chore(ci): release workflow

Author: aleksanderaleksic

.github/workflows/release.yml

@@ -2,100 +2,45 @@ name: release
 
 on:
   release:
-    types: [created, prereleased, released]
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: "Image and chart version tag (e.g. v3.1.0)"
+        required: true
+      latest:
+        description: "Update the latest tag"
+        type: boolean
+        default: true
 
 env:
   REGISTRY: ghcr.io
+  IMAGE: ghcr.io/${{ github.repository }}
+  TAG: ${{ inputs.tag || github.event.release.tag_name }}
 
 jobs:
-  version:
-    # created+draft  → commit-sha build
-    # prereleased    → rc.N build (auto-incremented)
-    # released       → final build
-    # created+!draft → skip (released/prereleased handles it)
-    if: >-
-      github.event.action == 'released' ||
-      github.event.action == 'prereleased' ||
-      (github.event.action == 'created' && github.event.release.draft)
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: read
-    outputs:
-      image_tag: ${{ steps.resolve.outputs.image_tag }}
-      chart_version: ${{ steps.resolve.outputs.chart_version }}
-      app_version: ${{ steps.resolve.outputs.app_version }}
-      is_latest: ${{ steps.resolve.outputs.is_latest }}
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Resolve version
-        id: resolve
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          TAG_NAME="${{ github.event.release.tag_name }}"
-
-          if [[ "${{ github.event.release.draft }}" == "true" ]]; then
-            SHORT_SHA=$(git rev-parse --short HEAD)
-            {
-              echo "image_tag=sha-${SHORT_SHA}"
-              echo "chart_version=${TAG_NAME#v}-sha.${SHORT_SHA}"
-              echo "app_version=sha-${SHORT_SHA}"
-              echo "is_latest=false"
-            } >> "$GITHUB_OUTPUT"
-
-          elif [[ "${{ github.event.release.prerelease }}" == "true" ]]; then
-            OWNER="${{ github.repository_owner }}"
-            PACKAGE="aws-load-balancer-controller"
-
-            EXISTING_TAGS=$( \
-              gh api "/orgs/${OWNER}/packages/container/${PACKAGE}/versions" \
-                --paginate --jq '.[].metadata.container.tags[]' 2>/dev/null \
-              || gh api "/users/${OWNER}/packages/container/${PACKAGE}/versions" \
-                --paginate --jq '.[].metadata.container.tags[]' 2>/dev/null \
-              || true)
-
-            LAST_RC=$(echo "$EXISTING_TAGS" \
-              | grep -E "^${TAG_NAME}-rc\.[0-9]+$" \
-              | sed "s/^${TAG_NAME}-rc\.//" \
-              | sort -n | tail -1)
-
-            NEXT_RC=$((${LAST_RC:-0} + 1))
-            {
-              echo "image_tag=${TAG_NAME}-rc.${NEXT_RC}"
-              echo "chart_version=${TAG_NAME#v}-rc.${NEXT_RC}"
-              echo "app_version=${TAG_NAME}-rc.${NEXT_RC}"
-              echo "is_latest=false"
-            } >> "$GITHUB_OUTPUT"
-
-          else
-            {
-              echo "image_tag=${TAG_NAME}"
-              echo "chart_version=${TAG_NAME#v}"
-              echo "app_version=${TAG_NAME}"
-              echo "is_latest=true"
-            } >> "$GITHUB_OUTPUT"
-          fi
-
-  container-image:
-    needs: version
-    runs-on: ubuntu-latest
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        platform: [linux/amd64, linux/arm64]
+    runs-on: ${{ matrix.platform == 'linux/arm64' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
     permissions:
       contents: read
       packages: write
     steps:
+      - name: Lowercase image name
+        run: echo "IMAGE=${IMAGE,,}" >> "$GITHUB_ENV"
+
       - uses: actions/checkout@v4
         with:
+          ref: ${{ env.TAG }}
           fetch-depth: 0
 
