Skip to content

Commit 8432172

Browse files
samrosesamrose
committed
feat: nix-ami-changes
1 parent 0d98728 commit 8432172

File tree

126 files changed

+7298
-22
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

126 files changed

+7298
-22
lines changed

‎.github/workflows/ami-release-nix.yml

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
name: Release AMI Nix
2+
3+
on:
4+
push:
5+
branches:
6+
- sam/2-stage-ami-nix
7+
paths:
8+
- '.github/workflows/ami-release-nix.yml'
9+
- 'common-nix.vars.pkr.hcl'
10+
workflow_dispatch:
11+
12+
jobs:
13+
build:
14+
strategy:
15+
matrix:
16+
include:
17+
- runner: arm-runner
18+
arch: arm64
19+
ubuntu_release: focal
20+
ubuntu_version: 20.04
21+
mcpu: neoverse-n1
22+
runs-on: ${{ matrix.runner }}
23+
timeout-minutes: 150
24+
permissions:
25+
contents: write
26+
packages: write
27+
id-token: write
28+
29+
steps:
30+
- name: Checkout Repo
31+
uses: actions/checkout@v3
32+
33+
- name: Run checks if triggered manually
34+
if: ${{ github.event_name == 'workflow_dispatch' }}
35+
# Update `ci.yaml` too if changing constraints.
36+
run: |
37+
SUFFIX=$(sed -E 's/postgres-version = "[0-9\.]+(.*)"/\1/g' common-nix.vars.pkr.hcl)
38+
if [[ -z $SUFFIX ]] ; then
39+
echo "Version must include non-numeric characters if built manually."
40+
exit 1
41+
fi
42+
43+
# extensions are build in nix prior to this step
44+
# so we can just use the binaries from the nix store
45+
# for postgres, extensions and wrappers
46+
47+
- name: Build AMI stage 1
48+
run: |
49+
packer init amazon-arm64-nix.pkr.hcl
50+
GIT_SHA=${{github.sha}}
51+
packer build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" -var "ansible_arguments=" amazon-arm64-nix.pkr.hcl
52+
53+
- name: Build AMI stage 2
54+
run: |
55+
packer init stage2-nix-psql.pkr.hcl
56+
GIT_SHA=${{github.sha}}
57+
packer build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" stage2-nix-psql.pkr.hcl
58+
59+
- name: Grab release version
60+
id: process_release_version
61+
run: |
62+
VERSION=$(sed -e 's/postgres-version = "\(.*\)"/\1/g' common-nix.vars.pkr.hcl)
63+
echo "version=$VERSION" >> "$GITHUB_OUTPUT"
64+
65+
- name: configure aws credentials - staging
66+
uses: aws-actions/configure-aws-credentials@v4
67+
with:
68+
role-to-assume: ${{ secrets.DEV_AWS_ROLE }}
69+
aws-region: "us-east-1"
70+
71+
- name: Upload software manifest to s3 staging
72+
run: |
73+
cd ansible
74+
ansible-playbook -i localhost \
75+
-e "ami_release_version=${{ steps.process_release_version.outputs.version }}" \
76+
-e "internal_artifacts_bucket=${{ secrets.ARTIFACTS_BUCKET }}" \
77+
manifest-playbook.yml
78+
79+
80+
#Our self hosted github runner already has permissions to publish images
81+
#but they're limited to only that;
82+
#so if we want s3 access we'll need to config credentials with the below steps
83+
# (which overwrites existing perms) after the ami build
84+
85+
- name: configure aws credentials - prod
86+
uses: aws-actions/configure-aws-credentials@v4
87+
with:
88+
role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
89+
aws-region: "us-east-1"
90+
91+
- name: Upload software manifest to s3 prod
92+
run: |
93+
cd ansible
94+
ansible-playbook -i localhost \
95+
-e "ami_release_version=${{ steps.process_release_version.outputs.version }}" \
96+
-e "internal_artifacts_bucket=${{ secrets.PROD_ARTIFACTS_BUCKET }}" \
97+
manifest-playbook.yml
98+
99+
100+
101+
- name: Create release
102+
uses: softprops/action-gh-release@v1
103+
with:
104+
name: ${{ steps.process_release_version.outputs.version }}
105+
tag_name: ${{ steps.process_release_version.outputs.version }}
106+
target_commitish: ${{github.sha}}
107+
108+
- name: Slack Notification on Failure
109+
if: ${{ failure() }}
110+
uses: rtCamp/action-slack-notify@v2
111+
env:
112+
SLACK_WEBHOOK: ${{ secrets.SLACK_NOTIFICATIONS_WEBHOOK }}
113+
SLACK_USERNAME: 'gha-failures-notifier'
114+
SLACK_COLOR: 'danger'
115+
SLACK_MESSAGE: 'Building Postgres AMI failed'
116+
SLACK_FOOTER: ''
117+
118+
- name: Cleanup resources on build cancellation
119+
if: ${{ cancelled() }}
120+
run: |
121+
aws ec2 describe-instances --filters "Name=tag:packerExecutionId,Values=${GITHUB_RUN_ID}" --query "Reservations[].Instances[].InstanceId" --output text | xargs -n 1 -I {} aws ec2 terminate-instances --instance-ids {}

