Migrate to GitHub actions

This includes some refactors to the build steps. High level items: * Add variables for DOCKER_IMAGE, S3_RELEASE_BUCKET to allow for forks of OPA to re-use the GitHub actions with their own s3 buckets and docker orgs/image names. * Unify the release build steps to use `make release` and the binaries being located under `_release/$(VERSION)`. All CI targets now rely on binaries being in that `RELEASE_DIR`, including image building steps The `make build` target is unaffected. * Add a wrapper to allow the CI to run the various golang target stages separately, but sharing the same docker configuration. * Conditionally specify `-it` for docker run commands based on whether A tty is available. * Added scripts to automate drafting a release with binary assets vi the `hub` CLI. * The release process triggered on a tag being pushed will now use the same binaries from `make release` for the docker images as well as the ones attached to the release (which are available under https://openpolicyagent.org/downloads/). The actions themselves are split into 3 workflows: pull-request.yaml: Triggers on pull requests. This will run all the normal tests/checks as before on Travis, however they are now split into separate jobs. In addition to what was done on Travis we will now have Codecov results included. post-merge.yaml: Triggers after a change is pushed to master. This will run tests and build+publish the `edge` and `dev` artifacts to dockerhub and s3. post-tag.yaml: Triggers after a tag has been pushed. Similar to post-merge.yaml it will run tests and build+publish release artifacts (for the tagged version). It will also create a draft release on GitHub with the same artifacts and notes from the CHANGELOG.md. If a release already exists it will be updated to include the assets, however the release notes will _not_ be added. The RELEASE.md steps have been updated and include notes on the new steps. Signed-off-by: Patrick East <east.patrick@gmail.com>
2026-08-12 19:32:48 -06:00 · 2020-07-08 12:33:51 -07:00
parent a5e5808076
commit fb5ff78c24
14 changed files with 427 additions and 101 deletions
@@ -0,0 +1,31 @@
+name: Post Merge
+
+on:
+  push:
+    branches:
+      - master
+
+jobs:
+  deploy-edge:
+    name: Push Edge Release
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Test
+        run: make travis-release-test
+        timeout-minutes: 60
+
+      - name: Build Release Binaries
+        run: make release-local
+
+      - name: Deploy OPA Edge
+        env:
+          DOCKER_USER: ${{ secrets.DOCKER_USER }}
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }}
+          S3_RELEASE_BUCKET: ${{ secrets.S3_RELEASE_BUCKET }}
+        run: make deploy-travis
@@ -0,0 +1,38 @@
+name: Post Tag
+
+on:
+  push:
+    tags:
+      - '*'
+
+jobs:
+  build:
+    name: Push Latest Release
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Set TAG_NAME in Environment
+        # Subsequent jobs will be have the computed tag name
+        run: echo ::set-env name=TAG_NAME::"${GITHUB_REF##*/}"
+
+      - name: Test
+        run: make travis-release-test
+        timeout-minutes: 60
+
+      - name: Build Release Binaries
+        run: make release
+
+      - name: Build and Deploy OPA Docker Images
+        env:
+          DOCKER_USER: ${{ secrets.DOCKER_USER }}
+          DOCKER_PASSWORD: ${{ secrets.DOCKER_PASSWORD }}
+          DOCKER_IMAGE: ${{ secrets.DOCKER_IMAGE }}
+        run: make release-travis
+
+      - name: Create or Update Release
+        env:
+          # Required for the `hub` CLI
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: ./build/github-release.sh --asset-dir=./_release/${TAG_NAME#v}/ --tag=${TAG_NAME}
@@ -0,0 +1,79 @@
+name: PR Check
+
+on: [pull_request]
+
+jobs:
+  # All jobs essentially re-create the `travis-release-build` make target, but are split
+  # up for parallel runners for faster PR feedback and a nicer UX.
+
+  go-build:
+    name: Go Build
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Build Golang
+        run: make travis-go-build-all-platforms
+        timeout-minutes: 30
+
+  go-test:
+    name: Go Test
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Unit Test Golang
+        run: make travis-go-test-coverage
+        timeout-minutes: 30
+
+      - name: Codecov Upload
+        uses: codecov/codecov-action@v1
+        with:
+          tags: unittests
+          file: ./coverage.txt
+
+  go-perf:
+    name: Go Perf
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Benchmark Test Golang
+        run: make travis-go-perf
+        timeout-minutes: 30
+
+  go-lint:
+    name: Go Lint
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Golang Style and Lint Check
+        run: make travis-go-check
+        timeout-minutes: 30
+
+  wasm:
+    name: WASM
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Build and Test WASM
+        run: make travis-wasm
+        timeout-minutes: 15
+
+  check-generated:
+    name: Check Generated
+    runs-on: ubuntu-18.04
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v2
+
+      - name: Check Working Copy
+        run: make travis-check-working-copy
+        timeout-minutes: 15
@@ -5,7 +5,7 @@
 *~

