Skip to content

Commit 83d3427

Browse files
joshhuntaangelisckminehartdiegommm
committed
CI: Additional changes for +security versions (#94854)
* Build: Fix docker manifest create not using correct IMAGE_TAG * Support publishing security versions of NPM packages --------- Co-authored-by: Andreas Christou <[email protected]> Co-authored-by: Kevin Minehart <[email protected]> Co-authored-by: Diego Augusto Molina <[email protected]>
1 parent 1a60a34 commit 83d3427

File tree

8 files changed

+96
-54
lines changed

8 files changed

+96
-54
lines changed

‎.drone.yml

Lines changed: 39 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -539,7 +539,7 @@ steps:
539539
name: identify-runner
540540
- commands:
541541
- mkdir -p bin
542-
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.53/grabpl
542+
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.56/grabpl
543543
- chmod +x bin/grabpl
544544
image: byrnedo/alpine-curl:0.1.8
545545
name: grabpl
@@ -995,7 +995,7 @@ steps:
995995
name: clone-enterprise
996996
- commands:
997997
- mkdir -p bin
998-
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.53/grabpl
998+
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.56/grabpl
999999
- chmod +x bin/grabpl
10001000
image: byrnedo/alpine-curl:0.1.8
10011001
name: grabpl
@@ -1957,7 +1957,7 @@ steps:
19571957
name: identify-runner
19581958
- commands:
19591959
- mkdir -p bin
1960-
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.53/grabpl
1960+
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.56/grabpl
19611961
- chmod +x bin/grabpl
19621962
image: byrnedo/alpine-curl:0.1.8
19631963
name: grabpl
@@ -2510,7 +2510,7 @@ services:
25102510
steps:
25112511
- commands:
25122512
- mkdir -p bin
2513-
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.53/grabpl
2513+
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.56/grabpl
25142514
- chmod +x bin/grabpl
25152515
image: byrnedo/alpine-curl:0.1.8
25162516
name: grabpl
@@ -2715,7 +2715,7 @@ steps:
27152715
name: identify-runner
27162716
- commands:
27172717
- $$ProgressPreference = "SilentlyContinue"
2718-
- Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.53/windows/grabpl.exe
2718+
- Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.56/windows/grabpl.exe
27192719
-OutFile grabpl.exe
27202720
image: grafana/ci-wix:0.1.1
27212721
name: windows-init
@@ -3142,7 +3142,7 @@ services:
31423142
steps:
31433143
- commands:
31443144
- mkdir -p bin
3145-
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.53/grabpl
3145+
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.56/grabpl
31463146
- chmod +x bin/grabpl
31473147
image: byrnedo/alpine-curl:0.1.8
31483148
name: grabpl
@@ -3387,7 +3387,7 @@ steps:
33873387
name: identify-runner
33883388
- commands:
33893389
- mkdir -p bin
3390-
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.53/grabpl
3390+
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.56/grabpl
33913391
- chmod +x bin/grabpl
33923392
image: byrnedo/alpine-curl:0.1.8
33933393
name: grabpl
@@ -3433,9 +3433,9 @@ steps:
34333433
$$debug docker push grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-armv7
34343434
34353435
# Create the grafana manifests
3436-
$$debug docker manifest create grafana/grafana:${TAG} grafana/grafana-image-tags:$${IMAGE_TAG}-amd64 grafana/grafana-image-tags:$${IMAGE_TAG}-arm64 grafana/grafana-image-tags:$${IMAGE_TAG}-armv7
3436+
$$debug docker manifest create grafana/grafana:$${IMAGE_TAG} grafana/grafana-image-tags:$${IMAGE_TAG}-amd64 grafana/grafana-image-tags:$${IMAGE_TAG}-arm64 grafana/grafana-image-tags:$${IMAGE_TAG}-armv7
34373437
3438-
$$debug docker manifest create grafana/grafana:${TAG}-ubuntu grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-amd64 grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-arm64 grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-armv7
3438+
$$debug docker manifest create grafana/grafana:$${IMAGE_TAG}-ubuntu grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-amd64 grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-arm64 grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-armv7
34393439
34403440
# Push the grafana manifests
34413441
$$debug docker manifest push grafana/grafana:$${IMAGE_TAG}
@@ -3519,7 +3519,7 @@ steps:
35193519
name: identify-runner