‎.github/workflows/nix-build.yml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,11 @@ jobs:
2525
steps:
2626

2727
- name: Check out code
28-
uses: actions/checkout@v3
28+
uses: actions/checkout@v4
29+
with:
30+
ref: ${{ github.event.pull_request.head.ref || github.ref }}
31+
fetch-depth: 0
32+
fetch-tags: true
2933
- name: aws-creds
3034
uses: aws-actions/configure-aws-credentials@v4
3135
with:

‎.github/workflows/text-nix.yml

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
name: Test Database
2+
3+
on:
4+
# push:
5+
# branches:
6+
# - develop
7+
# pull_request:
8+
workflow_dispatch:
9+
10+
jobs:
11+
build:
12+
strategy:
13+
matrix:
14+
include:
15+
- runner: [self-hosted, X64]
16+
arch: amd64
17+
- runner: arm-runner
18+
arch: arm64
19+
runs-on: ${{ matrix.runner }}
20+
timeout-minutes: 180
21+
env:
22+
POSTGRES_PORT: 5478
23+
POSTGRES_PASSWORD: password
24+
steps:
25+
- uses: actions/checkout@v3
26+
- id: args
27+
uses: mikefarah/yq@master
28+
with:
29+
cmd: yq 'to_entries | map(select(.value|type == "!!str")) | map(.key + "=" + .value) | join("\n")' 'ansible/vars.yml'
30+
31+
- run: docker context create builders
32+
- uses: docker/setup-buildx-action@v3
33+
with:
34+
endpoint: builders
35+
- uses: docker/build-push-action@v5
36+
with:
37+
load: true
38+
context: .
39+
target: production
40+
build-args: |
41+
${{ steps.args.outputs.result }}
42+
tags: samrose/nix-experimental-postgresql-15-aarch64-linux:latest
43+
cache-from: |
44+
type=gha,scope=${{ github.ref_name }}-latest-${{ matrix.arch }}
45+
type=gha,scope=${{ github.base_ref }}-latest-${{ matrix.arch }}
46+
cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-latest-${{ matrix.arch }}
47+
48+
- name: Start Postgres
49+
run: |
50+
docker run --rm --pull=never \
51+
-e POSTGRES_PASSWORD=${{ env.POSTGRES_PASSWORD }} \
52+
-p ${{ env.POSTGRES_PORT }}:5432 \
53+
--name supabase_postgres \
54+
-d supabase/postgres:latest
55+
56+
- name: Install psql
57+
run: |
58+
sudo apt update
59+
sudo apt install -y --no-install-recommends postgresql-client
60+
61+
- name: Install pg_prove
62+
run: sudo cpan -T TAP::Parser::SourceHandler::pgTAP
63+
env:
64+
SHELL: /bin/bash
65+
66+
- name: Wait for healthy database
67+
run: |
68+
count=0
69+
until [ "$(docker inspect -f '{{.State.Health.Status}}' "$container")" == "healthy" ]; do
70+
exit=$?
71+
count=$((count + 1))
72+
if [ $count -ge "$retries" ]; then
73+
echo "Retry $count/$retries exited $exit, no more retries left."
74+
docker stop -t 2 "$container"
75+
return $exit
76+
fi
77+
sleep 1;
78+
done;
79+
echo "$container container is healthy"
80+
env:
81+
retries: 20
82+
container: supabase_postgres
83+
84+
- name: Run tests
85+
run: pg_prove migrations/tests/test.sql
86+
env:
87+
PGHOST: localhost
88+
PGPORT: ${{ env.POSTGRES_PORT }}
89+
PGDATABASE: postgres
90+
PGUSER: supabase_admin
91+
PGPASSWORD: ${{ env.POSTGRES_PASSWORD }}
92+
93+
- name: Check migrations are idempotent
94+
run: |
95+
for sql in ./migrations/db/migrations/*.sql; do
96+
echo "$0: running $sql"
97+
psql -v ON_ERROR_STOP=1 --no-password --no-psqlrc -f "$sql"
98+
done
99+
env:
100+
PGHOST: localhost
101+
PGPORT: ${{ env.POSTGRES_PORT }}
102+
PGDATABASE: postgres
103+
PGUSER: supabase_admin
104+
PGPASSWORD: ${{ env.POSTGRES_PASSWORD }}
105+
106+
schema:
107+
runs-on: ubuntu-latest
108+
steps:
109+
- uses: actions/checkout@v3
110+
- name: verify schema.sql is committed
111+
run: |
112+
docker compose -f migrations/docker-compose.yaml up db dbmate --abort-on-container-exit
113+
if ! git diff --ignore-space-at-eol --exit-code --quiet migrations/schema.sql; then
114+
echo "Detected uncommitted changes after build. See status below:"
115+
git diff
116+
exit 1
117+
fi

