Skip to content

Commit ea7f467

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #566 from jstourac/fixDigestUpdaterRegexp
[GHA] digest updater workflow fixes and updates
2 parents 6bdc233 + 0c6aecc commit ea7f467

File tree

3 files changed

+94
-85
lines changed

3 files changed

+94
-85
lines changed

‎.github/workflows/notebooks-digest-updater-upstream.yaml

Lines changed: 91 additions & 82 deletions
Original file line numberDiff line numberDiff line change
@@ -67,57 +67,61 @@ jobs:
6767

6868
- name: Update the param.env file
6969
run: |
70-
echo Latest commit is: ${{ steps.hash-n.outputs.HASH_N }} on ${{ env.RELEASE_VERSION_N}}
71-
IMAGES=("odh-minimal-notebook-image-n"
72-
"odh-minimal-gpu-notebook-image-n"
73-
"odh-pytorch-gpu-notebook-image-n"
74-
"odh-generic-data-science-notebook-image-n"
75-
"odh-tensorflow-gpu-notebook-image-n"
76-
"odh-trustyai-notebook-image-n"
77-
"odh-codeserver-notebook-image-n"
78-
"odh-rstudio-notebook-image-n"
79-
"odh-rstudio-gpu-notebook-image-n")
80-
81-
for ((i=0;i<${#IMAGES[@]};++i)); do
82-
image=${IMAGES[$i]}
83-
echo "CHECKING: " $image
84-
img=$(cat manifests/base/params.env | grep -E "${image}=" | cut -d '=' -f2)
85-
registry=$(echo $img | cut -d '@' -f1)
86-
src_tag=$(skopeo inspect docker://$img | jq '.Env[] | select(startswith("OPENSHIFT_BUILD_NAME=")) | split("=")[1]' | tr -d '"' | sed 's/-amd64$//')
87-
regex="$src_tag-${{ env.RELEASE_VERSION_N}}-\d+-${{ steps.hash-n.outputs.HASH_N }}"
88-
latest_tag=$(skopeo inspect docker://$img | jq -r --arg regex "$regex" '.RepoTags | map(select(. | test($regex))) | .[0]')
89-
digest=$(skopeo inspect docker://$registry:$latest_tag | jq .Digest | tr -d '"')
90-
output=$registry@$digest
91-
echo "NEW:" $output
92-
sed -i "s|${image}=.*|${image}=$output|" manifests/base/params.env
70+
PARAMS_ENV_PATH="manifests/base/params.env"
71+
72+
echo Latest commit is: ${{ steps.hash-n.outputs.HASH_N }} on ${{ env.RELEASE_VERSION_N }}
73+
74+
# Get the complete list of images N-version to update
75+
IMAGES=$(cat "${PARAMS_ENV_PATH}" | grep "\-n=" | cut -d "=" -f 1)
76+
77+
for image in ${IMAGES}; do
78+
echo "CHECKING: '${image}'"
79+
img=$(grep -E "${image}=" "${PARAMS_ENV_PATH}" | cut -d '=' -f2)
80+
registry=$(echo "${img}" | cut -d '@' -f1)
81+
82+
skopeo_metadata=$(skopeo inspect --retry-times 3 "docker://${img}")
83+
84+
src_tag=$(echo "${skopeo_metadata}" | jq '.Env[] | select(startswith("OPENSHIFT_BUILD_NAME=")) | split("=")[1]' | tr -d '"' | sed 's/-amd64$//')
85+
regex="^$src_tag-${{ env.RELEASE_VERSION_N}}-\d+-${{ steps.hash-n.outputs.HASH_N }}\$"
86+
latest_tag=$(echo "${skopeo_metadata}" | jq -r --arg regex "$regex" '.RepoTags | map(select(. | test($regex))) | .[0]')
87+
# use `--no-tags` for skopeo once available in newer version
88+
digest=$(skopeo inspect --retry-times 3 "docker://${registry}:${latest_tag}" | jq .Digest | tr -d '"')
89+
output="${registry}@${digest}"
90+
echo "NEW: ${output}"
91+
sed -i "s|${image}=.*|${image}=${output}|" "${PARAMS_ENV_PATH}"
9392
done
