Skip to content

Commit 3d6590e

Browse files
cezar-rcezar-r
authored
feat: Ubuntu packaging (runfinch#1425)
* feat: Ubuntu packaging script Signed-off-by: Cezar Rata <[email protected]> * feat: apt repository setup Signed-off-by: Cezar Rata <[email protected]> * feat: apt repository setup Signed-off-by: Cezar Rata <[email protected]> --------- Signed-off-by: Cezar Rata <[email protected]>
1 parent d6aa084 commit 3d6590e

26 files changed

+909
-13
lines changed

‎.github/workflows/build-and-test-deb.yaml

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
name: Build, test and upload .deb to S3
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
ref_name:
7+
required: true
8+
type: string
9+
arch:
10+
type: string
11+
required: true
12+
output-arch:
13+
type: string
14+
required: true
15+
workflow_call:
16+
inputs:
17+
ref_name:
18+
required: true
19+
type: string
20+
arch:
21+
type: string
22+
required: true
23+
output-arch:
24+
type: string
25+
required: true
26+
schedule:
27+
- cron: '0 9 * * *'
28+
env:
29+
GO111MODULE: on
30+
GO_VERSION: '1.24.0'
31+
32+
permissions:
33+
# This is required for configure-aws-credentials to request an OIDC JWT ID token to access AWS resources later on.
34+
# More info: https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#adding-permissions-settings
35+
id-token: write
36+
contents: read # This is required for actions/checkout
37+
38+
jobs:
39+
get-tag-and-version:
40+
name: Get tag name
41+
runs-on: ubuntu-latest
42+
timeout-minutes: 2
43+
outputs:
44+
tag: ${{ steps.check-tag.outputs.tag }}
45+
version: ${{ steps.check-tag.outputs.version }}
46+
steps:
47+
- name: Check tag from workflow input and github ref
48+
id: check-tag
49+
run: |
50+
if [ -n "${{ inputs.ref_name }}" ]; then
51+
tag=${{ inputs.ref_name }}
52+
else
53+
tag=${{ github.ref_name }}
54+
fi
55+
echo "tag=$tag" >> ${GITHUB_OUTPUT}
56+
57+
version=${tag#v}
58+
if [[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
59+
echo "Version matches format: $version"
60+
else
61+
echo "Error: Version $version doesn't match format."
62+
exit 1
63+
fi
64+
echo "version=$version" >> ${GITHUB_OUTPUT}
65+
ubuntu-deb-build-and-test:
66+
needs: get-tag-and-version
67+
runs-on: codebuild-finch-${{ inputs.arch }}-2-instance-${{ github.run_id }}-${{ github.run_attempt }}
68+
timeout-minutes: 30
69+
steps:
70+
- name: Configure AWS credentials
71+
uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
72+
with:
73+
role-to-assume: ${{ secrets.DEB_ROLE_PROD }}
74+
role-session-name: ubuntu-deb
75+
aws-region: us-west-2
76+
- name: Clean ubuntu runner workspace
77+
run: |
78+
rm -rf ${{ github.workspace }}/*
79+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
80+
with:
81+
ref: ${{ inputs.tag }}
82+
fetch-depth: 0
83+
persist-credentials: false
84+
submodules: true
85+
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
86+
with:
87+
go-version: ${{ env.GO_VERSION }}
88+
cache: false
89+
- name: Install dependencies
90+
run: |
91+
sudo apt install build-essential -y
92+
sudo apt install libseccomp-dev -y
93+
sudo apt install pkg-config -y
94+
sudo apt install zlib1g-dev -y
95+
- name: Build for Ubuntu ${{ inputs.output-arch }}
96+
run: |
97+
make
98+
- name: Generate deb
99+
run: |
100+
./contrib/packaging/deb/package.sh --${{ inputs.output-arch }} --version ${{ needs.get-tag-and-version.outputs.version }}
101+
- name: Install Finch
102+
run: |
103+
sudo apt install ./_output/deb/runfinch-finch_${{ needs.get-tag-and-version.outputs.version }}_${{ inputs.output-arch }}.deb -y
104+
sudo systemctl daemon-reload
105+
sudo systemctl start containerd.service
106+
sudo systemctl restart finch.socket
107+
sudo systemctl start finch.service
108+
sudo systemctl start finch-buildkit.service
109+
sudo systemctl start finch-soci.service
110+
- name: Run e2e tests
111+
run: |
112+
git status
113+
git clean -f -d
114+
eval $(ssh-agent)
115+
sudo -E env "PATH=$PATH" INSTALLED=true make test-e2e-container
116+
sudo -E env "PATH=$PATH" INSTALLED=true make test-e2e-vm
117+
- name: Clean Up Previous Environment
118+
if: ${{ always() }}
119+
timeout-minutes: 2
120+
run: |
121+
sudo apt remove runfinch-finch -y
122+
sudo apt remove build-essential -y
123+
sudo apt remove libseccomp-dev -y
124+
sudo apt remove pkg-config -y
125+
sudo apt remove zlib1g-dev -y
126+
- name: Upload deb to S3
127+
run: |
128+
aws s3 cp ./_output/deb s3://${{ secrets.DEB_PRIVATE_BUCKET_NAME_UNSIGNED_PROD }}/ --recursive --exclude "*" --include "runfinch-finch_${{ needs.get-tag-and-version.outputs.version }}_${{ inputs.output-arch }}.deb"
129+
aws s3 cp ./contrib/packaging/deb/Release s3://${{ secrets.DEB_PRIVATE_BUCKET_NAME_UNSIGNED_PROD }}/