‎.github/workflows/textinfra-nix.yml

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
name: Testinfra Integration Tests
2+
3+
on:
4+
#pull_request:
5+
workflow_dispatch:
6+
7+
jobs:
8+
# test-all-in-one:
9+
# strategy:
10+
# matrix:
11+
# include:
12+
# - runner: [self-hosted, X64]
13+
# arch: amd64
14+
# - runner: arm-runner
15+
# arch: arm64
16+
# runs-on: ${{ matrix.runner }}
17+
# timeout-minutes: 30
18+
# steps:
19+
# - uses: actions/checkout@v3
20+
21+
# - run: docker context create builders
22+
# - uses: docker/setup-buildx-action@v3
23+
# with:
24+
# endpoint: builders
25+
26+
# - name: Run aio integration tests
27+
# run: |
28+
# # TODO: use poetry for pkg mgmt
29+
# pip3 install boto3 boto3-stubs[essential] docker ec2instanceconnectcli pytest pytest-testinfra[paramiko,docker] requests
30+
31+
32+
# if ! pytest -vv testinfra/test_all_in_one.py; then
33+
# # display container logs if the test fails
34+
35+
# if [ -f testinfra-aio-container-logs.log ]; then
36+
# echo "AIO container logs:"
37+
# cat testinfra-aio-container-logs.log
38+
# fi
39+
# exit 1
40+
# fi
41+
42+
test-ami:
43+
strategy:
44+
matrix:
45+
include:
46+
- runner: arm-runner
47+
arch: arm64
48+
ubuntu_release: focal
49+
ubuntu_version: 20.04
50+
mcpu: neoverse-n1
51+
runs-on: ${{ matrix.runner }}
52+
timeout-minutes: 150
53+
permissions:
54+
contents: write
55+
packages: write
56+
id-token: write
57+
58+
steps:
59+
- name: Checkout Repo
60+
uses: actions/checkout@v4
61+
62+
- id: args
63+
uses: mikefarah/yq@master
64+
with:
65+
cmd: yq 'to_entries | map(select(.value|type == "!!str")) | map(.key + "=" + .value) | join("\n")' 'ansible/vars.yml'
66+
67+
- run: docker context create builders
68+
69+
- uses: docker/setup-buildx-action@v3
70+
with:
71+
endpoint: builders
72+
73+
- uses: docker/build-push-action@v5
74+
with:
75+
build-args: |
76+
${{ steps.args.outputs.result }}
77+
target: extensions
78+
tags: supabase/postgres:extensions
79+
platforms: linux/${{ matrix.arch }}
80+
outputs: type=tar,dest=/tmp/extensions.tar
81+
cache-from: |
82+
type=gha,scope=${{ github.ref_name }}-extensions
83+
type=gha,scope=${{ github.base_ref }}-extensions
84+
type=gha,scope=develop-extensions
85+
cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-extensions
86+
87+
- name: Extract built packages
88+
run: |
89+
mkdir -p ansible/files/extensions
90+
tar xvf /tmp/extensions.tar -C ansible/files/extensions --strip-components 1
91+
92+
- id: version
93+
run: echo "${{ steps.args.outputs.result }}" | grep "postgresql" >> "$GITHUB_OUTPUT"
94+
95+
- name: Build Postgres deb
96+