       - name: Read Go version
         id: go
         run: echo "version=$(cat .go-version)" >> "$GITHUB_OUTPUT"
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
@@ -110,31 +55,93 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ${{ env.REGISTRY }}/${{ github.repository }}
-          tags: |
-            type=raw,value=${{ needs.version.outputs.image_tag }}
-            type=raw,value=latest,enable=${{ needs.version.outputs.is_latest }}
+          images: ${{ env.IMAGE }}
 
-      - name: Build and push
+      - name: Build and push by digest
+        id: build
         uses: docker/build-push-action@v6
         with:
           context: .
-          push: true
-          tags: ${{ steps.meta.outputs.tags }}
+          platforms: ${{ matrix.platform }}
           labels: ${{ steps.meta.outputs.labels }}
-          platforms: linux/amd64,linux/arm64
           build-args: |
             BASE_IMAGE=public.ecr.aws/eks-distro-build-tooling/eks-distro-minimal-base-nonroot:2025-12-09-1765306943.2023
             BUILD_IMAGE=public.ecr.aws/docker/library/golang:${{ steps.go.outputs.version }}
+          outputs: type=image,name=${{ env.IMAGE }},push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=${{ github.ref_name }}-${{ matrix.platform }}
+          cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-${{ matrix.platform }}
+
+      - name: Export digest
+        run: |
+          mkdir -p /tmp/digests
+          digest="${{ steps.build.outputs.digest }}"
+          touch "/tmp/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ matrix.platform == 'linux/amd64' && 'amd64' || 'arm64' }}
+          path: /tmp/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  push-image:
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Lowercase image name
+        run: echo "IMAGE=${IMAGE,,}" >> "$GITHUB_ENV"
+
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: /tmp/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE }}
+          tags: |
+            type=raw,value=${{ env.TAG }}
+            type=raw,value=latest,enable=${{ inputs.latest || !github.event.release.prerelease }}
+
+      - name: Create manifest list and push
+        working-directory: /tmp/digests
+        run: |
+          # shellcheck disable=SC2046
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ env.IMAGE }}@sha256:%s ' *)
+
+      - name: Inspect image
+        run: docker buildx imagetools inspect '${{ env.IMAGE }}:${{ env.TAG }}'
 
   helm-chart:
-    needs: version
+    needs: push-image
     runs-on: ubuntu-latest
     permissions:
       contents: read
       packages: write
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ env.TAG }}
 
       - name: Set up Helm
         uses: azure/setup-helm@v4
@@ -147,13 +154,15 @@ jobs:
 
       - name: Package Helm chart
         run: |
+          VERSION="${{ env.TAG }}"
           helm package helm/aws-load-balancer-controller \
-            --version "${{ needs.version.outputs.chart_version }}" \
-            --app-version "${{ needs.version.outputs.app_version }}"
+            --version "${VERSION#v}" \
+            --app-version "${{ env.TAG }}"
 
       - name: Push Helm chart
         run: |
+          VERSION="${{ env.TAG }}"
           REPO_OWNER="${{ github.repository_owner }}"
           helm push \
-            "aws-load-balancer-controller-${{ needs.version.outputs.chart_version }}.tgz" \
+            "aws-load-balancer-controller-${VERSION#v}.tgz" \
             "oci://${{ env.REGISTRY }}/${REPO_OWNER,,}/charts"

Dockerfile

@@ -10,14 +10,16 @@ COPY go.sum go.sum
 # cache deps before building and copying source so that we don't need to re-download as much
 # and so that source changes don't invalidate our downloaded layer
 RUN --mount=type=bind,target=. \
-    GOPROXY=direct go mod download
+    --mount=type=cache,target=/go/pkg/mod \
+    go mod download
 
 FROM base AS build
 ARG TARGETOS
 ARG TARGETARCH
 ENV VERSION_PKG=sigs.k8s.io/aws-load-balancer-controller/pkg/version
 RUN --mount=type=bind,target=. \
     --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
     GIT_VERSION=$(git describe --tags --dirty --always) && \
     GIT_COMMIT=$(git rev-parse HEAD) && \
     BUILD_DATE=$(date +%Y-%m-%dT%H:%M:%S%z) && \