Skip to content

Commit ba77cb4

Browse files
cmaynard-ngwpccmaynard-ngwpc
authored
Merge pull request #2 from NGWPC/development
Merge development into release-candidate for release 3.1.1.4.0-rc1
2 parents 83a0606 + 86395ee commit ba77cb4

2 files changed

Lines changed: 186 additions & 3 deletions

File tree

‎.github/workflows/ci-cd.yml‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
name: CI/CD Pipeline
2+
3+
on:
4+
pull_request:
5+
branches: [main, nwm-main, development, release-candidate]
6+
push:
7+
branches: [main, nwm-main, development, release-candidate]
8+
release:
9+
types: [published]
10+
11+
permissions:
12+
contents: read
13+
packages: write
14+
security-events: write
15+
16+
env:
17+
REGISTRY: ghcr.io
18+
PYTHON_VERSION: '3.11'
19+
20+
jobs:
21+
setup:
22+
runs-on: ubuntu-latest
23+
outputs:
24+
image_base: ${{ steps.vars.outputs.image_base }}
25+
pr_tag: ${{ steps.vars.outputs.pr_tag }}
26+
commit_sha: ${{ steps.vars.outputs.commit_sha }}
27+
commit_sha_short: ${{ steps.vars.outputs.commit_sha_short }}
28+
test_image_tag: ${{ steps.vars.outputs.test_image_tag }}
29+
steps:
30+
- name: Compute image vars
31+
id: vars
32+
shell: bash
33+
run: |
34+
set -euo pipefail
35+
ORG="$(echo "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')"
36+
REPO="$(basename "${GITHUB_REPOSITORY}")"
37+
IMAGE_BASE="${REGISTRY}/${ORG}/${REPO}"
38+
echo "image_base=${IMAGE_BASE}" >> "$GITHUB_OUTPUT"
39+
40+
if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
41+
PR_NUM="${{ github.event.pull_request.number }}"
42+
PR_TAG="pr-${PR_NUM}-build"
43+
echo "pr_tag=${PR_TAG}" >> "$GITHUB_OUTPUT"
44+
echo "test_image_tag=${PR_TAG}" >> "$GITHUB_OUTPUT"
45+
fi
46+
47+
if [ "${GITHUB_EVENT_NAME}" = "push" ]; then
48+
COMMIT_SHA="${GITHUB_SHA}"
49+
SHORT_SHA="${COMMIT_SHA:0:12}"
50+
echo "commit_sha=${COMMIT_SHA}" >> "$GITHUB_OUTPUT"
51+
echo "commit_sha_short=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
52+
echo "test_image_tag=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
53+
fi
54+
55+
build:
56+
name: build
57+
if: github.event_name == 'pull_request' || github.event_name == 'push'
58+
runs-on: ubuntu-latest
59+
needs: setup
60+
steps:
61+
- uses: actions/checkout@v4
62+
63+
- name: Log in to registry
64+
uses: docker/login-action@v3
65+
with:
66+
registry: ${{ env.REGISTRY }}
67+
username: ${{ github.actor }}
68+
password: ${{ secrets.GITHUB_TOKEN }}
69+
70+
- name: Build & push image
71+
uses: docker/build-push-action@v6
72+
with:
73+
context: .
74+
push: true
75+
tags: ${{ needs.setup.outputs.image_base }}:${{ needs.setup.outputs.test_image_tag }}
76+
build-args: |
77+
NGEN_IMAGE_TAG=${{ env.NGEN_IMAGE_TAG || 'latest' }}
78+
CI_COMMIT_REF_NAME=${{ github.ref_name }}
79+
80+
unit-test:
81+
name: unit-test
82+
if: github.event_name == 'pull_request' || github.event_name == 'push'
83+
runs-on: ubuntu-latest
84+
needs: [setup, build]
85+
container:
86+
image: ${{ needs.setup.outputs.image_base }}:${{ needs.setup.outputs.test_image_tag }}
87+
steps:
88+
- name: Run unit tests
89+
run: |
90+
echo "TODO: add unit tests here"
91+
92+
codeql-scan:
93+
if: github.event_name == 'pull_request' || github.event_name == 'push'
94+
runs-on: ubuntu-latest
95+
needs: [setup, build]
96+
permissions:
97+
actions: read
98+
contents: read
99+
security-events: write
100+
steps:
101+
- uses: actions/checkout@v4
102+
- name: Set up Python
103+
uses: actions/setup-python@v5