 # build artifacts
-coverage
+coverage.txt
 opa_*
 .Dockerfile_*
 _release
@@ -16,6 +16,7 @@ policy.wasm
 .npm
 .gitbook
 .go
+release-notes.md

 # ci artifacts
 fuzzit
@@ -16,7 +16,13 @@ ARG USER=0

 MAINTAINER Torin Sandall <torinsandall@gmail.com>
 COPY --from=certs /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
-COPY opa_linux_amd64 /opa
+
+# Hack.. https://github.com/moby/moby/issues/37965
+# _Something_ needs to be between the two COPY steps.
 USER ${USER}
+
+ARG BIN_DIR=.
+COPY ${BIN_DIR}/opa_linux_amd64 /opa
+
 ENTRYPOINT ["/opa"]
 CMD ["run"]
@@ -14,12 +14,20 @@ GOARCH := $(shell go env GOARCH)
 GOOS := $(shell go env GOOS)

 DOCKER_INSTALLED := $(shell hash docker 2>/dev/null && echo 1 || echo 0)
+
+ifeq ($(shell tty > /dev/null && echo 1 || echo 0), 1)
+DOCKER_FLAGS := --rm -it
+else
+DOCKER_FLAGS := --rm
+endif
+
 DOCKER := docker

 BIN := opa_$(GOOS)_$(GOARCH)

-REPOSITORY := openpolicyagent
-IMAGE := $(REPOSITORY)/opa
+DOCKER_IMAGE ?= openpolicyagent/opa
+
+S3_RELEASE_BUCKET ?= opa-releases

 BUILD_COMMIT := $(shell ./build/get-build-commit.sh)
 BUILD_TIMESTAMP := $(shell ./build/get-build-timestamp.sh)
@@ -27,14 +35,13 @@ BUILD_HOSTNAME := $(shell ./build/get-build-hostname.sh)

 RELEASE_BUILD_IMAGE := golang:$(GOVERSION)

+RELEASE_DIR ?= _release/$(VERSION)
+
 LDFLAGS := "-X github.com/open-policy-agent/opa/version.Version=$(VERSION) \
 	-X github.com/open-policy-agent/opa/version.Vcs=$(BUILD_COMMIT) \
 	-X github.com/open-policy-agent/opa/version.Timestamp=$(BUILD_TIMESTAMP) \
 	-X github.com/open-policy-agent/opa/version.Hostname=$(BUILD_HOSTNAME)"

-GO15VENDOREXPERIMENT := 1
-export GO15VENDOREXPERIMENT
-
 ######################################################
 #
 # Development targets
@@ -75,6 +82,10 @@ go-build: generate
 go-test: generate
 	$(GO) test -tags=slow ./...

