FluxCD MCP Server

name: push-manifests
on:
  workflow_dispatch:

permissions:
  contents: read

env:
  CONTROLLER: ${{ github.event.repository.name }}

jobs:
  flux-push:
    runs-on: ubuntu-latest
    permissions:
      id-token: write # for creating OIDC tokens for signing.
      packages: write # for pushing and signing container images.
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Kustomize
        uses: fluxcd/pkg/actions/kustomize@main
      - name: Setup Flux
        uses: fluxcd/flux2/action@ac71dd88a3e6170a068873ea78aafe90f8c9c82c #v2.8.0
      - name: Prepare
        id: prep
        run: |
          RELEASE=$(gh release view --json tagName -q '.tagName')
          VERSION="${RELEASE}-$(date +%s)"
          echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Login to GitHub Container Registry
        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
        with:
          cosign-release: v2.6.1 # TODO: remove after Flux 2.8 with support for cosign v3
      - name: Push and sign manifests
        env:
          COSIGN_EXPERIMENTAL: 1
        run: |
          set -euo pipefail
          
          make build-manifests
          
          img_digest=$(flux push artifact \
          oci://ghcr.io/controlplaneio-fluxcd/${{ env.CONTROLLER }}-manifests:${{ steps.prep.outputs.VERSION }} \
          --path=disto \
          --source=${{ github.repositoryUrl }} \
          --revision="${{ github.ref_name }}@sha1:${{ github.sha }}" \
          --annotations='org.opencontainers.image.description=Flux Operator' \
          --output=json | jq -r '.digest')
          
          cosign sign --yes ghcr.io/controlplaneio-fluxcd/${{ env.CONTROLLER }}-manifests@${img_digest}
          
          flux tag artifact oci://ghcr.io/controlplaneio-fluxcd/${{ env.CONTROLLER }}-manifests:${{ steps.prep.outputs.VERSION }} --tag=latest