Skip to content

Commit 888c09a

Browse files
aanmaanm
committed
.github/workflows: make adjustments for new GitHub workflow behavior
This was a semi-automatic change that makes the following changes across all affected files: - Creates new *-<branch>.yaml versioned files - Adds branches filter to pull_request_target (e.g., branches: [v1.18]) - Add "ignore branches" for all files without the prefix *-.yaml so that we don't run pull_request_target from main branch for stable branches events. A special mention to .github/workflows/build-images-base-v1.16.yaml which had to suffer more adjustments in order for it to work with the set-runtime-image which allows the workflow to use a dynamic CILIUM_RUNTIME image without hardcoding it in the workflow. Having this value hardcoded would it make difficult for renovate to update the this value on the v1.16 branch and test it on that same PR. Fixes: 23454eb (".github/workflows: copy stable workflows to main branch") Signed-off-by: André Martins <andre@cilium.io>
1 parent 8cf62cd commit 888c09a

18 files changed

Lines changed: 53 additions & 76 deletions

‎.github/workflows/auto-labeler-v1.18.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ on:
88
- opened
99
- reopened
1010

11+
1112
jobs:
1213
external-contributions:
1314
if: |

‎.github/workflows/auto-labeler.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ on:
55
types:
66
- opened
77
- reopened
8+
branches-ignore:
9+
- v1.18
10+
- v1.17
11+
- v1.16
812

913
jobs:
1014
external-contributions:

‎.github/workflows/build-images-base-v1.16.yaml‎

Lines changed: 2 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -12,23 +12,6 @@ on:
1212
paths:
1313
- images/runtime/**
1414
- images/builder/**
15-
# This workflow can be reused so that renovate can execute this workflow_dispatch:
16-
# run from a different environment than 'release-base-images'. See
17-
# build-images-base-renovate.yaml
18-
workflow_call:
19-
secrets:
20-
QUAY_BASE_RELEASE_USERNAME_202411:
21-
required: true
22-
QUAY_BASE_RELEASE_PASSWORD_202411:
23-
required: true
24-
AUTO_COMMITTER_PEM_202411:
25-
required: true
26-
AUTO_COMMITTER_APP_ID_202411:
27-
required: true
28-
inputs:
29-
environment:
30-
type: string
31-
default: "release-base-images"
3215

3316
permissions:
3417
# To be able to access the repository with `actions/checkout`
@@ -46,7 +29,7 @@ jobs:
4629
if: ${{ ! (github.event_name == 'pull_request_target' && startsWith(github.head_ref, 'renovate/')) }}
4730
name: Build and Push Images
4831
timeout-minutes: 60
49-
environment: ${{ inputs.environment || 'release-base-images' }}
32+
environment: 'release-base-images'
5033
runs-on: ubuntu-24.04
5134
steps:
5235
- name: Checkout default branch (trusted)
@@ -342,7 +325,7 @@ jobs:
342325
image-digests:
343326
name: Display Digests
344327
runs-on: ubuntu-24.04
345-
environment: ${{ inputs.environment || 'release-base-images' }}
328+
environment: 'release-base-images'
346329
needs: build-and-push
347330
steps:
348331
- name: Downloading Image Digests

‎.github/workflows/build-images-base-v1.17.yaml‎

Lines changed: 3 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -12,23 +12,6 @@ on:
1212
paths:
1313
- images/runtime/**
1414
- images/builder/**
15-
# This workflow can be reused so that renovate can execute this workflow_dispatch:
16-
# run from a different environment than 'release-base-images'. See
17-
# build-images-base-renovate.yaml
18-
workflow_call:
19-
secrets:
20-
QUAY_BASE_RELEASE_USERNAME_202411:
21-
required: true
22-
QUAY_BASE_RELEASE_PASSWORD_202411:
23-
required: true
24-
AUTO_COMMITTER_PEM_202411:
25-
required: true
26-
AUTO_COMMITTER_APP_ID_202411:
27-
required: true
28-
inputs:
29-
environment:
30-
type: string
31-
default: "release-base-images"
3215

3316
permissions:
3417
# To be able to access the repository with `actions/checkout`
@@ -44,7 +27,7 @@ jobs:
4427
has-credentials:
4528
name: Check for Quay secrets
4629
runs-on: ubuntu-24.04
47-
environment: ${{ inputs.environment || 'release-base-images' }}
30+
environment: 'release-base-images'
4831
timeout-minutes: 2
4932
outputs:
5033
present: ${{ steps.secrets.outputs.present }}
@@ -63,7 +46,7 @@ jobs:
6346
if: ${{ needs.has-credentials.outputs.present && ! (github.event_name == 'pull_request_target' && startsWith(github.head_ref, 'renovate/')) }}
6447
name: Build and Push Images
6548
timeout-minutes: 60
66-
environment: ${{ inputs.environment || 'release-base-images' }}
49+
environment: 'release-base-images'
6750
runs-on: ubuntu-24.04
6851
steps:
6952
- name: Checkout default branch (trusted)
@@ -343,7 +326,7 @@ jobs:
343326
image-digests:
344327
name: Display Digests
345328
runs-on: ubuntu-24.04
346-
environment: ${{ inputs.environment || 'release-base-images' }}
329+
environment: 'release-base-images'
347330
needs: build-and-push
348331
steps:
349332
- name: Downloading Image Digests

