Skip to content

Commit 0e2b010

Browse files
eudelins-zamaeudelins-zama
committed
ci(common): fix re-tag race conditions
1 parent 8b6af23 commit 0e2b010

File tree

3 files changed

+247
-84
lines changed

3 files changed

+247
-84
lines changed

‎.github/workflows/check-changes-for-docker-build.yml‎

Lines changed: 118 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,118 @@
1+
name: check-changes-for-docker-build
2+
3+
on:
4+
workflow_call:
5+
secrets:
6+
GHCR_READ_TOKEN:
7+
required: true
8+
inputs:
9+
caller-workflow-event-name:
10+
description: "The github.name of the caller workflow"
11+
type: string
12+
required: true
13+
caller-workflow-event-before:
14+
description: "The github.event.before sha of the caller workflow"
15+
type: string
16+
required: true
17+
docker-image:
18+
description: "The name of the docker image of the service"
19+
type: string
20+
required: true
21+
max-commit-count:
22+
description: Maximum number of commits to search for an image
23+
default: 50
24+
required: false
25+
filters:
26+
description: "The filters for the dorny/paths-filter action"
27+
type: string
28+
required: true
29+
outputs:
30+
base-commit:
31+
description: "The base commit of the previous docker image"
32+
value: ${{ jobs.check-changes.outputs.base-commit }}
33+
changes:
34+
description: "Output of the dorny/paths-filter action"
35+
value: ${{ jobs.check-changes.outputs.changes }}
36+
37+
permissions: {}
38+
39+
jobs:
40+
check-changes:
41+
name: check-changes
42+
permissions:
43+
actions: 'read' # Required to read workflow run information
44+
contents: 'read' # Required to checkout repository code
45+
pull-requests: 'read' # Required to read pull request information
46+
runs-on: ubuntu-latest
47+
outputs:
48+
changes: ${{ steps.set-changes-output.outputs.changes }}
49+
base-commit: ${{ steps.set-base-commit.outputs.base-commit }}
50+
steps:
51+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
52+
with:
53+
persist-credentials: 'false'
54+
55+
- name: Install Docker (push only)
56+
# if: inputs.caller-workflow-event-name == 'push' # TODO
57+
uses: docker/setup-docker-action@efe9e3891a4f7307e689f2100b33a155b900a608 # v4.5.0
58+
59+
- name: Login to GitHub Container Registry (push only)
60+
# if: inputs.caller-workflow-event-name == 'push' # TODO
61+
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
62+
with:
63+
registry: ghcr.io
64+
username: ${{ github.actor }}
65+
password: ${{ secrets.GHCR_READ_TOKEN }}
66+
67+
- name: Find latest commit with existing image (push only)
68+
id: find-latest-image-commit
69+
# if: inputs.caller-workflow-event-name == 'push' # TODO
70+
shell: bash
71+
env:
72+
BASE_BRANCH_COMMIT: ${{ inputs.caller-workflow-event-before }}
73+
IMAGE: ghcr.io/zama-ai/${{ inputs.docker-image }}
74+
MAX_COMMIT_COUNT: ${{ inputs.max-commit-count }}
75+
run: |
76+
git fetch origin main
77+
mapfile -t CANDIDATES < <(git rev-list "${BASE_BRANCH_COMMIT}" --max-count=${MAX_COMMIT_COUNT})
78+
79+
LATEST_IMAGE_COMMIT=""
80+
for commit in "${CANDIDATES[@]}"; do
81+
short_commit=${commit:0:7}
82+
echo "Checking if ${IMAGE}:${short_commit} image exists..."
83+
if docker manifest inspect "${IMAGE}:${short_commit}"; then
84+
LATEST_IMAGE_COMMIT="${commit}"
85+
echo "${IMAGE}:${short_commit} was found!"
86+
break
87+
fi
88+
done
89+
90+
if [[ -z "${LATEST_IMAGE_COMMIT}" ]]; then
91+
echo "No images found for ${IMAGE} with the last ${MAX_COMMIT_COUNT} commits!"
92+
exit 1
93+
fi
94+
95+
echo "latest-image-commit=${LATEST_IMAGE_COMMIT}" >> "$GITHUB_OUTPUT"
96+
97+
- id: set-base-commit
98+
shell: bash
99+
env:
100+
LATEST_IMAGE_COMMIT: ${{ steps.find-latest-image-commit.outputs.latest-image-commit }}
101+
BASE_BRANCH_COMMIT: ${{ inputs.caller-workflow-event-before }}
102+
run: |
103+
echo "base-commit=${LATEST_IMAGE_COMMIT:-$BASE_BRANCH_COMMIT}" >> "$GITHUB_OUTPUT"
104+
105+
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
106+
id: filter
107+
with:
108+
base: ${{ steps.set-base-commit.outputs.base-commit }}
109+
filters: ${{ inputs.filters }}
110+
111+
- id: set-changes-output
112+
shell: bash
113+
env:
114+
FILTER_OUTPUTS_JSON: ${{ toJSON(steps.filter.outputs) }}
115+
run: |
116+
first_key=$(jq -r 'keys[0]' <<< "$FILTER_OUTPUTS_JSON")
117+
first_value=$(jq -r --arg k "$first_key" '.[$k]' <<< "$FILTER_OUTPUTS_JSON")
118+
echo "changes=$first_value" >> "$GITHUB_OUTPUT"

