Skip to content

Commit 128612b

Browse files
kschelonkakschelonka
authored
Merge branch 'main' into feat/otel-test
2 parents 3e6a03f + f00b3d5 commit 128612b

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+599
-2888
lines changed

‎.github/workflows/docker_build_deploy.yml‎

Lines changed: 63 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,67 +1,95 @@
1-
name: Build Docker image and publish
1+
name: Build Docker image and publish to GAR
22

33
permissions: {}
44

55
on:
66
push:
7-
branches: [ main ]
7+
branches:
8+
- main
9+
tags:
10+
- "*"
11+
812
jobs:
9-
push_to_registry:
10-
name: Push Docker image to Docker Hub
13+
build_and_push_to_gar:
14+
# Define permissions at the job level
15+
permissions:
16+
contents: "read" # Needed for checkout
17+
id-token: "write" # Needed for GCP auth
18+
packages: "none" # Explicitly disable package permissions
19+
name: Build and Push Docker image to GAR
1120
runs-on: ubuntu-latest
21+
environment: build
22+
env:
23+
GAR_IMAGE_BASE: ${{ vars.GAR_REPO }}/${{ github.event.repository.name }} # Base name for GAR image
24+
GAR_REGISTRY: us-docker.pkg.dev
1225
steps:
1326
- name: Check out the repo
1427
uses: actions/checkout@v6
1528
with:
1629
persist-credentials: false
1730

18-
- name: Log in to Docker Hub
31+
- name: Authenticate to Google Cloud
32+
id: gcp-auth
33+
uses: google-github-actions/auth@v3
34+
with:
35+
token_format: access_token
36+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
37+
service_account: ${{ vars.GCP_GAR_SERVICE_ACCOUNT }}
38+
39+
- name: Login to Artifact Registry
40+
id: gar-login
1941
uses: docker/login-action@v3
2042
with:
21-
username: ${{ secrets.DOCKER_USERNAME }}
22-
password: ${{ secrets.DOCKER_PASSWORD }}
43+
registry: ${{ env.GAR_REGISTRY }}
44+
username: oauth2accesstoken
45+
password: ${{ steps.gcp-auth.outputs.access_token }}
2346

2447
- name: Extract metadata (tags, labels) for Docker
2548
id: meta
2649
uses: docker/metadata-action@v5
2750
with:
28-
images: mozilla/blurts-server
51+
# Only generate the image name for GAR
52+
images: ${{ env.GAR_IMAGE_BASE }}
2953
tags: |
30-
type=semver,pattern={{raw}}
31-
type=raw,value={{sha}},event=tag
54+
# Generate tag based on short commit SHA
55+
type=sha,format=short,prefix=
3256
3357
- name: Create version.json
3458
run: |
59+
# Use full sha here for version.json content
3560
echo "{\"commit\":\"$GITHUB_SHA\",\"version\":\"$GITHUB_REF_NAME\",\"source\":\"https://github.com/$GITHUB_REPOSITORY\",\"build\":\"$GITHUB_RUN_ID\"}" > version.json
3661
37-
- name: Check Docker Version
38-
run: docker --version
39-
- name: Install Latest Docker
40-
run: |
41-
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add -
42-
sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable"
43-
sudo apt-get update
44-
sudo apt-get install docker-ce
62+
- name: Set up QEMU
63+
uses: docker/setup-qemu-action@v3
4564

46-
- name: Build Docker image
65+
- name: Set up Docker Buildx
66+
id: buildx
67+
uses: docker/setup-buildx-action@v3
68+
69+
- name: Build and push Docker image to GAR
70+
id: build-and-push
4771
env:
48-
UPLOAD_SENTRY_SOURCEMAPS: true
49-
SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
50-
SENTRY_RELEASE: ${{ github.ref_name }}
51-
NEXT_PUBLIC_SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
52-
S3_BUCKET: ${{ secrets.S3_BUCKET }}
53-
run: |
54-
docker build --tag blurts-server \
55-
--build-arg SENTRY_RELEASE="$SENTRY_RELEASE" \
56-
--build-arg NEXT_PUBLIC_SENTRY_DSN="$NEXT_PUBLIC_SENTRY_DSN" \
57-
--secret id=SENTRY_AUTH_TOKEN \
58-
.
72+
TAGS: ${{ steps.meta.outputs.tags }}
73+
uses: docker/build-push-action@v6
74+
with:
75+
context: .
76+
# Push is true to push to GAR after build
77+
push: true
78+
# Tags generated by the metadata action (only GAR tag)
79+
tags: ${{ env.TAGS }}
80+
# Pass build arguments
81+
build-args: |
82+
SENTRY_RELEASE=${{ github.sha }}
83+
NEXT_PUBLIC_SENTRY_DSN=${{ secrets.SENTRY_DSN }}
84+
# Pass secrets securely to the build
85+
secrets: |
86+
SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
87+
# Enable build cache for faster builds (optional but recommended)
88+
cache-from: type=gha
89+
cache-to: type=gha,mode=max
5990

