chore: use kres to manage project

Move to using kres to manage project.

Signed-off-by: Noel Georgi <[email protected]>

.dockerignore

@@ -0,0 +1,8 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2023-11-02T15:47:10Z by kres 32170a7-dirty.
+
+*
+!CHANGELOG.md
+!README.md
+!pkg.yaml

.github/workflows/ci.yaml

@@ -1,8 +1,12 @@
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2023-11-02T16:04:24Z by kres 32170a7-dirty.
+
 name: default
 concurrency:
   group: ${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
-on:
+"on":
   push:
     branches:
       - main
@@ -15,54 +19,58 @@ on:
       - release-*
 jobs:
   default:
-    if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/'))
     permissions:
+      actions: read
+      contents: write
       packages: write
+      pull-requests: read
     runs-on:
       - self-hosted
       - pkgs
-    outputs:
-      labels: ${{ steps.workflow-run-info.outputs.pullRequestLabels }}
+    if: (!startsWith(github.head_ref, 'renovate/') && !startsWith(github.head_ref, 'dependabot/'))
     services:
       buildkitd:
-        image: moby/buildkit:buildx-stable-1
+        image: moby/buildkit:v0.12.2
+        options: --privileged
         ports:
           - 1234:1234
-        options: --privileged
         volumes:
           - /var/lib/buildkit/${{ github.repository }}:/var/lib/buildkit
           - /usr/etc/buildkit/buildkitd.toml:/etc/buildkit/buildkitd.toml
     steps:
       - name: checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: Unshallow
         run: |
           git fetch --prune --unshallow
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         with:
-          driver: remote
-          endpoint: tcp://localhost:1234
           append: |
             - endpoint: tcp://buildkit-arm64.ci.svc.cluster.local:1234
               platforms: linux/arm64
-      - name: build
+          driver: remote
+          endpoint: tcp://localhost:1234
+      - name: Build
         run: |
           make
-      - name: build nonfree
+      - name: Build nonfree
         run: |
           make nonfree
       - name: Login to registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           password: ${{ secrets.GITHUB_TOKEN }}
           registry: ghcr.io
           username: ${{ github.repository_owner }}
       - name: Push to registry
         if: github.event_name != 'pull_request'
         run: |
-          make PUSH=true
+          make  PUSH=true
+      - name: Push nonfree
+        if: github.event_name != 'pull_request'
+        run: |
           make nonfree PUSH=true
       - name: release-notes
         if: startsWith(github.ref, 'refs/tags/')
@@ -74,8 +82,3 @@ jobs:
         with:
           body_path: _out/RELEASE_NOTES.md
           draft: "true"
-      - name: Retrieve workflow info
-        id: workflow-run-info
-        uses: potiuk/get-workflow-origin@v1_5
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}

.gitignore

@@ -1,2 +1,6 @@
-_out/
+# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
+#
+# Generated on 2023-11-02T15:50:53Z by kres latest.
+
+_out
 internal/extensions/image-digests

.kres.yaml

@@ -0,0 +1,113 @@
+---
+kind: pkgfile.Build
+spec:
+  targets:
+    - amdgpu-firmware
+    - amd-ucode
+    - binfmt-misc
+    - bnx2-bnx2x
+    - btrfs
+    - chelsio-drivers
+    - chelsio-firmware
+    - drbd
+    - fuse3
+    - gasket-driver
+    - gvisor
+    - hello-world-service
+    - i915-ucode
+    - intel-ice-firmware
+    - intel-ucode
+    - iscsi-tools
+    - nut-client
+    - nvidia-container-toolkit
+    - nvidia-fabricmanager
+    - nvidia-open-gpu-kernel-modules
+    - qemu-guest-agent
+    - stargz-snapshotter
+    - tailscale
+    - thunderbolt
+    - usb-modem-drivers
+    - util-linux-tools
+    - xe-guest-utilities
+    - zfs
+  additionalTargets:
+    nonfree:
+      - nonfree-kmod-nvidia
+  extraBuildArgs:
+    - TAG
+    - PKGS
+  useBldrPkgTagResolver: true
+---
+kind: common.Build
+spec:
+    ignoredPaths:
+        - "internal/extensions/image-digests"
+---
+kind: auto.CustomSteps
+spec:
+  steps:
+    - name: extensions
+      toplevel: true
+    - name: extensions-metadata
+      toplevel: true
+    - name: internal/extensions/image-digests
+      toplevel: true
+    - name: sign-images
+      toplevel: true
+---
+kind: custom.Step
+name: extensions
+spec:
+  makefile:
+    enabled: true
+    phony: true
+    variables:
+      - name: EXTENSIONS_IMAGE_REF
+        defaultValue: $(REGISTRY_AND_USERNAME)/extensions:$(TAG)
+      - name: PKGS
+        defaultValue: v1.6.0-alpha.0-26-g5f84302
+    depends:
+      - internal/extensions/image-digests
+    script:
+      - |
+        @$(MAKE) docker-$@ TARGET_ARGS="--tag=$(EXTENSIONS_IMAGE_REF) --push=$(PUSH)"
+---
+kind: custom.Step
+name: extensions-metadata
+spec:
+  makefile:
+    enabled: true
+    phony: true
+    depends:
+      - $(ARTIFACTS)/bldr
+    script:
+      - |
+        @rm -f _out/extensions-metadata
+        @$(foreach target,$(TARGETS),echo $(REGISTRY)/$(USERNAME)/$(target):$(shell $(ARTIFACTS)/bldr eval --target $(target) --build-arg TAG=$(TAG) '{{.VERSION}}' 2>/dev/null) >> _out/extensions-metadata;)
+        @$(foreach target,$(NONFREE_TARGETS),echo $(REGISTRY)/$(USERNAME)/$(target):$(shell $(ARTIFACTS)/bldr eval --target $(target) --build-arg TAG=$(TAG) '{{.VERSION}}' 2>/dev/null) >> _out/extensions-metadata;)
+---
+kind: custom.Step
+name: internal/extensions/image-digests
+spec:
+  makefile:
+    enabled: true
+    phony: true
+    depends:
+      - extensions-metadata
+    script:
+      - |
+        @cat _out/extensions-metadata | xargs -I{} sh -c 'echo {}@$$(crane digest {})' > internal/extensions/image-digests
+---
+kind: custom.Step
+name: sign-images
+spec:
+  makefile:
+    enabled: true
+    phony: true
+    script:
+      - |
+        @for image in $(shell crane export $(EXTENSIONS_IMAGE_REF) | tar x --to-stdout image-digests) $(EXTENSIONS_IMAGE_REF)@$$(crane digest $(EXTENSIONS_IMAGE_REF)); do \
+          echo '==>' $$image; \
+          cosign verify $$image --certificate-identity-regexp '@siderolabs\.com$$' --certificate-oidc-issuer https://accounts.google.com || \
+            cosign sign --yes $$image; \
+        done