‎.github/workflows/ci.yaml

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,20 @@ jobs:
7070
git secrets --register-aws
7171
git secrets --scan-history
7272
73+
get-latest-tag:
74+
name: Get the latest release tag
75+
runs-on: ubuntu-latest
76+
timeout-minutes: 2
77+
outputs:
78+
tag: ${{ steps.latest-tag.outputs.tag }}
79+
steps:
80+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
81+
with:
82+
fetch-depth: 0
83+
- name: 'Get the latest tag'
84+
id: latest-tag
85+
uses: "WyriHaximus/github-action-get-previous-tag@04e8485ecb6487243907e330d522ff60f02283ce" # v1.4.0
86+
7387
gen-code-no-diff:
7488
strategy:
7589
matrix:
@@ -211,6 +225,21 @@ jobs:
211225
arch: ${{ matrix.arch }}
212226
version: ${{ matrix.version }}
213227
runner-type: ${{ matrix.runner-type }}
228+
ubuntu-e2e-tests:
229+
strategy:
230+
fail-fast: false
231+
matrix:
232+
arch: ['x86_64', 'arm64']
233+
include:
234+
- arch: 'x86_64'
235+
output-arch: 'amd64'
236+
- arch: 'arm64'
237+
output-arch: 'arm64'
238+
uses: ./.github/workflows/e2e-ubuntu.yaml
239+
secrets: inherit
240+
with:
241+
arch: ${{ matrix.arch }}
242+
output-arch: ${{ matrix.output-arch }}
214243

