MS: Updated values and ingress #123
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # CI Pipeline | |
| name: Build | |
| on: | |
| push: | |
| tags: | |
| - '*' | |
| branches: | |
| - 'master' | |
| - 'api-hardening' | |
| pull_request: | |
| branches: | |
| - 'master' | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| HELM_REPO_URL: eccr.ecmwf.int | |
| HELM_CHART: ${{ github.workspace }}/helm/gsprestapi | |
| HELM_REPO_CHANNEL: geoglows_api | |
| HELM_REPO_USERNAME: ${{ secrets.HELM_REPO_USERNAME }} | |
| HELM_KEY_PASSPHRASE: ${{ secrets.HELM_KEY_PASSPHRASE }} | |
| HELM_REPO_PASSWORD: ${{ secrets.HELM_REPO_PASSWORD }} | |
| CI_COMMIT_SHORT_SHA: ${{ github.sha }} | |
| ECCR_USER: ${{ secrets.ECCR_USER }} | |
| ECCR_PASSWORD: ${{ secrets.ECCR_PASSWORD }} | |
| KANIKO_IMAGE: gcr.io/kaniko-project/executor:debug | |
| KANIKO_CONTEXT: /workspace | |
| KANIKO_DOCKERFILE: Dockerfile | |
| BANNED_IPS: ${{ secrets.BANNED_IPS }} | |
| jobs: | |
| check-helm: | |
| name: Check Helm | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| submodules: false | |
| - name: Ensure HELM_CHART is set | |
| run: | | |
| if [[ -z "${HELM_CHART}" ]]; then | |
| echo "HELM_CHART must be set" >&2 | |
| exit 1 | |
| fi | |
| - name: Lint Helm Chart | |
| run: helm lint "$HELM_CHART" | |
| - name: Test Harbor auth | |
| run: | | |
| curl -I -u "$HELM_REPO_USERNAME:$HELM_REPO_PASSWORD" \ | |
| https://eccr.ecmwf.int/chartrepo/geoglows_api/index.yaml | |
| - name: Run Check Helm Script | |
| run: | | |
| chmod +x ./check_helm_chart | |
| ./check_helm_chart "$HELM_CHART" | |
| update-helm: | |
| runs-on: ubuntu-latest | |
| needs: check-helm | |
| steps: | |
| - name: Checkout Repository | |
| uses: actions/checkout@v4 | |
| with: | |
| submodules: false | |
| - name: Ensure Required Variables Are Set | |
| run: | | |
| : "${HELM_CHART:?must be set}" | |
| : "${HELM_KEY_PASSPHRASE:?must be set}" | |
| : "${HELM_REPO_PASSWORD:?must be set}" | |
| - name: Run Helm Lint | |
| run: helm lint "$HELM_CHART" | |
| - name: Run Check Helm Script and Upload | |
| run: | | |
| chmod +x ./check_helm_chart | |
| ./check_helm_chart "$HELM_CHART" --upload | |
| kaniko-build: | |
| if: startsWith(github.ref, 'refs/tags/') || github.ref_name == 'master' || github.ref_name == 'api-hardening' | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| submodules: true | |
| fetch-depth: 0 | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ github.token }} | |
| - name: Login to ECCR Harbor | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: eccr.ecmwf.int/ | |
| username: ${{ env.ECCR_USER }} | |
| password: ${{ env.ECCR_PASSWORD }} | |
| - name: Add Registry to Env | |
| run: echo "CI_REGISTRY_IMAGE=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_ENV" | |
| - name: Set Kaniko Build Variables | |
| run: | | |
| KANIKO_ARGS="" | |
| EXPECTED_ECCR_TAG="" | |
| if [[ "${{ startsWith(github.ref, 'refs/tags/') }}" == "true" ]]; then | |
| KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:${{ github.ref_name }}" | |
| KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:latest" | |
| KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:${{ github.ref_name }}" | |
| KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:latest" | |
| elif [[ "${{ github.ref_name }}" == "master" ]]; then | |
| KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:stable" | |
| # KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:stable" | |
| elif [[ "${{ github.ref_name }}" == "api-hardening" ]]; then | |
| KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:api-hardening" | |
| KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:${CI_COMMIT_SHORT_SHA}" | |
| KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:api-hardening" | |
| KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:${CI_COMMIT_SHORT_SHA}" | |
| EXPECTED_ECCR_TAG="api-hardening" | |
| else | |
| echo "No valid build type" >&2 | |
| exit 1 | |
| fi | |
| echo "KANIKO_ARGS=${KANIKO_ARGS}" >> "$GITHUB_ENV" | |
| echo "EXPECTED_ECCR_TAG=${EXPECTED_ECCR_TAG}" >> "$GITHUB_ENV" | |
| - name: Debug Published Image Tags | |
| run: | | |
| echo "Build ref: ${{ github.ref }}" | |
| echo "Build ref_name: ${{ github.ref_name }}" | |
| echo "Commit SHA: ${{ github.sha }}" | |
| echo "Commit short SHA: ${CI_COMMIT_SHORT_SHA}" | |
| echo "Expected ECCR primary tag: ${EXPECTED_ECCR_TAG}" | |
| echo "Expected ECCR SHA tag: ${CI_COMMIT_SHORT_SHA}" | |
| echo "Kaniko destinations: ${KANIKO_ARGS}" | |
| - name: Run Kaniko Build & Push | |
| run: | | |
| [[ -z "${KANIKO_DOCKERFILE}" ]] && echo "KANIKO_DOCKERFILE must be set" && exit 1 | |
| [[ -z "${KANIKO_CONTEXT}" ]] && echo "KANIKO_CONTEXT must be set" && exit 1 | |
| [[ -z "${KANIKO_ARGS}" ]] && echo "KANIKO_ARGS must be set" && exit 1 | |
| FINAL_ARGS="--context ${KANIKO_CONTEXT} --dockerfile ${KANIKO_DOCKERFILE} ${KANIKO_ARGS} --build-arg BANNED_IPS='${BANNED_IPS}' --cache=true --cache-repo ${CI_REGISTRY_IMAGE}/cache --force" | |
| echo "Running Kaniko with:" | |
| echo "${FINAL_ARGS}" | |
| docker run --rm \ | |
| -v "${{ github.workspace }}:/workspace" \ | |
| -v "$HOME/.docker:/kaniko/.docker:ro" \ | |
| ${{ env.KANIKO_IMAGE }} \ | |
| ${FINAL_ARGS} |