Update release to publish to Pixie OSS ghcr.io registry

Signed-off-by: Dom Del Nano <ddelnano@gmail.com>

Author: ddelnano

.github/workflows/cloud_release.yaml

@@ -17,6 +17,9 @@ jobs:
     name: Build Release
     runs-on: oracle-16cpu-64gb-x86-64
     needs: get-dev-image
+    permissions:
+      contents: read
+      packages: write
     container:
       image: ${{ needs.get-dev-image.outputs.image-with-tag }}
     steps:
@@ -30,15 +33,16 @@ jobs:
       with:
         download_toplevel: 'true'
         BB_API_KEY: ${{ secrets.BB_IO_API_KEY }}
-    - id: gcloud-creds
-      uses: ./.github/actions/gcloud_creds
-      with:
-        SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
     - name: Import GPG key
       env:
         BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
       run: |
         echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
+    - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  # v2
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ secrets.GITHUB_TOKEN }}
     - name: Build & Push Artifacts
       env:
         REF: ${{ github.event.ref }}
@@ -47,7 +51,6 @@ jobs:
         GH_API_KEY: ${{ secrets.GITHUB_TOKEN }}
         COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
         COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
-        GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
         BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
       shell: bash
       run: |

ci/artifact_mirrors.yaml

@@ -4,8 +4,3 @@
 - name: gh-releases
   type: gh-releases
   url_format: 'https://github.com/${gh_repo}/releases/download/release/${component}/v${version}/${artifact_name}'
-- name: pixie-oss-gcs
-  type: gcs
-  bucket: pixie-dev-public
-  path_format: '${component}/${version}/${artifact_name}'
-  url_format: 'https://storage.googleapis.com/pixie-dev-public/${component}/${version}/${artifact_name}'

ci/cloud_build_release.sh

@@ -34,12 +34,11 @@ if [[ "${release_tag}" == *"-"* ]]; then
 fi
 
 echo "The image tag is: ${release_tag}"
-image_repo="gcr.io/pixie-oss/pixie-prod"
+image_repo="ghcr.io/pixie-io"
 
 bazel run -c opt \
   --config=stamp \
   --config=x86_64_sysroot \
-  --action_env=GOOGLE_APPLICATION_CREDENTIALS \
   --//k8s:image_repository="${image_repo}" \
   --//k8s:image_version="${release_tag}" \
   //k8s/cloud:cloud_images_push
@@ -53,17 +52,13 @@ done < <(bazel run -c opt \
   --//k8s:image_version="${release_tag}" \
   //k8s/cloud:list_image_bundle)
 
-all_licenses_opts=("//tools/licenses:all_licenses" "--action_env=GOOGLE_APPLICATION_CREDENTIALS" "--remote_download_outputs=toplevel")
+all_licenses_opts=("//tools/licenses:all_licenses" "--remote_download_outputs=toplevel")
 all_licenses_path="$(bazel cquery "${all_licenses_opts[@]}"  --output starlark --starlark:expr "target.files.to_list()[0].path" 2> /dev/null)"
 bazel build "${all_licenses_opts[@]}"
 
 upload_artifact_to_mirrors "cloud" "${release_tag}" "${all_licenses_path}" "licenses.json"
-# The licenses file uses a non-standard path (outside of the "component/version/artifact" convention)
-# so for now we'll also copy it to the legacy path.
-gsutil cp "${all_licenses_path}" "gs://pixie-dev-public/oss-licenses/${release_tag}.json"
 if [[ "${release}" == "true" ]]; then
   upload_artifact_to_mirrors "cloud" "latest" "${all_licenses_path}" "licenses.json"
-  gsutil cp "${all_licenses_path}" "gs://pixie-dev-public/oss-licenses/latest.json"
 fi
 
 # Write YAMLs + image paths to a tar file to support easy deployment.