60-
- name: Deploy to Dockerhub
91+
- name: Print Image URI
6192
env:
62-
DOCKERHUB_REPO: ${{ env.DOCKERHUB_REPO }}
6393
TAGS: ${{ steps.meta.outputs.tags }}
6494
run: |
65-
# deploy main
66-
docker tag blurts-server $TAGS
67-
docker push $TAGS
95+
echo "Pushed GAR image: $TAGS"

.github/workflows/docker_build_deploy_v2.yml renamed to .github/workflows/docker_build_deploy_dev.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1-
name: Build Docker image and publish to GAR
1+
name: Build Docker image and publish to GAR (Dev)
22

3+
# Actions in this repository could be streamlined with
4+
# reusable workflows (significant refactor)
35
permissions: {}
46

57
on:
68
push:
79
branches:
8-
- main
9-
tags:
10-
- "*"
10+
- dev
1111

1212
jobs:
1313
build_and_push_to_gar:
@@ -52,7 +52,7 @@ jobs:
5252
images: ${{ env.GAR_IMAGE_BASE }}
5353
tags: |
5454
# Generate tag based on short commit SHA
55-
type=sha,format=short,prefix=
55+
type=sha,format=short,prefix=dev-
5656
5757
- name: Create version.json
5858
run: |

‎.github/workflows/production_deploy.yml‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -39,12 +39,6 @@ jobs:
3939
uses: actions/checkout@v6
4040
with:
4141
persist-credentials: false
42-
43-
- name: Log in to Docker Hub
44-
uses: docker/login-action@v3
45-
with:
46-
username: ${{ secrets.DOCKER_USERNAME }}
47-
password: ${{ secrets.DOCKER_PASSWORD }}
4842

4943
- name: Authenticate to Google Cloud
5044
id: gcp-auth
@@ -62,15 +56,6 @@ jobs:
6256
username: oauth2accesstoken
6357
password: ${{ steps.gcp-auth.outputs.access_token }}
6458

65-
- name: Pull Docker Hub image
66-
run: docker pull "$DOCKERHUB_IMAGE:$SAFE_IMAGE_TAG"
67-
68-
- name: Retag Docker Hub image
69-
run: docker tag "$DOCKERHUB_IMAGE:$SAFE_IMAGE_TAG" "$DOCKERHUB_IMAGE:$SAFE_ENVIRONMENT-$SAFE_IMAGE_TAG"
70-
71-
- name: Push Docker Hub image
72-
run: docker push "$DOCKERHUB_IMAGE:$SAFE_ENVIRONMENT-$SAFE_IMAGE_TAG"
73-
7459
- name: Pull GAR image
7560
run: docker pull "$GAR_IMAGE_BASE:$SAFE_IMAGE_TAG"
7661

‎.github/workflows/release_cron_daily.yml‎

Lines changed: 5 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ jobs:
1717
env:
1818
GAR_IMAGE_BASE: ${{ vars.GAR_REPO }}/${{ github.event.repository.name }}
1919
GAR_REGISTRY: us-docker.pkg.dev
20-
DOCKERHUB_IMAGE: mozilla/blurts-server # Define Docker Hub image name
2120

2221
steps:
2322
- name: Checkout main branch
@@ -50,16 +49,6 @@ jobs:
5049
"generate_release_notes": true
5150
}'
5251
53-
# We cannot rely on the release_retag.yaml workflow because of the
54-
# auth scope of the default github token. It's a good security practice
55-
# to prevent a github action being triggered by another.
56-
# So we will deliberately push to dockerhub below
57-
- name: Log in to Docker Hub
58-
uses: docker/login-action@v3
59-
with:
60-
username: ${{ secrets.DOCKER_USERNAME }}
61-
password: ${{ secrets.DOCKER_PASSWORD }}
62-
6352
- name: Authenticate to Google Cloud
6453
id: gcp-auth
6554
uses: google-github-actions/auth@v3
@@ -80,22 +69,17 @@ jobs:
8069
id: meta
8170
uses: docker/metadata-action@v5
8271
with:
83-
images: ${{ env.DOCKERHUB_IMAGE }}
84-
tags: type=sha,format=short,prefix=
72+
# Use the GAR image base
73+
images: ${{ env.GAR_IMAGE_BASE }}
74+
tags: |
75+
# Only generate the tag based on short commit SHA
76+
type=sha,format=short,prefix=
8577
8678
- name: Pull Docker image from GAR with commit tag
8779
env:
8880
VERSION: ${{ steps.meta.outputs.version }}
8981
run: docker pull ${{ env.GAR_IMAGE_BASE }}:$VERSION
9082

