Skip to content

Commit fe9cff7

Browse files
sd109sd109
authored
Merge pull request #3 from stackhpc/feat/workflow-improvements
Make workflows more suitable for downstream use
2 parents c095f49 + 33f65fd commit fe9cff7

File tree

4 files changed

+62
-114
lines changed

4 files changed

+62
-114
lines changed

‎.github/workflows/docker-build-push-backend-container-on-tag.yml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,20 +26,27 @@ jobs:
2626
username: ${{ github.actor }}
2727
password: ${{ secrets.GITHUB_TOKEN }}
2828

29+
- name: Docker meta
30+
id: meta
31+
uses: docker/metadata-action@v5
32+
with:
33+
images: ${{ env.REGISTRY_IMAGE }}
34+
tags: |
35+
type=raw,value=${{ github.ref_name }}
36+
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
37+
2938
- name: Backend Image Docker Build and Push
3039
uses: docker/build-push-action@v5
3140
with:
3241
context: ./backend
3342
file: ./backend/Dockerfile
3443
platforms: linux/amd64,linux/arm64
3544
push: true
36-
tags: |
37-
${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}
38-
${{ env.REGISTRY_IMAGE }}:latest
45+
tags: ${{ steps.meta.outputs.tags }}
3946
build-args: |
4047
DANSWER_VERSION=${{ github.ref_name }}
41-
cache-from: type=gha
42-
cache-to: type=gha,mode=max
48+
cache-from: type=registry,ref=${{ env.REGISTRY_IMAGE }}:buildcache
49+
cache-to: type=registry,ref=${{ env.REGISTRY_IMAGE}}:buildcache,mode=max
4350

4451
- name: Run Trivy vulnerability scanner
4552
uses: aquasecurity/trivy-action@master

‎.github/workflows/docker-build-push-web-container-on-tag.yml‎

Lines changed: 42 additions & 106 deletions
Original file line numberDiff line numberDiff line change
@@ -9,112 +9,48 @@ env:
99
REGISTRY_IMAGE: ghcr.io/stackhpc/danswer/danswer-web-server
1010

1111
jobs:
12-
build:
12+
build-and-push:
1313
runs-on: ubuntu-latest
14-
strategy:
15-
fail-fast: false
16-
matrix:
17-
platform:
18-
- linux/amd64
19-
# - linux/arm64
2014