35203520
- commands:
35213521
- mkdir -p bin
3522-
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.53/grabpl
3522+
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.56/grabpl
35233523
- chmod +x bin/grabpl
35243524
image: byrnedo/alpine-curl:0.1.8
35253525
name: grabpl
@@ -3565,9 +3565,9 @@ steps:
35653565
$$debug docker push grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-armv7
35663566
35673567
# Create the grafana manifests
3568-
$$debug docker manifest create grafana/grafana:${TAG} grafana/grafana-image-tags:$${IMAGE_TAG}-amd64 grafana/grafana-image-tags:$${IMAGE_TAG}-arm64 grafana/grafana-image-tags:$${IMAGE_TAG}-armv7
3568+
$$debug docker manifest create grafana/grafana:$${IMAGE_TAG} grafana/grafana-image-tags:$${IMAGE_TAG}-amd64 grafana/grafana-image-tags:$${IMAGE_TAG}-arm64 grafana/grafana-image-tags:$${IMAGE_TAG}-armv7
35693569
3570-
$$debug docker manifest create grafana/grafana:${TAG}-ubuntu grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-amd64 grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-arm64 grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-armv7
3570+
$$debug docker manifest create grafana/grafana:$${IMAGE_TAG}-ubuntu grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-amd64 grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-arm64 grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-armv7
35713571
35723572
# Push the grafana manifests
35733573
$$debug docker manifest push grafana/grafana:$${IMAGE_TAG}
@@ -3829,6 +3829,7 @@ platform:
38293829
services: []
38303830
steps:
38313831
- commands:
3832+
- export version=$(echo ${TAG} | sed -e "s/+security-/-/g")
38323833
- 'echo "Step 1: Updating package lists..."'
38333834
- apt-get update >/dev/null 2>&1
38343835
- 'echo "Step 2: Installing prerequisites..."'
@@ -3844,7 +3845,7 @@ steps:
38443845
- 'echo "Step 5: Installing Grafana..."'
38453846
- for i in $(seq 1 60); do
38463847
- ' if apt-get update >/dev/null 2>&1 && DEBIAN_FRONTEND=noninteractive apt-get
3847-
install -yq grafana=${TAG} >/dev/null 2>&1; then'
3848+
install -yq grafana=$version >/dev/null 2>&1; then'
38483849
- ' echo "Command succeeded on attempt $i"'
38493850
- ' break'
38503851
- ' else'
@@ -3858,10 +3859,10 @@ steps:
38583859
- ' fi'
38593860
- done
38603861
- 'echo "Step 6: Verifying Grafana installation..."'
3861-
- 'if dpkg -s grafana | grep -q "Version: ${TAG}"; then'
3862-
- ' echo "Successfully verified Grafana version ${TAG}"'
3862+
- 'if dpkg -s grafana | grep -q "Version: $version"; then'
3863+
- ' echo "Successfully verified Grafana version $version"'
38633864
- else
3864-
- ' echo "Failed to verify Grafana version ${TAG}"'
3865+
- ' echo "Failed to verify Grafana version $version"'
38653866
- ' exit 1'
38663867
- fi
38673868
- echo "Verification complete."
@@ -3889,11 +3890,12 @@ steps:
38893890
sslcacert=/etc/pki/tls/certs/ca-bundle.crt
38903891
' > /etc/yum.repos.d/grafana.repo
38913892
- 'echo "Step 5: Checking RPM repository..."'
3892-
- dnf list available grafana-${TAG}
3893+
- export version=$(echo "${TAG}" | sed -e "s/+security-/^security_/g")
3894+
- dnf list available grafana-$version
38933895
- if [ $? -eq 0 ]; then
38943896
- ' echo "Grafana package found in repository. Installing from repo..."'
38953897
- for i in $(seq 1 60); do
3896-
- ' if dnf install -y --nogpgcheck grafana-${TAG} >/dev/null 2>&1; then'
3898+
- ' if dnf install -y --nogpgcheck grafana-$version >/dev/null 2>&1; then'
38973899
- ' echo "Command succeeded on attempt $i"'
38983900
- ' break'
38993901
- ' else'
@@ -3910,16 +3912,16 @@ steps:
39103912
- ' rpm --import https://rpm.grafana.com/gpg.key'
39113913
- ' rpm -qa gpg-pubkey* | xargs rpm -qi | grep -i grafana'
39123914
- else
3913-
- ' echo "Grafana package version ${TAG} not found in repository."'
3915+
- ' echo "Grafana package version $version not found in repository."'
39143916
- ' dnf repolist'
39153917
- ' dnf list available grafana*'
39163918
- ' exit 1'
39173919
- fi
39183920
- 'echo "Step 6: Verifying Grafana installation..."'
3919-
- if rpm -q grafana | grep -q "${TAG}"; then
3920-
- ' echo "Successfully verified Grafana version ${TAG}"'
3921+
- if rpm -q grafana | grep -q "$verison"; then
3922+
- ' echo "Successfully verified Grafana version $version"'
39213923
- else
