Skip to content

Commit f9a2a6c

Browse files
verbanicmverbanicm
authored
use goreleaser for ci and start release process (#11)
1 parent 545222c commit f9a2a6c

File tree

6 files changed

+224
-40
lines changed

6 files changed

+224
-40
lines changed

‎.github/workflows/ci.yml

Lines changed: 40 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,13 @@ env:
2727
WIF_PROVIDER: 'projects/138221849759/locations/global/workloadIdentityPools/github-pool-ac8f/providers/github-provider'
2828
WIF_SERVICE_ACCOUNT: 'github-metrics-ac8f-ci-sa@github-metrics-ci.iam.gserviceaccount.com'
2929
DOCKER_REGISTRY: 'us-docker.pkg.dev'
30-
DOCKER_TAG: '${{ github.sha }}'
3130
DOCKER_REPO: 'us-docker.pkg.dev/github-metrics-ci/ci-images'
31+
DOCKER_TAG: '${{ github.sha }}'
3232
INTEGRATION_PROJECT_ID: 'github-metrics-ci'
3333
INTEGRATION_DATESET_ID: 'github-metrics'
3434
INTEGRATION_REGION: 'us-central1'
3535
INTEGRATION_SERVICE_NAME: 'github-metrics-webhook-8ecc'
36+
INTEGRATION_SERVICE_AUDIENCE: 'https://github-metrics-webhook-8ecc-fghj6lcama-uc.a.run.app'
3637

3738
concurrency:
3839
group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
@@ -64,7 +65,7 @@ jobs:
6465
steps:
6566
- run: 'echo prechecks complete'
6667

67-
# Build the main github-metrics-aggregator-server and push to artifact registry
68+
# Build github-metrics-aggregator-server and push to artifact registry
6869
build:
6970
runs-on: 'ubuntu-latest'
7071
needs:
@@ -75,6 +76,10 @@ jobs:
7576
steps:
7677
- name: 'Checkout'
7778
uses: 'actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c' # ratchet:actions/checkout@v3
79+
- name: 'Setup Go'
80+
uses: 'actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568' # ratchet:actions/setup-go@v3
81+
with:
82+
go-version: '1.19'
7883
- id: 'auth'
7984
name: 'Authenticate to Google Cloud'
8085
uses: 'google-github-actions/auth@ef5d53e30bbcd8d0836f4288f5e50ff3e086997d' # ratchet:google-github-actions/auth@v1
@@ -88,14 +93,19 @@ jobs:
8893
username: 'oauth2accesstoken'
8994
password: '${{ steps.auth.outputs.access_token }}'
9095
registry: '${{ env.DOCKER_REGISTRY }}'
91-
- name: 'Build the main server container and push to the registry'
92-
uses: 'docker/build-push-action@c56af957549030174b10d6867f20e78cfd7debc5' # ratchet:docker/build-push-action@v3
96+
# goreleaser requires a tag to publish images to container registry.
97+
# We create a local tag to make it happy.
98+
- run: |-
99+
git config user.name "${GITHUB_ACTOR}"
100+
git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
101+
git tag -f `date "+%Y%m%d%H%M%S"`
102+
- name: 'Build the server container and push to the registry with goreleaser'
103+
uses: 'goreleaser/goreleaser-action@b508e2e3ef3b19d4e4146d4f8fb3ba9db644a757' # ratchet:goreleaser/goreleaser-action@v3
93104
with:
94-
push: true
95-
tags: '${{ env.DOCKER_REPO }}/github-metrics-aggregator-server:${{ env.DOCKER_TAG }}'
96-
file: 'Dockerfile'
105+
version: 'v1.12.3' # Manually pinned
106+
args: 'release -f .goreleaser.docker.yaml --rm-dist --skip-validate'
97107

