Skip to content

Commit 13ae9b9

Browse files
puehringerpuehringer
committed
feat: push-docker-artifact workflow
1 parent a27fdad commit 13ae9b9

File tree

4 files changed

+255
-1
lines changed

4 files changed

+255
-1
lines changed

‎.github/workflows/build-docker-artifacts-config.schema.json‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
},
3636
"skip_image_scan": {
3737
"type": "boolean",
38+
"default": false,
3839
"description": "Skip scanning the image for vulnerabilities"
3940
}
4041
},
@@ -44,6 +45,52 @@
4445
},
4546
"required": ["directory", "components"]
4647
}
48+
},
49+
"customers": {
50+
"type": "object",
51+
"additionalProperties": true,
52+
"properties": {
53+
"patternProperties": {
54+
"^[a-zA-Z0-9_-]+$": {
55+
"type": "object",
56+
"additionalProperties": false,
57+
"properties": {
58+
"type": {
59+
"type": "string",
60+
"enum": ["aws"],
61+
"description": "Type of customer configuration"
62+
},
63+
"secret_key": {
64+
"type": "string",
65+
"description": "Secret key for AWS secrets"
66+
},
67+
"registry": {
68+
"type": "string",
69+
"description": "Registry URL at customer"
70+
},
71+
"repositories": {
72+
"type": "array",
73+
"items": {
74+
"type": "object",
75+
"additionalProperties": false,
76+
"properties": {
77+
"source_repository": {
78+
"type": "string",
79+
"description": "Internal ECR repository name"
80+
},
81+
"target_repository": {
82+
"type": "string",
83+
"description": "Repository name at customer"
84+
}
85+
},
86+
"required": ["source_repository", "target_repository"]
87+
}
88+
}
89+
},
90+
"required": ["type", "secret_key", "registry", "repositories"]
91+
}
92+
}
93+
}
4794
}
4895
},
4996
"required": ["flavors"]

‎.github/workflows/build-docker-artifacts-push-to-customer.yml‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
name: Push docker artifacts to customer (must be infrastructure-k8s)
2+
run-name: Push ${{ inputs.repository }}:${{ inputs.image_tag }} docker artifacts to ${{ inputs.customer }}
3+
4+
on:
5+
workflow_call:
6+
inputs:
7+
repository:
8+
type: string
9+
required: true
10+
customer:
11+
type: string
12+
required: true
13+
customer_json:
14+
type: string
15+
required: true
16+
image_tag:
17+
type: string
18+
required: true
19+
runs_on:
20+
type: string
21+
required: false
22+
default: "ubuntu-22.04"
23+
secrets:
24+
DATAVISYN_BOT_REPO_TOKEN:
25+
required: false
26+
27+
concurrency:
28+
group: "${{ github.workflow }}-${{ github.ref || github.head_ref }}-${{ github.event.inputs.repository }}-${{ github.event.inputs.customer }}-${{ github.event.inputs.image_tag }}"
29+
cancel-in-progress: true
30+
31+
env:
32+
WORKFLOW_BRANCH: "mp/push_docker"
33+
34+
permissions:
35+
contents: read
36+
id-token: write
37+
38+
jobs:
39+
post-build:
40+
name: Push docker artifacts to ${{ inputs.customer }}
41+
runs-on: ${{ inputs.runs_on || 'ubuntu-22.04' }}
42+
43+
steps:
44+
- name: Checkout repository (must be infrastructure-k8s)
45+
uses: actions/checkout@v4
46+
with:
47+
token: ${{ secrets.CHECKOUT_TOKEN || github.event.repository.private == true && secrets.DATAVISYN_BOT_REPO_TOKEN || github.token }}
48+
49+
- name: Checkout github-workflows repository
50+
uses: actions/checkout@v4
51+
with:
52+
repository: datavisyn/github-workflows
53+
ref: ${{ env.WORKFLOW_BRANCH }}
54+
path: ./tmp/github-workflows
55+
56+
- name: Extract customer from payload
57+
uses: actions/github-script@v7
58+
id: get-customer
59+
with:
60+
script: |
61+
const customer = JSON.parse(process.env.CUSTOMER_JSON);
62+
63+
// Comma separated list of source images, incl. registry, repository and tag
64+
const sourceImages = customer.repositories.map(repo => `${process.env.SOURCE_ECR_REGISTRY}/${repo.source_repository}:${repo.image_tag || process.env.IMAGE_TAG}`).join(',');
65+
const destinationImages = customer.repositories.map(repo => `${customer.registry}/${repo.target_repository}:${repo.image_tag || process.env.IMAGE_TAG}`).join(',');
66+
67+
const result = {
68+
customer,
69+
source_images: sourceImages,
70+
destination_images: destinationImages
71+
};
72+
console.log(result);
73+
return result;
74+
env:
75+
SOURCE_ECR_REGISTRY: ${{ vars.DV_AWS_ECR_REGISTRY }}
76+
CUSTOMER_JSON: ${{ inputs.customer_json }}
77+
CUSTOMER: ${{ inputs.customer }}
78+
IMAGE_TAG: ${{ inputs.image_tag }}
79+
80+
- name: Get dv image aws config
81+
id: get-dv-aws-image-config
82+
uses: ./.github/actions/get-aws-config
83+
with:
84+
aws_config: ${{ secrets.DV_AWS_ECR_SECRETS }}
85+
86+
- name: Get image aws config
87+
id: get-aws-image-config
88+
uses: ./.github/actions/get-aws-config
89+
with:
90+
aws_config: ${{ secrets[fromJson(steps.get-customer.outputs.result).customer.secret_key] }}
91+
92+
- name: Push images
93+
id: pull-push-image
94+
uses: ./.github/actions/pull-push-image
95+
with:
96+
source_aws_role: ${{ steps.get-dv-aws-image-config.outputs.aws_role }}
97+
source_aws_region: ${{ steps.get-dv-aws-image-config.outputs.aws_region }}
98+
source_images: ${{ fromJson(steps.get-customer.outputs.result).source_images }}
99+
destination_aws_role: ${{ steps.get-aws-image-config.outputs.aws_role }}
100+
destination_aws_region: ${{ steps.get-aws-image-config.outputs.aws_region }}
101+
destination_aws_access_key_id: ${{ steps.get-aws-image-config.outputs.aws_access_key_id }}
102+
destination_aws_secret_access_key: ${{ steps.get-aws-image-config.outputs.aws_secret_access_key }}
103+
destination_images: ${{ fromJson(steps.get-customer.outputs.result).destination_images }}