3922-
- ' echo "Failed to verify Grafana version ${TAG}"'
3924+
- ' echo "Failed to verify Grafana version $version"'
39233925
- ' exit 1'
39243926
- fi
39253927
- echo "Verification complete."
@@ -4006,6 +4008,7 @@ steps:
40064008
from_secret: packages_service_account
40074009
target_bucket: grafana-packages
40084010
- commands:
4011+
- export version=$(echo ${TAG} | sed -e "s/+security-/-/g")
40094012
- 'echo "Step 1: Updating package lists..."'
40104013
- apt-get update >/dev/null 2>&1
40114014
- 'echo "Step 2: Installing prerequisites..."'
@@ -4021,7 +4024,7 @@ steps:
40214024
- 'echo "Step 5: Installing Grafana..."'
40224025
- for i in $(seq 1 60); do
40234026
- ' if apt-get update >/dev/null 2>&1 && DEBIAN_FRONTEND=noninteractive apt-get
4024-
install -yq grafana=${TAG} >/dev/null 2>&1; then'
4027+
install -yq grafana=$version >/dev/null 2>&1; then'
40254028
- ' echo "Command succeeded on attempt $i"'
40264029
- ' break'
40274030
- ' else'
@@ -4035,10 +4038,10 @@ steps:
40354038
- ' fi'
40364039
- done
40374040
- 'echo "Step 6: Verifying Grafana installation..."'
4038-
- 'if dpkg -s grafana | grep -q "Version: ${TAG}"; then'
4039-
- ' echo "Successfully verified Grafana version ${TAG}"'
4041+
- 'if dpkg -s grafana | grep -q "Version: $version"; then'
4042+
- ' echo "Successfully verified Grafana version $version"'
40404043
- else
4041-
- ' echo "Failed to verify Grafana version ${TAG}"'
4044+
- ' echo "Failed to verify Grafana version $version"'
40424045
- ' exit 1'
40434046
- fi
40444047
- echo "Verification complete."
@@ -4067,11 +4070,12 @@ steps:
40674070
sslcacert=/etc/pki/tls/certs/ca-bundle.crt
40684071
' > /etc/yum.repos.d/grafana.repo
40694072
- 'echo "Step 5: Checking RPM repository..."'
4070-
- dnf list available grafana-${TAG}
4073+
- export version=$(echo "${TAG}" | sed -e "s/+security-/^security_/g")
4074+
- dnf list available grafana-$version
40714075
- if [ $? -eq 0 ]; then
40724076
- ' echo "Grafana package found in repository. Installing from repo..."'
40734077
- for i in $(seq 1 60); do
4074-
- ' if dnf install -y --nogpgcheck grafana-${TAG} >/dev/null 2>&1; then'
4078+
- ' if dnf install -y --nogpgcheck grafana-$version >/dev/null 2>&1; then'
40754079
- ' echo "Command succeeded on attempt $i"'
40764080
- ' break'
40774081
- ' else'
@@ -4088,16 +4092,16 @@ steps:
40884092
- ' rpm --import https://rpm.grafana.com/gpg.key'
40894093
- ' rpm -qa gpg-pubkey* | xargs rpm -qi | grep -i grafana'
40904094
- else
4091-
- ' echo "Grafana package version ${TAG} not found in repository."'
4095+
- ' echo "Grafana package version $version not found in repository."'
40924096
- ' dnf repolist'
40934097
- ' dnf list available grafana*'
40944098
- ' exit 1'
40954099
- fi
40964100
- 'echo "Step 6: Verifying Grafana installation..."'
4097-
- if rpm -q grafana | grep -q "${TAG}"; then
4098-
- ' echo "Successfully verified Grafana version ${TAG}"'
4101+
- if rpm -q grafana | grep -q "$verison"; then
4102+
- ' echo "Successfully verified Grafana version $version"'
40994103
- else
4100-
- ' echo "Failed to verify Grafana version ${TAG}"'
4104+
- ' echo "Failed to verify Grafana version $version"'
41014105
- ' exit 1'
41024106
- fi
41034107
- echo "Verification complete."
@@ -4395,7 +4399,7 @@ steps:
43954399
name: identify-runner
43964400
- commands:
43974401
- $$ProgressPreference = "SilentlyContinue"
4398-
- Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.53/windows/grabpl.exe
4402+
- Invoke-WebRequest https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.56/windows/grabpl.exe
43994403
-OutFile grabpl.exe
44004404
image: grafana/ci-wix:0.1.1
44014405
name: windows-init
@@ -5195,7 +5199,7 @@ services:
51955199
steps:
51965200
- commands:
51975201
- mkdir -p bin
5198-
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.53/grabpl
5202+
- curl -fL -o bin/grabpl https://grafana-downloads.storage.googleapis.com/grafana-build-pipeline/v3.0.56/grabpl
51995203
- chmod +x bin/grabpl
52005204
image: byrnedo/alpine-curl:0.1.8
52015205
name: grabpl
@@ -5987,6 +5991,6 @@ kind: secret
59875991
name: gcr_credentials
59885992
---
59895993
kind: signature
5990-
hmac: dc30a3a00ee542fb289da36ef6db4274684db4533c472f7f903468919d1046ac
5994+
hmac: 41df5b1fdbd1b3c9aa915919ae5be16d2a188cbaf6b243c14fd66f94db0db8d8
59915995

