Migrate webhook CI to GHA

There should be two shell variables, HELM_VERSION for pulling
down the right version of helm, and HELM_CHART_VERSION, for identifying
generated helm charts.

.github/workflows/ci.yaml

@@ -0,0 +1,93 @@
+# Add a comment to force a change.
+
+name: Webhook CI
+
+on:
+  workflow_call:
+  push:
+    branches:
+      - release/v*
+    paths-ignore:
+      - '*.md'
+      - '.gitignore'
+      - 'CODEOWNERS'
+      - 'LICENSE'
+  pull_request:
+    paths-ignore:
+    - '*.md'
+    - '.gitignore'
+    - 'CODEOWNERS'
+    - 'LICENSE'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: CI
+    runs-on : ubuntu-latest
+    strategy:
+      matrix:
+          arch:
+          - amd64
+          # TODO: See wrangler for an example of how to run tests on arm64, not ready here
+          # - arm64
+    steps:
+      - name : Checkout repository
+        uses : actions/checkout@v4
+
+      # TODO: Pull this next one out once there's a helm-release for rancher 2.9
+      - name : Checkout rancher/rancher and build the chart
+        run: |
+          pushd "${{ runner.temp}}"
+          git clone --depth 1 -b release/v2.9 https://github.com/rancher/rancher.git rancherDir
+          cd rancherDir
+          ./scripts/chart/build chart
+          sed -i -e 's/kubeVersion: < 1.29.0-0/kubeVersion: < 1.30.0-0/' build/chart/rancher/Chart.yaml
+          tar cfz "${{ runner.temp }}/rancher.tgz" -C build/chart/rancher .
+          popd
+
+      - run : make ci
+        name: ci
+
+#      - name: Build an image for integration testing
+#        run: ./scripts/package-for-ci
+#        env:
+#          ARCH: "${{ matrix.arch }}"
+#          SHA: "${{ github.sha }}"
+
+      - name : install K3d
+        run : ./.github/workflows/scripts/install-k3d.sh
+
+      - name : setup cluster
+        run : ./.github/workflows/scripts/setup-cluster.sh
+        env:
+          CLUSTER_NAME: webhook
+          K3S_VERSION: v1.28.9-k3s1
+          ARCH: "${{ matrix.arch }}"
+
+      - name : import image
+        run : k3d image import dist/rancher-webhook-image.tar -c webhook
+
+      - name : start rancher
+        run : ./.github/workflows/scripts/start-rancher.sh
+        env:
+          ARCH: "${{ matrix.arch }}"
+          CHART_PATH: "${{ runner.temp }}/rancher.tgz"
+          RANCHER_IMAGE_TAG: "v2.9-head"
+          VERSION: "2.9"
+
+      - name : debug show image_tag file
+        run : cat dist/image_tag
+
+      - name : get vars
+        run : cat dist/image_tag >> $GITHUB_ENV
+
+      - name : Run integration tests
+        run : ./.github/workflows/scripts/integration-test-ci
+        env:
+          ARCH: "${{ matrix.arch }}"
+          CLUSTER_NAME: webhook
+          IMAGE_REPO: rancher/webhook
+          IMAGE_TAG: "${{ env.TAG }}"
+

.github/workflows/publish.yaml

@@ -0,0 +1,54 @@
+name : Publish Webhook Images
+
+on:
+  push:
+    tags:
+      - "*"
+
+env:
+  REGISTRY: docker.io
+  REPO : rancher
+
+jobs:
+  ci :
+    uses: rancher/webhook/.github/workflows/ci.yaml@release/v0.5
+    permissions:
+      contents: read
+  push:
+    needs : [
+      ci
+    ]
+    permissions:
+      contents : read
+      id-token: write
+    name : Build and push Webhook images
+    runs-on : ubuntu-latest
+    steps:
+      - name : "Read vault secrets"
+        uses : rancher-eio/read-vault-secrets@main
+        with:
+          secrets: |
+            secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
+            secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials password | DOCKER_PASSWORD
+      - name : Checkout repository
+        uses: actions/checkout@v4
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+      - name: Log in to the Container registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ env.DOCKER_USERNAME }}
+          password: ${{ env.DOCKER_PASSWORD }}
+        # setup tag name
+      - if: ${{ startsWith(github.ref, 'refs/tags/') }}
+        run: |
+          echo TAG_NAME=$(echo $GITHUB_REF | sed -e "s|refs/tags/||") >> $GITHUB_ENV
+      - name: Build and push the webhook image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ./package/Dockerfile
+          push: true
+          tags: ${{ env.REGISTRY }}/${{ env.REPO }}/webhook:${{ env.TAG_NAME }}
+          platforms: linux/amd64,linux/arm64

.github/workflows/release.yaml

@@ -0,0 +1,37 @@
+name: goreleaser
+
+on:
+  push:
+    tags:
+      - '*'
+
+permissions:
+  contents: write
+
+jobs:
+  ci:
+    uses: rancher/webhook/.github/workflows/ci.yaml@release/v0.5
+    permissions:
+      contents: read
+  goreleaser:
+    needs: [
+      ci
+    ]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-tags: true
+      - uses: actions/setup-go@v5
+        with:
+          go-version: 1.22
+      - name: Package release helm charts
+        run: make package-helm
+      - run: mkdir -p ./build/artifacts/ && mv -v ./dist/artifacts/ ./build/
+      - uses: goreleaser/goreleaser-action@v5
+        with:
+          distribution: goreleaser
+          version: latest
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/scripts/install-k3d.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+set -e
+set -x
+
+K3D_URL=https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh
+DEFAULT_K3D_VERSION=v5.4.6
+
+install_k3d(){
+  local k3dVersion=${K3D_VERSION:-${DEFAULT_K3D_VERSION}}
+  echo -e "Downloading k3d@${k3dVersion} see: ${K3D_URL}"
+  curl --silent --fail ${K3D_URL} | TAG=${k3dVersion} bash
+}
+
+install_k3d
+
+k3d version