Skip to content

Commit c2de857

Browse files
ayuskauskasayuskauskas
committed
feat(ci/githubi/agent): organize each container build into its own workflow for clarity and appropriate filters on file changes
Change to build on PR, commits to main and agent/* tags
1 parent cdb55e4 commit c2de857

File tree

5 files changed

+104
-76
lines changed

5 files changed

+104
-76
lines changed

‎.github/workflows/agent-ci.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ on:
33
pull_request:
44
paths:
55
- agent/**
6+
- .github/workflows/agent-ci.yaml
67
jobs:
78
test:
89
name: Skyhook Agent Unit Tests

‎.github/workflows/agent-container.yaml‎

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
name: Build and push agent container image
2+
3+
# Configures this workflow to run every time a tag is created
4+
on:
5+
pull_request:
6+
branches:
7+
- main
8+
paths:
9+
- agent/**
10+
- containers/agent.Dockerfile
11+
- .github/workflows/agent-container.yaml
12+
push:
13+
branches:
14+
- main
15+
tags:
16+
- agent/*
17+
paths:
18+
- agent/**
19+
- containers/agent.Dockerfile
20+
- .github/workflows/agent-container.yaml
21+
22+
# NOTE: we may want to switch to matrix build for multi-platform support if this is taking too long
23+
# https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
24+
25+
26+
# Defines two custom environment variables for the workflow. These are used for the Container registry domain, and a name for the Docker image that this workflow builds.
27+
env:
28+
REGISTRY: ghcr.io
29+
IMAGE_NAME: ${{ github.repository }}
30+
31+
# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
32+
jobs:
33+
build-and-push-agent:
34+
runs-on: ubuntu-latest
35+
# Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
36+
permissions:
37+
contents: read
38+
packages: write
39+
attestations: write
40+
id-token: write
41+
#
42+
steps:
43+
- name: Checkout repository
44+
uses: actions/checkout@v4
45+
# Uses the `docker/login-action` action to log in to the Container registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
46+
- name: Log in to the Container registry
47+
uses: docker/login-action@v3
48+
with:
49+
registry: ${{ env.REGISTRY }}
50+
username: ${{ github.actor }}
51+
password: ${{ secrets.GITHUB_TOKEN }}
52+
53+
# Setup for multi-platform
54+
- name: Set up QEMU
55+
uses: docker/setup-qemu-action@v3
56+
57+
- name: Set up Docker Buildx
58+
uses: docker/setup-buildx-action@v3
59+
60+
- name: Build the agent container image
61+
id: build
62+
run: |
63+
apt-get update && apt-get install -y make git jq
64+
cd agent
65+
# if this is a tag build, use the tag as the version, otherwise use the sha
66+
TAGS="-t ${REGISTRY@L}/${{env.IMAGE_NAME}}/agent:${{ github.sha }}"
67+
case ${{ github.ref_type }} in
68+
branch)
69+
# The last tag + current git sha
70+
export AGENT_VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo "0.0.0")+${{ github.sha }}
71+
;;
72+
tag)
73+
# The version part of the tag
74+
export AGENT_VERSION=$(echo "${{ github.ref_name }}" | cut -f 2 -d /)
75+
TAGS="$TAGS -t ${REGISTRY@L}/${{env.IMAGE_NAME}}/agent:${AGENT_VERSION}"
76+
;;
77+
*)
78+
echo "Unkown type ${{ github.ref_type }}"
79+
exit 1
80+
;;
81+
esac
82+
export TAGS=$TAGS
83+
export REGISTRY=${REGISTRY@L}
84+
export BUILD_ARGS="--push"
85+
make docker-build-only agent_version=${AGENT_VERSION}
86+
cat metadata.json
87+
echo "digest=$(cat metadata.json | jq -r .\"containerimage.digest\")" >> $GITHUB_OUTPUT
88+
cat $GITHUB_OUTPUT
89+
env:
90+
AGENT_IMAGE: ${{env.IMAGE_NAME}}/agent
91+
92+
# This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see [AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).
93+
- name: Generate artifact attestation
94+
uses: actions/attest-build-provenance@v2
95+
with:
96+
subject-name: ${{ env.REGISTRY }}/${{env.IMAGE_NAME}}/agent
97+
subject-digest: ${{ steps.build.outputs.digest }}
98+
push-to-registry: true
99+

‎.github/workflows/agent-coverage.yaml‎

Lines changed: 0 additions & 21 deletions
This file was deleted.