uses: docker/build-push-action@v5
97+
with:
98+
file: docker/Dockerfile
99+
target: pg-deb
100+
build-args: |
101+
ubuntu_release=${{ matrix.ubuntu_release }}
102+
ubuntu_release_no=${{ matrix.ubuntu_version }}
103+
postgresql_major=${{ steps.version.outputs.postgresql_major }}
104+
postgresql_release=${{ steps.version.outputs.postgresql_release }}
105+
CPPFLAGS=-mcpu=${{ matrix.mcpu }}
106+
tags: supabase/postgres:deb
107+
platforms: linux/${{ matrix.arch }}
108+
outputs: type=tar,dest=/tmp/pg-deb.tar
109+
cache-from: |
110+
type=gha,scope=${{ github.ref_name }}-deb
111+
type=gha,scope=${{ github.base_ref }}-deb
112+
type=gha,scope=develop-deb
113+
cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-deb
114+
115+
- name: Extract Postgres deb
116+
run: |
117+
mkdir -p ansible/files/postgres
118+
tar xvf /tmp/pg-deb.tar -C ansible/files/postgres --strip-components 1
119+
120+
# Packer doesn't support skipping registering the AMI for the ebssurrogate
121+
# builder, so we register an AMI with a fixed name and run tests on an
122+
# instance launched from that
123+
# https://github.com/hashicorp/packer/issues/4899
124+
- name: Build AMI
125+
run: |
126+
packer init amazon-arm64.pkr.hcl
127+
GIT_SHA=${{github.sha}}
128+
packer build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var-file="development-arm.vars.pkr.hcl" -var-file="common.vars.pkr.hcl" -var "ansible_arguments=" -var "postgres-version=ci-ami-test" -var "region=ap-southeast-1" -var 'ami_regions=["ap-southeast-1"]' -var "force-deregister=true" amazon-arm64.pkr.hcl
129+
130+
- name: Run tests
131+
timeout-minutes: 10
132+
run: |
133+
# TODO: use poetry for pkg mgmt
134+
pip3 install boto3 boto3-stubs[essential] docker ec2instanceconnectcli pytest pytest-testinfra[paramiko,docker] requests
135+
pytest -vv -s testinfra/test_ami.py
136+
137+
- name: Cleanup resources on build cancellation
138+
if: ${{ cancelled() }}
139+
run: |
140+
aws ec2 --region ap-southeast-1 describe-instances --filters "Name=tag:packerExecutionId,Values=${GITHUB_RUN_ID}" --query "Reservations[].Instances[].InstanceId" --output text | xargs -n 1 -I {} aws ec2 terminate-instances --region ap-southeast-1 --instance-ids {}
141+
142+
- name: Cleanup resources on build cancellation
143+
if: ${{ always() }}
144+
run: |
145+
aws ec2 --region ap-southeast-1 describe-instances --filters "Name=tag:testinfra-run-id,Values=${GITHUB_RUN_ID}" --query "Reservations[].Instances[].InstanceId" --output text | xargs -n 1 -I {} aws ec2 terminate-instances --region ap-southeast-1 --instance-ids {} || true

0 commit comments

Comments
 (0)