+.PHONY: test-coverage
+test-coverage:
+	$(GO) test -tags=slow -coverprofile=coverage.txt -covermode=atomic ./...
+
 .PHONY: perf
 perf: generate
 	$(GO) test -run=- -bench=. -benchmem ./...
@@ -176,19 +187,25 @@ wasm-rego-testgen-install:
 #
 ######################################################

-.PHONY: travis-go
-travis-go:
-	$(DOCKER) run \
-		--rm \
-		-u $(shell id -u):$(shell id -g) \
-		-v $(PWD):/src \
-		-w /src \
-		-e GOCACHE=/src/.go/cache \
-		golang:$(GOVERSION) \
-		make build-linux build-windows build-darwin go-test perf travis-check
+TRAVIS_GOLANG_DOCKER_MAKE := $(DOCKER) run \
+	$(DOCKER_FLAGS) \
+	-u $(shell id -u):$(shell id -g) \
+	-v $(PWD):/src \
+	-w /src \
+	-e GOCACHE=/src/.go/cache \
+	golang:$(GOVERSION) \
+	make

-.PHONY: travis-check
-travis-check: check
+.PHONY: travis-go-%
+travis-go-%:
+	$(TRAVIS_GOLANG_DOCKER_MAKE) $*
+
+.PHONY: travis-release-test
+travis-release-test:
+	$(TRAVIS_GOLANG_DOCKER_MAKE)
+
+.PHONY: travis-check-working-copy
+travis-check-working-copy: generate
 	./build/check-working-copy.sh

 # The travis-wasm target exists because we do not want to run the generate
@@ -198,67 +215,87 @@ travis-check: check
 travis-wasm: wasm-lib-test
 	GOVERSION=$(GOVERSION) ./build/run-wasm-rego-tests.sh

-.PHONY: travis
-travis: travis-go travis-wasm
-
 .PHONY: build-linux
-build-linux:
+build-linux: ensure-release-dir
 	@$(MAKE) build GOOS=linux
+	mv opa_linux_$(GOARCH) $(RELEASE_DIR)/

 .PHONY: build-darwin
-build-darwin:
+build-darwin: ensure-release-dir
 	@$(MAKE) build GOOS=darwin
+	mv opa_darwin_$(GOARCH) $(RELEASE_DIR)/

 .PHONY: build-windows
-build-windows:
+build-windows: ensure-release-dir
 	@$(MAKE) build GOOS=windows
-	mv opa_windows_$(GOARCH) opa_windows_$(GOARCH).exe
+	mv opa_windows_$(GOARCH) $(RELEASE_DIR)/opa_windows_$(GOARCH).exe
+
+.PHONY: ensure-release-dir
+ensure-release-dir:
+	mkdir -p $(RELEASE_DIR)
+
+.PHONY: build-all-platforms
+build-all-platforms: build-linux build-darwin build-windows

 .PHONY: image-quick
 image-quick:
-	$(DOCKER) build -t $(IMAGE):$(VERSION) --build-arg BASE=scratch .
-	$(DOCKER) build -t $(IMAGE):$(VERSION)-debug --build-arg BASE=gcr.io/distroless/base:debug .
-	$(DOCKER) build -t $(IMAGE):$(VERSION)-rootless --build-arg USER=1000 --build-arg BASE=scratch .
+	$(DOCKER) build \
+		-t $(DOCKER_IMAGE):$(VERSION) \
+		--build-arg BASE=scratch \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		.
+	$(DOCKER) build \
+		-t $(DOCKER_IMAGE):$(VERSION)-debug \
+		--build-arg BASE=gcr.io/distroless/base:debug \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		.
+	$(DOCKER) build \
+		-t $(DOCKER_IMAGE):$(VERSION)-rootless \
+		--build-arg USER=1000 \
+		--build-arg BASE=scratch \
+		--build-arg BIN_DIR=$(RELEASE_DIR) \
+		.

