Skip to content

Commit f28a19e

Browse files
pdabelf5pdabelf5
committed
F5 github runners
1 parent 184a12c commit f28a19e

File tree

3 files changed

+250
-117
lines changed

3 files changed

+250
-117
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 8 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@ on:
44
push:
55
branches:
66
- main
7-
tags:
8-
- "v[0-9]+.[0-9]+.[0-9]+"
97
pull_request:
108
branches:
119
- main
@@ -43,7 +41,7 @@ jobs:
4341

4442
build-docker:
4543
name: Build Docker Image
46-
runs-on: ubuntu-24.04
44+
runs-on: ${{ github.event_name == 'pull_request' && 'ubuntu-24.04' || 'ubuntu-24.04-amd64' }}
4745
permissions:
4846
contents: write # for lucacome/draft-release to create/update release draft
4947
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
@@ -59,8 +57,6 @@ jobs:
5957
steps:
6058
- name: Checkout Repository
6159
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
62-
with:
63-
fetch-depth: 0
6460

6561
- name: Setup Golang Environment
6662
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
@@ -125,10 +121,6 @@ jobs:
125121
tags: |
126122
type=edge
127123
type=ref,event=pr
128-
type=schedule
129-
type=semver,pattern={{version}}
130-
type=semver,pattern={{major}}
131-
type=semver,pattern={{major}}.{{minor}}
132124
labels: |
133125
org.opencontainers.image.vendor=NGINX Inc <[email protected]>
134126
env:
@@ -139,51 +131,29 @@ jobs:
139131
with:
140132
minor-label: "enhancement"
141133
major-label: "change"
142-
publish: ${{ github.ref_type == 'tag' }}
134+
publish: false
143135
collapse-after: 30
144136
notes-footer: |
145137
## Upgrade
146138
147139
- Use the {{version}} image from our [DockerHub](https://hub.docker.com/r/nginx/nginx-prometheus-exporter/tags?page=1&ordering=last_updated&name={{version-number}}), [GitHub Container](https://github.com/nginx/nginx-prometheus-exporter/pkgs/container/nginx-prometheus-exporter), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-prometheus-exporter) or [Quay.io](https://quay.io/repository/nginx/nginx-prometheus-exporter/tag/{{version-number}}?tab=tags).
148140
- Download the latest binaries from the [GitHub releases page](https://github.com/nginx/nginx-prometheus-exporter/releases/tag/{{version}}).
149-
- Update to the latest version with `brew upgrade nginx-prometheus-exporter`, `snap refresh nginx-prometheus-exporter` or `scoop update nginx-prometheus-exporter`.
141+
- Update to the latest version with `brew upgrade nginx-prometheus-exporter` or `scoop update nginx-prometheus-exporter`.
150142
151143
## Compatibility
152144
153145
- NGINX 0.1.18 or newer.
154146
- NGINX Plus R19 or newer.
155147
if: github.event_name != 'pull_request'
156148

157-
- name: Download Syft
158-
uses: anchore/sbom-action/download-syft@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # v0.20.6
159-
if: github.ref_type == 'tag'
160-
161-
- name: Install Cosign
162-
uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
163-
if: github.ref_type == 'tag'
164-
165-
- name: Setup Snapcraft
166-
run: |
167-
sudo snap install snapcraft --classic
168-
mkdir -p $HOME/.cache/snapcraft/download
169-
mkdir -p $HOME/.cache/snapcraft/stage-packages
170-
if: github.ref_type == 'tag'
171-
172-
- name: Install Nix
173-
uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
174-
with:
175-
github_access_token: ${{ secrets.GITHUB_TOKEN }}
176-
if: github.ref_type == 'tag'
177-
178149
- name: Run GoReleaser
179150
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
180151
with:
181152
version: v2.12.5 # renovate: datasource=github-tags depName=goreleaser/goreleaser
182-
args: ${{ github.ref_type == 'tag' && 'release' || 'build --snapshot' }} --clean
153+
args: build --snapshot --clean
183154
env:
184155
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
185156
NGINX_GITHUB_TOKEN: ${{ secrets.NGINX_PAT }}
186-
SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAPCRAFT_LOGIN }}
187157

