by: A...

Minor cleanup of gcb stage command

the previous code had a superfluous append() and was harder to read

Signed-off-by: Ashley Davis...

Add support for signing helm charts and bundled manifests

This builds on the KMS bootstrapping work to use KMS/PGP to sign helm
charts using helm's own si...

Add script for generating a GPG keyring from an armored key

Ensure that all keys use a static time

these keyrings are required by helm for validating signed charts; this
script is intended to rem...

the reasoning is explained in a comment on keyCreationTimeUnix in
pkg/sign/kmspgp.go - in short,...

Add kms/pgp bootstrapping commands for signing

This adds the "cmrel bootstrap-pgp" command which will start a
cloudbuild job to both bootstrap ...

Get the bazel image from gcr.io/cloud-builders