‎.github/workflows/kms-connector-docker-build.yml‎

Lines changed: 121 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ on:
99
required: true
1010
BLOCKCHAIN_ACTIONS_TOKEN:
1111
required: true
12+
GHCR_READ_TOKEN:
13+
required: true
1214
CGR_USERNAME:
1315
required: true
1416
CGR_PASSWORD:
@@ -50,6 +52,7 @@ on:
5052
push:
5153
branches:
5254
- main
55+
pull_request: # TODO: remove later
5356

5457
permissions: {}
5558

@@ -58,50 +61,31 @@ concurrency:
5861
cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
5962

6063
jobs:
61-
check-changes:
62-
name: check-changes
63-
permissions:
64+
########################################################################
65+
# DB MIGRATION #
66+
########################################################################
67+
check-changes-db-migration:
68+
uses: ./.github/workflows/check-changes-for-docker-build.yml
69+
secrets: &check_changes_secrets
70+
GHCR_READ_TOKEN: ${{ secrets.GHCR_READ_TOKEN }}
71+
permissions: &check_changes_permissions
6472
actions: 'read' # Required to read workflow run information
6573
contents: 'read' # Required to checkout repository code
6674
pull-requests: 'read' # Required to read pull request information
67-
runs-on: ubuntu-latest
68-
outputs:
69-
changes-db-migration: ${{ steps.filter.outputs.db-migration }}
70-
changes-gw-listener: ${{ steps.filter.outputs.gw-listener }}
71-
changes-kms-worker: ${{ steps.filter.outputs.kms-worker }}
72-
changes-tx-sender: ${{ steps.filter.outputs.tx-sender }}
73-
steps:
74-
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
75-
with:
76-
persist-credentials: 'false'
77-
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
78-
id: filter
79-
with:
80-
filters: |
81-
db-migration:
82-
- .github/workflows/kms-connector-docker-build.yml
83-
- kms-connector/connector-db/**
84-
gw-listener:
85-
- .github/workflows/kms-connector-docker-build.yml
86-
- kms-connector/crates/gw-listener/**
87-
- kms-connector/crates/utils/**
88-
- kms-connector/Cargo.*
89-
kms-worker:
90-
- .github/workflows/kms-connector-docker-build.yml
91-
- kms-connector/crates/kms-worker/**
92-
- kms-connector/crates/utils/**
93-
- kms-connector/Cargo.*
94-
tx-sender:
95-
- .github/workflows/kms-connector-docker-build.yml
96-
- kms-connector/crates/tx-sender/**
97-
- kms-connector/crates/utils/**
98-
- kms-connector/Cargo.*
75+
with:
76+
caller-workflow-event-name: ${{ github.event_name }}
77+
caller-workflow-event-before: ${{ github.event.before }}
78+
docker-image: fhevm/kms-connector/db-migration
79+
filters: |
80+
db-migration:
81+
- .github/workflows/kms-connector-docker-build.yml
82+
- kms-connector/connector-db/**
9983
10084
build-db-migration:
101-
needs: check-changes
85+
needs: check-changes-db-migration
10286
if: |
10387
github.event_name == 'release'
104-
|| (github.event_name != 'workflow_dispatch' && needs.check-changes.outputs.changes-db-migration == 'true')
88+
|| (github.event_name != 'workflow_dispatch' && needs.check-changes-db-migration.outputs.changes == 'true')
10589
|| (github.event_name == 'workflow_dispatch' && inputs.build_db_migration)
10690
uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@3cf4c2b133947d29e7a313555638621f9ca0345c # v1.0.3
10791
secrets: &docker_secrets
@@ -125,11 +109,44 @@ jobs:
125109
app-cache-dir: "fhevm-kms-connector-db-migration"
126110
rust-toolchain-file-path: kms-connector/rust-toolchain.toml
127111