59925996
...

‎pkg/build/cmd/grafanacom.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -145,6 +145,9 @@ func Builds(baseURL *url.URL, grafana, version string, packages []packaging.Buil
145145
if arch == "aarch64" {
146146
arch = "arm64"
147147
}
148+
if arch == "x86_64" {
149+
arch = "amd64"
150+
}
148151
}
149152

150153
if v.Distro == "deb" {

‎pkg/build/cmd/npm.go

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ package main
22

33
import (
44
"fmt"
5+
"log"
56
"os"
67
"strings"
78

@@ -23,6 +24,11 @@ func NpmRetrieveAction(c *cli.Context) error {
2324
return fmt.Errorf("no tag version specified, exitting")
2425
}
2526

27+
if strings.Contains(tag, "security") {
28+
log.Printf("skipping npm publish because version '%s' has 'security'", tag)
29+
return nil
30+
}
31+
2632
prereleaseBucket := strings.TrimSpace(os.Getenv("PRERELEASE_BUCKET"))
2733
if prereleaseBucket == "" {
2834
return cli.Exit("the environment variable PRERELEASE_BUCKET must be set", 1)
@@ -48,6 +54,11 @@ func NpmStoreAction(c *cli.Context) error {
4854
return fmt.Errorf("no tag version specified, exiting")
4955
}
5056