93+
9494
if [[ $(git status --porcelain | wc -l) -gt 0 ]]; then
95-
git fetch origin ${{ env.DIGEST_UPDATER_BRANCH }} && git pull origin ${{ env.DIGEST_UPDATER_BRANCH }} && git add manifests/base/params.env && git commit -m "Update images for release N via ${{ env.DIGEST_UPDATER_BRANCH }} GitHub action" && git push origin ${{ env.DIGEST_UPDATER_BRANCH }}
95+
git fetch origin ${{ env.DIGEST_UPDATER_BRANCH }} && \
96+
git pull origin ${{ env.DIGEST_UPDATER_BRANCH }} && \
97+
git add "${PARAMS_ENV_PATH}" && \
98+
git commit -m "Update images for release N via ${{ env.DIGEST_UPDATER_BRANCH }} GitHub action" && \
99+
git push origin ${{ env.DIGEST_UPDATER_BRANCH }}
96100
else
97-
echo "There were no changes detected in the images for the ${{ env.RELEASE_VERSION_N}}"
101+
echo "There were no changes detected in the images for the ${{ env.RELEASE_VERSION_N }}"
98102
fi
99103
100104
- name: Update the commit.env file
101105
run: |
102-
echo Latest commit is: ${{ steps.hash-n.outputs.HASH_N }} on ${{ env.RELEASE_VERSION_N}}
103-
COMMIT=("odh-minimal-notebook-image-commit-n"
104-
"odh-minimal-gpu-notebook-image-commit-n"
105-
"odh-pytorch-gpu-notebook-image-commit-n"
106-
"odh-generic-data-science-notebook-image-commit-n"
107-
"odh-tensorflow-gpu-notebook-image-commit-n"
108-
"odh-trustyai-notebook-image-commit-n"
109-
"odh-codeserver-notebook-image-commit-n"
110-
"odh-rstudio-notebook-image-commit-n"
111-
"odh-rstudio-gpu-notebook-image-commit-n")
112-
113-
for val in "${COMMIT[@]}"; do
114-
echo $val
115-
sed -i "s|${val}=.*|${val}=${{ steps.hash-n.outputs.HASH_N }}|" manifests/base/commit.env
106+
COMMIT_ENV_PATH="manifests/base/commit.env"
107+
108+
echo Latest commit is: ${{ steps.hash-n.outputs.HASH_N }} on ${{ env.RELEASE_VERSION_N }}
109+
# Get the complete list of images N-1-version to update
110+
COMMIT=$(grep "\-n=" "${COMMIT_ENV_PATH}" | cut -d "=" -f 1)
111+
112+
for val in ${COMMIT}; do
113+
echo "${val}"
114+
sed -i "s|${val}=.*|${val}=${{ steps.hash-n.outputs.HASH_N }}|" "${COMMIT_ENV_PATH}"
116115
done
116+
117117
if [[ $(git status --porcelain | wc -l) -gt 0 ]]; then
118-
git fetch origin ${{ env.DIGEST_UPDATER_BRANCH }} && git pull origin ${{ env.DIGEST_UPDATER_BRANCH }} && git add manifests/base/commit.env && git commit -m "Update image commits for release N via ${{ env.DIGEST_UPDATER_BRANCH }} GitHub action" && git push origin ${{ env.DIGEST_UPDATER_BRANCH }}
118+
git fetch origin ${{ env.DIGEST_UPDATER_BRANCH }} && \
119+
git pull origin ${{ env.DIGEST_UPDATER_BRANCH }} && \
120+
git add "${COMMIT_ENV_PATH}" && \
121+
git commit -m "Update image commits for release N via ${{ env.DIGEST_UPDATER_BRANCH }} GitHub action" && \
122+
git push origin ${{ env.DIGEST_UPDATER_BRANCH }}
119123
else
120-
echo "There were no changes detected in the images for the ${{ env.RELEASE_VERSION_N}}"
124+
echo "There were no changes detected in the images for the ${{ env.RELEASE_VERSION_N }}"
121125
fi
122126
123127
update-n-1-version:
@@ -147,56 +151,61 @@ jobs:
147151

