Skip to content

Commit 186996f

Browse files
v1vv1v
authored
github-action: enable provenance (#2014)
1 parent 71bd199 commit 186996f

File tree

8 files changed

+147
-64
lines changed

8 files changed

+147
-64
lines changed

‎.github/actions/build-distribution/action.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
---
2+
3+
name: common build distribution tasks
4+
description: Run the build distribution
5+
6+
runs:
7+
using: "composite"
8+
steps:
9+
- uses: actions/setup-python@v5
10+
with:
11+
python-version: "3.10"
12+
13+
- name: Build lambda layer zip
14+
run: ./dev-utils/make-distribution.sh
15+
shell: bash
16+
17+
- uses: actions/upload-artifact@v4
18+
with:
19+
name: build-distribution
20+
path: ./build/
21+
if-no-files-found: error

‎.github/actions/packages/action.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
---
2+
3+
name: common package tasks
4+
description: Run the packages
5+
6+
runs:
7+
using: "composite"
8+
steps:
9+
- uses: actions/setup-python@v5
10+
with:
11+
python-version: "3.10"
12+
- name: Override the version if there is no tag release.
13+
run: |
14+
if [[ "${GITHUB_REF}" != refs/tags/* ]]; then
15+
echo "ELASTIC_CI_POST_VERSION=${{ github.run_id }}" >> "${GITHUB_ENV}"
16+
fi
17+
shell: bash
18+
- name: Build packages
19+
run: ./dev-utils/make-packages.sh
20+
shell: bash
21+
- name: Upload Packages
22+
uses: actions/upload-artifact@v4
23+
with:
24+
name: packages
25+
path: |
26+
dist/*.whl
27+
dist/*tar.gz
28+
- name: generate build provenance
29+
uses: github-early-access/generate-build-provenance@main
30+
with:
31+
subject-path: "${{ github.workspace }}/dist/*"

‎.github/dependabot.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,3 +29,30 @@ updates:
2929
github-actions:
3030
patterns:
3131
- "*"
32+
33+
# GitHub composite actions
34+
- package-ecosystem: "github-actions"
35+
directory: "/.github/actions/packages"
36+
reviewers:
37+
- "elastic/observablt-ci"
38+
schedule:
39+
interval: "weekly"
40+
day: "sunday"
41+
time: "22:00"
42+
groups:
43+
github-actions:
44+
patterns:
45+
- "*"
46+
47+
- package-ecosystem: "github-actions"
48+
directory: "/.github/actions/build-distribution"
49+
reviewers:
50+
- "elastic/observablt-ci"
51+
schedule:
52+
interval: "weekly"
53+
day: "sunday"
54+
time: "22:00"
55+
groups:
56+
github-actions:
57+
patterns:
58+
- "*"

‎.github/workflows/build-distribution.yml‎

Lines changed: 0 additions & 23 deletions
This file was deleted.

‎.github/workflows/packages.yml‎

Lines changed: 4 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -18,27 +18,10 @@ permissions:
1818

1919
jobs:
2020
build:
21+
permissions:
22+
id-token: write
23+
contents: write
2124
runs-on: ubuntu-latest
2225
steps:
2326
- uses: actions/checkout@v4
24-
- uses: actions/setup-python@v5
25-
with:
26-
python-version: "3.10"
27-
- name: Override the version if there is no tag release.
28-
run: |
29-
if [[ "${GITHUB_REF}" != refs/tags/* ]]; then
30-
echo "ELASTIC_CI_POST_VERSION=${{ github.run_id }}" >> "${GITHUB_ENV}"
31-
fi
32-
- name: Install wheel
33-
run: pip install --user wheel
34-
- name: Building universal wheel
35-
run: python setup.py bdist_wheel
36-
- name: Building source distribution
37-
run: python setup.py sdist
38-
- name: Upload Packages
39-
uses: actions/upload-artifact@v4
40-
with:
41-
name: packages
42-
path: |
43-
dist/*.whl
44-
dist/*tar.gz
27+
- uses: ./.github/actions/packages

‎.github/workflows/release.yml‎

Lines changed: 43 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,13 @@ jobs:
1818
enabled: ${{ startsWith(github.ref, 'refs/tags') }}
1919

2020
packages:
21-
uses: ./.github/workflows/packages.yml
21+
permissions:
22+
id-token: write
23+
contents: write
24+
runs-on: ubuntu-latest
25+
steps:
26+
- uses: actions/checkout@v4
27+
- uses: ./.github/actions/packages
2228

2329
publish-pypi:
2430
needs:
@@ -46,7 +52,17 @@ jobs:
4652
repository-url: https://test.pypi.org/legacy/
4753