98-
integration:
108+
deployment:
99109
runs-on: 'ubuntu-latest'
100110
needs:
101111
- 'build'
@@ -111,8 +121,6 @@ jobs:
111121
with:
112122
workload_identity_provider: '${{ env.WIF_PROVIDER }}'
113123
service_account: '${{ env.WIF_SERVICE_ACCOUNT }}'
114-
token_format: 'id_token'
115-
id_token_audience: 'https://github-metrics-webhook-8ecc-fghj6lcama-uc.a.run.app'
116124
- name: 'Setup gcloud'
117125
uses: 'google-github-actions/setup-gcloud@d51b5346f85640ec2aa2fa057354d2b82c2fcbce' # ratchet:google-github-actions/setup-gcloud@v1
118126
- name: 'Deploy to Cloud Run'
@@ -121,7 +129,27 @@ jobs:
121129
--project="${{ env.INTEGRATION_PROJECT_ID }}" \
122130
--region="${{ env.INTEGRATION_REGION }}" \
123131
--image="${{ env.DOCKER_REPO }}/github-metrics-aggregator-server:${{ env.DOCKER_TAG }}"
124-
- uses: 'actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568' # ratchet:actions/setup-go@v3
132+
133+
integration:
134+
runs-on: 'ubuntu-latest'
135+
needs:
136+
- 'deployment'
137+
permissions:
138+
contents: 'read'
139+
id-token: 'write'
140+
steps:
141+
- name: 'Checkout'
142+
uses: 'actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c' # ratchet:actions/checkout@v3
143+
- id: 'auth'
144+
name: 'Authenticate to Google Cloud'
145+
uses: 'google-github-actions/auth@ef5d53e30bbcd8d0836f4288f5e50ff3e086997d' # ratchet:google-github-actions/auth@v1
146+
with:
147+
workload_identity_provider: '${{ env.WIF_PROVIDER }}'
148+
service_account: '${{ env.WIF_SERVICE_ACCOUNT }}'
149+
token_format: 'id_token'
150+
id_token_audience: '${{ env.INTEGRATION_SERVICE_AUDIENCE }}'
151+
- name: 'Setup Go'
152+
uses: 'actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568' # ratchet:actions/setup-go@v3
125153
with:
126154
go-version: '1.19'
127155
- name: 'Run integration tests'
@@ -133,5 +161,4 @@ jobs:
133161
GITHUB_WEBHOOK_SECRET: '${{ secrets.INTEGRATION_WEBHOOK_SECRET }}'
134162
ENDPOINT_URL: 'https://github-metrics-ci.tycho.joonix.net/webhook'
135163
run: |-
136-
go test github.com/abcxyz/github-metrics-aggregator/integration \
137-
-timeout=15m
164+
go test github.com/abcxyz/github-metrics-aggregator/integration -timeout=15m

‎.github/workflows/cleanup.yml

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,17 @@
1+
# Copyright 2023 The Authors (see AUTHORS file)
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
115
name: 'cleanup'
216

317
on:
@@ -21,8 +35,7 @@ permissions:
2135

2236
jobs:
2337
# cleanup_cloudrun_revisions deletes all Cloud Run revisions for the given service
24-
# that are more than 5 hours old, since sometimes services are not deleted during
25-
# integration tests.
38+
# that are more than 5 hours old
2639
cleanup_cloudrun_revisions:
2740
runs-on: 'ubuntu-latest'
2841
steps:
@@ -32,7 +45,7 @@ jobs:
3245
workload_identity_provider: '${{ env.WIF_PROVIDER }}'
3346
service_account: '${{ env.WIF_SERVICE_ACCOUNT }}'
3447
- uses: 'google-github-actions/setup-gcloud@ee9693ff89cdf73862b8a13988f6a71070e8fc58' # ratchet:google-github-actions/setup-gcloud@v1
35-
- name: 'Remove old Cloud Run services'
48+
- name: 'Remove old Cloud Run revisions'
3649
shell: 'bash'
3750
run: |-
3851
gcloud config set core/project "${{ env.INTEGRATION_PROJECT_ID }}"