 .PHONY: push
 push:
-	$(DOCKER) push $(IMAGE):$(VERSION)
-	$(DOCKER) push $(IMAGE):$(VERSION)-debug
-	$(DOCKER) push $(IMAGE):$(VERSION)-rootless
+	$(DOCKER) push $(DOCKER_IMAGE):$(VERSION)
+	$(DOCKER) push $(DOCKER_IMAGE):$(VERSION)-debug
+	$(DOCKER) push $(DOCKER_IMAGE):$(VERSION)-rootless

 .PHONY: tag-latest
 tag-latest:
-	$(DOCKER) tag $(IMAGE):$(VERSION) $(IMAGE):latest
-	$(DOCKER) tag $(IMAGE):$(VERSION)-debug $(IMAGE):latest-debug
-	$(DOCKER) tag $(IMAGE):$(VERSION)-rootless $(IMAGE):latest-rootless
+	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION) $(DOCKER_IMAGE):latest
+	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-debug $(DOCKER_IMAGE):latest-debug
+	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-rootless $(DOCKER_IMAGE):latest-rootless

 .PHONY: push-latest
 push-latest:
-	$(DOCKER) push $(IMAGE):latest
-	$(DOCKER) push $(IMAGE):latest-debug
-	$(DOCKER) push $(IMAGE):latest-rootless
+	$(DOCKER) push $(DOCKER_IMAGE):latest
+	$(DOCKER) push $(DOCKER_IMAGE):latest-debug
+	$(DOCKER) push $(DOCKER_IMAGE):latest-rootless

 .PHONY: push-binary-edge
 push-binary-edge:
-	aws s3 cp opa_darwin_$(GOARCH) s3://opa-releases/edge/opa_darwin_$(GOARCH)
-	aws s3 cp opa_windows_$(GOARCH).exe s3://opa-releases/edge/opa_windows_$(GOARCH).exe
-	aws s3 cp opa_linux_$(GOARCH) s3://opa-releases/edge/opa_linux_$(GOARCH)
+	aws s3 cp $(RELEASE_DIR)/opa_darwin_$(GOARCH) s3://$(S3_RELEASE_BUCKET)/edge/opa_darwin_$(GOARCH)
+	aws s3 cp $(RELEASE_DIR)/opa_windows_$(GOARCH).exe s3://$(S3_RELEASE_BUCKET)/edge/opa_windows_$(GOARCH).exe
+	aws s3 cp $(RELEASE_DIR)/opa_linux_$(GOARCH) s3://$(S3_RELEASE_BUCKET)/edge/opa_linux_$(GOARCH)

 .PHONY: tag-edge
 tag-edge:
-	$(DOCKER) tag $(IMAGE):$(VERSION) $(IMAGE):edge
-	$(DOCKER) tag $(IMAGE):$(VERSION)-debug $(IMAGE):edge-debug
-	$(DOCKER) tag $(IMAGE):$(VERSION)-rootless $(IMAGE):edge-rootless
+	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION) $(DOCKER_IMAGE):edge
+	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-debug $(DOCKER_IMAGE):edge-debug
+	$(DOCKER) tag $(DOCKER_IMAGE):$(VERSION)-rootless $(DOCKER_IMAGE):edge-rootless

 .PHONY: push-edge
 push-edge:
-	$(DOCKER) push $(IMAGE):edge
-	$(DOCKER) push $(IMAGE):edge-debug
-	$(DOCKER) push $(IMAGE):edge-rootless
+	$(DOCKER) push $(DOCKER_IMAGE):edge
+	$(DOCKER) push $(DOCKER_IMAGE):edge-debug
+	$(DOCKER) push $(DOCKER_IMAGE):edge-rootless

 .PHONY: docker-login
 docker-login:
-	@$(DOCKER) login -u ${DOCKER_USER} -p ${DOCKER_PASSWORD}
+	@echo "Docker Login..."
+	@echo ${DOCKER_PASSWORD} | $(DOCKER) login -u ${DOCKER_USER} --password-stdin