4854
build-distribution:
49-
uses: ./.github/workflows/build-distribution.yml
55+
permissions:
56+
id-token: write
57+
contents: write
58+
runs-on: ubuntu-latest
59+
steps:
60+
- uses: actions/checkout@v4
61+
- uses: ./.github/actions/build-distribution
62+
- name: generate build provenance
63+
uses: github-early-access/generate-build-provenance@main
64+
with:
65+
subject-path: "${{ github.workspace }}/build/dist/elastic-apm-python-lambda-layer.zip"
5066

5167
publish-lambda-layers:
5268
needs:
@@ -63,7 +79,7 @@ jobs:
6379
secrets: |
6480
secret/observability-team/ci/service-account/apm-agent-python access_key_id | AWS_ACCESS_KEY_ID ;
6581
secret/observability-team/ci/service-account/apm-agent-python secret_access_key | AWS_SECRET_ACCESS_KEY
66-
- uses: actions/download-artifact@v3
82+
- uses: actions/download-artifact@v4
6783
with:
6884
name: build-distribution
6985
path: ./build
@@ -86,6 +102,9 @@ jobs:
86102
needs:
87103
- build-distribution
88104
runs-on: ubuntu-latest
105+
permissions:
106+
id-token: write
107+
contents: write
89108
env:
90109
DOCKER_IMAGE_NAME: docker.elastic.co/observability/apm-agent-python
91110
steps:
@@ -97,7 +116,7 @@ jobs:
97116
url: ${{ secrets.VAULT_ADDR }}
98117
roleId: ${{ secrets.VAULT_ROLE_ID }}
99118
secretId: ${{ secrets.VAULT_SECRET_ID }}
100-
- uses: actions/download-artifact@v3
119+
- uses: actions/download-artifact@v4
101120
with:
102121
name: build-distribution
103122
path: ./build
@@ -107,25 +126,30 @@ jobs:
107126
if [ "${{ startsWith(github.ref, 'refs/tags') }}" == "false" ] ; then
108127
# for testing purposes
109128
echo "tag=test" >> "${GITHUB_OUTPUT}"
129+
echo "latest=test-latest" >> "${GITHUB_OUTPUT}"
110130
else
111131
# version without v prefix (e.g. 1.2.3)
112132
echo "tag=${GITHUB_REF_NAME/v/}" >> "${GITHUB_OUTPUT}"
133+
echo "latest=latest" >> "${GITHUB_OUTPUT}"
113134
fi
114-
- name: Docker build
115-
run: >-
116-
docker build
117-
-t ${{ env.DOCKER_IMAGE_NAME }}:${{ steps.setup-docker.outputs.tag }}
118-
--build-arg AGENT_DIR=./build/dist/package/python
119-
.
120-
- name: Docker retag
121-
run: >-
122-
docker tag
123-
${{ env.DOCKER_IMAGE_NAME }}:${{ steps.setup-docker.outputs.tag }}
124-
${{ env.DOCKER_IMAGE_NAME }}:latest
125-
- name: Docker push
126-
if: startsWith(github.ref, 'refs/tags')
127-
run: |-
128-
docker push --all-tags ${{ env.DOCKER_IMAGE_NAME }}
135+
- name: Build and push image
136+
id: push
137+
uses: docker/[email protected]
138+
with:
139+
context: .
140+
push: true
141+
tags: |
142+
${{ env.DOCKER_IMAGE_NAME }}:${{ steps.setup-docker.outputs.tag }}
143+
${{ env.DOCKER_IMAGE_NAME }}:${{ steps.setup-docker.outputs.latest }}
144+
build-args: |
145+
AGENT_DIR=./build/dist/package/python
146+
147+
- name: Attest image
148+
uses: github-early-access/generate-build-provenance@main
149+
with:
150+
subject-name: "${{ env.DOCKER_IMAGE_NAME }}:${{ steps.setup-docker.outputs.tag }}"
151+
subject-digest: ${{ steps.push.outputs.digest }}
152+
push-to-registry: false
129153

130154
github-draft:
131155
permissions:

‎.github/workflows/test.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,11 @@ permissions:
3535

3636
jobs:
3737
build-distribution:
38-
uses: ./.github/workflows/build-distribution.yml
38+
runs-on: ubuntu-latest
39+
steps:
40+
- uses: actions/checkout@v4
41+
- uses: ./.github/actions/build-distribution
42+
3943

4044
create-matrix:
4145
runs-on: ubuntu-latest

‎dev-utils/make-packages.sh‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#!/bin/bash
2+
#
3+
# Make a Python APM agent distribution
4+
#
5+
6+
echo "::group::Install wheel"
7+
pip install --user wheel
8+
echo "::endgroup::"
9+
10+
echo "::group::Building universal wheel"
11+
python setup.py bdist_wheel
12+
echo "::endgroup::"
13+
14+
echo "::group::Building source distribution"
15+
python setup.py sdist
16+
echo "::endgroup::"

0 commit comments

Comments
 (0)