2115
steps:
22-
- name: Prepare
23-
run: |
24-
platform=${{ matrix.platform }}
25-
echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
26-
27-
- name: Checkout
28-
uses: actions/checkout@v4
29-
30-
- name: Docker meta
31-
id: meta
32-
uses: docker/metadata-action@v5
33-
with:
34-
images: ${{ env.REGISTRY_IMAGE }}
35-
tags: |
36-
type=raw,value=${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}
37-
type=raw,value=${{ env.REGISTRY_IMAGE }}:latest
38-
39-
- name: Set up Docker Buildx
40-
uses: docker/setup-buildx-action@v3
41-
42-
- name: Login to GitHub Container Registry
43-
uses: docker/login-action@v3
44-
with:
45-
registry: ghcr.io
46-
username: ${{ github.actor }}
47-
password: ${{ secrets.GITHUB_TOKEN }}
48-
49-
- name: Build and push by digest
50-
id: build
51-
uses: docker/build-push-action@v5
52-
with:
53-
context: ./web
54-
file: ./web/Dockerfile
55-
platforms: ${{ matrix.platform }}
56-
push: true
57-
build-args: |
58-
DANSWER_VERSION=${{ github.ref_name }}
59-
# needed due to weird interactions with the builds for different platforms
60-
no-cache: true
61-
labels: ${{ steps.meta.outputs.labels }}
62-
outputs: type=image,name=${{ env.REGISTRY_IMAGE }},push-by-digest=true,name-canonical=true,push=true
63-
64-
- name: Export digest
65-
run: |
66-
mkdir -p /tmp/digests
67-
digest="${{ steps.build.outputs.digest }}"
68-
touch "/tmp/digests/${digest#sha256:}"
69-
70-
- name: Upload digest
71-
uses: actions/upload-artifact@v4
72-
with:
73-
name: digests-${{ env.PLATFORM_PAIR }}
74-
path: /tmp/digests/*
75-
if-no-files-found: error
76-
retention-days: 1
77-
78-
merge:
79-
runs-on: ubuntu-latest
80-
needs:
81-
- build
82-
steps:
83-
- name: Download digests
84-
uses: actions/download-artifact@v4
85-
with:
86-
path: /tmp/digests
87-
pattern: digests-*
88-
merge-multiple: true
89-
90-
- name: Set up Docker Buildx
91-
uses: docker/setup-buildx-action@v3
92-
93-
- name: Docker meta
94-
id: meta
95-
uses: docker/metadata-action@v5
96-
with:
97-
images: ${{ env.REGISTRY_IMAGE }}
98-
99-
- name: Login to GitHub Container Registry
100-
uses: docker/login-action@v3
101-
with:
102-
registry: ghcr.io
103-
username: ${{ github.actor }}
104-
password: ${{ secrets.GITHUB_TOKEN }}
105-
106-
- name: Create manifest list and push
107-
working-directory: /tmp/digests
108-
run: |
109-
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
110-
$(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
111-
112-
- name: Inspect image
113-
run: |
114-
docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
115-
116-
- name: Run Trivy vulnerability scanner
117-
uses: aquasecurity/trivy-action@master
118-
with:
119-
image-ref: ${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}
120-
severity: 'CRITICAL,HIGH'
16+
- name: Checkout code
17+
uses: actions/checkout@v4
18+
19+
- name: Set up Docker Buildx
20+
uses: docker/setup-buildx-action@v3
21+
22+
- name: Login to GitHub Container Registry
23+
uses: docker/login-action@v3
24+
with:
25+
registry: ghcr.io
26+
username: ${{ github.actor }}
27+
password: ${{ secrets.GITHUB_TOKEN }}
28+
29+
- name: Docker meta
30+
id: meta
31+
uses: docker/metadata-action@v5
32+
with:
33+
images: ${{ env.REGISTRY_IMAGE }}
34+
tags: |
35+
type=raw,value=${{ github.ref_name }}
36+
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
37+
38+
- name: Web Image Docker Build and Push
39+
uses: docker/build-push-action@v5
40+
with:
41+
context: ./web
42+
file: ./web/Dockerfile
43+
platforms: linux/amd64 #,linux/arm64
44+
push: true
45+
tags: ${{ steps.meta.outputs.tags }}
46+
build-args: |
47+
DANSWER_VERSION=${{ github.ref_name }}
48+
cache-from: type=registry,ref=${{ env.REGISTRY_IMAGE }}:buildcache
49+
cache-to: type=registry,ref=${{ env.REGISTRY_IMAGE}}:buildcache,mode=max
50+
51+
- name: Run Trivy vulnerability scanner
52+
uses: aquasecurity/trivy-action@master
53+
with:
54+
# To run locally: trivy image --severity HIGH,CRITICAL danswer/danswer-web
55+
image-ref: ${{ env.REGISTRY_IMAGE }}:${{ github.ref_name }}
56+
severity: 'CRITICAL,HIGH'

‎.github/workflows/helm-build-push.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,12 @@ jobs:
2222
# We publish our 'release' Semver tags as X.Y.Z-stackhpc.[1-9]+
2323
# so if main branch chart version doesn't match this then abort
2424
- name: Fail on dev chart version
25-
run: yq .version deployment/helm/Chart.yaml | grep "\-stackhpc."
25+
run: yq .version deployment/helm/Chart.yaml | grep "\-stackhpc.[0-9]\+$"
26+
if: ${{ github.ref_name == 'main'}}
27+
28+
# Stable 'release' image tags should be of the form "v<upstream-semver>-stackhpc.X"
29+
- name: Fail on dev image version
30+
run: yq .appVersion deployment/helm/Chart.yaml | grep "^v[0-9]" | grep "\-stackhpc.[0-9]\+$"
2631
if: ${{ github.ref_name == 'main'}}
2732

2833
- name: Configure Git

‎deployment/helm/Chart.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ home: https://www.danswer.ai/
55
sources:
66
- "https://github.com/danswer-ai/danswer"
77
type: application
8-
version: 0.5.10-stackhpc.1
9-
appVersion: "v0.5.10"
8+
version: 0.5.10
9+
appVersion: v0.5.10-stackhpc.1
1010
annotations:
1111
category: Productivity
1212
licenses: MIT

0 commit comments

Comments
 (0)