 .PHONY: push-image
 push-image: docker-login image-quick push
@@ -289,23 +326,23 @@ netlify-preview: clean docs-clean build docs-live-blocks-install-deps docs-live-

 .PHONY: release
 release:
-	$(DOCKER) run -it --rm \
-		-v $(PWD)/_release/$(VERSION):/_release/$(VERSION) \
+	$(DOCKER) run $(DOCKER_FLAGS) \
+		-v $(PWD)/$(RELEASE_DIR):/$(RELEASE_DIR) \
 		-v $(PWD):/_src \
 		$(RELEASE_BUILD_IMAGE) \
-		/_src/build/build-release.sh --version=$(VERSION) --output-dir=/_release/$(VERSION) --source-url=/_src
+		/_src/build/build-release.sh --version=$(VERSION) --output-dir=/$(RELEASE_DIR) --source-url=/_src

 .PHONY: release-local
 release-local:
-	$(DOCKER) run -it --rm \
-		-v $(PWD)/_release/$(VERSION):/_release/$(VERSION) \
+	$(DOCKER) run $(DOCKER_FLAGS) \
+		-v $(PWD)/$(RELEASE_DIR):/$(RELEASE_DIR) \
 		-v $(PWD):/_src \
 		$(RELEASE_BUILD_IMAGE) \
-		/_src/build/build-release.sh --output-dir=/_release/$(VERSION) --source-url=/_src
+		/_src/build/build-release.sh --output-dir=/$(RELEASE_DIR) --source-url=/_src

 .PHONY: release-patch
 release-patch:
-	@$(DOCKER) run -it --rm \
+	@$(DOCKER) run $(DOCKER_FLAGS) \
 		-e LAST_VERSION=$(LAST_VERSION) \
 		-v $(PWD):/_src \
 		python:2.7 \
@@ -313,7 +350,7 @@ release-patch:

 .PHONY: dev-patch
 dev-patch:
-	@$(DOCKER) run -it --rm \
+	@$(DOCKER) run $(DOCKER_FLAGS) \
 		-v $(PWD):/_src \
 		python:2.7 \
 		/_src/build/gen-dev-patch.sh --version=$(VERSION) --source-url=/_src
@@ -1,6 +1,6 @@
 # ![logo](./logo/logo-144x144.png) Open Policy Agent

-[![Slack Status](http://slack.openpolicyagent.org/badge.svg)](https://slack.openpolicyagent.org) [![Build Status](https://travis-ci.org/open-policy-agent/opa.svg?branch=master)](https://travis-ci.org/open-policy-agent/opa) [![Go Report Card](https://goreportcard.com/badge/open-policy-agent/opa)](https://goreportcard.com/report/open-policy-agent/opa) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1768/badge)](https://bestpractices.coreinfrastructure.org/projects/1768) [![Netlify Status](https://api.netlify.com/api/v1/badges/4a0a092a-8741-4826-a28f-826d4a576cab/deploy-status)](https://app.netlify.com/sites/openpolicyagent/deploys)
+[![Slack Status](http://slack.openpolicyagent.org/badge.svg)](https://slack.openpolicyagent.org) [![Build Status](https://github.com/open-policy-agne/opa/workflows/Post%20Merge/badge.svg)](https://github.com/open-policy-agent/opa/actions) [![Go Report Card](https://goreportcard.com/badge/open-policy-agent/opa)](https://goreportcard.com/report/open-policy-agent/opa) [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/1768/badge)](https://bestpractices.coreinfrastructure.org/projects/1768) [![Netlify Status](https://api.netlify.com/api/v1/badges/4a0a092a-8741-4826-a28f-826d4a576cab/deploy-status)](https://app.netlify.com/sites/openpolicyagent/deploys)

 The Open Policy Agent (OPA) is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack.

