Migrate Tekton single arch image build to ghcr.io

[afrittoli]

Feature request

Migrate the single-arch-template pipeline to publish to ghcr.io. This includes updates to any of the cronjobs that use this template to build images.

Note: To be implemented as a separate PR: update references in the plumbing repo from gcr.io to ghcr.io once the new images are produced.

The pipeline project release pipeline. has been migrated and can provide some insight.

Some key information for the migration:

• Existing path: gcr.io/tekton-releases/dogfooding/<image-name>
• Target path: ghcr.io/tektoncd/plumbing/<image-name>
• GitHub requires OCI labels to be set to associate images with the correct GitHub repo, which should be implemented in Add OCI labels to docker files in tekton/images #2222

Use case

Reduce Cloud Storage / Container Registry Spending: #2157

Additional Info

• the template part defines the pipeline that is executed to build images
• the cronjobs provide the trigger for the execution of the pipelines, and they include the list of parameters as well as the frequency of execution

The template part needs to be updated so that it may work with ghcr.io. The current version works with gcr.io, and unfortunately, it's not enough to change the target registry as authentication works a bit different (for gcr.io we used a service account file, and for ghcr.io we use a PAT), and ghcr.io requires OCI labels to be set

There are three types of builds we do today, which correspond to three separate templates.

• Single architecture: Migrate Tekton single arch image build to ghcr.io #2221, PLATFORMS and BUILD_TYPE are not set in the cronjob
• Multi-architecture, using docker: Migrate Tekton multi-arch image build to ghcr.io #2223, PLATFORMS is set and BUILD_TYPE=docker
• Multi-architecture, using ko: Migrate Tekton ko-multi-arch-template image build to ghcr.io #2224, PLATFORMS is set and BUILD_TYPE=ko

This issue covers updating the template and cronjob for single architecture.

The order of implementation should be:

• Set the OCI labels in Dockerfiles Add OCI labels to docker files in tekton/images #2222
• Adapt the template to work with ghcr.io (see the changes in the pipeline project release pipeline for inspiration)
• Adapt the cronjobs (this can be in the same PR as the template or separate)

[LiteBrick204]

I would like to work on this

[afrittoli]

The username for ghcr.io is tekton-robot, same as:

plumbing/tekton/cronjobs/dogfooding/releases/pipeline-nightly/cronjob.yaml

Lines 23 to 24 in eee5180

	- name: CR_USER
	value: tekton-robot

The credentials are defined in a secret available on the cluster, called ghcr-creds, same as:

plumbing/tekton/resources/nightly-release/overlays/pipeline/template.yaml

Lines 51 to 52 in eee5180

	secret:
	secretName: ghcr-creds