215244
mdlint:
216245
runs-on: ubuntu-latest

‎.github/workflows/e2e-ubuntu.yaml

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
name: e2e-ubuntu
2+
on:
3+
workflow_call:
4+
inputs:
5+
arch:
6+
type: string
7+
required: true
8+
output-arch:
9+
type: string
10+
required: true
11+
12+
env:
13+
GO111MODULE: on
14+
GO_VERSION: '1.24.0'
15+
16+
jobs:
17+
get-latest-tag:
18+
name: Get the latest release tag
19+
runs-on: ubuntu-latest
20+
timeout-minutes: 2
21+
outputs:
22+
tag: ${{ steps.latest-tag.outputs.tag }}
23+
steps:
24+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
25+
with:
26+
fetch-depth: 0
27+
- name: 'Get the latest tag'
28+
id: latest-tag
29+
uses: "WyriHaximus/github-action-get-previous-tag@04e8485ecb6487243907e330d522ff60f02283ce" # v1.4.0
30+
31+
get-tag-and-version:
32+
needs: get-latest-tag
33+
name: Get tag name
34+
runs-on: ubuntu-latest
35+
timeout-minutes: 2
36+
outputs:
37+
tag: ${{ steps.check-tag.outputs.tag }}
38+
version: ${{ steps.check-tag.outputs.version }}
39+
steps:
40+
- name: Check tag from workflow input and github ref
41+
id: check-tag
42+
run: |
43+
if [ -n "${{ needs.get-latest-tag.outputs.tag }}" ]; then
44+
tag=${{ needs.get-latest-tag.outputs.tag }}
45+
else
46+
tag=${{ github.tag }}
47+
fi
48+
echo "tag=$tag" >> ${GITHUB_OUTPUT}
49+
50+
version=${tag#v}
51+
if [[ $version =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
52+
echo "Version matches format: $version"
53+
else
54+
echo "Error: Version $version doesn't match format."
55+
exit 1
56+
fi
57+
echo "version=$version" >> ${GITHUB_OUTPUT}
58+
59+
e2e-test:
60+
needs: get-tag-and-version
61+
runs-on: codebuild-finch-${{ inputs.arch }}-2-instance-${{ github.run_id }}-${{ github.run_attempt }}
62+
timeout-minutes: 60
63+
outputs:
64+
has_creds: ${{ steps.vars.outputs.has_creds}}
65+
vm_report: ${{ steps.set-multiple-vars.outputs.VM_REPORT }}
66+
container_report: ${{ steps.set-multiple-vars.outputs.CONTAINER_REPORT }}
67+
vm_serial_report: ${{ steps.set-multiple-vars.outputs.VM_SERIAL_REPORT }}
68+
steps:
69+
- name: Clean Ubuntu workspace
70+
run: |
71+
rm -rf ${{ github.workspace }}/*
72+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
73+
with:
74+
# We need to get all the git tags to make version injection work. See VERSION in Makefile for more detail.
75+
fetch-depth: 0
76+
persist-credentials: false
77+
submodules: recursive
78+
- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
79+
with:
80+
go-version: ${{ env.GO_VERSION }}
81+
cache: false
82+
- name: Set output variables
83+
id: vars
84+
run: |
85+
has_creds=${{ (github.event_name == 'push' || github.repository == github.event.pull_request.head.repo.full_name) && github.actor != 'dependabot[bot]' }}
86+
echo "has_creds=$has_creds" >> $GITHUB_OUTPUT
87+
- name: Install dependencies
88+
run: |
89+
sudo apt install build-essential -y
90+
sudo apt install libseccomp-dev -y
91+
sudo apt install pkg-config -y
92+
sudo apt install zlib1g-dev -y
93+
- name: Build for Ubuntu ${{ inputs.output-arch }}
94+
run: |
95+
make
96+
- name: Generate deb
97+
run: |
98+
./contrib/packaging/deb/package.sh --${{ inputs.output-arch }} --version ${{ needs.get-tag-and-version.outputs.version }}
99+
- name: Install Finch
100+
run: |
101+
sudo apt install ./_output/deb/runfinch-finch_${{ needs.get-tag-and-version.outputs.version }}_${{ inputs.output-arch }}.deb -y
102+
sudo systemctl daemon-reload
103+
sudo systemctl start containerd.service
104+
sudo systemctl restart finch.socket
105+
sudo systemctl start finch.service
106+
sudo systemctl start finch-buildkit.service
107+
sudo systemctl start finch-soci.service
108+
- name: Set up REPORT_DIR
109+
run: |
110+
echo "REPORT_DIR=${{ github.workspace }}/reports" >> $GITHUB_ENV
111+
- name: Run e2e tests
112+
run: |
113+
git status
114+
git clean -f -d
115+
eval $(ssh-agent)
116+
sudo -E env "PATH=$PATH" INSTALLED=true make test-e2e-container
117+
sudo -E env "PATH=$PATH" INSTALLED=true make test-e2e-vm
118+
- name: Change ownership of reports
119+
if: always()
120+
run: |
121+
if [ ! -d "$REPORT_DIR" ]; then
122+
echo "Error: Directory $REPORT_DIR does not exist."
123+
exit 1
124+
fi
125+
126+
USER=$(whoami)
127+
GROUP=$(id -gn)
128+
129+
if sudo chown -R "$USER:$GROUP" "$REPORT_DIR"; then
130+
echo "Ownership of $REPORT_DIR changed to $USER:$GROUP"
131+
else
132+
echo "Error: Failed to change ownership of $REPORT_DIR"
133+
exit 1
134+
fi
135+
- name: Set artifacts name outputs
136+
if: always()
137+
id: set-multiple-vars
138+
run: |
139+
echo "VM_REPORT=${{ github.run_id }}-${{ github.run_attempt }}-e2e-vm-report.json" >> $GITHUB_OUTPUT
140+
echo "CONTAINER_REPORT=${{ github.run_id }}-${{ github.run_attempt }}-e2e-container-report.json" >> $GITHUB_OUTPUT
141+
echo "VM_SERIAL_REPORT=${{ github.run_id }}-${{ github.run_attempt }}-e2e-vm-serial-report.json" >> $GITHUB_OUTPUT
142+
- name: Upload reports artifact
143+
if: always()
144+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
145+
with:
146+
name: ubuntu-test-e2e-${{ inputs.arch }}-${{ github.run_id }}-${{ github.run_attempt }}-e2e-reports
147+
path: ${{ github.workspace }}/reports/${{ github.run_id }}-${{ github.run_attempt }}-*.json
148+
- name: Clean Up Previous Environment
149+
if: always()
150+
timeout-minutes: 2
151+
run: |
152+
sudo apt remove runfinch-finch -y
153+
sudo apt remove build-essential -y
154+
sudo apt remove libseccomp-dev -y
155+
sudo apt remove pkg-config -y
156+
sudo apt remove zlib1g-dev -y

