Skip to content

Commit 71dcffd

Browse files
AlexFenlonAlexFenlon
authored
Use F5 self-hosted runners (#8268)
1 parent 862d367 commit 71dcffd

File tree

9 files changed

+674
-725
lines changed

9 files changed

+674
-725
lines changed

‎.github/actionlint.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ self-hosted-runner:
22
# Labels of self-hosted runner in array of strings.
33
labels:
44
- kic-plus
5+
- ubuntu-24.04-amd64
56
# Configuration variables in array of strings defined in your repository or
67
# organization. `null` means disabling configuration variables check.
78
# Empty array means no configuration variable is allowed.

‎.github/workflows/build-artifacts.yml‎

Lines changed: 185 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,185 @@
1+
name: Build Artifacts
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
tag:
7+
required: true
8+
type: string
9+
go-md5:
10+
required: true
11+
type: string
12+
docker-md5:
13+
required: true
14+
type: string
15+
branch:
16+
required: true
17+
type: string
18+
authenticated:
19+
required: true
20+
type: boolean
21+
force:
22+
description: Always build artifacts
23+
type: boolean
24+
default: false
25+
ic-version:
26+
required: true
27+
type: string
28+
runner:
29+
type: string
30+
default: ubuntu-24.04
31+
go-proxy:
32+
required: true
33+
type: string
34+
go-path:
35+
required: true
36+
type: string
37+
image-matrix-oss:
38+
required: true
39+
type: string
40+
image-matrix-plus:
41+
required: true
42+
type: string
43+
image-matrix-nap:
44+
required: true
45+
type: string
46+
47+
defaults:
48+
run:
49+
shell: bash
50+
51+
permissions:
52+
contents: read
53+
54+
jobs:
55+
binaries:
56+
name: Build Binaries
57+
runs-on: ${{ inputs.runner }}
58+
permissions:
59+
contents: read
60+
id-token: write
61+
steps:
62+
- name: Checkout Repository
63+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
64+
with:
65+
ref: ${{ inputs.branch }}
66+
67+
- name: Setup Golang Environment
68+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
69+
with:
70+
go-version-file: go.mod
71+
if: ${{ inputs.force }}
72+
73+
- name: Setup netrc
74+
run: |
75+
cat <<EOF > $HOME/.netrc
76+
machine azr.artifactory.f5net.com
77+
login ${{ secrets.ARTIFACTORY_USER }}
78+
password ${{ secrets.ARTIFACTORY_TOKEN }}
79+
EOF
80+
chmod 600 $HOME/.netrc
81+
if: ${{ inputs.force || inputs.authenticated == 'true' }}
82+
83+
- name: Build binaries
84+
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
85+
with:
86+
version: latest
87+
args: build --snapshot --clean
88+
env:
89+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
90+
GOPATH: ${{ inputs.go-path }}
91+
GOPROXY: ${{ inputs.go-proxy }}
92+
AWS_PRODUCT_CODE: ${{ secrets.AWS_PRODUCT_CODE }}
93+
AWS_PUB_KEY: ${{ secrets.AWS_PUB_KEY }}
94+
AWS_NAP_DOS_PRODUCT_CODE: ${{ secrets.AWS_NAP_DOS_PRODUCT_CODE }}
95+
AWS_NAP_DOS_PUB_KEY: ${{ secrets.AWS_NAP_DOS_PUB_KEY }}
96+
AWS_NAP_WAF_PRODUCT_CODE: ${{ secrets.AWS_NAP_WAF_PRODUCT_CODE }}
97+
AWS_NAP_WAF_PUB_KEY: ${{ secrets.AWS_NAP_WAF_PUB_KEY }}
98+
AWS_NAP_WAF_DOS_PRODUCT_CODE: ${{ secrets.AWS_NAP_WAF_DOS_PRODUCT_CODE }}
99+
AWS_NAP_WAF_DOS_PUB_KEY: ${{ secrets.AWS_NAP_WAF_DOS_PUB_KEY }}
100+
GORELEASER_CURRENT_TAG: "v${{ inputs.ic-version }}"
101+
if: ${{ inputs.force }}
102+
103+
- name: Store Artifacts in Cache
104+
uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
105+
with:
106+
path: ${{ github.workspace }}/dist
107+
key: nginx-ingress-${{ inputs.go-md5 }}
108+
if: ${{ inputs.force }}
109+
110+
build-docker:
111+
name: Build Docker OSS
112+
needs: [binaries]
113+
strategy:
114+
fail-fast: false
115+
matrix: ${{ fromJSON( inputs.image-matrix-oss ) }}
116+
uses: ./.github/workflows/build-oss.yml
117+
with:
118+
platforms: ${{ matrix.platforms }}
119+
image: ${{ matrix.image }}
120+
go-md5: ${{ inputs.go-md5 }}
121+
base-image-md5: ${{ inputs.docker-md5 }}
122+
authenticated: ${{ inputs.authenticated }}
123+
full-build: ${{ inputs.force }}
124+
tag: ${{ inputs.tag }}
125+
branch: ${{ inputs.branch }}
126+
ic-version: ${{ inputs.ic-version }}
127+
runner: ${{ inputs.runner }}
128+
permissions:
129+
contents: read
130+
actions: read
131+
id-token: write
132+
packages: write
133+
pull-requests: write # for scout report
134+
secrets: inherit
135+
136+
build-docker-plus:
137+
name: Build Docker Plus
138+
needs: [binaries]
139+
strategy:
140+
fail-fast: false
141+
matrix: ${{ fromJSON( inputs.image-matrix-plus ) }}
142+
uses: ./.github/workflows/build-plus.yml
143+
with:
144+
platforms: ${{ matrix.platforms }}
145+
image: ${{ matrix.image }}
146+
target: ${{ matrix.target }}
147+
go-md5: ${{ inputs.go-md5 }}
148+
base-image-md5: ${{ inputs.docker-md5 }}
149+
branch: ${{ inputs.branch }}
150+
tag: ${{ inputs.tag }}
151+
authenticated: ${{ inputs.authenticated }}
152+
full-build: ${{ inputs.force }}
153+
ic-version: ${{ inputs.ic-version }}
154+
runner: ${{ inputs.runner }}
155+
permissions:
156+
contents: read
157+
id-token: write
158+
pull-requests: write # for scout report
159+
secrets: inherit
160+
161+
build-docker-nap:
162+
name: Build Docker NAP
163+
needs: [binaries]
164+
strategy:
165+
fail-fast: false
166+
matrix: ${{ fromJSON( inputs.image-matrix-nap ) }}
167+
uses: ./.github/workflows/build-plus.yml
168+
with:
169+
platforms: ${{ matrix.platforms }}
170+
image: ${{ matrix.image }}
171+
target: ${{ matrix.target }}
172+
go-md5: ${{ inputs.go-md5 }}
173+
base-image-md5: ${{ inputs.docker-md5 }}
174+
branch: ${{ inputs.branch }}
175+
tag: ${{ inputs.tag }}
176+
nap-modules: ${{ matrix.nap_modules }}
177+
authenticated: ${{ inputs.authenticated }}
178+
full-build: ${{ inputs.force }}
179+
ic-version: ${{ inputs.ic-version }}
180+
runner: ${{ inputs.runner }}
181+
permissions:
182+
contents: read
183+
id-token: write # gcr login
184+
pull-requests: write # for scout report
185+
secrets: inherit

