Skip to content

Commit 45cc068

Browse files
liam-vertaliam-verta
authored
Merge pull request #83 from VertaAI/ln/gha-kaniko
chore: move to GHA publish
2 parents f430874 + c66e3eb commit 45cc068

File tree

5 files changed

+156
-19
lines changed

5 files changed

+156
-19
lines changed

‎.github/workflows/images.yaml

+9-5
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,15 @@
11
name: Build images
22

3+
34
on:
4-
pull_request:
5-
branches: ['main']
6-
push:
7-
branches: ['main']
8-
tags: ['v[0-9]+.[0-9]+.[0-9]+*']
5+
# Only run when this repo changes from private to public.
6+
# Already public = never
7+
public
8+
# pull_request:
9+
# branches: ['main']
10+
# push:
11+
# branches: ['main']
12+
# tags: ['v[0-9]+.[0-9]+.[0-9]+*']
913

1014
jobs:
1115
build-images:

‎.github/workflows/integration-tests.yaml

+7-4
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,13 @@
11
name: Integration tests
22

33
on:
4-
push:
5-
branches: ['main']
6-
pull_request:
7-
branches: ['main']
4+
# Only run when this repo changes from private to public.
5+
# Already public = never
6+
public
7+
# push:
8+
# branches: ['main']
9+
# pull_request:
10+
# branches: ['main']
811

912
permissions:
1013
contents: read

‎.github/workflows/scorecards-analysis.yml

+9-6
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,15 @@
11
name: Scorecards supply-chain security
22
on:
3+
# Only run when this repo changes from private to public.
4+
# Already public = never
5+
public
36
# Only the default branch is supported.
4-
branch_protection_rule:
5-
schedule:
6-
# Weekly on Saturdays.
7-
- cron: '30 1 * * 6'
8-
push:
9-
branches: ['main']
7+
# branch_protection_rule:
8+
# schedule:
9+
# # Weekly on Saturdays.
10+
# - cron: '30 1 * * 6'
11+
# push:
12+
# branches: ['main']
1013

1114
# Declare default permissions as read only.
1215
permissions: read-all

‎.github/workflows/unit-tests.yaml

+7-4
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,13 @@
11
name: Unit tests
22

33
on:
4-
push:
5-
branches: ['main']
6-
pull_request:
7-
branches: ['main']
4+
# Only run when this repo changes from private to public.
5+
# Already public = never
6+
public
7+
# push:
8+
# branches: ['main']
9+
# pull_request:
10+
# branches: ['main']
811