‎.github/workflows/build-docker-artifacts-trigger-push-to-customer.yml‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
name: Trigger push docker artifacts to customer
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
customers:
7+
type: string
8+
required: true
9+
description: Comma separated list of customers
10+
branch:
11+
type: string
12+
required: false
13+
# When using github.ref || github.head_ref, it would contain the full path, including /, which breaks the postgres hostname
14+
default: ${{ github.sha }}
15+
runs_on:
16+
type: string
17+
required: false
18+
default: "ubuntu-22.04"
19+
secrets:
20+
DATAVISYN_BOT_REPO_TOKEN:
21+
required: false
22+
23+
concurrency:
24+
group: "${{ github.workflow }}-${{ github.ref || github.head_ref }}-${{ github.event.inputs.app }}-${{ github.event.inputs.customer }}-${{ github.event.inputs.image_tag }}"
25+
cancel-in-progress: true
26+
27+
env:
28+
WORKFLOW_BRANCH: "mp/push_docker"
29+
30+
permissions:
31+
contents: read
32+
id-token: write
33+
34+
jobs:
35+
get-customers:
36+
name: Trigger push docker artifacts to ${{ inputs.customers }}
37+
runs-on: ${{ inputs.runs_on || 'ubuntu-22.04' }}
38+
outputs:
39+
result: ${{ steps.get-customers.outputs.result }}
40+
41+
steps:
42+
- name: Checkout repository
43+
uses: actions/checkout@v4
44+
with:
45+
ref: ${{ inputs.branch }}
46+
token: ${{ secrets.CHECKOUT_TOKEN || github.event.repository.private == true && secrets.DATAVISYN_BOT_REPO_TOKEN || github.token }}
47+
48+
- name: Checkout github-workflows repository
49+
uses: actions/checkout@v4
50+
with:
51+
repository: datavisyn/github-workflows
52+
ref: ${{ env.WORKFLOW_BRANCH }}
53+
path: ./tmp/github-workflows
54+
55+
- name: Validate ./deploy/build/config.json
56+
shell: bash
57+
run: |
58+
# Validate the config with the schema
59+
python -m venv .venv
60+
source .venv/bin/activate
61+
pip install jsonschema
62+
jsonschema -i ./deploy/build/config.json ./tmp/github-workflows/.github/workflows/build-docker-artifacts-config.schema.json
63+
deactivate
64+
rm -rf .venv
65+
66+
- name: Get customers from ./deploy/build/config.json
67+
uses: actions/github-script@v7
68+
id: get-customers
69+
with:
70+
script: |
71+
const config = require('./deploy/build/config.json');
72+
const customers = process.env.CUSTOMERS.split(',');
73+
const imageTagBranchName = "${{ github.ref }}".replace('refs/heads/', '').replace('refs/tags/', '').replace(/[^a-zA-Z0-9._-]/g, '-');
74+
75+
const result = customers.map((c) => ({
76+
repository: process.env.REPOSITORY,
77+
customer: c,
78+
customer_json: JSON.stringify(config.customers[c]),
79+
image_tag: imageTagBranchName,
80+
}));
81+
console.log(result);
82+
return result;
83+
env:
84+
CUSTOMERS: ${{ inputs.customers }}
85+
REPOSITORY: ${{ github.repository }}
86+
87+
trigger-push:
88+
needs: get-customers
89+
strategy:
90+
fail-fast: true
91+
matrix:
92+
customer: ${{ fromJson(needs.get-customers.outputs.result) }}
93+
runs-on: ${{ inputs.runs_on }}
94+
steps:
95+
- name: Trigger push docker artifacts to ${{ matrix.customer.customer }}
96+
uses: datavisyn/github-action-trigger-workflow@v1
97+
with:
98+
owner: "datavisyn"
99+
repo: "infrastructure-k8s"
100+
github_token: ${{ secrets.DATAVISYN_BOT_REPO_TOKEN }}
101+
workflow_file_name: "push-docker-artifact-to-customer.yml"
102+
ref: "main"
103+
github_user: ${{ secrets.DV_BOT_USER }}
104+
client_payload: ${{ toJson(matrix.customer) }}

‎.github/workflows/build-docker-artifacts.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ concurrency:
2424
cancel-in-progress: true
2525

2626
env:
27-
WORKFLOW_BRANCH: "main"
27+
WORKFLOW_BRANCH: "mp/push_docker"
2828
PYTHON_BASE_IMAGE: "python:3.10.8-slim-bullseye"
2929
DATAVISYN_PYTHON_BASE_IMAGE: "188237246440.dkr.ecr.eu-central-1.amazonaws.com/datavisyn/base/python:main"
3030
NODE_BASE_IMAGE: "node:20.9-bullseye"

0 commit comments

Comments
 (0)