Skip to content

Commit 983bec1

Browse files
puehringerpuehringer
committed
feat: add test_images.sh hook
1 parent 8c8c8b6 commit 983bec1

File tree

1 file changed

+129
-77
lines changed

1 file changed

+129
-77
lines changed

‎.github/workflows/build-docker-artifacts.yml‎

Lines changed: 129 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ concurrency:
4545
cancel-in-progress: true
4646

4747
env:
48-
WORKFLOW_BRANCH: "main"
48+
WORKFLOW_BRANCH: "mp/test_images" # TODO: Revert to main
4949
DATAVISYN_PYTHON_BASE_IMAGE: "188237246440.dkr.ecr.eu-central-1.amazonaws.com/datavisyn/base/python:main"
5050
DATAVISYN_NGINX_BASE_IMAGE: "188237246440.dkr.ecr.eu-central-1.amazonaws.com/datavisyn/base/nginx:main"
5151

@@ -195,10 +195,120 @@ jobs:
195195
fi
196196
197197
# Required for build secrets to work: https://docs.docker.com/build/ci/github-actions/secrets/#secret-mounts
198-
- name: Set up QEMU
199-
uses: docker/setup-qemu-action@v3
200-
- name: Set up Docker Buildx
201-
uses: docker/setup-buildx-action@v3
198+
# - name: Set up QEMU
199+
# uses: docker/setup-qemu-action@v3
200+
# - name: Set up Docker Buildx
201+
# uses: docker/setup-buildx-action@v3
202+
203+
# - name: Configure AWS Credentials
204+
# uses: aws-actions/[email protected]
205+
# with:
206+
# role-to-assume: ${{ vars.DV_AWS_ECR_ROLE }}
207+
# aws-region: ${{ vars.DV_AWS_REGION }}
208+
209+
# - name: Login to Amazon ECR
210+
# id: login-ecr
211+
# uses: aws-actions/[email protected]
212+
213+
# - uses: ./tmp/github-workflows/.github/actions/get-branch
214+
# id: get-branch
215+
# with:
216+
# branch: ${{ inputs.branch }}
217+
218+
# - name: Build image
219+
# uses: docker/build-push-action@v6
220+
# with:
221+
# context: .
222+
# file: ${{ matrix.component.flavor_directory }}/${{ matrix.component.directory }}/Dockerfile
223+
# push: false
224+
# load: true
225+
# # Disable provenance as it creates weird multi-arch images: https://github.com/docker/build-push-action/issues/755
226+
# provenance: false
227+
# # Disable the cache to avoid outdated (base) images
228+
# no-cache: true
229+
# build-args: |
230+
# GIT_BRANCH=${{ steps.get-branch.outputs.branch }}
231+
# GIT_COMMIT_HASH=${{ steps.get-branch.outputs.commit_hash }}
232+
# DOCKERFILE_DIRECTORY=${{ matrix.component.flavor_directory }}/${{ matrix.component.directory }}
233+
# DATAVISYN_PYTHON_BASE_IMAGE=${{ env.DATAVISYN_PYTHON_BASE_IMAGE }}
234+
# DATAVISYN_NGINX_BASE_IMAGE=${{ env.DATAVISYN_NGINX_BASE_IMAGE }}
235+
# UV_HTTP_TIMEOUT=300
236+
# ${{ matrix.component.formatted_build_args }}
237+
# secrets:
238+
# # Mount the token as secret mount: https://docs.docker.com/build/ci/github-actions/secrets/#secret-mounts
239+
# "github_token=${{ secrets.CHECKOUT_TOKEN || github.event.repository.private == true && secrets.DATAVISYN_BOT_REPO_TOKEN || github.token }}"
240+
# # TODO: As soon as we only have a single tag, we can push the same image to multiple repositories: https://docs.docker.com/build/ci/github-actions/push-multi-registries/
241+
# # This will be useful for the images which don't change between flavors, e.g. the backend images
242+
# tags: |
243+