148152
- name: Update the param.env file
149153
run: |
150-
echo Latest commit is: ${{ steps.hash-n-1.outputs.HASH_N_1 }} on ${{ env.RELEASE_VERSION_N_1}}
151-
IMAGES=("odh-minimal-notebook-image-n-1"
152-
"odh-minimal-gpu-notebook-image-n-1"
153-
"odh-pytorch-gpu-notebook-image-n-1"
154-
"odh-generic-data-science-notebook-image-n-1"
155-
"odh-tensorflow-gpu-notebook-image-n-1"
156-
"odh-trustyai-notebook-image-n-1"
157-
"odh-codeserver-notebook-image-n-1"
158-
"odh-rstudio-notebook-image-n-1"
159-
"odh-rstudio-gpu-notebook-image-n-1")
160-
161-
for ((i=0;i<${#IMAGES[@]};++i)); do
162-
image=${IMAGES[$i]}
163-
echo "CHECKING: " $image
164-
img=$(cat manifests/base/params.env | grep -E "${image}=" | cut -d '=' -f2)
165-
registry=$(echo $img | cut -d '@' -f1)
166-
src_tag=$(skopeo inspect docker://$img | jq '.Env[] | select(startswith("OPENSHIFT_BUILD_NAME=")) | split("=")[1]' | tr -d '"' | sed 's/-amd64$//')
167-
regex="$src_tag-${{ env.RELEASE_VERSION_N_1}}-\d+-${{ steps.hash-n-1.outputs.HASH_N_1 }}"
168-
latest_tag=$(skopeo inspect docker://$img | jq -r --arg regex "$regex" '.RepoTags | map(select(. | test($regex))) | .[0]')
169-
digest=$(skopeo inspect docker://$registry:$latest_tag | jq .Digest | tr -d '"')
170-
output=$registry@$digest
171-
echo "NEW:" $output
172-
sed -i "s|${image}=.*|${image}=$output|" manifests/base/params.env
154+
PARAMS_ENV_PATH="manifests/base/params.env"
155+
156+
echo Latest commit is: ${{ steps.hash-n-1.outputs.HASH_N_1 }} on ${{ env.RELEASE_VERSION_N_1 }}
157+
158+
# Get the complete list of images N-1-version to update
159+
IMAGES=$(cat "${PARAMS_ENV_PATH}" | grep "\-n-1=" | cut -d "=" -f 1)
160+
161+
for image in ${IMAGES}; do
162+
echo "CHECKING: '${image}'"
163+
img=$(grep -E "${image}=" "${PARAMS_ENV_PATH}" | cut -d '=' -f2)
164+
registry=$(echo "${img}" | cut -d '@' -f1)
165+
166+
skopeo_metadata=$(skopeo inspect --retry-times 3 "docker://${img}")
167+
168+
src_tag=$(echo "${skopeo_metadata}" | jq '.Env[] | select(startswith("OPENSHIFT_BUILD_NAME=")) | split("=")[1]' | tr -d '"' | sed 's/-amd64$//')
169+
regex="^$src_tag-${{ env.RELEASE_VERSION_N_1}}-\d+-${{ steps.hash-n-1.outputs.HASH_N_1 }}\$"
170+
latest_tag=$(echo "${skopeo_metadata}" | jq -r --arg regex "$regex" '.RepoTags | map(select(. | test($regex))) | .[0]')
171+
# use `--no-tags` for skopeo once available in newer version
172+
digest=$(skopeo inspect --retry-times 3 "docker://${registry}:${latest_tag}" | jq .Digest | tr -d '"')
173+
output="${registry}@${digest}"
174+
echo "NEW: ${output}"
175+
sed -i "s|${image}=.*|${image}=${output}|" "${PARAMS_ENV_PATH}"
173176
done
177+
174178
if [[ $(git status --porcelain | wc -l) -gt 0 ]]; then
175-
git fetch origin ${{ env.DIGEST_UPDATER_BRANCH }} && git pull origin ${{ env.DIGEST_UPDATER_BRANCH }} && git add manifests/base/params.env && git commit -m "Update images for release N-1 via ${{ env.DIGEST_UPDATER_BRANCH }} GitHub action" && git push origin ${{ env.DIGEST_UPDATER_BRANCH }}
179+
git fetch origin ${{ env.DIGEST_UPDATER_BRANCH }} && \
180+
git pull origin ${{ env.DIGEST_UPDATER_BRANCH }} && \
181+
git add "${PARAMS_ENV_PATH}" && \
182+
git commit -m "Update images for release N-1 via ${{ env.DIGEST_UPDATER_BRANCH }} GitHub action" && \
183+
git push origin ${{ env.DIGEST_UPDATER_BRANCH }}
176184
else
177-
echo "There were no changes detected in the images for the ${{ env.RELEASE_VERSION_N_1}}"
185+
echo "There were no changes detected in the images for the ${{ env.RELEASE_VERSION_N_1 }}"
178186
fi
187+
179188
- name: Update the commit.env file
180189
run: |
181-
echo Latest commit is: ${{ steps.hash-n-1.outputs.HASH_N_1 }} on ${{ env.RELEASE_VERSION_N_1}}
182-
COMMIT=("odh-minimal-notebook-image-commit-n-1"
183-
"odh-minimal-gpu-notebook-image-commit-n-1"
184-
"odh-pytorch-gpu-notebook-image-commit-n-1"
185-
"odh-generic-data-science-notebook-image-commit-n-1"
186-
"odh-tensorflow-gpu-notebook-image-commit-n-1"
187-
"odh-trustyai-notebook-image-commit-n-1"
188-
"odh-codeserver-notebook-image-commit-n-1"
189-
"odh-rstudio-notebook-image-commit-n-1"
190-
"odh-rstudio-gpu-notebook-image-commit-n-1")
191-
192-
for val in "${COMMIT[@]}"; do
193-
echo $val
194-
sed -i "s|${val}=.*|${val}=${{ steps.hash-n-1.outputs.HASH_N_1 }}|" manifests/base/commit.env
190+
COMMIT_ENV_PATH="manifests/base/commit.env"
191+
192+
echo Latest commit is: ${{ steps.hash-n-1.outputs.HASH_N_1 }} on ${{ env.RELEASE_VERSION_N_1 }}
193+
# Get the complete list of images N-1-version to update
194+
COMMIT=$(grep "\-n-1=" "${COMMIT_ENV_PATH}" | cut -d "=" -f 1)
195+
196+
for val in ${COMMIT}; do
197+
echo "${val}"
198+
sed -i "s|${val}=.*|${val}=${{ steps.hash-n-1.outputs.HASH_N_1 }}|" "${COMMIT_ENV_PATH}"
195199
done
200+
196201
if [[ $(git status --porcelain | wc -l) -gt 0 ]]; then
197-
git fetch origin ${{ env.DIGEST_UPDATER_BRANCH }} && git pull origin ${{ env.DIGEST_UPDATER_BRANCH }} && git add manifests/base/commit.env && git commit -m "Update image commits for release N via ${{ env.DIGEST_UPDATER_BRANCH }} GitHub action" && git push origin ${{ env.DIGEST_UPDATER_BRANCH }}
202+
git fetch origin ${{ env.DIGEST_UPDATER_BRANCH }} && \
203+
git pull origin ${{ env.DIGEST_UPDATER_BRANCH }} && \
204+
git add "${COMMIT_ENV_PATH}" && \
205+
git commit -m "Update image commits for release N via ${{ env.DIGEST_UPDATER_BRANCH }} GitHub action" && \
206+
git push origin ${{ env.DIGEST_UPDATER_BRANCH }}
198207
else
199-
echo "There were no changes detected in the images for the ${{ env.RELEASE_VERSION_N}}"
208+
echo "There were no changes detected in the images for the ${{ env.RELEASE_VERSION_N }}"
200209
fi
201210
202211
open-pull-request:

‎.github/workflows/runtimes-digest-updater-upstream.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ jobs:
9292
name="minimal-$name"
9393
fi
9494
registry=$(echo $img | cut -d '@' -f1)
95-
regex="runtime-$name-$py_version-${{ env.RELEASE_VERSION_N}}-\d+-${{ steps.hash-n.outputs.HASH_N }}"
95+
regex="^runtime-$name-$py_version-${{ env.RELEASE_VERSION_N}}-\d+-${{ steps.hash-n.outputs.HASH_N }}\$"
9696
echo "CHECKING: " $regex
9797
latest_tag=$(skopeo inspect docker://$img | jq -r --arg regex "$regex" '.RepoTags | map(select(. | test($regex))) | .[0]')
9898
digest=$(skopeo inspect docker://$registry:$latest_tag | jq .Digest | tr -d '"')

‎ci/security-scan/quay_security_analysis.py

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,9 +81,9 @@ def process_image(image, commit_id_path, RELEASE_VERSION_N, HASH_N):
8181
regex = ""
8282

8383
if RELEASE_VERSION_N == "":
84-
regex = f"{src_tag}-(\\d+-)?{HASH_N}"
84+
regex = f"^{src_tag}-(\\d+-)?{HASH_N}$"
8585
else:
86-
regex = f"{src_tag}-{RELEASE_VERSION_N}-\\d+-{HASH_N}"
86+
regex = f"^{src_tag}-{RELEASE_VERSION_N}-\\d+-{HASH_N}$"
8787

8888
latest_tag_cmd = f'skopeo inspect docker://{img} | jq -r --arg regex "{regex}" \'.RepoTags | map(select(. | test($regex))) | .[0]\''
8989
latest_tag = subprocess.check_output(latest_tag_cmd, shell=True, text=True).strip()

0 commit comments

Comments
 (0)