‎.github/workflows/release-automation.yaml

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,33 @@ jobs:
4949
secrets: inherit
5050
with:
5151
ref_name: ${{ needs.get-latest-tag.outputs.tag }}
52+
53+
build-and-test-finch-deb:
54+
needs: get-latest-tag
55+
strategy:
56+
fail-fast: false
57+
matrix:
58+
arch: ['x86_64', 'arm64']
59+
include:
60+
- arch: 'x86_64'
61+
output-arch: 'amd64'
62+
- arch: 'arm64'
63+
output-arch: 'arm64'
64+
uses: ./.github/workflows/build-and-test-deb.yaml
65+
secrets: inherit
66+
with:
67+
ref_name: ${{ needs.get-latest-tag.outputs.tag }}
68+
arch: ${{ matrix.arch }}
69+
output-arch: ${{ matrix.output-arch }}
70+
71+
upload-deb-to-release:
72+
needs:
73+
- get-latest-tag
74+
- build-and-test-finch-deb
75+
uses: ./.github/workflows/upload-deb-to-release.yaml
76+
secrets: inherit
77+
with:
78+
ref_name: ${{ needs.get-latest-tag.outputs.tag }}
5279

5380
update-latest-version-in-s3:
5481
needs:

‎.github/workflows/upload-build-to-S3.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,4 +105,4 @@ jobs:
105105
- name: "Upload to S3"
106106
run: |
107107
aws s3 cp ./build/ s3://${{ secrets.DEPENDENCY_BUCKET_NAME }}/aarch64/ --recursive --exclude "*" --include "finch.${GITHUB_REF_NAME}.aarch64.tar.gz"
108-
aws s3 cp ./build/ s3://${{ secrets.DEPENDENCY_BUCKET_NAME }}/x86-64/ --recursive --exclude "*" --include "finch.${GITHUB_REF_NAME}.x86_64.tar.gz"
108+
aws s3 cp ./build/ s3://${{ secrets.DEPENDENCY_BUCKET_NAME }}/x86-64/ --recursive --exclude "*" --include "finch.${GITHUB_REF_NAME}.x86_64.tar.gz"

0 commit comments

Comments
 (0)