112+
re-tag-db-migration-image:
113+
needs: check-changes-db-migration
114+
if: |
115+
needs.check-changes-db-migration.outputs.changes != 'true' && github.event_name == 'push'
116+
permissions: &re-tag-image-permissions
117+
actions: 'read' # Required to read workflow run information
118+
contents: 'read' # Required to checkout repository code
119+
packages: 'write' # Required to publish Docker images
120+
id-token: 'write' # Required for OIDC authentication
121+
uses: ./.github/workflows/re-tag-docker-image.yml
122+
with:
123+
image-name: "fhevm/kms-connector/db-migration"
124+
previous-tag-or-commit: ${{ needs.check-changes-db-migration.outputs.base-commit }}
125+
new-tag-or-commit: ${{ github.event.after }}
126+
127+
########################################################################
128+
# GATEWAY LISTENER #
129+
########################################################################
130+
check-changes-gw-listener:
131+
uses: ./.github/workflows/check-changes-for-docker-build.yml
132+
secrets: *check_changes_secrets
133+
permissions: *check_changes_permissions
134+
with:
135+
caller-workflow-event-name: ${{ github.event_name }}
136+
caller-workflow-event-before: ${{ github.event.before }}
137+
docker-image: fhevm/kms-connector/gw-listener
138+
filters: |
139+
gw-listener:
140+
- .github/workflows/kms-connector-docker-build.yml
141+
- kms-connector/crates/gw-listener/**
142+
- kms-connector/crates/utils/**
143+
- kms-connector/Cargo.*
144+
128145
build-gw-listener:
129-
needs: check-changes
146+
needs: check-changes-gw-listener
130147
if: |
131148
github.event_name == 'release'
132-
|| (github.event_name != 'workflow_dispatch' && needs.check-changes.outputs.changes-gw-listener == 'true')
149+
|| (github.event_name != 'workflow_dispatch' && needs.check-changes-gw-listener.outputs.changes == 'true')
133150
|| (github.event_name == 'workflow_dispatch' && inputs.build_gw_listener)
134151
uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@3cf4c2b133947d29e7a313555638621f9ca0345c # v1.0.3
135152
permissions: *docker_permissions
@@ -142,11 +159,40 @@ jobs:
142159
app-cache-dir: "fhevm-kms-connector-gw-listener"
143160
rust-toolchain-file-path: kms-connector/rust-toolchain.toml
144161

162+
re-tag-gw-listener-image:
163+
needs: check-changes-gw-listener
164+
if: |
165+
needs.check-changes-gw-listener.outputs.changes != 'true' && github.event_name == 'push'
166+
permissions: *re-tag-image-permissions
167+
uses: ./.github/workflows/re-tag-docker-image.yml
168+
with:
169+
image-name: "fhevm/kms-connector/gw-listener"
170+
previous-tag-or-commit: ${{ needs.check-changes-gw-listener.outputs.base-commit }}
171+
new-tag-or-commit: ${{ github.event.after }}
172+
173+
########################################################################
174+
# KMS WORKER #
175+
########################################################################
176+
check-changes-kms-worker:
177+
uses: ./.github/workflows/check-changes-for-docker-build.yml
178+
secrets: *check_changes_secrets
179+
permissions: *check_changes_permissions
180+
with:
181+
caller-workflow-event-name: ${{ github.event_name }}
182+
caller-workflow-event-before: ${{ github.event.before }}
183+
docker-image: fhevm/kms-connector/kms-worker
184+
filters: |
185+
kms-worker:
186+
- .github/workflows/kms-connector-docker-build.yml
187+
- kms-connector/crates/kms-worker/**
188+
- kms-connector/crates/utils/**
189+
- kms-connector/Cargo.*
190+
145191
build-kms-worker:
146-
needs: check-changes
192+
needs: check-changes-kms-worker
147193
if: |
148194
github.event_name == 'release'
149-
|| (github.event_name != 'workflow_dispatch' && needs.check-changes.outputs.changes-kms-worker == 'true')
195+
|| (github.event_name != 'workflow_dispatch' && needs.check-changes-kms-worker.outputs.changes == 'true')
150196
|| (github.event_name == 'workflow_dispatch' && inputs.build_kms_worker)
151197
uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@3cf4c2b133947d29e7a313555638621f9ca0345c # v1.0.3
152198
permissions: *docker_permissions
@@ -159,11 +205,40 @@ jobs:
159205
app-cache-dir: "fhevm-kms-connector-kms-worker"
160206
rust-toolchain-file-path: kms-connector/rust-toolchain.toml
161207

