Skip to content

Commit c4a156b

Browse files
jonathanspwjonathanspw
committed
GCP image pipeline final tweaks and additions
1 parent 1bb953e commit c4a156b

File tree

2 files changed

+125
-19
lines changed

2 files changed

+125
-19
lines changed

‎.github/actions/shared-steps/action.yml‎

Lines changed: 12 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -438,6 +438,12 @@ runs:
438438
# don't fail if this doesn't exist, we may not always generate it
439439
sudo mv sbom-data-*.json $(basename ${image_file}).sbom-data.json || true
440440
441+
- name: Generate SBOM
442+
shell: bash
443+
run: |
444+
echo "Generating SBOM document of ${{ env.IMAGE_FILE }}"
445+
sudo .venv-sbom/bin/python3 sbom-tools/sbom_generator.py "${{ env.IMAGE_NAME }}" "${{ env.IMAGE_FILE }}.sbom-data.json" "${{ env.IMAGE_FILE }}.sbom.spdx.json"
446+
441447
- id: 'google-auth-dev-images'
442448
if: env.IMAGE_TYPE == 'gcp'
443449
uses: 'google-github-actions/auth@v2'
@@ -449,11 +455,16 @@ runs:
449455
if: env.IMAGE_TYPE == 'gcp'
450456
uses: 'google-github-actions/[email protected]'
451457

452-
- name: 'Upload output to GCP storage bucket'
458+
- name: Upload output to GCP storage bucket
453459
if: env.IMAGE_TYPE == 'gcp'
454460
shell: bash
455461
run: gcloud storage cp ${{ env.IMAGE_FILE }} gs://almalinux-images-dev/almalinux-${version_major}${{ inputs.arch == 'aarch64' && '-arm64' || '' }}-v$(date +'%Y%m%d')/root.tar.gz
456462

463+
- name: Upload SBOM data to GCP storage bucket
464+
if: env.IMAGE_TYPE == 'gcp'
465+
shell: bash
466+
run: gcloud storage cp ${{ env.IMAGE_FILE }}.sbom.spdx.json gs://almalinux-images-dev-sbom/almalinux-${version_major}${{ inputs.arch == 'aarch64' && '-arm64' || '' }}-v$(date +'%Y%m%d').sbom.spdx.json
467+
457468
- name: Clone gce_image_publish repo
458469
if: env.IMAGE_TYPE == 'gcp'
459470
uses: actions/checkout@v5
@@ -497,24 +508,6 @@ runs:
497508
-source_gcs_path="gs://almalinux-images-dev/" \
498509
vm-scripts/gcp/almalinux_${version_major}${{ inputs.arch == 'aarch64' && '_arm64' || '' }}.publish.json
499510
500-
# - name: 'Run Google cloud-image-testing tests (basic suite)'
501-
# if: env.IMAGE_TYPE == 'gcp' && inputs.run_test == 'true'
502-
# shell: bash
503-
# run: |
504-
# cd cloud-image-tests
505-
# ./bin/manager \
506-
# -local_path bin \
507-
# -project almalinux-image-testing-469421 \
508-
# -filter '^(cvm|livemigrate|suspendresume|loadbalancer|guestagent|hostnamevalidation|imageboot|licensevalidation|network|security|hotattach|lssd|disk|packagevalidation|ssh|metadata|vmspec)$' \
509-
# -images 'projects/almalinux-dev-images-469421/global/images/family/almalinux-${{ env.version_major }}${{ inputs.arch == 'aarch64' && '-arm64' || '' }}' \
510-
# -parallel_stagger 10s -parallel_count 20
511-
512-
- name: Generate SBOM
513-
shell: bash
514-
run: |
515-
echo "Generating SBOM document of ${{ env.IMAGE_FILE }}"
516-
sudo .venv-sbom/bin/python3 sbom-tools/sbom_generator.py "${{ env.IMAGE_NAME }}" "${{ env.IMAGE_FILE }}.sbom-data.json" "${{ env.IMAGE_FILE }}.sbom.spdx.json"
517-
518511
- name: Test ${{ inputs.type }} ${{ inputs.variant }} image
519512
if: inputs.run_test == 'true' && contains(inputs.type, 'vagrant')
520513
shell: bash