‎.github/workflows/build-images-base-v1.18.yaml‎

Lines changed: 1 addition & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -12,23 +12,6 @@ on:
1212
paths:
1313
- images/runtime/**
1414
- images/builder/**
15-
# This workflow can be reused so that renovate can execute this workflow_dispatch:
16-
# run from a different environment than 'release-base-images'. See
17-
# build-images-base-renovate.yaml
18-
workflow_call:
19-
secrets:
20-
QUAY_BASE_RELEASE_USERNAME_202411:
21-
required: true
22-
QUAY_BASE_RELEASE_PASSWORD_202411:
23-
required: true
24-
AUTO_COMMITTER_PEM_202411:
25-
required: true
26-
AUTO_COMMITTER_APP_ID_202411:
27-
required: true
28-
inputs:
29-
environment:
30-
required: true
31-
type: string
3215

3316
permissions:
3417
# To be able to access the repository with `actions/checkout`
@@ -46,7 +29,7 @@ jobs:
4629
if: ${{ vars.QUAY_BASE_RELEASE_ENABLED == 'true' && ! (github.event_name == 'pull_request_target' && startsWith(github.head_ref, 'renovate/')) }}
4730
name: Build and Push Images
4831
timeout-minutes: 60
49-
environment: ${{ inputs.environment || 'release-base-images' }}
32+
environment: 'release-base-images'
5033
runs-on: ubuntu-24.04
5134
steps:
5235
- name: Checkout base or default branch (trusted)

‎.github/workflows/build-images-base.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,10 @@ on:
1010
paths:
1111
- images/runtime/**
1212
- images/builder/**
13+
branches-ignore:
14+
- v1.18
15+
- v1.17
16+
- v1.16
1317
# This workflow can be reused so that renovate can execute this workflow_dispatch:
1418
# run from a different environment than 'release-base-images'. See
1519
# build-images-base-renovate.yaml

‎.github/workflows/build-images-ci-v1.16.yaml‎

Lines changed: 18 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,6 @@ on:
99
- opened
1010
- synchronize
1111
- reopened
12-
push:
13-
branches:
14-
- v1.16
15-
- ft/v1.16/**
1612

1713
permissions:
1814
# To be able to access the repository with `actions/checkout`
@@ -83,6 +79,11 @@ jobs:
8379
- name: Set Environment Variables
8480
uses: ./.github/actions/set-env-variables
8581

82+
- name: Copy scripts to trusted directory
83+
run: |
84+
mkdir -p ../cilium-base-branch
85+
cp -r .github/actions/set-runtime-image ../cilium-base-branch
86+
8687
- name: Check for disk usage and cleanup /mnt
8788
shell: bash
8889
run: |
@@ -169,6 +170,15 @@ jobs:
169170
run: |
170171
df -h
171172
173+
- name: Copy runtime image tag from untrusted branch
174+
run: |
175+
cp -r .github/actions/set-runtime-image/runtime-image.txt ../cilium-base-branch/set-runtime-image/
176+
177+
- name: Set runtime image environment variable
178+
uses: ./../cilium-base-branch/set-runtime-image
179+
with:
180+
repository: ${{ env.CILIUM_RUNTIME_IMAGE_PREFIX }}
181+
172182
# Load Golang cache build from GitHub
173183
- name: Restore Golang cache build from GitHub
174184
uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
@@ -228,6 +238,7 @@ jobs:
228238
tags: ${{ steps.tag.outputs.normal_tag }}
229239
target: release
230240
build-args: |
241+
CILIUM_RUNTIME_IMAGE=${{ env.CILIUM_RUNTIME_IMAGE }}
231242
OPERATOR_VARIANT=${{ matrix.name }}
232243
233244
- name: CI race detection Build ${{ matrix.name }}
@@ -243,7 +254,8 @@ jobs:
243254
tags: ${{ steps.tag.outputs.race_tag }}
244255
target: release
245256
build-args: |
246-
BASE_IMAGE=quay.io/cilium/cilium-runtime:b21eb30e9334659f2f5b42ec71ad373fc6a10239@sha256:96a219d4c99c02049fecc7798a0f3a0494a4e589115cb36172e75c7d0383c148
257+
BASE_IMAGE=${{ env.CILIUM_RUNTIME_IMAGE }}
258+
CILIUM_RUNTIME_IMAGE=${{ env.CILIUM_RUNTIME_IMAGE }}
247259
MODIFIERS="LOCKDEBUG=1 RACE=1"
248260
OPERATOR_VARIANT=${{ matrix.name }}
249261
@@ -260,6 +272,7 @@ jobs:
260272
tags: ${{ steps.tag.outputs.unstripped_tag }}
261273
target: release
262274
build-args: |
275+
CILIUM_RUNTIME_IMAGE=${{ env.CILIUM_RUNTIME_IMAGE }}
263276
MODIFIERS="NOSTRIP=1"
264277
OPERATOR_VARIANT=${{ matrix.name }}
265278

‎.github/workflows/build-images-ci-v1.17.yaml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,6 @@ on:
99
- opened
1010
- synchronize
1111
- reopened
12-
push:
13-
branches:
14-
- v1.17
15-
- ft/v1.17/**
1612

1713
permissions:
1814
# To be able to access the repository with `actions/checkout`

‎.github/workflows/build-images-ci-v1.18.yaml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,6 @@ on:
99
- opened
1010
- synchronize
1111
- reopened
12-
push:
13-
branches:
14-
- v1.18
15-
- ft/v1.18/**
1612

1713
permissions:
1814
# To be able to access the repository with `actions/checkout`

‎.github/workflows/build-images-ci.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ on:
77
- opened
88
- synchronize
99
- reopened
10+
branches-ignore:
11+
- v1.18
12+
- v1.17
13+
- v1.16
1014
push:
1115
branches:
1216
- main

0 commit comments

Comments
 (0)