Skip to content

Commit 6bffdf7

Browse files
bertiethorpebertiethorpe
committed
add final nightlybuilds workflow
1 parent 5c13b41 commit 6bffdf7

File tree

1 file changed

+257
-0
lines changed

1 file changed

+257
-0
lines changed

‎.github/workflows/nightlybuild.yml‎

Lines changed: 257 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,257 @@
1+
name: Build nightly image
2+
on:
3+
workflow_dispatch:
4+
inputs:
5+
ci_cloud:
6+
description: 'Select the CI_CLOUD'
7+
required: true
8+
type: choice
9+
options:
10+
- LEAFCLOUD
11+
- SMS
12+
- ARCUS
13+
schedule:
14+
- cron: '0 0 * * *' # Run at midnight
15+
16+
jobs:
17+
openstack:
18+
name: openstack-imagebuild
19+
concurrency:
20+
group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.os_version }}-${{ matrix.build }} # to branch/PR + OS + build
21+
cancel-in-progress: true
22+
runs-on: ubuntu-22.04
23+
strategy:
24+
fail-fast: false # allow other matrix jobs to continue even if one fails
25+
matrix: # build RL8+OFED, RL9+OFED, RL9+OFED+CUDA versions
26+
os_version:
27+
- RL8
28+
- RL9
29+
build:
30+
- openstack.rocky-latest
31+
- openstack.rocky-latest-cuda
32+
exclude:
33+
- os_version: RL8
34+
build: openstack.rocky-latest-cuda
35+
36+
env:
37+
ANSIBLE_FORCE_COLOR: True
38+
OS_CLOUD: openstack
39+
CI_CLOUD: ${{ github.event.inputs.ci_cloud || vars.CI_CLOUD }}
40+
steps:
41+
- uses: actions/checkout@v2
42+
43+
- name: Record settings for CI cloud
44+
run: |
45+
echo CI_CLOUD: ${{ env.CI_CLOUD }}
46+
47+
- name: Setup ssh
48+
run: |
49+
set -x
50+
mkdir ~/.ssh
51+
echo "${{ secrets[format('{0}_SSH_KEY', env.CI_CLOUD)] }}" > ~/.ssh/id_rsa
52+
chmod 0600 ~/.ssh/id_rsa
53+
shell: bash
54+
55+
- name: Add bastion's ssh key to known_hosts
56+
run: cat environments/.stackhpc/bastion_fingerprints >> ~/.ssh/known_hosts
57+
shell: bash
58+
59+
- name: Install ansible etc
60+
run: dev/setup-env.sh
61+
62+
- name: Write clouds.yaml
63+
run: |
64+
mkdir -p ~/.config/openstack/
65+
echo "${{ secrets[format('{0}_CLOUDS_YAML', env.CI_CLOUD)] }}" > ~/.config/openstack/clouds.yaml
66+
shell: bash
67+
68+
- name: Setup environment
69+
run: |
70+
. venv/bin/activate
71+
. environments/.stackhpc/activate
72+
73+
- name: Build fat image with packer
74+
id: packer_build
75+
run: |
76+
set -x
77+
. venv/bin/activate
78+
. environments/.stackhpc/activate
79+
cd packer/
80+
packer init .
81+
82+
PACKER_LOG=1 packer build \
83+
-on-error=${{ vars.PACKER_ON_ERROR }} \
84+
-only=${{ matrix.build }} \
85+
-var-file=$PKR_VAR_environment_root/${{ env.CI_CLOUD }}.pkrvars.hcl \
86+
openstack.pkr.hcl
87+
88+
env:
89+
PKR_VAR_os_version: ${{ matrix.os_version }}
90+
91+
- name: Get created image names from manifest
92+
id: manifest
93+
run: |
94+
. venv/bin/activate
95+
IMAGE_ID=$(jq --raw-output '.builds[-1].artifact_id' packer/packer-manifest.json)
96+
while ! openstack image show -f value -c name $IMAGE_ID; do
97+
sleep 5
98+
done
99+
IMAGE_NAME=$(openstack image show -f value -c name $IMAGE_ID)
100+
echo "image-name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
101+
echo "image-id=$IMAGE_ID" >> "$GITHUB_OUTPUT"
102+
103+
- name: Download image
104+
run: |
105+
. venv/bin/activate
106+
sudo mkdir /mnt/images
107+
sudo chmod 777 /mnt/images
108+
openstack image unset --property signature_verified "${{ steps.manifest.outputs.image-id }}"
109+
openstack image save --file /mnt/images/${{ steps.manifest.outputs.image-name }}.qcow2 ${{ steps.manifest.outputs.image-id }}
110+
111+
- name: Set up QEMU
112+
uses: docker/setup-qemu-action@v3
113+
114+
- name: install libguestfs
115+
run: |
116+
sudo apt -y update
117+
sudo apt -y install libguestfs-tools
118+
119+
- name: mkdir for mount
120+
run: sudo mkdir -p './${{ steps.manifest.outputs.image-name }}'
121+
122+
- name: mount qcow2 file
123+
run: sudo guestmount -a /mnt/images/${{ steps.manifest.outputs.image-name }}.qcow2 -i --ro -o allow_other './${{ steps.manifest.outputs.image-name }}'
124+
125+
- name: Run Trivy vulnerability scanner
126+
uses: aquasecurity/[email protected]
127+
with:
128+
scan-type: fs
129+
scan-ref: "${{ steps.manifest.outputs.image-name }}"
130+
scanners: "vuln"
131+
format: sarif
132+
output: "${{ steps.manifest.outputs.image-name }}.sarif"
133+
# turn off secret scanning to speed things up
134+
env:
135+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
136+
137+
- name: Upload Trivy scan results to GitHub Security tab
138+
uses: github/codeql-action/upload-sarif@v3
139+
with:
140+
sarif_file: "${{ steps.manifest.outputs.image-name }}.sarif"
141+
category: "${{ matrix.os_version }}-${{ matrix.build }}"
142+
143+
- name: Fail if scan has CRITICAL vulnerabilities
144+
uses: aquasecurity/[email protected]
145+
with:
146+
scan-type: fs
147+
scan-ref: "${{ steps.manifest.outputs.image-name }}"
148+
scanners: "vuln"
149+
format: table
150+
exit-code: '1'
151+
severity: 'CRITICAL'
152+
ignore-unfixed: true
153+
env:
154+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
155+
156+
- name: Delete new image if Trivy scan fails
157+
if: failure() && steps.packer_build.outcome == 'success' # Runs if the Trivy scan found crit vulnerabilities or failed
158+
run: |
159+
. venv/bin/activate
160+
echo "Deleting new image due to critical vulnerabilities..."
161+
openstack image delete "${{ steps.manifest.outputs.image-id }}"
162+
163+
- name: Delete old latest image
164+
if: success() # Runs only if Trivy scan passed
165+
run: |
166+
. venv/bin/activate
167+
IMAGE_COUNT=$(openstack image list --name ${{ steps.manifest.outputs.image-name }} -f value -c ID | wc -l)
168+
if [ "$IMAGE_COUNT" -gt 1 ]; then
169+
OLD_IMAGE_ID=$(openstack image list --sort created_at:asc --name "${{ steps.manifest.outputs.image-name }}" -f value -c ID | head -n 1)
170+
echo "Deleting old image ID: $OLD_IMAGE_ID"
171+
openstack image delete "$OLD_IMAGE_ID"
172+
else
173+
echo "Only one image exists, skipping deletion."
174+
fi
175+
176+
upload:
177+
name: upload-nightly-targets
178+
needs: openstack
179+
concurrency:
180+
group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.os_version }}-${{ matrix.image }}-${{ matrix.target_cloud }}
181+
cancel-in-progress: true
182+
runs-on: ubuntu-22.04
183+
strategy:
184+
fail-fast: false
185+
matrix:
186+
target_cloud:
187+
- LEAFCLOUD
188+
- SMS
189+
- ARCUS
190+
os_version:
191+
- RL8
192+
- RL9
193+
image:
194+
- rocky-latest
195+
- rocky-latest-cuda
196+
exclude:
197+
- os_version: RL8
198+
image: rocky-latest-cuda
199+
- target_cloud: LEAFCLOUD
200+
env:
201+
OS_CLOUD: openstack
202+
SOURCE_CLOUD: ${{ github.event.inputs.ci_cloud || vars.CI_CLOUD }}
203+
TARGET_CLOUD: ${{ matrix.target_cloud }}
204+
IMAGE_NAME: "${{ matrix.image }}-${{ matrix.os_version }}"
205+
steps:
206+
- uses: actions/checkout@v2
207+
208+
- name: Record settings for CI cloud
209+
run: |
210+
echo SOURCE_CLOUD: ${{ env.SOURCE_CLOUD }}
211+
echo TARGET_CLOUD: ${{ env.TARGET_CLOUD }}
212+
213+
- name: Install openstackclient
214+
run: |
215+
python3 -m venv venv
216+
. venv/bin/activate
217+
pip install -U pip
218+
pip install $(grep -o 'python-openstackclient[><=0-9\.]*' requirements.txt)
219+
shell: bash
220+
221+
- name: Write clouds.yaml
222+
run: |
223+
mkdir -p ~/.config/openstack/
224+
echo "${{ secrets[format('{0}_CLOUDS_YAML', env.SOURCE_CLOUD)] }}" > ~/.config/openstack/source_clouds.yaml
225+
echo "${{ secrets[format('{0}_CLOUDS_YAML', env.TARGET_CLOUD)] }}" > ~/.config/openstack/target_clouds.yaml
226+
shell: bash
227+
228+
- name: Download source image
229+
run: |
230+
. venv/bin/activate
231+
export OS_CLIENT_CONFIG_FILE=~/.config/openstack/source_clouds.yaml
232+
openstack image save --file ${{ env.IMAGE_NAME }} ${{ env.IMAGE_NAME }}
233+
shell: bash
234+
235+
- name: Upload to target cloud
236+
run: |
237+
. venv/bin/activate
238+
export OS_CLIENT_CONFIG_FILE=~/.config/openstack/target_clouds.yaml
239+
240+
openstack image create "${{ env.IMAGE_NAME }}" \
241+
--file "${{ env.IMAGE_NAME }}" \
242+
--disk-format qcow2 \
243+
shell: bash
244+
245+
- name: Delete old latest image from target cloud
246+
run: |
247+
. venv/bin/activate
248+
export OS_CLIENT_CONFIG_FILE=~/.config/openstack/target_clouds.yaml
249+
250+
IMAGE_COUNT=$(openstack image list --name ${{ env.IMAGE_NAME }} -f value -c ID | wc -l)
251+
if [ "$IMAGE_COUNT" -gt 1 ]; then
252+
OLD_IMAGE_ID=$(openstack image list --sort created_at:asc --name "${{ env.IMAGE_NAME }}" -f value -c ID | head -n 1)
253+
openstack image delete "$OLD_IMAGE_ID"
254+
else
255+
echo "Only one image exists, skipping deletion."
256+
fi
257+
shell: bash

0 commit comments

Comments
 (0)