Skip to content

Commit cb9e0ee

Browse files
puehringerpuehringer
committed
Add back code
1 parent a1a5a50 commit cb9e0ee

File tree

1 file changed

+93
-94
lines changed

1 file changed

+93
-94
lines changed

‎.github/workflows/build-docker-artifacts.yml‎

Lines changed: 93 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -97,8 +97,7 @@ jobs:
9797
9898
const buildTime = new Date().toISOString().replace(/:/g, '').replace(/\..+/, 'Z');
9999
const imageTagBranchName = "${{ github.ref }}".replace('refs/heads/', '').replace('refs/tags/', '').replace(/[^a-zA-Z0-9._-]/g, '-');
100-
// const imageTag = `tagged-${imageTagBranchName}-${buildTime}`;
101-
const imageTag = "v32.1.1"; // TODO: Revert to dynamic tag
100+
const imageTag = `tagged-${imageTagBranchName}-${buildTime}`;
102101
103102
const builds = process.env.BUILDS ? process.env.BUILDS.split(',') : Object.keys(config.build);
104103
const push_to = process.env.PUSH_TO ? process.env.PUSH_TO.split(',') : Object.keys(config.push || {});
@@ -197,98 +196,98 @@ jobs:
197196
fi
198197
199198
# Required for build secrets to work: https://docs.docker.com/build/ci/github-actions/secrets/#secret-mounts
200-
# - name: Set up QEMU
201-
# uses: docker/setup-qemu-action@v3
202-
# - name: Set up Docker Buildx
203-
# uses: docker/setup-buildx-action@v3
204-
205-
# - name: Configure AWS Credentials
206-
# uses: aws-actions/[email protected]
207-
# with:
208-
# role-to-assume: ${{ vars.DV_AWS_ECR_ROLE }}
209-
# aws-region: ${{ vars.DV_AWS_REGION }}
210-
211-
# - name: Login to Amazon ECR
212-
# id: login-ecr
213-
# uses: aws-actions/[email protected]
214-
215-
# - uses: ./tmp/github-workflows/.github/actions/get-branch
216-
# id: get-branch
217-
# with:
218-
# branch: ${{ inputs.branch }}
219-
220-
# - name: Build image
221-
# uses: docker/build-push-action@v6
222-
# with:
223-
# context: .
224-
# file: ${{ matrix.component.flavor_directory }}/${{ matrix.component.directory }}/Dockerfile
225-
# push: false
226-
# load: true
227-
# # Disable provenance as it creates weird multi-arch images: https://github.com/docker/build-push-action/issues/755
228-
# provenance: false
229-
# # Disable the cache to avoid outdated (base) images
230-
# no-cache: true
231-
# build-args: |
232-
# GIT_BRANCH=${{ steps.get-branch.outputs.branch }}
233-
# GIT_COMMIT_HASH=${{ steps.get-branch.outputs.commit_hash }}
234-
# DOCKERFILE_DIRECTORY=${{ matrix.component.flavor_directory }}/${{ matrix.component.directory }}
235-
# DATAVISYN_PYTHON_BASE_IMAGE=${{ env.DATAVISYN_PYTHON_BASE_IMAGE }}
236-
# DATAVISYN_NGINX_BASE_IMAGE=${{ env.DATAVISYN_NGINX_BASE_IMAGE }}
237-
# UV_HTTP_TIMEOUT=300
238-
# ${{ matrix.component.formatted_build_args }}
239-
# secrets:
240-
# # Mount the token as secret mount: https://docs.docker.com/build/ci/github-actions/secrets/#secret-mounts
241-
# "github_token=${{ secrets.CHECKOUT_TOKEN || github.event.repository.private == true && secrets.DATAVISYN_BOT_REPO_TOKEN || github.token }}"
242-
# # TODO: As soon as we only have a single tag, we can push the same image to multiple repositories: https://docs.docker.com/build/ci/github-actions/push-multi-registries/
243-
# # This will be useful for the images which don't change between flavors, e.g. the backend images
244-
# tags: |
245-