912
permissions:
1013
contents: read

‎.github/workflows/verta-build.yaml

+124
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
name: Build and Push
2+
3+
on:
4+
pull_request:
5+
types: [opened, reopened, synchronize]
6+
push:
7+
branches:
8+
- verta/main
9+
- 'release/*'
10+
11+
permissions:
12+
id-token: write # This is required for requesting the JWT
13+
contents: write # Read is required for actions/checkout, write is required to comment on commits
14+
statuses: write
15+
16+
concurrency:
17+
group: ${{ github.workflow }}-${{ github.ref }}
18+
cancel-in-progress: true
19+
20+
env:
21+
VERTA_ECR_REGISTRY: "493416687123.dkr.ecr.us-east-1.amazonaws.com"
22+
23+
jobs:
24+
kaniko:
25+
runs-on: ubuntu-latest
26+
27+
env:
28+
ECR_REPOSITORY: "493416687123.dkr.ecr.us-east-1.amazonaws.com/external/kaniko-project/executor"
29+
30+
steps:
31+
- name: Checkout repository
32+
uses: actions/checkout@v3
33+
with:
34+
# need previous commit to find PR head commit info
35+
fetch-depth: 2
36+
37+
- name: Configure AWS credentials
38+
uses: aws-actions/configure-aws-credentials@v2
39+
with:
40+
role-to-assume: arn:aws:iam::493416687123:role/github-actions
41+
aws-region: us-east-1
42+
43+
- name: Login to Amazon ECR
44+
id: login-ecr
45+
uses: aws-actions/amazon-ecr-login@v1
46+
47+
- name: Get branch names
48+
id: branch_names
49+
uses: tj-actions/branch-names@v7
50+
51+
- name: Get docker image tag
52+
id: image_info
53+
run: |
54+
branch=$(echo ${{ steps.branch_names.outputs.current_branch }} | sed 's,/,_,g')
55+
# PRs checkout a merge of PR head with target. Branches checkout current head of branch.
56+
# When in a PR, use the PR head commit sha instead of the checkout commit sha.
57+
pr_sha="${{ github.event.pull_request.head.sha }}"
58+
sha=${pr_sha:-$GITHUB_SHA}
59+
sha_details=$(TZ=UTC git show -s --format=%cd--%h --date='format-local:%Y-%m-%dT%H-%M-%S' --abbrev=7 $sha)
60+
echo "sha=${sha}" >> $GITHUB_OUTPUT
61+
echo "tag=${branch}-${sha_details}" >> $GITHUB_OUTPUT
62+
63+
- name: Update commit status with Docker image status
64+
uses: ouzi-dev/commit-status-updater@v2
65+
with:
66+
name: "Tag: ${{ steps.image_info.outputs.tag }}"
67+
description: "Publishing..."
68+
69+
- name: Inspect image to see if it already exists
70+
id: should_publish
71+
run: |
72+
TARGETS=""
73+
docker manifest inspect $ECR_REPOSITORY:${{ steps.image_info.outputs.tag }} || TARGETS="kaniko"
74+
echo "targets=${TARGETS}" >> $GITHUB_OUTPUT
75+
76+
- name: Build and push Docker image to ECR
77+
uses: docker/build-push-action@v4
78+
if: "!(steps.should_publish.outputs.targets == '')"
79+
env:
80+
DOCKER_BUILDKIT: "1"
81+
with:
82+
# context: .
83+
file: deploy/Dockerfile
84+
push: true
85+
# build-args: |
86+
# VERSION=${{ steps.image_info.outputs.tag }}
87+
tags: |
88+
${{ env.ECR_REPOSITORY }}:${{ steps.image_info.outputs.tag }}
89+
90+
- name: Configure AWS credentials for us-west-2
91+
# external components should mirror every merge to verta/main
92+
if: startsWith( github.ref, 'refs/heads/release/' ) || ( github.ref == 'refs/heads/verta/main' )
93+
uses: aws-actions/configure-aws-credentials@v2
94+
with:
95+
role-to-assume: arn:aws:iam::493416687123:role/github-actions
96+
aws-region: us-west-2
97+
98+
- name: Login to Amazon ECR for us-west-2
99+
id: login-ecr-release
100+
if: startsWith( github.ref, 'refs/heads/release/' ) || ( github.ref == 'refs/heads/verta/main' )
101+
uses: aws-actions/amazon-ecr-login@v1
102+
103+
- name: Mirror Docker image to us-west-2
104+
id: mirror-release
105+
if: startsWith( github.ref, 'refs/heads/release/' ) || ( github.ref == 'refs/heads/verta/main' )
106+
shell: bash
107+
run: |
108+
export TARGET_REPOSITORY=${ECR_REPOSITORY/us-east-1/us-west-2}
109+
docker manifest inspect ${TARGET_REPOSITORY}:${{ steps.image_info.outputs.tag }} || \
110+
docker tag ${ECR_REPOSITORY}:${{ steps.image_info.outputs.tag }} ${TARGET_REPOSITORY}:${{ steps.image_info.outputs.tag }} && \
111+
docker push ${TARGET_REPOSITORY}:${{ steps.image_info.outputs.tag }}
112+
113+
- name: Create commit comment
114+
uses: peter-evans/commit-comment@v2
115+
if: "!(steps.should_publish.outputs.targets == '')"
116+
with:
117+
body: "Docker Tag: ${{ steps.image_info.outputs.tag }}"
118+
119+
- name: Update commit status with Docker image status
120+
uses: ouzi-dev/commit-status-updater@v2
121+
with:
122+
name: "Tag: ${{ steps.image_info.outputs.tag }}"
123+
url: "${{ github.server_url }}/${{ github.repository }}/commit/${{ steps.image_info.outputs.sha }}#comments"
124+
status: success

0 commit comments

Comments
 (0)