‎.github/workflows/build_agent_container.yaml‎ renamed to ‎.github/workflows/agentless-container.yaml‎

Lines changed: 3 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1-
name: Build and push container image
1+
name: Build and push agentless container image
22

33
# Configures this workflow to run every time a tag is created
44
on:
55
push:
66
branches:
77
- main
88
paths:
9-
- agent/**
10-
- .github/workflows/build_agent_container.yaml
9+
- containers/agentless/**
10+
- .github/workflows/agentless-container.yaml
1111

1212
# NOTE: we may want to switch to matrix build for multi-platform support if this is taking too long
1313
# https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
@@ -19,59 +19,7 @@ env:
1919
IMAGE_NAME: ${{ github.repository }}
2020
DOCKER_CMD: docker
2121

22-
# There is a single job in this workflow. It's configured to run on the latest available version of Ubuntu.
2322
jobs:
24-
build-and-push-agent:
25-
runs-on: ubuntu-latest
26-
# Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.
27-
permissions:
28-
contents: read
29-
packages: write
30-
attestations: write
31-
id-token: write
32-
#
33-
steps:
34-
- name: Checkout repository
35-
uses: actions/checkout@v4
36-
# Uses the `docker/login-action` action to log in to the Container registry using the account and password that will publish the packages. Once published, the packages are scoped to the account defined here.
37-
- name: Log in to the Container registry
38-
uses: docker/login-action@v3
39-
with:
40-
registry: ${{ env.REGISTRY }}
41-
username: ${{ github.actor }}
42-
password: ${{ secrets.GITHUB_TOKEN }}
43-
44-
# Setup for multi-platform
45-
- name: Set up QEMU
46-
uses: docker/setup-qemu-action@v3
47-
48-
- name: Set up Docker Buildx
49-
uses: docker/setup-buildx-action@v3
50-
51-
- name: Build the agent container image
52-
id: build
53-
run: |
54-
apt-get update && apt-get install -y make git jq
55-
cd agent
56-
export TAGS="-t ${REGISTRY@L}/${{env.IMAGE_NAME}}/agent:${{ github.sha }}"
57-
export REGISTRY=${REGISTRY@L}
58-
# Get the last tag and use it as the env var AGENT_VERSION if it doesn't exist use 0.0.0+{github.sha}
59-
export AGENT_VERSION=$(git describe --tags --abbrev=0 2>/dev/null || echo "0.0.0+${{ github.sha }}")
60-
make docker-build-only agent_version=${AGENT_VERSION}
61-
cat metadata.json
62-
echo "digest=$(cat metadata.json | jq -r .\"containerimage.digest\")" >> $GITHUB_OUTPUT
63-
cat $GITHUB_OUTPUT
64-
env:
65-
AGENT_IMAGE: ${{env.IMAGE_NAME}}/agent
66-
67-
# This step generates an artifact attestation for the image, which is an unforgeable statement about where and how it was built. It increases supply chain security for people who consume the image. For more information, see [AUTOTITLE](/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds).
68-
- name: Generate artifact attestation
69-
uses: actions/attest-build-provenance@v2
70-
with:
71-
subject-name: ${{ env.REGISTRY }}/${{env.IMAGE_NAME}}/agent
72-
subject-digest: ${{ steps.build.outputs.digest }}
73-
push-to-registry: true
74-
7523
build-and-publish-agentless:
7624
runs-on: ubuntu-latest
7725
# Sets the permissions granted to the `GITHUB_TOKEN` for the actions in this job.

‎agent/Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
VENV := ./venv/bin/
1616
REGISTRY ?= nvcr.io
1717
AGENT_IMAGE ?= nvidian/swgpu-baseos/skyhook-agent
18+
DOCKER_CMD ?= docker
1819

1920
.PHONY: all
2021
all: venv test

0 commit comments

Comments
 (0)