# ${{ matrix.component.image_ref }}
246-
# labels: |
247-
# name=${{ matrix.component.ecr_repository }}
248-
# version=${{ matrix.component.image_tag_branch_name }}
249-
# org.opencontainers.image.description=Image for ${{ matrix.component.ecr_repository }}
250-
# org.opencontainers.image.source=${{ github.event.repository.html_url }}
251-
# org.opencontainers.image.url=${{ github.event.repository.html_url }}
252-
# org.opencontainers.image.title=${{ matrix.component.ecr_repository }}
253-
# org.opencontainers.image.version=${{ matrix.component.image_tag_branch_name }}
254-
# org.opencontainers.image.created=${{ matrix.component.build_time }}
255-
# org.opencontainers.image.revision=${{ github.sha }}
256-
# env:
257-
# # Disable the build summary for now as it leads to "Failed to export build record: .../export/rec.dockerbuild not found"
258-
# # https://github.com/docker/build-push-action/issues/1156#issuecomment-2437227730
259-
# DOCKER_BUILD_SUMMARY: false
260-
261-
# - name: Determine trivy scan severity levels
262-
# id: set_severity
263-
# run: |
264-
# if [[ "${{ github.event.inputs.scan_high_severity }}" == "false" ]] || \
265-
# [[ "${{ vars.SCAN_HIGH_SEVERITY }}" == "false" ]] || \
266-
# [[ "${{ matrix.component.scan_high_severity }}" == "false" ]]; then
267-
# echo "severity=CRITICAL" >> "$GITHUB_OUTPUT"
268-
# else
269-
# echo "severity=HIGH,CRITICAL" >> "$GITHUB_OUTPUT"
270-
# fi
271-
# - name: Run Trivy vulnerability scanner
272-
# uses: aquasecurity/[email protected]
273-
# with:
274-
# image-ref: ${{ matrix.component.image_ref }}
275-
# # Disable scanning the current directory (defaults to .)
276-
# scan-ref: '/dev/null'
277-
# format: 'table'
278-
# exit-code: '1'
279-
# ignore-unfixed: false
280-
# vuln-type: 'os,library'
281-
# severity: ${{ steps.set_severity.outputs.severity }}
282-
# continue-on-error: false
283-
284-
# - name: Push image
285-
# if: ${{ inputs.skip_push != true }}
286-
# # Instead of the docker/build-push-action@v6 which will rebuild the image, just push it directly
287-
# run: docker push ${{ matrix.component.image_ref }}
288-
289-
# - name: Log out from Amazon ECR
290-
# shell: bash
291-
# run: docker logout ${{ steps.login-ecr.outputs.registry }}
199+
- name: Set up QEMU
200+
uses: docker/setup-qemu-action@v3
201+
- name: Set up Docker Buildx
202+
uses: docker/setup-buildx-action@v3
203+
204+
- name: Configure AWS Credentials
205+
uses: aws-actions/[email protected]
206+
with:
207+
role-to-assume: ${{ vars.DV_AWS_ECR_ROLE }}
208+
aws-region: ${{ vars.DV_AWS_REGION }}
209+
210+
- name: Login to Amazon ECR
211+
id: login-ecr
212+
uses: aws-actions/[email protected]
213+
214+
- uses: ./tmp/github-workflows/.github/actions/get-branch
215+
id: get-branch
216+
with:
217+
branch: ${{ inputs.branch }}
218+
219+
- name: Build image
220+
uses: docker/build-push-action@v6
221+
with:
222+
context: .
223+
file: ${{ matrix.component.flavor_directory }}/${{ matrix.component.directory }}/Dockerfile
224+
push: false
225+
load: true
226+
# Disable provenance as it creates weird multi-arch images: https://github.com/docker/build-push-action/issues/755
227+
provenance: false
228+
# Disable the cache to avoid outdated (base) images
229+
no-cache: true
230+
build-args: |
231+