57+
if strings.Contains(tag, "security") {
58+
log.Printf("skipping npm publish because version '%s' has 'security'", tag)
59+
return nil
60+
}
61+
5162
prereleaseBucket := strings.TrimSpace(os.Getenv("PRERELEASE_BUCKET"))
5263
if prereleaseBucket == "" {
5364
return cli.Exit("the environment variable PRERELEASE_BUCKET must be set", 1)
@@ -73,6 +84,11 @@ func NpmReleaseAction(c *cli.Context) error {
7384
return fmt.Errorf("no tag version specified, exitting")
7485
}
7586

87+
if strings.Contains(tag, "security") {
88+
log.Printf("skipping npm publish because version '%s' has 'security'", tag)
89+
return nil
90+
}
91+
7692
err := npm.PublishNpmPackages(c.Context, tag)
7793
if err != nil {
7894
return err

‎pkg/build/packaging/artifacts.go

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,16 @@ var ARMArtifacts = []BuildArtifact{
113113
Arch: "armv7",
114114
Ext: "tar.gz",
115115
},
116+
{
117+
Distro: "linux",
118+
Arch: "arm64",
119+
Ext: "tar.gz",
120+
},
121+
{
122+
Distro: "linux",
123+
Arch: "amd64",
124+
Ext: "tar.gz",
125+
},
116126
}
117127

118128
func join(a []BuildArtifact, b ...[]BuildArtifact) []BuildArtifact {

‎pkg/build/versions/version.go

Lines changed: 13 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -13,15 +13,17 @@ import (
1313
)
1414

1515
var (
16-
reGrafanaTag = regexp.MustCompile(`^v(\d+\.\d+\.\d+$)`)
17-
reGrafanaTagPreview = regexp.MustCompile(`^v(\d+\.\d+\.\d+-preview)`)
18-
reGrafanaTagCustom = regexp.MustCompile(`^v(\d+\.\d+\.\d+-\w+)`)
16+
reGrafanaTag = regexp.MustCompile(`^v(\d+\.\d+\.\d+$)`)
17+
reGrafanaTagPreview = regexp.MustCompile(`^v(\d+\.\d+\.\d+-preview)`)
18+
reGrafanaTagCustom = regexp.MustCompile(`^v(\d+\.\d+\.\d+-\w+)`)
19+
reGrafanaTagSecurity = regexp.MustCompile(`^v(\d+\.\d+\.\d+\+\w+\-\d+)`)
1920
)
2021

2122
const (
22-
Latest = "latest"
23-
Next = "next"
24-
Test = "test"
23+
Latest = "latest"
24+
Next = "next"
25+
Test = "test"
26+
Security = "security"
2527
)
2628

2729
type Version struct {
@@ -152,6 +154,11 @@ func GetVersion(tag string) (*Version, error) {
152154
Version: reGrafanaTagCustom.FindStringSubmatch(tag)[1],
153155
Channel: Test,
154156
}
157+
case reGrafanaTagSecurity.MatchString(tag):
158+
version = Version{
159+
Version: reGrafanaTagSecurity.FindStringSubmatch(tag)[1],
160+
Channel: Security,
161+
}
155162
default:
156163
return nil, fmt.Errorf("%s not a supported Grafana version, exitting", tag)
157164
}

‎scripts/drone/pipelines/publish_images.star

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,12 +45,12 @@ def publish_image_public_step():
4545
$$debug docker push grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-armv7
4646
4747
# Create the grafana manifests
48-
$$debug docker manifest create grafana/grafana:${TAG} \
48+
$$debug docker manifest create grafana/grafana:$${IMAGE_TAG} \
4949
grafana/grafana-image-tags:$${IMAGE_TAG}-amd64 \
5050
grafana/grafana-image-tags:$${IMAGE_TAG}-arm64 \
5151
grafana/grafana-image-tags:$${IMAGE_TAG}-armv7
5252
53-
$$debug docker manifest create grafana/grafana:${TAG}-ubuntu \
53+
$$debug docker manifest create grafana/grafana:$${IMAGE_TAG}-ubuntu \
5454
grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-amd64 \
5555
grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-arm64 \
5656
grafana/grafana-image-tags:$${IMAGE_TAG}-ubuntu-armv7

0 commit comments

Comments
 (0)