@@ -42,11 +42,7 @@ elif [ -z "$SOURCE_URL" ]; then
 fi

 build_release() {
-    GOOS=darwin GOARCH=amd64 make build
-    GOOS=linux GOARCH=amd64 make build
-    GOOS=windows GOARCH=amd64 make build
-    mv opa_windows_amd64 opa_windows_amd64.exe
-    mv opa_*_* $OUTPUT_DIR
+    make build-all-platforms RELEASE_DIR="${OUTPUT_DIR}"
 }

 clone_repo() {
@@ -60,7 +56,6 @@ clone_repo() {
 main() {
    clone_repo
    build_release
-    make test
 }

 main
@@ -0,0 +1,54 @@
+#!/usr/bin/env bash
+# Script to draft and edit OPA GitHub releases. Assumes execution environment is Github Action runner.
+
+set -x
+
+usage() {
+    echo "github-release.sh [--asset-dir=<path>] [--tag=<git tag>]"
+    echo "    Default --asset-dir is $PWD and --tag $TAG_NAME "
+}
+
+TAG_NAME=${TAG_NAME}
+ASSET_DIR=${PWD:-"./"}
+
+for i in "$@"; do
+    case $i in
+    --asset-dir=*)
+        ASSET_DIR="${i#*=}"
+        shift
+        ;;
+    --tag=*)
+        TAG_NAME="${i#*=}"
+        shift
+        ;;
+    *)
+        usage
+        exit 1
+        ;;
+    esac
+done
+
+# Collect a list of opa binaries (expect binaries in the form: opa_<platform>_<arch>[extension])
+ASSETS=()
+for asset in "${ASSET_DIR}"/opa_*_*; do
+    ASSETS+=("-a" "$asset")
+done
+
+# Gather the release notes from the CHANGELOG for the latest version
+RELEASE_NOTES="release-notes.md"
+
+# The hub CLI expects the first line to be the title
+echo -e "${TAG_NAME}\n" > "${RELEASE_NOTES}"
+
+# Fill in the description
+./build/latest-release-notes.sh --output="${RELEASE_NOTES}"
+
+# Update or create a release on github
+if hub release show "${TAG_NAME}" > /dev/null; then
+    # Occurs when the tag is created via GitHub UI w/ a release
+    # Use -m "" to preserve the existing text.
+    hub release edit "${ASSETS[@]}" -m "" "${TAG_NAME}"
+else
+    # Create a draft release
+    hub release create "${ASSETS[@]}" -F ${RELEASE_NOTES} --draft "${TAG_NAME}"
+fi
@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+
+set -e
+
+OPA_DIR=$(dirname "${BASH_SOURCE}")/..
+CHANGELOG="${OPA_DIR}/CHANGELOG.md"
+
+usage() {
+    echo "latest-release-notes.sh --output=<path>"
+}
+
+OUTPUT=""
+
+for i in "$@"; do
+    case $i in
+    --output=*)
+        OUTPUT="${i#*=}"
+        shift
+        ;;
+    *)
+        usage
+        exit 1
+        ;;
+    esac
+done
+
+if [ -z "${OUTPUT}" ]; then
+    usage
+    exit 1
+fi
+
+# Versions start with a h2 (## <semver>), find the latest two for start and stop
+# positions in the CHANGELOG
+LATEST_VERSION=$(grep '## [0-9]' "${CHANGELOG}" | head -n 1)
+STOP_VERSION=$(grep '## [0-9]' "${CHANGELOG}" | head -n 2 | tail -n 1)
+
+STARTED=false
+
+while IFS= read -r line
+do
+    # Skip lines until the first version header is found
+    if [[ "${STARTED}" == false ]]; then
+        if [[ "${line}" == "${LATEST_VERSION}" ]]; then
+            STARTED=true
+        fi
+        continue
+    fi
+
+    # Stop reading after we see the stopping point
+    if [[ "${line}" == "${STOP_VERSION}" ]]; then
+        break
+    fi
+
+    # Append each line between the two onto the release notes
+    echo -e "${line}" >> "${OUTPUT}"
+
+done < "${CHANGELOG}"
+
+# Delete all leading blank lines at top of file
+sed -i.bak '/./,$!d' "${OUTPUT}"
+rm "${OUTPUT}.bak"
@@ -0,0 +1 @@
+comment: false
@@ -143,3 +143,22 @@ files in the root of this repository:

 * `.go-version`- which is used by the Makefile and CI tooling. Put the exact go
  version that OPA should use.
+
+# CI Configuration
+
+OPA uses Github Actions defined in the [.github/workflows](../../.github/workflows)
+directory.
+
+## Required Secrets
+
+The following secrets are assumed to be configured for the Repository. Any fork of
+OPA will need to have them configured to be able to run the full CI workflow.
+
+| Name | Description |
+|------|-------------|
+| S3_RELEASE_BUCKET | AWS S3 Bucket name to upload `edge` release binaries to. |
+| AWS_ACCESS_KEY_ID | AWS credentials required to upload to the configured `S3_RELEASE_BUCKET`. |
+| AWS_SECRET_ACCESS_KEY | AWS credentials required to upload to the configured `S3_RELEASE_BUCKET`. |
+| DOCKER_IMAGE | Full docker image name (with org) to tag and publish images to. |
+| DOCKER_USER | Docker username for uploading release images. Will be used with `docker login` |
+| DOCKER_PASSWORD | Docker password or API token for the configured `DOCKER_USER`. Will be used with `docker login` |
@@ -2,32 +2,30 @@

 ## Overview

-The release process consists of three phases: versioning, building, and
-publishing.
+The release process consists of two phases: versioning and publishing the release.

 Versioning involves maintaining the following files:

 - **CHANGELOG.md** - this file contains a list of all the important changes in each release.
 - **Makefile** - the Makefile contains a VERSION variable that defines the version of the project.
- **docs/website/RELEASES*** - this file determines which versions of documentation are displayed
-  in the public [documentation](https://openpolicyagent.org/docs). __The first entry on the list is
-  considered to be the latest.__

 The steps below explain how to update these files. In addition, the repository
 should be tagged with the semantic version identifying the release.

-Building involves obtaining a copy of the repository, checking out the release
-tag, and building the binaries.
-
 Publishing involves creating a new *Release* on GitHub with the relevant
 CHANGELOG.md snippet and uploading the binaries from the build phase.

 ## Versioning

-1. Obtain a copy of repository.
+The steps below assume an OPA development environment has configured for the
+standard GitHub fork workflow. See [OPA Dev Instructions](DEVELOPMENT.md)
+
+1. The following steps assume a remote named `upstream` exists that references the OPA source
+   repository. As needed, add an `upstream` remote for the repository:

 	```
-	git clone git@github.com:open-policy-agent/opa.git
+	git remote add upstream git@github.com:open-policy-agent/opa.git
+	git fetch --tags upstream
 	```

 1. Execute the release-patch target to generate boilerplate patch. Give the semantic version of the release:
@@ -47,19 +45,23 @@ CHANGELOG.md snippet and uploading the binaries from the build phase.
 	> changes may not be user facing (so remove them). Also, if there have been
 	> any significant API changes, call them out in their own sections.

-1. Commit the changes and push to remote repository.
+1. Commit the changes and push to remote repository fork.

 	```
 	git commit -a -s -m "Prepare v<version> release"
 	git push origin master
 	```

-1. Tag repository with release version and push tags to remote repository.
+1. Create a Pull Request for the release preparation commit.

-	```
-	git tag v<semver>
-	git push origin --tags
-	```
+1. Once the Pull Request has merged fetch the latest changes and tag the commit to prepare for publishing:
+
+    ```
+    git fetch upstream
+    git tag v<semver> upstream/master
+    ```
+
+    > Note: Ensure that tag is pointing to the correct commit ID! It must be the merged release preparation commit.