GIT_BRANCH=${{ steps.get-branch.outputs.branch }}
232+
GIT_COMMIT_HASH=${{ steps.get-branch.outputs.commit_hash }}
233+
DOCKERFILE_DIRECTORY=${{ matrix.component.flavor_directory }}/${{ matrix.component.directory }}
234+
DATAVISYN_PYTHON_BASE_IMAGE=${{ env.DATAVISYN_PYTHON_BASE_IMAGE }}
235+
DATAVISYN_NGINX_BASE_IMAGE=${{ env.DATAVISYN_NGINX_BASE_IMAGE }}
236+
UV_HTTP_TIMEOUT=300
237+
${{ matrix.component.formatted_build_args }}
238+
secrets:
239+
# Mount the token as secret mount: https://docs.docker.com/build/ci/github-actions/secrets/#secret-mounts
240+
"github_token=${{ secrets.CHECKOUT_TOKEN || github.event.repository.private == true && secrets.DATAVISYN_BOT_REPO_TOKEN || github.token }}"
241+
# TODO: As soon as we only have a single tag, we can push the same image to multiple repositories: https://docs.docker.com/build/ci/github-actions/push-multi-registries/
242+
# This will be useful for the images which don't change between flavors, e.g. the backend images
243+
tags: |
244+
${{ matrix.component.image_ref }}
245+
labels: |
246+
name=${{ matrix.component.ecr_repository }}
247+
version=${{ matrix.component.image_tag_branch_name }}
248+
org.opencontainers.image.description=Image for ${{ matrix.component.ecr_repository }}
249+
org.opencontainers.image.source=${{ github.event.repository.html_url }}
250+
org.opencontainers.image.url=${{ github.event.repository.html_url }}
251+
org.opencontainers.image.title=${{ matrix.component.ecr_repository }}
252+
org.opencontainers.image.version=${{ matrix.component.image_tag_branch_name }}
253+
org.opencontainers.image.created=${{ matrix.component.build_time }}
254+
org.opencontainers.image.revision=${{ github.sha }}
255+
env:
256+
# Disable the build summary for now as it leads to "Failed to export build record: .../export/rec.dockerbuild not found"
257+
# https://github.com/docker/build-push-action/issues/1156#issuecomment-2437227730
258+
DOCKER_BUILD_SUMMARY: false
259+
260+
- name: Determine trivy scan severity levels
261+
id: set_severity
262+
run: |
263+
if [[ "${{ github.event.inputs.scan_high_severity }}" == "false" ]] || \
264+
[[ "${{ vars.SCAN_HIGH_SEVERITY }}" == "false" ]] || \
265+
[[ "${{ matrix.component.scan_high_severity }}" == "false" ]]; then
266+
echo "severity=CRITICAL" >> "$GITHUB_OUTPUT"
267+
else
268+
echo "severity=HIGH,CRITICAL" >> "$GITHUB_OUTPUT"
269+
fi
270+
- name: Run Trivy vulnerability scanner
271+
uses: aquasecurity/[email protected]
272+
with:
273+
image-ref: ${{ matrix.component.image_ref }}
274+
# Disable scanning the current directory (defaults to .)
275+
scan-ref: '/dev/null'
276+
format: 'table'
277+
exit-code: '1'
278+
ignore-unfixed: false
279+
vuln-type: 'os,library'
280+
severity: ${{ steps.set_severity.outputs.severity }}
281+
continue-on-error: false
282+
283+
- name: Push image
284+
if: ${{ inputs.skip_push != true }}
285+
# Instead of the docker/build-push-action@v6 which will rebuild the image, just push it directly
286+
run: docker push ${{ matrix.component.image_ref }}
287+
288+
- name: Log out from Amazon ECR
289+
shell: bash
290+
run: docker logout ${{ steps.login-ecr.outputs.registry }}
292291

293292
test-images:
294293
name: Test images of flavor ${{ matrix.flavor.id || 'default' }}

0 commit comments

Comments
 (0)