188158
- name: Print NGINX Prometheus Exporter info
189159
run: ./dist/nginx-prometheus-exporter_linux_amd64_v1/nginx-prometheus-exporter --version
@@ -199,7 +169,7 @@ jobs:
199169
tags: ${{ steps.meta.outputs.tags }}
200170
labels: ${{ steps.meta.outputs.labels }}
201171
annotations: ${{ steps.meta.outputs.annotations }}
202-
push: true
172+
push: ${{ github.event_name != 'pull_request' }}
203173
cache-from: type=gha,scope=exporter
204174
cache-to: type=gha,scope=exporter,mode=max
205175
no-cache: ${{ github.event_name != 'pull_request' }}
@@ -211,12 +181,14 @@ jobs:
211181
id: scan
212182
continue-on-error: true
213183
with:
214-
image: localhost:5000/nginx/nginx-prometheus-exporter:${{ steps.meta.outputs.version }}
184+
image: localhost:5000/nginx/nginx-prometheus-exporter:edge
215185
only-fixed: true
216186
add-cpes-if-none: true
187+
if: github.event_name != 'pull_request'
217188

218189
- name: Upload scan result to GitHub Security tab
219190
uses: github/codeql-action/upload-sarif@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6
220191
continue-on-error: true
221192
with:
222193
sarif_file: ${{ steps.scan.outputs.sarif }}
194+
if: github.event_name != 'pull_request'