# ${{ vars.DV_AWS_ECR_REGISTRY }}/${{ matrix.component.ecr_repository }}:${{ matrix.component.image_tag }}
244+
# labels: |
245+
# name=${{ matrix.component.ecr_repository }}
246+
# version=${{ matrix.component.image_tag_branch_name }}
247+
# org.opencontainers.image.description=Image for ${{ matrix.component.ecr_repository }}
248+
# org.opencontainers.image.source=${{ github.event.repository.html_url }}
249+
# org.opencontainers.image.url=${{ github.event.repository.html_url }}
250+
# org.opencontainers.image.title=${{ matrix.component.ecr_repository }}
251+
# org.opencontainers.image.version=${{ matrix.component.image_tag_branch_name }}
252+
# org.opencontainers.image.created=${{ matrix.component.build_time }}
253+
# org.opencontainers.image.revision=${{ github.sha }}
254+
# env:
255+
# # Disable the build summary for now as it leads to "Failed to export build record: .../export/rec.dockerbuild not found"
256+
# # https://github.com/docker/build-push-action/issues/1156#issuecomment-2437227730
257+
# DOCKER_BUILD_SUMMARY: false
258+
259+
# - name: Determine trivy scan severity levels
260+
# id: set_severity
261+
# run: |
262+
# if [[ "${{ github.event.inputs.scan_high_severity }}" == "false" ]] || \
263+
# [[ "${{ vars.SCAN_HIGH_SEVERITY }}" == "false" ]] || \
264+
# [[ "${{ matrix.component.scan_high_severity }}" == "false" ]]; then
265+
# echo "severity=CRITICAL" >> "$GITHUB_OUTPUT"
266+
# else
267+
# echo "severity=HIGH,CRITICAL" >> "$GITHUB_OUTPUT"
268+
# fi
269+
# - name: Run Trivy vulnerability scanner
270+
# uses: aquasecurity/[email protected]
271+
# with:
272+
# image-ref: ${{ vars.DV_AWS_ECR_REGISTRY }}/${{ matrix.component.ecr_repository }}:${{ matrix.component.image_tag }}
273+
# # Disable scanning the current directory (defaults to .)
274+
# scan-ref: '/dev/null'
275+
# format: 'table'
276+
# exit-code: '1'
277+
# ignore-unfixed: false
278+
# vuln-type: 'os,library'
279+
# severity: ${{ steps.set_severity.outputs.severity }}
280+
# continue-on-error: false
281+
282+
# - name: Push image
283+
# if: ${{ inputs.skip_push != true }}
284+
# # Instead of the docker/build-push-action@v6 which will rebuild the image, just push it directly
285+
# run: docker push ${{ vars.DV_AWS_ECR_REGISTRY }}/${{ matrix.component.ecr_repository }}:${{ matrix.component.image_tag }}
286+
287+
# - name: Log out from Amazon ECR
288+
# shell: bash
289+
# run: docker logout ${{ steps.login-ecr.outputs.registry }}
290+
291+
test-images:
292+
name: Test images of flavor ${{ matrix.flavor.id || 'default' }}
293+
needs: [get-flavors, build-flavors]
294+
strategy:
295+
fail-fast: false
296+
matrix:
297+
flavor: ${{ fromJson(needs.get-flavors.outputs.result).flavors }}
298+
runs-on: ${{ inputs.runs_on || 'ubuntu-22.04' }}
299+
steps:
300+
- name: Checkout repository
301+
uses: actions/checkout@v5
302+
with:
303+
ref: ${{ inputs.branch || github.sha }}
304+
token: ${{ secrets.CHECKOUT_TOKEN || github.event.repository.private == true && secrets.DATAVISYN_BOT_REPO_TOKEN || github.token }}
305+
306+
- name: Checkout github-workflows repository
307+
uses: actions/checkout@v5
308+
with:
309+
repository: datavisyn/github-workflows
310+
ref: ${{ env.WORKFLOW_BRANCH }}
311+
path: ./tmp/github-workflows
202312

