ci: Move to new artifact upload action

Signed-off-by: Andy Doan <[email protected]>

Author: doanac

.github/workflows/build-daily.yml

@@ -9,7 +9,7 @@ on:
 
 permissions:
   contents: read
-  security-events: read  # This is required to handle authentication to our artifact publishing API
+  id-token: write  # Required by upload-private-artifact-action
 
 jobs:
   build-daily:

.github/workflows/build-on-pr.yml

@@ -5,7 +5,7 @@ on:
 
 permissions:
   contents: read
-  security-events: read  # This is required to handle authentication to our artifact publishing API
+  id-token: write  # Required by upload-private-artifact-action
 
 jobs:
   build-pr:

.github/workflows/build-on-push.yml

@@ -6,7 +6,7 @@ on:
 
 permissions:
   contents: read
-  security-events: read  # This is required to handle authentication to our artifact publishing API
+  id-token: write  # Required by upload-private-artifact-action
 
 jobs:
   build-daily:

.github/workflows/debos.yml

@@ -11,13 +11,7 @@ on:
 # permissions to none
 permissions:
   contents: read
-  security-events: read  # This is required to handle authentication to our artifact publishing API
-
-env:
-  # github runs are only unique per repository and may also be re-run; create a
-  # build id for the current run
-  BUILD_ID: ${{ github.repository }}-${{ github.run_id }}-${{ github.run_attempt }}
-  FILESERVER_URL: https://quic-yocto-fileserver-1029608027416.us-central1.run.app
+  id-token: write  # Required by upload-private-artifact-action
 
 # cancel in progress builds for this workflow triggered by the same ref
 concurrency:
@@ -93,16 +87,11 @@ jobs:
           debos -t u_boot_rb1:rb1-boot.img \
                  debos-recipes/qualcomm-linux-debian-flash.yaml
 
-      - name: Upload artifacts to fileserver space for builds
-        id: upload_artifacts
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Stage build artifacts for publishing
         run: |
           set -ux
-          # python3-requests is used by publish_aritfacts.py
-          apt -y install python3-requests
           # create a directory for the current run
-          export BUILD_DIR="/tmp/${BUILD_ID}"
+          BUILD_DIR="./uploads"
           mkdir -vp "${BUILD_DIR}"
           # copy output files
           cp -av rootfs.tar.gz "${BUILD_DIR}"
@@ -118,7 +107,9 @@ jobs:
               disk-sdcard.img1 \
               disk-sdcard.img2 \
               flash_rb1*
-          # instruct fileserver to publish this directory
-          export URL="${FILESERVER_URL}/${BUILD_ID}/"
-          .github/workflows/publish_artifacts.py
-          echo Image available at: ${URL}
+
+      - name: Upload private artifacts
+        uses: qualcomm-linux/upload-private-artifact-action@v1
+        id: upload_artifacts
+        with:
+          path: ./uploads

.github/workflows/linux.yml

@@ -11,7 +11,7 @@ on:
 # permissions to none
 permissions:
   contents: read
-  security-events: read  # This is required to handle authentication to our artifact publishing API
+  id-token: write  # Required by upload-private-artifact-action
 
 env:
   # where results will be posted/hosted

.github/workflows/publish_artifacts.py

@@ -8,7 +8,7 @@ on:
 # permissions to none
 permissions:
   contents: read
-  security-events: read  # This is required to handle authentication to our artifact publishing API
+  id-token: write  # Required by upload-private-artifact-action
 
 env:
   # where results will be posted/hosted