‎.github/workflows/gcp-publish.yml‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
name: GCP Image Publish
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version_major:
7+
description: 'AlmaLinux major version'
8+
required: true
9+
default: ''
10+
type: choice
11+
options:
12+
- 10-kitten
13+
- 10
14+
- 9
15+
- 8
16+
arch:
17+
description: 'Architecture we are publishing'
18+
required: true
19+
default: ''
20+
type: choice
21+
options:
22+
- x86_64
23+
- aarch64
24+
image_datetag:
25+
description: 'Date tag of the image to publish after the "v" in the image name. E.g. for almalinux-10-arm64-v20251205 the date tag is "20251205"'
26+
required: true
27+
default: ''
28+
29+
jobs:
30+
publish-image:
31+
name: Publish Images to almalinux-cloud GCP Project (prod)
32+
runs-on: ubuntu-latest
33+
permissions:
34+
id-token: write
35+
contents: read
36+
steps:
37+
# we don't need the checked out files, but this is required for the google auth action to work
38+
- uses: actions/checkout@v5
39+
40+
- name: Build image name from inputs
41+
id: build-image-name
42+
run: |
43+
IMAGE_NAME="almalinux-${{ inputs.version_major }}${{ inputs.arch == 'aarch64' && '-arm64' || '' }}-v${{ inputs.image_datetag }}"
44+
echo "image_name=${IMAGE_NAME}" >> $GITHUB_OUTPUT
45+
46+
# todo: this is for prod
47+
# - id: google-auth-image-release
48+
# uses: google-github-actions/auth@v2
49+
# with:
50+
# workload_identity_provider: projects/1071098808632/locations/global/workloadIdentityPools/github-actions/providers/github
51+
# service_account: gh-actions-prod-release@almalinux-image-release.iam.gserviceaccount.com
52+
53+
- id: 'google-auth-dev-images'
54+
uses: 'google-github-actions/auth@v2'
55+
with:
56+
workload_identity_provider: 'projects/443728870479/locations/global/workloadIdentityPools/github-actions/providers/github'
57+
service_account: 'github-actions-cloud-images@almalinux-dev-images-469421.iam.gserviceaccount.com'
58+
59+
- name: Set up Google Cloud SDK
60+
uses: google-github-actions/[email protected]
61+
62+
# TODO: re-enable this for prod
63+
# - name: Copy image to almalinux-cloud project
64+
# run: |
65+
# gcloud storage cp gs://almalinux-images-dev/${{ steps.build-image-name.outputs.image_name }}/root.tar.gz gs://almalinux-images-prod/${{ steps.build-image-name.outputs.image_name }}/root.tar.gz
66+
67+
- name: Get gce_image_publish tool
68+
run: |
69+
wget https://storage.googleapis.com/compute-image-tools/release/linux/gce_image_publish
70+
chmod +x gce_image_publish
71+
72+
# todo: this is the prod version
73+
# - name: Create production image on GCP
74+
# shell: bash
75+
# run: |
76+
# ./gce_image_publish \
77+
# -var:environment=prod \
78+
# -skip_confirmation \
79+
# -rollout_rate=60 \
80+
# -work_project="almalinux-image-release" \
81+
# -source_gcs_path="gs://almalinux-images-prod/" \
82+
# -source_version="${{ inputs.image_datetag }}" \
83+
# vm-scripts/gcp/almalinux_${{ inputs.version_major }}${{ inputs.arch == 'aarch64' && '_arm64' || '' }}.publish.json
84+
85+
- name: Create production image on GCP
86+
shell: bash
87+
run: |
88+
./gce_image_publish \
89+
-var:environment=test \
90+
-skip_confirmation \
91+
-replace \
92+
-rollout_rate=0 \
93+
-work_project="almalinux-dev-images-469421" \
94+
-source_gcs_path="gs://almalinux-dev-images-469421/" \
95+
-source_version="${{ inputs.image_datetag }}" \
96+
vm-scripts/gcp/almalinux_${{ inputs.version_major }}${{ inputs.arch == 'aarch64' && '_arm64' || '' }}.publish.json
97+
98+
# todo: prod version
99+
# - name: Get ID of image just created
100+
# shell: bash
101+
# run: |
102+
# IMAGE_ID=$(gcloud compute images describe ${{ steps.build-image-name.outputs.image_name }} --project=almalinux-cloud --format='value(id)')
103+
# echo "IMAGE_ID=$IMAGE_ID" >> $GITHUB_ENV
104+
105+
- name: Get ID of image just created
106+
shell: bash
107+
run: |
108+
IMAGE_ID=$(gcloud compute images describe ${{ steps.build-image-name.outputs.image_name }} --project=almalinux-dev-images-469421 --format='value(id)')
109+
echo "IMAGE_ID=$IMAGE_ID" >> $GITHUB_ENV
110+
111+
- name: Print image ID
112+
run: |
113+
echo "Published image ID is $IMAGE_ID"

0 commit comments

Comments
 (0)