Skip to content

Commit 7e1b04e

Browse files
ayuskauskasayuskauskas
committed
feat: consolidate agent and operator CI to better control dependencies
Fix license formatter to recognize when license hasn't changed and not introduce extra lines
1 parent dc78f74 commit 7e1b04e

File tree

5 files changed

+195
-267
lines changed

5 files changed

+195
-267
lines changed

‎.github/workflows/agent-ci.yaml‎

Lines changed: 86 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,27 @@
2424

2525

2626

27-
name: Agent Unittest
27+
name: Agent CI
2828
on:
2929
pull_request:
30+
branches:
31+
- main
3032
paths:
3133
- agent/**
32-
- .github/workflows/agent-ci.yaml
34+
- containers/agent.Dockerfile
35+
- .github/workflows/agent-container.yaml
36+
push:
37+
branches:
38+
- main
39+
tags:
40+
- agent/*
41+
paths:
42+
- agent/**
43+
- containers/agent.Dockerfile
44+
- .github/workflows/agent-container.yaml
45+
env:
46+
REGISTRY: ghcr.io
47+
IMAGE_NAME: ${{ github.repository }}
3348
jobs:
3449
test:
3550
name: Skyhook Agent Unit Tests
@@ -54,4 +69,72 @@ jobs:
5469
- name: Display Summary
5570
if: always()
5671
run: |
57-
cat test-summary.md >> $GITHUB_STEP_SUMMARY
72+
cat test-summary.md >> $GITHUB_STEP_SUMMARY
73+
build-and-push-agent:
74+
runs-on: ubuntu-latest
75+
needs: [test] # Don't run the build and push if the unit tests fail
76+
# Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
77+
permissions:
78+
contents: read
79+
packages: write
80+
attestations: write
81+
id-token: write
82+
#
83+
steps:
84+
- name: Checkout repository
85+
uses: actions/checkout@v4
86+
# Uses the `docker/login-action` action to log in to the Container registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
87+
- name: Log in to the Container registry
88+
uses: docker/login-action@v3
89+
with:
90+
registry: ${{ env.REGISTRY }}
91+
username: ${{ github.actor }}
92+
password: ${{ secrets.GITHUB_TOKEN }}
93+
94+
# Setup for multi-platform
95+
- name: Set up QEMU
96+
uses: docker/setup-qemu-action@v3
97+
98+
- name: Set up Docker Buildx
99+
uses: docker/setup-buildx-action@v3
100+
101+
- name: Build the agent container image
102+
id: build
103+
run: |
104+
apt-get update && apt-get install -y make git jq
105+
cd agent
106+
# if this is a tag build, use the tag as the version, otherwise use the sha
107+
TAGS="-t ${REGISTRY@L}/${{env.IMAGE_NAME}}/agent:${{ github.sha }}"
108+
case ${{ github.ref_type }} in
109+
branch)
110+
# The last tag + current git sha
111+
export AGENT_VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo "0.0.0")+${{ github.sha }}
112+
;;
113+
tag)
114+
# The version part of the tag
115+
export AGENT_VERSION=$(echo "${{ github.ref_name }}" | cut -f 2 -d /)
116+
TAGS="$TAGS -t ${REGISTRY@L}/${{env.IMAGE_NAME}}/agent:${AGENT_VERSION} -t ${REGISTRY@L}/${{env.IMAGE_NAME}}/agent:latest"
117+
;;
118+
*)
119+
echo "Unkown type ${{ github.ref_type }}"
120+
exit 1
121+
;;
122+
esac
123+
export TAGS=$TAGS
124+
export REGISTRY=${REGISTRY@L}
125+
export BUILD_ARGS="--push"
126+
make docker-build-only agent_version=${AGENT_VERSION}
127+
cat metadata.json
128+
echo "digest=$(cat metadata.json | jq -r .\"containerimage.digest\")" >> $GITHUB_OUTPUT
129+
cat $GITHUB_OUTPUT
130+
env:
131+
AGENT_IMAGE: ${{env.IMAGE_NAME}}/agent
132+
133+
# This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see [AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).
134+
- name: Generate artifact attestation
135+
uses: actions/attest-build-provenance@v2
136+
with:
137+
subject-name: ${{ env.REGISTRY }}/${{env.IMAGE_NAME}}/agent
138+
subject-digest: ${{ steps.build.outputs.digest }}
139+
push-to-registry: true
140+

‎.github/workflows/agent-container.yaml‎

Lines changed: 0 additions & 125 deletions
This file was deleted.

