add ngc signing job for auto signing

[shivakunv]

@cdesiniotis @elezar PTAL

[cdesiniotis]

Is it possible to use a matrix so that we have one sign:ngc-rhcos job and we specify a matrix of RHCOS_VERSIONS (e.g. 4.9, 4.10, ...)? The same suggestion applies for the rhel jobs.

[cdesiniotis]

This may require us to also parallelize the release:ngc-rhcos jobs using similar logic. If required we can improve this in a follow-up.

[shivakunv]

added : ubuntu 22.04, 20.04 , rhcos and rhel in parallel matrix .
@cdesiniotis

[shivakunv]

@tariq1890 @cdesiniotis @elezar

I have tested some new changes to remove hardcoded value for DRIVER VERSION:
https://gitlab-master.nvidia.com/dl/container-dev/driver/-/merge_requests/23

summary : added setup stage to set the env

stages:
  **- setup**
  - trigger
  - image-build
  - test
  - scan
  - release
  - sign

setup_env:
  stage: setup
  script:
    - apk add --no-cache bash
    - |
      # Ensure compatibility with /bin/sh by using POSIX-compliant syntax
      set -e  # Exit immediately if a command exits with a non-zero status
      IFS=' ' # Set IFS to space

      # Split DRIVER_VERSIONS into individual versions
      i=1  # Initialize a counter
      for version in $DRIVER_VERSIONS; do
        # Construct variable name dynamically
        version_var="DRIVER_VERSION$i"
        echo "$version_var=$version"
        echo "$version_var=$version" >> setup_env.env
        i=$((i + 1))  # Increment counter
      done
    - cat setup_env.env  # Print the contents of setup_env.env for debugging
    - ls -l
  artifacts:
    reports:
      dotenv: setup_env.env

sign:ngc-ubuntu-rhel-rhcos:
  extends:
    - .sign:ngc
  parallel:
    matrix:
      - SIGN_JOB_NAME: ["ubuntu"]
        VERSION: ["22.04"]
        DRIVER_VERSION: ["$DRIVER_VERSION2", "$DRIVER_VERSION3"]
      - SIGN_JOB_NAME: ["ubuntu"]
        VERSION: ["20.04"]
        DRIVER_VERSION: ["$DRIVER_VERSION1", "$DRIVER_VERSION2", "$DRIVER_VERSION3"]
      - SIGN_JOB_NAME: ["rhel"]
        VERSION: ["8.6", "8.7", "8.8", "8.9", "8.10"]
        DRIVER_VERSION: ["$DRIVER_VERSION1", "$DRIVER_VERSION2", "$DRIVER_VERSION3"]
      - SIGN_JOB_NAME: ["rhcos"]
        VERSION: ["4.9", "4.10", "4.11", "4.12", "4.13", "4.14", "4.15"]
        DRIVER_VERSION: ["$DRIVER_VERSION1", "$DRIVER_VERSION2", "$DRIVER_VERSION3"]
  rules:
    - when: always
      variables:
        DIST: "$SIGN_JOB_NAME${VERSION}"
  needs:
    - setup_env

Please suggest what should be done:

If you are okay with this change, I will merge these changes into the current PR.
or

I will create a separate Jira ticket for this. I'll remove all hardcoded values and import the DRIVER_VERSION, VERSION, etc., and add them to the setup stage, which can override the current values. In this case, we will have to change only one file or import the pipeline variable from the GitHub variable.

[shivakunv]

added conditional run with commit tag

[shivakunv]

moved :
rules:
- if: $CI_COMMIT_TAG
variables:
DIST: "${SIGN_JOB_NAME}${VERSION}"

inside .sign:ngc as @cdesiniotis comments :
NVIDIA/k8s-driver-manager#35 (comment)

[cdesiniotis]

@shivakunv I am fine with the current approach. We can always improve this in a follow-up.