 1. Execute the dev-patch target to generate boilerplate patch. Give the semantic version of the next release:

@@ -76,35 +78,31 @@ CHANGELOG.md snippet and uploading the binaries from the build phase.
 	git diff
 	```

-1. Commit the changes and push to remote repository.
+1. Commit the changes and push to remote repository fork.

 	```
 	git commit -a -s -m "Prepare v<next_semvar> development"
 	git push origin master
 	```

-## Building
-
-1. Obtain copy of remote repository.
-
-	```
-	git clone git@github.com:open-policy-agent/opa.git
-	```
-
-1. Execute the release target. The results can be found under _release/VERSION:
-
-	```
-	make release VERSION=0.12.8
-	```
+1. Create a Pull Request for the development preparation commit.

 ## Publishing

-1. Open browser and go to https://github.com/open-policy-agent/opa/releases
+1. Push the release tag to remote source repository.

-1. Create a new release for the version.
-	- Copy the changelog content into the message.
-	- Upload the binaries.
+	```
+	git push upstream v<semver>
+	```

+   > Note: Only OPA maintainers will have permissions to perform this step.
+
+1. Open browser and go to [https://github.com/open-policy-agent/opa/releases](https://github.com/open-policy-agent/opa/releases)
+
+1. Update the draft release (may take up to 20 min for the draft to become
+   available, track its process under
+   [https://github.com/open-policy-agent/opa/actions](https://github.com/open-policy-agent/opa/actions)).
+   Ensure everything looks OK and publish when ready.

 ## Notes

@@ -1,5 +1,11 @@
 DOCKER := docker

+ifeq ($(shell tty > /dev/null && echo 1 || echo 0), 1)
+DOCKER_FLAGS := --rm -it
+else
+DOCKER_FLAGS := --rm
+endif
+
 WASM_BUILDER_REPOSITORY := openpolicyagent/opa-wasm-builder
 WASM_BUILDER_VERSION := 1.0
 WASM_BUILDER_IMAGE := $(WASM_BUILDER_REPOSITORY):$(WASM_BUILDER_VERSION)
@@ -29,16 +35,16 @@ builder: Dockerfile

 .PHONY: build
 build:
-	@$(DOCKER) run -it --rm -v $(CURDIR):/src $(WASM_BUILDER_IMAGE) make $(WASM_OBJ_DIR)/opa.wasm
+	@$(DOCKER) run $(DOCKER_FLAGS) -v $(CURDIR):/src $(WASM_BUILDER_IMAGE) make $(WASM_OBJ_DIR)/opa.wasm

 .PHONY: test
 test:
-	@$(DOCKER) run -it --rm -v $(CURDIR):/src $(WASM_BUILDER_IMAGE) make $(WASM_OBJ_DIR)/opa-test.wasm
-	@$(DOCKER) run -it --rm -e VERBOSE=$(VERBOSE) -v $(CURDIR):/src -w /src node:8 node test.js $(WASM_OBJ_DIR)/opa-test.wasm
+	@$(DOCKER) run $(DOCKER_FLAGS) -v $(CURDIR):/src $(WASM_BUILDER_IMAGE) make $(WASM_OBJ_DIR)/opa-test.wasm
+	@$(DOCKER) run $(DOCKER_FLAGS) -e VERBOSE=$(VERBOSE) -v $(CURDIR):/src -w /src node:8 node test.js $(WASM_OBJ_DIR)/opa-test.wasm

 .PHONY: hack
 hack:
-	@$(DOCKER) run -it --rm -v $(CURDIR):/src $(WASM_BUILDER_IMAGE)
+	@$(DOCKER) run $(DOCKER_FLAGS) -v $(CURDIR):/src $(WASM_BUILDER_IMAGE)

 $(shell mkdir -p $(WASM_OBJ_DIR)/src/lib)
 $(shell mkdir -p $(WASM_OBJ_DIR)/src/libmpdec)