‎.github/workflows/operator-ci.yaml‎

Lines changed: 100 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -18,20 +18,38 @@
1818
# LICENSE END
1919
#
2020

21+
# Build when operator code changes
22+
name: Build and push operator container image
2123

24+
on:
25+
pull_request:
26+
branches:
27+
- main
28+
paths:
29+
- operator/**
30+
- containers/operator.Dockerfile
31+
- .github/workflows/operator-container.yaml
32+
push:
33+
branches:
34+
- main
35+
tags:
36+
- operator/*
37+
paths:
38+
- operator/**/*.go
39+
- containers/operator.Dockerfile
40+
- .github/workflows/operator-container.yaml
2241

42+
# NOTE: we may want to switch to matrix build for multi-platform support if this is taking too long
43+
# https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
2344

2445

25-
26-
27-
name: Operator unit and functional tests
28-
on:
29-
pull_request:
30-
paths:
31-
- operator/**
32-
- .github/workflows/operator-ci.yaml
46+
# Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
3347
env:
3448
REGISTRY: ghcr.io
49+
IMAGE_NAME: ${{ github.repository }}
50+
GO_VERSION: 1.23.6
51+
52+
# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
3553
jobs:
3654
unit-test:
3755
runs-on: ubuntu-latest
@@ -47,6 +65,7 @@ jobs:
4765
make unit-tests
4866
k8s-tests:
4967
runs-on: ubuntu-latest
68+
needs: [unit-test] # Don't run the k8s tests if the unit tests fail
5069
steps:
5170
- uses: actions/checkout@v4
5271
with:
@@ -72,4 +91,76 @@ jobs:
7291
run: |
7392
cd operator
7493
GITHUB_TOKEN=${{ secrets.github_token }} make create-kind-cluster
75-
make e2e-tests
94+
make e2e-tests
95+
build-and-push-operator:
96+
runs-on: ubuntu-latest
97+
needs: [k8s-tests] # Don't run the build and push if the k8s tests fail
98+
# Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
99+
permissions:
100+
contents: read
101+
packages: write
102+
attestations: write
103+
id-token: write
104+
#
105+
steps:
106+
- name: Checkout repository
107+
uses: actions/checkout@v4
108+
# Uses the `docker/login-action` action to log in to the Container registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
109+
- name: Log in to the Container registry
110+
uses: docker/login-action@v3
111+
with:
112+
registry: ${{ env.REGISTRY }}
113+
username: ${{ github.actor }}
114+
password: ${{ secrets.GITHUB_TOKEN }}
115+
116+
# Setup for multi-platform
117+
- name: Set up QEMU
118+
uses: docker/setup-qemu-action@v3
119+
120+
- name: Set up Docker Buildx
121+
uses: docker/setup-buildx-action@v3
122+
123+
- name: Build the operator container image
124+
id: build
125+
run: |
126+
apt-get update && apt-get install -y make git jq
127+
cd operator
128+
# if this is a tag build, use the tag as the version, otherwise use the sha
129+
TAGS="-t ${REGISTRY@L}/${{env.IMAGE_NAME}}/operator:${{ github.sha }}"
130+
case ${{ github.ref_type }} in
131+
branch)
132+
# The last tag + current git sha
133+
export OPERATOR_VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo "0.0.0")+${{ github.sha }}
134+
;;
135+
tag)
136+
# The version part of the tag
137+
export OPERATOR_VERSION=$(echo "${{ github.ref_name }}" | cut -f 2 -d /)
138+
TAGS="$TAGS -t ${REGISTRY@L}/${{env.IMAGE_NAME}}/operator:${OPERATOR_VERSION} -t ${REGISTRY@L}/${{env.IMAGE_NAME}}/operator:latest"
139+
;;
140+
*)
141+
echo "Unkown type ${{ github.ref_type }}"
142+
exit 1
143+
;;
144+
esac
145+
set -x
146+
docker buildx build \
147+
--build-arg GIT_SHA=$${{ github.sha }} \
148+
--build-arg VERSION=${OPERATOR_VERSION} \
149+
--build-arg GO_VERSION=${GO_VERSION} \
150+
--push \
151+
--platform linux/amd64 \
152+
${TAGS@L} \
153+
--metadata-file=metadata.json \
154+
-f ../containers/operator.Dockerfile .
155+
cat metadata.json
156+
echo "digest=$(cat metadata.json | jq -r .\"containerimage.digest\")" >> $GITHUB_OUTPUT
157+
cat $GITHUB_OUTPUT
158+
159+
# This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see [AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).
160+
- name: Generate artifact attestation
161+
uses: actions/attest-build-provenance@v2
162+
with:
163+
subject-name: ${{ env.REGISTRY }}/${{env.IMAGE_NAME}}/operator
164+
subject-digest: ${{ steps.build.outputs.digest }}
165+
push-to-registry: true
166+

0 commit comments

Comments
 (0)