‎.github/workflows/release.yml

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# Copyright 2023 The Authors (see AUTHORS file)
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
name: 'release'
16+
17+
on:
18+
push:
19+
tags:
20+
- 'v*'
21+
env:
22+
SOURCE_DOCKER_IMAGE: 'us-docker.pkg.dev/github-metrics-ci/ci-images/github-metrics-aggregator-server:${{ github.sha }}'
23+
DEST_DOCKER_REPO: 'us-docker.pkg.dev/abcxyz-artifacts/docker-images/github-metrics-aggregator-server:${{ github.ref_name }}'
24+
WIF_PROVIDER: 'projects/138221849759/locations/global/workloadIdentityPools/github-pool-ac8f/providers/github-provider'
25+
WIF_SERVICE_ACCOUNT: 'github-metrics-ac8f-ci-sa@github-metrics-ci.iam.gserviceaccount.com'
26+
27+
# Don't cancel in progress since we don't want to have half-baked releases.
28+
concurrency: '${{ github.workflow }}-${{ github.head_ref || github.ref }}-release'
29+
30+
jobs:
31+
image-release:
32+
runs-on: 'ubuntu-latest'
33+
permissions:
34+
contents: 'read'
35+
id-token: 'write'
36+
steps:
37+
- name: 'Setup QEMU'
38+
uses: 'docker/setup-qemu-action@e81a89b1732b9c48d79cd809d8d81d79c4647a18' # ratchet:docker/setup-qemu-action@v2
39+
- id: 'auth'
40+
name: 'Authenticate to Google Cloud'
41+
uses: 'google-github-actions/auth@c4799db9111fba4461e9f9da8732e5057b394f72' # ratchet:google-github-actions/auth@v0
42+
with:
43+
workload_identity_provider: '${{ env.WIF_PROVIDER }}'
44+
service_account: '${{ env.WIF_SERVICE_ACCOUNT }}'
45+
token_format: 'access_token'
46+
- name: 'Authenticate to Artifact Registry'
47+
uses: 'docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a' # ratchet:docker/login-action@v2
48+
with:
49+
username: 'oauth2accesstoken'
50+
password: '${{ steps.auth.outputs.access_token }}'
51+
registry: 'us-docker.pkg.dev'
52+
- name: 'Tag and push Docker images'
53+
run: |-
54+
docker pull ${{ env.SOURCE_DOCKER_IMAGE }}-amd64
55+
docker tag ${{ env.SOURCE_DOCKER_IMAGE }}-amd64 ${{ env.TARGET_DOCKER_IMAGE }}-amd64
56+
docker push ${{ env.TARGET_DOCKER_IMAGE }}-amd64
57+
58+
docker pull ${{ env.SOURCE_DOCKER_IMAGE }}-arm64
59+
docker tag ${{ env.SOURCE_DOCKER_IMAGE }}-arm64 ${{ env.TARGET_DOCKER_IMAGE }}-arm64
60+
docker push ${{ env.TARGET_DOCKER_IMAGE }}-arm64

‎.gitignore

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ coverage.out
6969
*.tfvars
7070