91-
- name: Tag Docker image for Docker Hub with release tag
92-
env:
93-
VERSION: ${{ steps.meta.outputs.version }}
94-
run: docker tag ${{ env.GAR_IMAGE_BASE }}:$VERSION ${{ env.DOCKERHUB_IMAGE }}:${{ env.CURRENT_DATE }}
95-
96-
- name: Push Docker image to Docker Hub with release tag
97-
run: docker push ${{ env.DOCKERHUB_IMAGE }}:${{ env.CURRENT_DATE }}
98-
9983
- name: Tag Docker image for GAR with release tag
10084
env:
10185
VERSION: ${{ steps.meta.outputs.version }}

‎.github/workflows/release_retag.yaml‎

Lines changed: 53 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,83 @@
1-
name: Retag and Push Docker Image on Release
1+
name: Retag and Push GAR Image on Release
22

33
permissions: {}
44

5-
# GH release should always create a tag automatically
65
on:
76
push:
87
tags:
98
- '*'
109

1110
jobs:
12-
retag-and-push:
11+
retag-and-push-gar:
12+
permissions:
13+
contents: "read" # Needed for checkout
14+
id-token: "write" # Needed for GCP auth
15+
packages: "none" # Explicitly disable package permissions
16+
name: Retag and Push GAR image
1317
runs-on: ubuntu-latest
14-
18+
environment: build
19+
env:
20+
GAR_IMAGE_BASE: ${{ vars.GAR_REPO }}/${{ github.event.repository.name }}
1521
steps:
1622
- name: Check out the repo
1723
uses: actions/checkout@v6
1824
with:
19-
persist-credentials: false
25+
persist-credentials: false # Not strictly needed for retagging, but good practice
26+
27+
- name: Authenticate to Google Cloud
28+
id: gcp-auth
29+
uses: google-github-actions/auth@v3
30+
with:
31+
token_format: access_token
32+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
33+
service_account: ${{ vars.GCP_GAR_SERVICE_ACCOUNT }}
2034

21-
- name: Log in to Docker Hub
35+
- name: Login to Artifact Registry
36+
id: gar-login
2237
uses: docker/login-action@v3
2338
with:
24-
username: ${{ secrets.DOCKER_USERNAME }}
25-
password: ${{ secrets.DOCKER_PASSWORD }}
39+
registry: us-docker.pkg.dev
40+
username: oauth2accesstoken
41+
password: ${{ steps.gcp-auth.outputs.access_token }}
2642

2743
- name: Extract metadata (tags, labels) for Docker
2844
id: meta
2945
uses: docker/metadata-action@v5
3046
with:
31-
images: mozilla/blurts-server
32-
tags: type=sha,format=short,prefix=
47+
# Use the GAR image base
48+
images: ${{ env.GAR_IMAGE_BASE }}
49+
tags: |
50+
# Only generate the tag based on short commit SHA
51+
type=sha,format=short,prefix=
52+
53+
- name: Determine Release-tagged image name
54+
id: release_tag_info
55+
run: echo "name=${{ env.GAR_IMAGE_BASE }}:${{ github.ref_name }}" >> $GITHUB_OUTPUT
3356

34-
- name: Pull Docker image with commit tag
57+
- name: Pull Docker image with commit tag from GAR
3558
env:
3659
TAGS: ${{ steps.meta.outputs.tags }}
37-
run: docker pull $TAGS
60+
run: |
61+
echo "Pulling $TAGS"
62+
docker pull $TAGS
3863
3964
- name: Tag Docker image with release tag
4065
env:
4166
TAGS: ${{ steps.meta.outputs.tags }}
42-
run: docker tag $TAGS mozilla/blurts-server:${{ github.ref_name }}
67+
NAME: ${{ steps.release_tag_info.outputs.name }}
68+
run: |
69+
echo "Tagging $TAGS as $NAME"
70+
docker tag $TAGS $NAME
4371
44-
- name: Push Docker image with release tag
45-
run: docker push mozilla/blurts-server:${{ github.ref_name }}
72+
- name: Push Docker image with release tag to GAR
73+
env:
74+
NAME: ${{ steps.release_tag_info.outputs.name }}
75+
run: |
76+
echo "Pushing $NAME"
77+
docker push $NAME
78+
79+
- name: Print Image URI
80+
env:
81+
NAME: ${{ steps.release_tag_info.outputs.name }}
82+
run: |
83+
echo "Retagged and pushed GAR image: $NAME"

0 commit comments

Comments
 (0)