From b779827f5fea97561cbf398874987ea61baff124 Mon Sep 17 00:00:00 2001 From: Alexey Pustovalov Date: Sun, 11 Feb 2024 00:19:34 +0900 Subject: [PATCH] Prepare universal workflow --- .github/workflows/images_build_rhel.yml | 158 ++++++++++++++++++++---- 1 file changed, 135 insertions(+), 23 deletions(-) diff --git a/.github/workflows/images_build_rhel.yml b/.github/workflows/images_build_rhel.yml index 7897bbcfe..72f8786cd 100644 --- a/.github/workflows/images_build_rhel.yml +++ b/.github/workflows/images_build_rhel.yml @@ -4,6 +4,7 @@ on: release: types: - published + workflow_dispatch: defaults: run: @@ -11,7 +12,14 @@ defaults: env: LATEST_BRANCH: ${{ github.event.repository.default_branch }} + IMAGES_PREFIX: "zabbix-" BASE_BUILD_NAME: "build-base" + + DOCKERFILES_DIRECTORY: "Dockerfiles" + + OIDC_ISSUER: "https://token.actions.githubusercontent.com" + IDENITY_REGEX: "https://github.com/zabbix/zabbix-docker/.github/" + REGISTRY: "quay.io" REGISTRY_NAMESPACE: "redhat-isv-containers" PFLT_LOGLEVEL: "warn" @@ -20,23 +28,30 @@ env: jobs: init_build: name: Initialize build - runs-on: [self-hosted, linux, X64] + runs-on: ubuntu-latest + permissions: + contents: read outputs: components: ${{ steps.components.outputs.list }} is_default_branch: ${{ steps.branch_info.outputs.is_default_branch }} current_branch: ${{ steps.branch_info.outputs.current_branch }} sha_short: ${{ steps.branch_info.outputs.sha_short }} steps: - - name: Checkout repository - uses: actions/checkout@v4 + - name: Block egress traffic + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 with: - fetch-depth: 1 + disable-sudo: true + egress-policy: block - name: Get branch info id: branch_info + shell: bash + env: + LATEST_BRANCH: ${{ env.LATEST_BRANCH }} + github_ref: ${{ env.TRUNK_ONLY_EVENT == 'true' && env.TRUNK_GIT_BRANCH || github.ref }} run: | - github_ref="${{ github.ref }}" result=false + sha_short=$(git rev-parse --short HEAD) if [[ "$github_ref" == "refs/tags/"* ]]; then github_ref=${github_ref%.*} @@ -44,55 +59,80 @@ jobs: github_ref=${github_ref##*/} - if [[ "$github_ref" == "${{ env.LATEST_BRANCH }}" ]]; then + if [[ "$github_ref" == "$LATEST_BRANCH" ]]; then result=true fi + echo "::group::Branch data" + echo "is_default_branch - $result" + echo "current_branch - $github_ref" + echo "sha_short - $sha_short" + echo "::endgroup::" + echo "is_default_branch=$result" >> $GITHUB_OUTPUT echo "current_branch=$github_ref" >> $GITHUB_OUTPUT - echo "sha_short=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT + echo "sha_short=$sha_short" >> $GITHUB_OUTPUT - name: Prepare Zabbix component list id: components env: REDHAT_CERTIFY_CREDENTIALS: ${{ secrets.REDHAT_CERTIFY_CREDENTIALS }} + CURRENT_BRANCH: ${{ steps.branch_info.outputs.current_branch }} run: | - component_list=$(jq --raw-output --argjson data "$REDHAT_CERTIFY_CREDENTIALS" -n '$data."${{ steps.branch_info.outputs.current_branch }}".components | keys | [ .[] | tostring ] | @json') + component_list=$(jq --raw-output --argjson data "${REDHAT_CERTIFY_CREDENTIALS}" -n '$data."${CURRENT_BRANCH}".components | keys | [ .[] | tostring ] | @json') + + echo "::group::Zabbix Component List" + echo "$component_list" + echo "::endgroup::" echo "list=$component_list" >> $GITHUB_OUTPUT build_base: timeout-minutes: 30 - name: Build ${{ matrix.build }} base on RHEL + name: Build ${{ matrix.build }} base on RHEL (${{ matrix.arch }}) needs: ["init_build"] strategy: fail-fast: false matrix: build: ["build-base"] - - runs-on: [self-hosted, linux, X64] - outputs: - image: ${{ steps.build_image.outputs.image-with-tag }} + arch: ["X64", "ARM64"] + runs-on: [self-hosted, linux, ${{ matrix.arch }}] + permissions: + contents: read + id-token: write steps: + - name: Block egress traffic + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 + with: + egress-policy: audit + - name: Checkout repository uses: actions/checkout@v4 with: fetch-depth: 1 + - name: Install cosign + uses: sigstore/cosign-installer@e1523de7571e31dbe865fd2e80c5c7c23ae71eb4 + with: + cosign-release: 'v2.2.3' + + - name: Check cosign version + run: cosign version + - name: Generate tags id: meta uses: docker/metadata-action@v5 with: - images: zabbix-${{ matrix.build }} + images: ${{ env.IMAGES_PREFIX }}${{ matrix.build }} tags: | - type=sha + type=sha,postfix=-${{ matrix.arch }} - name: Build Zabbix Build Base id: build_image uses: redhat-actions/buildah-build@v2 with: - context: ./Dockerfiles/${{ matrix.build }}/rhel + context: ${{ env.DOCKERFILES_DIRECTORY }}/${{ matrix.build }}/rhel layers: false tags: ${{ steps.meta.outputs.tags }} containerfiles: | @@ -100,6 +140,26 @@ jobs: extra-args: | --pull + - name: Image digest + env: + DIGEST: ${{ steps.docker_build.outputs.digest }} + CACHE_FILE_NAME: ${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }} + run: | + echo "::group::Image digest" + echo "$DIGEST" + echo "::endgroup::" + echo "::group::Cache file name" + echo "$CACHE_FILE_NAME" + echo "::endgroup::" + + echo "$DIGEST" > "$CACHE_FILE_NAME" + + - name: Cache image digest + uses: actions/cache@v4 + with: + path: ${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }} + key: ${{ env.BASE_BUILD_NAME }}-${{ matrix.arch }}-${{ github.run_id }} + build_base_database: timeout-minutes: 180 needs: [ "build_base", "init_build"] @@ -108,9 +168,17 @@ jobs: fail-fast: false matrix: build: ["mysql", "sqlite3"] - - runs-on: [self-hosted, linux, X64] + arch: ["X64", "ARM64"] + runs-on: [self-hosted, linux, ${{ matrix.arch }}] + permissions: + contents: read + id-token: write steps: + - name: Block egress traffic + uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 + with: + egress-policy: audit + - name: Checkout repository uses: actions/checkout@v4 with: @@ -122,18 +190,62 @@ jobs: with: images: zabbix-build-${{ matrix.build }} tags: | - type=sha + type=sha,postfix=-${{ matrix.arch }} - - name: Build ${{ matrix.build }} image + - name: Download SHA256 tag of ${{ env.BASE_BUILD_NAME }}:${{ matrix.arch }} + uses: actions/cache@v4 + with: + path: ${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }} + key: ${{ env.BASE_BUILD_NAME }}-${{ matrix.arch }}-${{ github.run_id }} + + - name: Retrieve ${{ env.BASE_BUILD_NAME }}:${{ matrix.arch }} SHA256 tag + id: base_build + env: + MATRIX_ARCH: ${{ matrix.arch }} + BASE_IMAGE: ${{ env.BASE_BUILD_NAME }} + IMAGES_PREFIX: ${{ env.IMAGES_PREFIX }} + run: | + BASE_TAG=$(cat "${BASE_IMAGE}_${MATRIX_ARCH}") + BUILD_BASE_IMAGE="${IMAGES_PREFIX}${BASE_IMAGE}@${BASE_TAG}" + + echo "::group::Base build image information" + echo "base_tag=${BASE_TAG}" + echo "base_build_image=${BUILD_BASE_IMAGE}" + echo "::endgroup::" + + echo "base_tag=${BASE_TAG}" >> $GITHUB_OUTPUT + echo "base_build_image=${BUILD_BASE_IMAGE}" >> $GITHUB_OUTPUT + + - name: Build Zabbix Build Base id: build_image uses: redhat-actions/buildah-build@v2 with: - context: ./Dockerfiles/build-${{ matrix.build }}/rhel + context: ${{ env.DOCKERFILES_DIRECTORY }}/${{ matrix.build }}/rhel layers: false tags: ${{ steps.meta.outputs.tags }} containerfiles: | - ./Dockerfiles/build-${{ matrix.build }}/rhel/Dockerfile - build-args: BUILD_BASE_IMAGE=${{ needs.build_base.outputs.image }} + ${{ env.DOCKERFILES_DIRECTORY }}/build-${{ matrix.build }}/rhel/Dockerfile + extra-args: BUILD_BASE_IMAGE=${{ steps.base_build.outputs.base_build_image }} + + - name: Image digest + env: + DIGEST: ${{ steps.docker_build.outputs.digest }} + CACHE_FILE_NAME: ${{ matrix.build }}_${{ matrix.arch }} + run: | + echo "::group::Image digest" + echo "$DIGEST" + echo "::endgroup::" + echo "::group::Cache file name" + echo "$CACHE_FILE_NAME" + echo "::endgroup::" + + echo "$DIGEST" > "$CACHE_FILE_NAME" + + - name: Cache image digest + uses: actions/cache@v4 + with: + path: ${{ matrix.build }}_${{ matrix.arch }} + key: ${{ matrix.build }}-${{ matrix.arch }}-${{ github.run_id }} build_images: timeout-minutes: 90