7171
bin/
72+
dist/
7273

7374
# Env Vars
7475
.env*

‎.goreleaser.docker.yaml

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
# Copyright 2023 The Authors (see AUTHORS file)
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
env:
16+
# Global env vars for Go build.
17+
- 'CGO_ENABLED=0'
18+
- 'GO111MODULE=on'
19+
- 'GOPROXY=https://proxy.golang.org,direct'
20+
21+
before:
22+
hooks:
23+
- go mod tidy
24+
25+
builds:
26+
- id: server
27+
main: ./cmd/github-metrics-aggregator
28+
binary: server
29+
mod_timestamp: '{{ .CommitTimestamp }}'
30+
flags:
31+
- '-a'
32+
- '-trimpath'
33+
ldflags:
34+
- '-s'
35+
- '-w'
36+
- '-X={{ .ModulePath }}/pkg/version.Name=github-metrics-aggregator-server'
37+
- '-X={{ .ModulePath }}/pkg/version.Version={{ .Version }}'
38+
- '-X={{ .ModulePath }}/pkg/version.Commit={{ .Commit }}'
39+
- '-extldflags=-static'
40+
goos:
41+
- 'linux'
42+
goarch:
43+
- 'amd64'
44+
- 'arm64'
45+
46+
dockers:
47+
- ids:
48+
- server
49+
use: 'buildx'
50+
goos: 'linux'
51+
goarch: 'amd64'
52+
image_templates:
53+
- '{{ .Env.DOCKER_REPO }}/github-metrics-aggregator-server:{{ .Env.DOCKER_TAG }}-amd64'
54+
build_flag_templates:
55+
- '--platform=linux/amd64'
56+
- '--pull'
57+
- '--label=org.opencontainers.image.created={{ .CommitTimestamp }}'
58+
- '--label=org.opencontainers.image.description=GitHub Metrics Aggregator server is a service to ingest GitHub webhook events.'
59+
- '--label=org.opencontainers.image.licenses=Apache-2.0'
60+
- '--label=org.opencontainers.image.name=github-metrics-aggregator-server'
61+
- '--label=org.opencontainers.image.revision={{ .FullCommit }}'
62+
- '--label=org.opencontainers.image.source={{ .GitURL }}'
63+
- '--label=org.opencontainers.image.title=github-metrics-aggregator-server'
64+
- '--label=org.opencontainers.image.version={{ .Version }}'
65+
- ids:
66+
- server
67+
use: 'buildx'
68+
goos: 'linux'
69+
goarch: 'arm64'
70+
image_templates:
71+
- '{{ .Env.DOCKER_REPO }}/github-metrics-aggregator-server:{{ .Env.DOCKER_TAG }}-arm64'
72+
build_flag_templates:
73+
- '--platform=linux/arm64'
74+
- '--pull'
75+
- '--label=org.opencontainers.image.created={{ .CommitTimestamp }}'
76+
- '--label=org.opencontainers.image.description=GitHub Metrics Aggregator server is a service to ingest GitHub webhook events.'
77+
- '--label=org.opencontainers.image.licenses=Apache-2.0'
78+
- '--label=org.opencontainers.image.name=github-metrics-aggregator-server'
79+
- '--label=org.opencontainers.image.revision={{ .FullCommit }}'
80+
- '--label=org.opencontainers.image.source={{ .GitURL }}'
81+
- '--label=org.opencontainers.image.title=github-metrics-aggregator-server'
82+
- '--label=org.opencontainers.image.version={{ .Version }}'
83+
84+
docker_manifests:
85+
- name_template: '{{ .Env.DOCKER_REPO }}/github-metrics-aggregator-server:{{ .Env.DOCKER_TAG }}'
86+
image_templates:
87+
- '{{ .Env.DOCKER_REPO }}/github-metrics-aggregator-server:{{ .Env.DOCKER_TAG }}-amd64'
88+
- '{{ .Env.DOCKER_REPO }}/github-metrics-aggregator-server:{{ .Env.DOCKER_TAG }}-arm64'
89+
90+
# TODO: Follow up on signing.
91+
92+
# Disable SCM release we only want docker release here.
93+
release:
94+
disable: true

‎Dockerfile

Lines changed: 13 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -12,33 +12,22 @@
1212
# See the License for the specific language governing permissions and
1313
# limitations under the License.
1414

15-
FROM --platform=$BUILDPLATFORM golang:1.19 AS builder
16-
17-
ENV PORT=8080
18-
ENV CGO_ENABLED=0
19-
ENV GOPROXY=https://proxy.golang.org,direct
20-
21-
WORKDIR /go/src/app
22-
COPY . .
23-
24-
RUN go build \
25-
-a \
26-
-trimpath \
27-
-ldflags "-s -w -extldflags='-static'" \
28-
-o /go/bin/server \
29-
./cmd/github-metrics-aggregator
30-
31-
RUN strip -s /go/bin/server
32-
33-
RUN echo "nobody:*:65534:65534:nobody:/:/bin/false" > /tmp/etc-passwd
15+
# Use distroless for ca certs.
16+
FROM gcr.io/distroless/static AS distroless
3417

3518
# Use a scratch image to host our binary.
3619
FROM scratch
37-
COPY --from=builder /tmp/etc-passwd /etc/passwd
38-
COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
39-
COPY --from=builder /go/bin/server /server
20+
COPY --from=distroless /etc/passwd /etc/passwd
21+
COPY --from=distroless /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
22+
23+
COPY server /server
4024

41-
USER nobody
25+
# Normally we would set this to run as "nobody".
26+
# But goreleaser builds the binary locally and sometimes it will mess up the permission
27+
# and cause "exec user process caused: permission denied".
28+
#
29+
# USER nobody
4230

43-
EXPOSE 8080
31+
# Run the server on container startup.
32+
ENV PORT 8080
4433
ENTRYPOINT ["/server"]

0 commit comments

Comments
 (0)