104+
with:
105+
python-version: ${{ env.PYTHON_VERSION }}
106+
- name: Initialize CodeQL
107+
uses: github/codeql-action/init@v3
108+
with:
109+
languages: python
110+
- name: Install dependencies
111+
run: |
112+
python -m pip install --upgrade pip
113+
if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
114+
- name: Perform CodeQL Analysis
115+
uses: github/codeql-action/analyze@v3
116+
117+
container-scanning:
118+
if: github.event_name == 'pull_request' || github.event_name == 'push'
119+
runs-on: ubuntu-latest
120+
needs: [setup, build]
121+
steps:
122+
- name: Scan container with Trivy
123+
uses: aquasecurity/trivy-action@0.20.0
124+
with:
125+
image-ref: ${{ needs.setup.outputs.image_base }}:${{ needs.setup.outputs.test_image_tag }}
126+
format: 'template'
127+
template: '@/contrib/sarif.tpl'
128+
output: 'trivy-results.sarif'
129+
severity: 'CRITICAL,HIGH'
130+
- name: Upload Trivy SARIF
131+
uses: github/codeql-action/upload-sarif@v3
132+
with:
133+
sarif_file: 'trivy-results.sarif'
134+
135+
deploy-latest-on-development:
136+
name: deploy-latest-on-development
137+
if: github.event_name == 'push' && github.ref_name == 'development'
138+
runs-on: ubuntu-latest
139+
needs: [setup, build, unit-test, codeql-scan, container-scanning]
140+
steps:
141+
- name: Log in to registry
142+
uses: docker/login-action@v3
143+
with:
144+
registry: ${{ env.REGISTRY }}
145+
username: ${{ github.actor }}
146+
password: ${{ secrets.GITHUB_TOKEN }}
147+
- name: Build latest image
148+
run: |
149+
docker pull ${{ needs.setup.outputs.image_base }}:${{ needs.setup.outputs.commit_sha_short }}
150+
docker tag ${{ needs.setup.outputs.image_base }}:${{ needs.setup.outputs.commit_sha_short }} ${{ needs.setup.outputs.image_base }}:latest
151+
docker push ${{ needs.setup.outputs.image_base }}:latest
152+
153+
release:
154+
name: release
155+
if: github.event_name == 'release' && github.event.action == 'published'
156+
runs-on: ubuntu-latest
157+
needs: setup
158+
steps:
159+
- name: Log in to registry
160+
uses: docker/login-action@v3
161+
with:
162+
registry: ${{ env.REGISTRY }}
163+
username: ${{ github.actor }}
164+
password: ${{ secrets.GITHUB_TOKEN }}
165+
166+
- name: Check out the release tag
167+
uses: actions/checkout@v4
168+
with:
169+
ref: ${{ github.event.release.tag_name }}
170+
fetch-depth: 0
171+
172+
- name: Resolve commit sha for the tag
173+
id: rev
174+
shell: bash
175+
run: |
176+
SHORT_SHA="$(git rev-parse --short=12 HEAD)"
177+
echo "short_sha=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
178+
179+
- name: Tag image with release tag
180+
run: |
181+
docker pull ${{ needs.setup.outputs.image_base }}:${{ steps.rev.outputs.short_sha }}
182+
docker tag ${{ needs.setup.outputs.image_base }}:${{ steps.rev.outputs.short_sha }} ${{ needs.setup.outputs.image_base }}:${{ github.event.release.tag_name }}
183+
docker push ${{ needs.setup.outputs.image_base }}:${{ github.event.release.tag_name }}

‎Dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
ARG NGEN_VERSION=latest
2-
FROM registry.sh.nextgenwaterprediction.com/ngwpc/nwm-ngen/ngen:${NGEN_VERSION}
1+
ARG NGEN_IMAGE_TAG=latest
2+
FROM ghcr.io/ngwpc/ngen:${NGEN_IMAGE_TAG}
33

44
RUN set -eux; \
55
dnf install -y \
@@ -47,4 +47,4 @@ RUN set -eux; \
4747

4848
WORKDIR /
4949

50-
ENTRYPOINT [ "/ngen-app/bin/run-ngen-fcst.sh" ]
50+
ENTRYPOINT [ "/ngen-app/bin/run-ngen-fcst.sh" ]

0 commit comments

Comments
 (0)