Build fat image #525
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build fat image | |
| on: | |
| workflow_dispatch: | |
| # checkov:skip=CKV_GHA_7: "The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. " | |
| inputs: | |
| ci_cloud: | |
| description: 'Select the CI_CLOUD' | |
| required: true | |
| type: choice | |
| options: | |
| - LEAFCLOUD | |
| - SMS | |
| - ARCUS | |
| cleanup_on_failure: | |
| description: Cleanup Packer resources on failure | |
| type: boolean | |
| required: true | |
| default: true | |
| permissions: | |
| contents: read | |
| packages: write | |
| # To report GitHub Actions status checks | |
| statuses: write | |
| jobs: | |
| openstack: | |
| name: openstack-imagebuild | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.build.image_name }} # to branch/PR + OS | |
| cancel-in-progress: true | |
| runs-on: ubuntu-22.04 | |
| strategy: | |
| fail-fast: false # allow other matrix jobs to continue even if one fails | |
| matrix: # build RL8, RL9 | |
| build: | |
| - image_name: openhpc-RL8 | |
| source_image_name: Rocky-8-GenericCloud-Base-8.10-20240528.0.x86_64.raw | |
| inventory_groups: control,compute,login,update | |
| - image_name: openhpc-RL9 | |
| source_image_name: Rocky-9-GenericCloud-Base-9.6-20250531.0.x86_64.qcow2 | |
| inventory_groups: control,compute,login,update | |
| env: | |
| ANSIBLE_FORCE_COLOR: True | |
| OS_CLOUD: openstack | |
| CI_CLOUD: ${{ github.event.inputs.ci_cloud }} | |
| ARK_PASSWORD: ${{ secrets.ARK_PASSWORD }} | |
| LEAFCLOUD_PULP_PASSWORD: ${{ secrets.LEAFCLOUD_PULP_PASSWORD }} | |
| PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Record settings for CI cloud | |
| run: | | |
| echo CI_CLOUD: ${{ env.CI_CLOUD }} | |
| - name: Setup ssh | |
| run: | | |
| set -x | |
| mkdir ~/.ssh | |
| echo "${{ secrets[format('{0}_SSH_KEY', env.CI_CLOUD)] }}" > ~/.ssh/id_rsa | |
| chmod 0600 ~/.ssh/id_rsa | |
| shell: bash | |
| - name: Add bastion's ssh key to known_hosts | |
| run: cat environments/.stackhpc/bastion_fingerprints >> ~/.ssh/known_hosts | |
| shell: bash | |
| - name: Install ansible etc | |
| run: dev/setup-env.sh | |
| - name: Write clouds.yaml | |
| run: | | |
| mkdir -p ~/.config/openstack/ | |
| echo "${{ secrets[format('{0}_CLOUDS_YAML', env.CI_CLOUD)] }}" > ~/.config/openstack/clouds.yaml | |
| shell: bash | |
| - name: Setup environment | |
| run: | | |
| . venv/bin/activate | |
| . environments/.stackhpc/activate | |
| - name: Build fat image with packer | |
| id: packer_build | |
| run: | | |
| set -x | |
| . venv/bin/activate | |
| . environments/.stackhpc/activate | |
| cd packer/ | |
| packer init . | |
| PACKER_LOG=1 packer build \ | |
| -on-error=${{ github.event.inputs.cleanup_on_failure && 'cleanup' || 'abort' }} \ | |
| -var-file="$PKR_VAR_environment_root/${{ env.CI_CLOUD }}.pkrvars.hcl" \ | |
| -var "source_image_name=${{ matrix.build.source_image_name }}" \ | |
| -var "image_name=${{ matrix.build.image_name }}" \ | |
| -var "inventory_groups=${{ matrix.build.inventory_groups }}" \ | |
| openstack.pkr.hcl | |
| - name: Get created image names from manifest | |
| id: manifest | |
| run: | | |
| . venv/bin/activate | |
| IMAGE_ID=$(jq --raw-output '.builds[-1].artifact_id' packer/packer-manifest.json) | |
| while ! openstack image show -f value -c name "$IMAGE_ID"; do | |
| sleep 5 | |
| done | |
| IMAGE_NAME=$(openstack image show -f value -c name "$IMAGE_ID") | |
| echo "image-name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT" | |
| echo "image-id=$IMAGE_ID" >> "$GITHUB_OUTPUT" | |
| echo "$IMAGE_ID" > image-id.txt | |
| echo "$IMAGE_NAME" > image-name.txt | |
| - name: Make image usable for further builds | |
| run: | | |
| . venv/bin/activate | |
| openstack image unset --property signature_verified "${{ steps.manifest.outputs.image-id }}" || true | |
| - name: Upload manifest artifact | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: image-details-${{ matrix.build.image_name }} | |
| path: | | |
| ./image-id.txt | |
| ./image-name.txt | |
| overwrite: true |