‎.github/workflows/build-oss.yml‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,9 @@ on:
3131
ic-version:
3232
required: false
3333
type: string
34+
runner:
35+
type: string
36+
default: ubuntu-24.04
3437

3538
defaults:
3639
run:
@@ -41,7 +44,8 @@ permissions:
4144

4245
jobs:
4346
build:
44-
runs-on: ubuntu-24.04
47+
name: "OSS ${{ inputs.image }} ${{inputs.platforms }}"
48+
runs-on: ${{ inputs.runner }}
4549
permissions:
4650
contents: read # for docker/build-push-action to read repo content
4751
id-token: write # for OIDC login to GCR
@@ -183,15 +187,6 @@ jobs:
183187
mkdir -p "${{ inputs.image }}-results/"
184188
if: ${{ inputs.authenticated && steps.build-push.conclusion == 'success' }}
185189

186-
# - name: Run Trivy vulnerability scanner
187-
# uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
188-
# with:
189-
# image-ref: ${{ steps.meta.outputs.tags }}
190-
# format: "sarif"
191-
# output: "${{ inputs.image }}-results/trivy.sarif"
192-
# ignore-unfixed: "true"
193-
# if: ${{ inputs.authenticated && steps.build-push.conclusion == 'success' }}
194-
195190
- name: DockerHub Login for Docker Scout
196191
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
197192
with:

‎.github/workflows/build-plus.yml‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@ on:
3737
ic-version:
3838
required: false
3939
type: string
40+
runner:
41+
type: string
42+
default: ubuntu-24.04
4043

4144
defaults:
4245
run:
@@ -47,11 +50,12 @@ permissions:
4750

4851
jobs:
4952
build:
53+
name: "${{ contains(inputs.image, 'nap') && 'NAP' || 'Plus' }} ${{ inputs.image }}, ${{ inputs.target }}, ${{inputs.platforms }}, ${{ inputs.nap-modules != '' && inputs.nap-modules || 'plus' }}"
5054
permissions:
5155
contents: read # for docker/build-push-action to read repo content
5256
id-token: write # for OIDC login to AWS
5357
pull-requests: write # for scout report
54-
runs-on: ubuntu-24.04
58+
runs-on: ${{ inputs.runner }}
5559
steps:
5660
- name: Checkout Repository
5761
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -199,15 +203,6 @@ jobs:
199203
mkdir -p "${{ inputs.image }}-results/"
200204
if: ${{ inputs.authenticated && steps.build-push.conclusion == 'success' }}
201205

202-
# - name: Run Trivy vulnerability scanner
203-
# uses: aquasecurity/trivy-action@6e7b7d1fd3e4fef0c5fa8cce1229c54b2c9bd0d8 # 0.24.0
204-
# with:
205-
# image-ref: ${{ steps.meta.outputs.tags }}
206-
# format: "sarif"
207-
# output: "${{ inputs.image }}-results/trivy.sarif"
208-
# ignore-unfixed: "true"
209-
# if: ${{ inputs.authenticated && steps.build-push.conclusion == 'success' }}
210-
211206
- name: DockerHub Login for Docker Scout
212207
uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
213208
with:

0 commit comments

Comments
 (0)