208+
re-tag-kms-worker-image:
209+
needs: check-changes-kms-worker
210+
if: |
211+
needs.check-changes-kms-worker.outputs.changes != 'true' && github.event_name == 'push'
212+
permissions: *re-tag-image-permissions
213+
uses: ./.github/workflows/re-tag-docker-image.yml
214+
with:
215+
image-name: "fhevm/kms-connector/kms-worker"
216+
previous-tag-or-commit: ${{ needs.check-changes-kms-worker.outputs.base-commit }}
217+
new-tag-or-commit: ${{ github.event.after }}
218+
219+
########################################################################
220+
# TRANSACTION SENDER #
221+
########################################################################
222+
check-changes-tx-sender:
223+
uses: ./.github/workflows/check-changes-for-docker-build.yml
224+
secrets: *check_changes_secrets
225+
permissions: *check_changes_permissions
226+
with:
227+
caller-workflow-event-name: ${{ github.event_name }}
228+
caller-workflow-event-before: ${{ github.event.before }}
229+
docker-image: fhevm/kms-connector/tx-sender
230+
filters: |
231+
tx-sender:
232+
- .github/workflows/kms-connector-docker-build.yml
233+
- kms-connector/crates/tx-sender/**
234+
- kms-connector/crates/utils/**
235+
- kms-connector/Cargo.*
236+
162237
build-tx-sender:
163-
needs: check-changes
238+
needs: check-changes-tx-sender
164239
if: |
165240
github.event_name == 'release'
166-
|| (github.event_name != 'workflow_dispatch' && needs.check-changes.outputs.changes-tx-sender == 'true')
241+
|| (github.event_name != 'workflow_dispatch' && needs.check-changes-tx-sender.outputs.changes == 'true')
167242
|| (github.event_name == 'workflow_dispatch' && inputs.build_tx_sender)
168243
uses: zama-ai/ci-templates/.github/workflows/common-docker.yml@3cf4c2b133947d29e7a313555638621f9ca0345c # v1.0.3
169244
permissions: *docker_permissions
@@ -176,50 +251,13 @@ jobs:
176251
app-cache-dir: "fhevm-kms-connector-tx-sender"
177252
rust-toolchain-file-path: kms-connector/rust-toolchain.toml
178253

179-
re-tag-db-migration-image:
180-
needs: check-changes
181-
if: |
182-
needs.check-changes.outputs.changes-db-migration != 'true' && github.event_name == 'push'
183-
permissions: &re-tag-image-permissions
184-
actions: 'read' # Required to read workflow run information
185-
contents: 'read' # Required to checkout repository code
186-
packages: 'write' # Required to publish Docker images
187-
id-token: 'write' # Required for OIDC authentication
188-
uses: ./.github/workflows/re-tag-docker-image.yml
189-
with:
190-
image-name: "fhevm/kms-connector/db-migration"
191-
previous-tag-or-commit: ${{ github.event.before }}
192-
new-tag-or-commit: ${{ github.event.after }}
193-
194-
re-tag-gw-listener-image:
195-
needs: check-changes
196-
if: |
197-
needs.check-changes.outputs.changes-gw-listener != 'true' && github.event_name == 'push'
198-
permissions: *re-tag-image-permissions
199-
uses: ./.github/workflows/re-tag-docker-image.yml
200-
with:
201-
image-name: "fhevm/kms-connector/gw-listener"
202-
previous-tag-or-commit: ${{ github.event.before }}
203-
new-tag-or-commit: ${{ github.event.after }}
204-
205-
re-tag-kms-worker-image:
206-
needs: check-changes
207-
if: |
208-
needs.check-changes.outputs.changes-kms-worker != 'true' && github.event_name == 'push'
209-
permissions: *re-tag-image-permissions
210-
uses: ./.github/workflows/re-tag-docker-image.yml
211-
with:
212-
image-name: "fhevm/kms-connector/kms-worker"
213-
previous-tag-or-commit: ${{ github.event.before }}
214-
new-tag-or-commit: ${{ github.event.after }}
215-
216254
re-tag-tx-sender-image:
217-
needs: check-changes
255+
needs: check-changes-tx-sender
218256
if: |
219-
needs.check-changes.outputs.changes-tx-sender != 'true' && github.event_name == 'push'
257+
needs.check-changes-tx-sender.outputs.changes != 'true' && github.event_name == 'push'
220258
permissions: *re-tag-image-permissions
221259
uses: ./.github/workflows/re-tag-docker-image.yml
222260
with:
223261
image-name: "fhevm/kms-connector/tx-sender"
224-
previous-tag-or-commit: ${{ github.event.before }}
262+
previous-tag-or-commit: ${{ needs.check-changes-tx-sender.outputs.base-commit }}
225263
new-tag-or-commit: ${{ github.event.after }}

0 commit comments

Comments
 (0)