kms/.github/workflows/common-update-argocd.yml at c16345c9badc516c75fef82882f832799dca77a2 · zama-ai/kms · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
name: common-update-argocd

on:
  workflow_call:
    inputs:
      branch-name:
        type: string
        required: true
      argocd-namespace:
        type: string
        required: true
      argocd-app-name:
        type: string
        required: true
      application-image:
        type: string
        required: true
      enclave-deployment:
        type: boolean
        required: false
        default: false
      image-tag:
        type: string
        required: true
      enclave-pcr0:
        type: string
        required: false
      enclave-pcr1:
        type: string
        required: false
      enclave-pcr2:
        type: string
        required: false
    secrets:
      ZWS_BOT_TOKEN:
        required: true

permissions: {}

jobs:
  update-argocd-image-tag:
    name: common-update-argocd/update-argocd-image-tag
    runs-on: ubuntu-latest
    steps:
      # TODO: remove once GitHub runner images ship the CVE-2026-31431 kernel fix
      - name: Workaround CVE-2026-31431 (copy.fail)
        run: |
          echo "install algif_aead /bin/false" | sudo tee /etc/modprobe.d/disable-algif-aead.conf
          if lsmod | grep -q algif_aead; then
            sudo rmmod algif_aead || echo "WARNING: rmmod failed - module may be in use"
          elif modinfo algif_aead 2>/dev/null | grep -q builtin; then
            echo "WARNING: algif_aead built-in - modprobe.d blacklist has no effect"
          fi

      - name: Checkout Project
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          ref: ${{ inputs.branch-name }}
          token: ${{ secrets.ZWS_BOT_TOKEN }}
          repository: 'zama-zws/zws-gitops'
          persist-credentials: true

      - name: Change image tag
        uses: mikefarah/yq@751d8ad57b84f1794661bc70c0afb92a22ad7b3c # v4.53.2
        env:
          ARGOCD_NAMESPACE: ${{ inputs.argocd-namespace }}
          ARGOCD_APP_NAME: ${{ inputs.argocd-app-name }}
          APPLICATION_IMAGE: ${{ inputs.application-image }}
          DOCKER_TAG: ${{ inputs.image-tag }}
        with:
          cmd: |
            pathEnv=".${APPLICATION_IMAGE}.image.tag"  valueEnv="${DOCKER_TAG}" yq -i 'eval(strenv(pathEnv)) = strenv(valueEnv)' ./values/${ARGOCD_NAMESPACE}/${ARGOCD_APP_NAME}/values-${ARGOCD_NAMESPACE}.yaml

      - name: Add enclave deployment
        if: ${{ inputs.enclave-deployment }}
        uses: mikefarah/yq@751d8ad57b84f1794661bc70c0afb92a22ad7b3c # v4.53.2
        env:
          ARGOCD_NAMESPACE: ${{ inputs.argocd-namespace }}
          ARGOCD_APP_NAME: ${{ inputs.argocd-app-name }}
          ENCLAVE_PCR0: ${{ inputs.enclave-pcr0 }}
          ENCLAVE_PCR1: ${{ inputs.enclave-pcr1 }}
          ENCLAVE_PCR2: ${{ inputs.enclave-pcr2 }}
        with:
          cmd: |
            pathEnv=".kmsParties.awsKms.recipientAttestationImageSHA384"  valueEnv="${ENCLAVE_PCR0}" yq -i 'eval(strenv(pathEnv)) = strenv(valueEnv)' ./values/${ARGOCD_NAMESPACE}/tkms-infra/values.yaml
            pathEnv=".kmsCore.thresholdMode.tls.trustedReleases[0].pcr0"  valueEnv="${ENCLAVE_PCR0}" yq -i 'eval(strenv(pathEnv)) = strenv(valueEnv)' ./values/${ARGOCD_NAMESPACE}/${ARGOCD_APP_NAME}/values-${ARGOCD_NAMESPACE}.yaml
            pathEnv=".kmsCore.thresholdMode.tls.trustedReleases[0].pcr1"  valueEnv="${ENCLAVE_PCR1}" yq -i 'eval(strenv(pathEnv)) = strenv(valueEnv)' ./values/${ARGOCD_NAMESPACE}/${ARGOCD_APP_NAME}/values-${ARGOCD_NAMESPACE}.yaml
            pathEnv=".kmsCore.thresholdMode.tls.trustedReleases[0].pcr2"  valueEnv="${ENCLAVE_PCR2}" yq -i 'eval(strenv(pathEnv)) = strenv(valueEnv)' ./values/${ARGOCD_NAMESPACE}/${ARGOCD_APP_NAME}/values-${ARGOCD_NAMESPACE}.yaml

      - name: Commit and push to gitops repository
        env:
          APPLICATION_IMAGE: ${{ inputs.application-image }}
          DOCKER_TAG: ${{ inputs.image-tag }}
        run: |
          git config user.name "zws-bot[bot]"
          git config user.email "zws-bot[bot]@users.noreply.github.com"
          if [ -z "$(git status -s)" ]; then
            echo "No changes to commit"
          else
            git pull
            git add .
            git commit -m "chore: bump ${APPLICATION_IMAGE} image tag to ${DOCKER_TAG}"
            git push
          fi