ci(kms-operator): build + push the ZAP-transport KMSSecret reconciler

The deployed kms-operator (ghcr.io/luxfi/kms-operator:0d446b0) is the legacy Infisical-flavor HTTP operator: it POSTs /api/v1/auth/universal-auth/login, which the Go KMS server does NOT expose, so every KMSSecret sync fails with CallUniversalAuthLogin 404 (e.g. lux-devnet/luxd-staking-kms-sync). The fix — cmd/kms-operator, which reconciles over the native luxfi/zap binary transport on port 9999 (no HTTP auth round-trip) — already exists in source but had no CI to ship it. Add a self-contained build for Dockerfile.operator (same pattern as build-lux-kms.yml), publishing ghcr.io/luxfi/kms-operator.
2026-07-27 03:38:31 +00:00 · 2026-06-22 03:43:31 -07:00
parent a92ebad1aa
commit bd804cb17c
1 changed files with 82 additions and 0 deletions
@@ -0,0 +1,82 @@
+name: Build KMS Operator
+
+# Builds the KMSSecret reconciler (cmd/kms-operator) over the native luxfi/zap
+# binary transport — replaces the legacy Infisical-flavor HTTP operator that
+# POSTed /api/v1/auth/universal-auth/login (which the Go KMS server does not
+# expose → 404, breaking every KMSSecret sync). Self-contained build (no
+# cross-org reusable workflow); same pattern as build-lux-kms.yml /
+# build-server-self.yml. Dockerfile.operator is a scratch image building the
+# single static CGO=0 binary from the repo's own vendor tree.
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - 'cmd/kms-operator/**'
+      - 'pkg/zapclient/**'
+      - 'Dockerfile.operator'
+      - '.github/workflows/build-operator.yml'
+    tags: ['v*']
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  build:
+    runs-on: [self-hosted, linux, amd64]
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Compute tags
+        id: meta
+        run: |
+          if [[ "$GITHUB_REF" == refs/tags/v* ]]; then
+            VERSION="${GITHUB_REF#refs/tags/v}"
+            {
+              echo "tags<<EOF"
+              echo "ghcr.io/luxfi/kms-operator:v${VERSION}"
+              echo "ghcr.io/luxfi/kms-operator:${VERSION}"
+              echo "ghcr.io/luxfi/kms-operator:sha-${GITHUB_SHA:0:7}"
+              echo "EOF"
+            } >> "$GITHUB_OUTPUT"
+          else
+            {
+              echo "tags<<EOF"
+              echo "ghcr.io/luxfi/kms-operator:main"
+              echo "ghcr.io/luxfi/kms-operator:sha-${GITHUB_SHA:0:7}"
+              echo "EOF"
+            } >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Login to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Set up Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Build and push (linux/amd64, ZAP-transport reconciler)
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: Dockerfile.operator
+          platforms: linux/amd64
+          build-args: |
+            GITHUB_TOKEN=${{ secrets.GITHUB_TOKEN }}
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Summary
+        run: |
+          echo "### KMS operator build complete" >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+          echo '${{ steps.meta.outputs.tags }}' >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"