‎.github/workflows/release.yml‎

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
name: Release NGINX Prometheus Exporter
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
version:
7+
description: 'Release version (e.g. 1.0.0)'
8+
required: true
9+
dry_run:
10+
description: 'Dry run'
11+
required: false
12+
default: false
13+
type: boolean
14+
15+
env:
16+
DOCKER_PLATFORMS: "linux/arm/v5,linux/arm/v6,linux/arm/v7,linux/arm64,linux/amd64,linux/ppc64le,linux/s390x,linux/mips64le,linux/386,linux/riscv64"
17+
18+
concurrency:
19+
group: ${{ github.ref_name }}-release
20+
cancel-in-progress: true
21+
22+
permissions:
23+
contents: read
24+
25+
jobs:
26+
variables:
27+
name: Setup variables
28+
runs-on: ubuntu-24.04
29+
outputs:
30+
tag: ${{ steps.vars.outputs.tag }}
31+
steps:
32+
- name: Checkout Repository
33+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
34+
35+
- name: Set up Go
36+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
37+
with:
38+
go-version: stable
39+
40+
- name: Get version
41+
id: vars
42+
run: echo "tag=${{ github.event.inputs.version }}" >> $GITHUB_OUTPUT
43+
44+
build-docker:
45+
name: Build Docker Image
46+
runs-on: ubuntu-24.04-amd64
47+
permissions:
48+
contents: write # for lucacome/draft-release to create/update release draft
49+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
50+
id-token: write # for OIDC login to AWS ECR and goreleaser/goreleaser-action to sign artifacts
51+
packages: write # for docker/build-push-action to push to GHCR
52+
issues: write # for goreleaser/goreleaser-action to close milestones
53+
services:
54+
registry:
55+
image: registry:3
56+
ports:
57+
- 5000:5000
58+
steps:
59+
- name: Checkout Repository
60+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
61+
with:
62+
fetch-depth: 0
63+
64+
- name: Setup Golang Environment
65+
uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
66+
with:
67+
go-version: stable
68+
69+
- name: Setup QEMU
70+
uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0
71+
72+
- name: Docker Buildx
73+
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
74+
with:
75+
version: latest
76+
driver-opts: network=host
77+
78+
- name: DockerHub Login
79+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
80+
with:
81+
username: ${{ secrets.DOCKER_USERNAME }}
82+
password: ${{ secrets.DOCKER_PASSWORD }}
83+
84+
- name: Login to GitHub Container Registry
85+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
86+
with:
87+
registry: ghcr.io
88+
username: ${{ github.repository_owner }}
89+
password: ${{ secrets.GITHUB_TOKEN }}
90+
91+
- name: Configure AWS Credentials
92+
uses: aws-actions/configure-aws-credentials@00943011d9042930efac3dcd3a170e4273319bc8 # v5.1.0
93+
with:
94+
aws-region: us-east-1
95+
role-to-assume: ${{ secrets.AWS_ROLE_PUBLIC_ECR }}
96+
97+
- name: Login to Public ECR
98+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
99+
with:
100+
registry: public.ecr.aws
101+
102+
- name: Login to Quay.io
103+
uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
104+
with:
105+
registry: quay.io
106+
username: ${{ secrets.QUAY_USERNAME }}
107+
password: ${{ secrets.QUAY_ROBOT_TOKEN }}
108+
109+
- name: Docker meta
110+
id: meta
111+
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
112+
with:
113+
images: |
114+
name=nginx/nginx-prometheus-exporter,enable=true
115+
name=ghcr.io/nginx/nginx-prometheus-exporter,enable=true
116+
name=public.ecr.aws/nginx/nginx-prometheus-exporter,enable=true
117+
name=quay.io/nginx/nginx-prometheus-exporter,enable=true
118+
name=localhost:5000/nginx/nginx-prometheus-exporter
119+
tags: |
120+
type=raw,value=${{ github.event.inputs.version }}
121+
labels: |
122+
org.opencontainers.image.vendor=NGINX Inc <[email protected]>
123+
env:
124+
DOCKER_METADATA_ANNOTATIONS_LEVELS: manifest,index
125+
126+
- name: Create/Update Draft
127+
uses: lucacome/draft-release@fd099feb33710d1fa27b915a08a7acd6a1fb7fd2 # v2.0.0
128+
with:
129+
minor-label: "enhancement"
130+
major-label: "change"
131+
publish: ${{ !github.event.inputs.dry_run }}
132+
collapse-after: 30
133+
notes-footer: |
134+
## Upgrade
135+
136+
- Use the {{version}} image from our [DockerHub](https://hub.docker.com/r/nginx/nginx-prometheus-exporter/tags?page=1&ordering=last_updated&name={{version-number}}), [GitHub Container](https://github.com/nginx/nginx-prometheus-exporter/pkgs/container/nginx-prometheus-exporter), [Amazon ECR Public Gallery](https://gallery.ecr.aws/nginx/nginx-prometheus-exporter) or [Quay.io](https://quay.io/repository/nginx/nginx-prometheus-exporter/tag/{{version-number}}?tab=tags).
137+
- Download the latest binaries from the [GitHub releases page](https://github.com/nginx/nginx-prometheus-exporter/releases/tag/{{version}}).
138+
- Update to the latest version with `brew upgrade nginx-prometheus-exporter` or `scoop update nginx-prometheus-exporter`.
139+
140+
## Compatibility
141+
142+
- NGINX 0.1.18 or newer.
143+
- NGINX Plus R19 or newer.
144+
145+
- name: Download Syft
146+
uses: anchore/sbom-action/download-syft@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # v0.20.6
147+
148+
- name: Install Cosign
149+
uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62 # v3.10.0
150+
151+
- name: Install Nix
152+
uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd # v31
153+
with:
154+
github_access_token: ${{ secrets.GITHUB_TOKEN }}
155+
156+
- name: Run GoReleaser
157+
uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
158+
with:
159+
version: v2.12.5 # renovate: datasource=github-tags depName=goreleaser/goreleaser
160+
args: ${{ github.event.inputs.dry_run && 'build --snapshot' || 'release' }} --clean
161+
env:
162+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
163+
NGINX_GITHUB_TOKEN: ${{ secrets.NGINX_PAT }}
164+
165+
- name: Print NGINX Prometheus Exporter info
166+
run: ./dist/nginx-prometheus-exporter_linux_amd64_v1/nginx-prometheus-exporter --version
167+
continue-on-error: false
168+
169+
- name: Build and Push Docker Image
170+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
171+
with:
172+
file: build/Dockerfile
173+
context: "."
174+
target: goreleaser
175+
platforms: ${{ env.DOCKER_PLATFORMS }}
176+
tags: ${{ steps.meta.outputs.tags }}
177+
labels: ${{ steps.meta.outputs.labels }}
178+
annotations: ${{ steps.meta.outputs.annotations }}
179+
push: ${{ !github.event.inputs.dry_run }}
180+
cache-from: type=gha,scope=exporter
181+
cache-to: type=gha,scope=exporter,mode=max
182+
no-cache: true
183+
provenance: mode=max
184+
sbom: true
185+
186+
- name: Scan image
187+
uses: anchore/scan-action@1638637db639e0ade3258b51db49a9a137574c3e # v6.5.1
188+
id: scan
189+
continue-on-error: true
190+
with:
191+
image: localhost:5000/nginx/nginx-prometheus-exporter:${{ steps.meta.outputs.version }}
192+
only-fixed: true
193+
add-cpes-if-none: true
194+
195+
- name: Upload scan result to GitHub Security tab
196+
uses: github/codeql-action/upload-sarif@64d10c13136e1c5bce3e5fbde8d4906eeaafc885 # v3.30.6
197+
continue-on-error: true
198+
with:
199+
sarif_file: ${{ steps.scan.outputs.sarif }}

0 commit comments

Comments
 (0)