203313
- name: Configure AWS Credentials
204314
uses: aws-actions/[email protected]
@@ -210,87 +320,29 @@ jobs:
210320
id: login-ecr
211321
uses: aws-actions/[email protected]
212322

213-
- uses: ./tmp/github-workflows/.github/actions/get-branch
214-
id: get-branch
215-
with:
216-
branch: ${{ inputs.branch }}
217-
218-
- name: Build image
219-
uses: docker/build-push-action@v6
220-
with:
221-
context: .
222-
file: ${{ matrix.component.flavor_directory }}/${{ matrix.component.directory }}/Dockerfile
223-
push: false
224-
load: true
225-
# Disable provenance as it creates weird multi-arch images: https://github.com/docker/build-push-action/issues/755
226-
provenance: false
227-
# Disable the cache to avoid outdated (base) images
228-
no-cache: true
229-
build-args: |
230-
GIT_BRANCH=${{ steps.get-branch.outputs.branch }}
231-
GIT_COMMIT_HASH=${{ steps.get-branch.outputs.commit_hash }}
232-
DOCKERFILE_DIRECTORY=${{ matrix.component.flavor_directory }}/${{ matrix.component.directory }}
233-
DATAVISYN_PYTHON_BASE_IMAGE=${{ env.DATAVISYN_PYTHON_BASE_IMAGE }}
234-
DATAVISYN_NGINX_BASE_IMAGE=${{ env.DATAVISYN_NGINX_BASE_IMAGE }}
235-
UV_HTTP_TIMEOUT=300
236-
${{ matrix.component.formatted_build_args }}
237-
secrets:
238-
# Mount the token as secret mount: https://docs.docker.com/build/ci/github-actions/secrets/#secret-mounts
239-
"github_token=${{ secrets.CHECKOUT_TOKEN || github.event.repository.private == true && secrets.DATAVISYN_BOT_REPO_TOKEN || github.token }}"
240-
# TODO: As soon as we only have a single tag, we can push the same image to multiple repositories: https://docs.docker.com/build/ci/github-actions/push-multi-registries/
241-
# This will be useful for the images which don't change between flavors, e.g. the backend images
242-
tags: |
243-
${{ vars.DV_AWS_ECR_REGISTRY }}/${{ matrix.component.ecr_repository }}:${{ matrix.component.image_tag }}
244-
labels: |
245-
name=${{ matrix.component.ecr_repository }}
246-
version=${{ matrix.component.image_tag_branch_name }}
247-
org.opencontainers.image.description=Image for ${{ matrix.component.ecr_repository }}
248-
org.opencontainers.image.source=${{ github.event.repository.html_url }}
249-
org.opencontainers.image.url=${{ github.event.repository.html_url }}
250-
org.opencontainers.image.title=${{ matrix.component.ecr_repository }}
251-
org.opencontainers.image.version=${{ matrix.component.image_tag_branch_name }}
252-
org.opencontainers.image.created=${{ matrix.component.build_time }}
253-
org.opencontainers.image.revision=${{ github.sha }}
254-
env:
255-
# Disable the build summary for now as it leads to "Failed to export build record: .../export/rec.dockerbuild not found"
256-
# https://github.com/docker/build-push-action/issues/1156#issuecomment-2437227730
257-
DOCKER_BUILD_SUMMARY: false
258-
259-
- name: Determine trivy scan severity levels
260-
id: set_severity
323+
- name: Test images
324+
shell: bash
261325
run: |
262-
if [[ "${{ github.event.inputs.scan_high_severity }}" == "false" ]] || \
263-
[[ "${{ vars.SCAN_HIGH_SEVERITY }}" == "false" ]] || \
264-
[[ "${{ matrix.component.scan_high_severity }}" == "false" ]]; then
265-
echo "severity=CRITICAL" >> "$GITHUB_OUTPUT"
326+
directory="./deploy/build/"${{ matrix.flavor.directory }}""
327+
cd "$directory"
328+
329+
if [[ -f "./hooks/test_images.sh" ]]; then
330+
echo "Run test_images.sh in $directory"
331+
chmod +x ./hooks/test_images.sh
332+
./hooks/test_images.sh
266333
else
267-
echo "severity=HIGH,CRITICAL" >> "$GITHUB_OUTPUT"
334+
echo "No hooks/test_images.sh found in $directory, skipping tests"
268335
fi
269-
- name: Run Trivy vulnerability scanner
270-
uses: aquasecurity/[email protected]
271-
with:
272-
image-ref: ${{ vars.DV_AWS_ECR_REGISTRY }}/${{ matrix.component.ecr_repository }}:${{ matrix.component.image_tag }}
273-
# Disable scanning the current directory (defaults to .)
274-
scan-ref: '/dev/null'
275-
format: 'table'
276-
exit-code: '1'
277-
ignore-unfixed: false
278-
vuln-type: 'os,library'
279-
severity: ${{ steps.set_severity.outputs.severity }}
280-
continue-on-error: false
281-
282-
- name: Push image
283-
if: ${{ inputs.skip_push != true }}
284-
# Instead of the docker/build-push-action@v6 which will rebuild the image, just push it directly
285-
run: docker push ${{ vars.DV_AWS_ECR_REGISTRY }}/${{ matrix.component.ecr_repository }}:${{ matrix.component.image_tag }}
336+
env:
337+
FLAVOR: ${{ toJSON(matrix.flavor) }}
286338

287339
- name: Log out from Amazon ECR
288340
shell: bash
289341
run: docker logout ${{ steps.login-ecr.outputs.registry }}
290342

291343
retag-images:
292-
name: Retag images of flavor ${{ toJSON(matrix.flavor).id || 'default' }}
293-
needs: [get-flavors, build-flavors]
344+
name: Retag images of flavor ${{ matrix.flavor.id || 'default' }}
345+
needs: [get-flavors, test-images]
294346
if: ${{ inputs.skip_push != true }}
295347
strategy:
296348
fail-fast: false

0 commit comments

Comments
 (0)