Skip to content

Commit c3a8b0c

Browse files
Crispy1975Crispy1975
committed
chore: add composite action for downloading artifacts
1 parent 4af89b0 commit c3a8b0c

File tree

4 files changed

+137
-12
lines changed

4 files changed

+137
-12
lines changed

‎.github/actions/download-supabase-artifacts/action.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: "Download Supabase project artifacts"
2+
description: "Authenticate with AWS shared account and download artifacts from S3"
3+
4+
inputs:
5+
region:
6+
description: "AWS region"
7+
required: true
8+
auth-role:
9+
description: "Initial role to assume using GitHub OIDC"
10+
required: true
11+
download-role:
12+
description: "Role to assume for S3 access"
13+
required: true
14+
bucket:
15+
description: "S3 bucket name"
16+
required: true
17+
prefix:
18+
description: "S3 path prefix (e.g. supabase-admin-agent/v1.4.35)"
19+
required: true
20+
artifacts:
21+
description: "Newline-separated list of artefact filenames to download"
22+
required: true
23+
24+
runs:
25+
using: "composite"
26+
steps:
27+
- name: GitHub OIDC Auth
28+
uses: aws-actions/[email protected]
29+
with:
30+
aws-region: ${{ inputs.region }}
31+
role-to-assume: ${{ inputs.auth-role }}
32+
role-session-name: github-oidc-session
33+
34+
- name: Assume Destination Role
35+
uses: aws-actions/[email protected]
36+
with:
37+
aws-region: ${{ inputs.region }}
38+
role-to-assume: ${{ inputs.download-role }}
39+
role-session-name: s3-access
40+
role-skip-session-tagging: true
41+
role-chaining: true
42+
43+
- name: Download artifacts from S3
44+
shell: bash
45+
run: |
46+
set -euo pipefail
47+
mkdir -p ./dist
48+
49+
bucket="${{ inputs.bucket }}"
50+
prefix="${{ inputs.prefix }}"
51+
IFS=$'\n' read -r -d '' -a artifacts <<< "$(printf "%s\n" "${{ inputs.artifacts }}")"$'\0'
52+
53+
for object_key in "${artifacts[@]}"; do
54+
s3_path="s3://${bucket}/${prefix}/${object_key}"
55+
echo "Downloading $s3_path"
56+
aws s3 cp "$s3_path" "./dist/$object_key"
57+
done

‎.github/workflows/actions/s3/action.yml‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
name: "Download Supabase project artifacts"
2+
description: "Authenticate with AWS shared account and download artifacts from S3"
3+
4+
inputs:
5+
region:
6+
description: "The AWS region"
7+
required: true
8+
auth-role:
9+
description: "The initial role to assume using GitHub OIDC"
10+
required: true
11+
download-role:
12+
description: "The role to assume for S3 access"
13+
required: true
14+
bucket:
15+
description: "The download S3 bucket name"
16+
required: true
17+
artifacts:
18+
description: "List of artifacts in the form: <tool>,<version>,<os-arch>"
19+
required: true
20+
21+
runs:
22+
using: "composite"
23+
steps:
24+
- name: GitHub OIDC Auth
25+
uses: aws-actions/[email protected]
26+
with:
27+
aws-region: ${{ inputs.region }}
28+
role-to-assume: ${{ inputs.auth-role }}
29+
role-session-name: github-oidc-session
30+
31+
- name: Assume Destination Role
32+
uses: aws-actions/[email protected]
33+
with:
34+
aws-region: ${{ inputs.region }}
35+
role-to-assume: ${{ inputs.download-role }}
36+
role-session-name: s3-access
37+
role-skip-session-tagging: true
38+
role-chaining: true
39+
40+
- name: Download Artifacts From S3
41+
shell: bash
42+
run: |
43+
set -euo pipefail
44+
mkdir -p /tmp/supabase-dist
45+
46+
bucket="${{ inputs.bucket }}"
47+
mapfile -t entries <<< "${{ inputs.artifacts }}"
48+
49+
for entry in "${entries[@]}"; do
50+
IFS=',' read -r tool version platform <<< "$entry"
51+
filename="${tool}-${version}-${platform}.tar.xz"
52+
s3_path="s3://${bucket}/${tool}/v${version}/${filename}"
53+
54+
echo "Downloading $s3_path"
55+
aws s3 cp "$s3_path" "/tmp/supabase-dist/$filename"
56+
done

‎.github/workflows/nix-build.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -79,19 +79,19 @@ jobs:
7979
trusted-public-keys = nix-postgres-artifacts:dGZlQOvKcNEjvT7QEAJbcV6b6uk7VF/hWMjhYleiaLI=% cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
8080
- name: Build psql bundle
8181
run: >
82-
nix run "github:Mic92/nix-fast-build?rev=b1dae483ab7d4139a6297e02b6de9e5d30e43d48"
83-
-- --skip-cached --no-nom
84-
--flake ".#checks.$(nix eval --raw --impure --expr 'builtins.currentSystem')"
82+
nix run "github:Mic92/nix-fast-build?rev=b1dae483ab7d4139a6297e02b6de9e5d30e43d48"
83+
-- --skip-cached --no-nom
84+
--flake ".#checks.$(nix eval --raw --impure --expr 'builtins.currentSystem')"
8585
env:
8686
AWS_ACCESS_KEY_ID: ${{ env.AWS_ACCESS_KEY_ID }}
8787
AWS_SECRET_ACCESS_KEY: ${{ env.AWS_SECRET_ACCESS_KEY }}
8888
AWS_SESSION_TOKEN: ${{ env.AWS_SESSION_TOKEN }}
89-
89+
9090
run-testinfra:
9191
needs: build-run-image
9292
if: ${{ success() }}
9393
uses: ./.github/workflows/testinfra-ami-build.yml
94-
94+
9595
run-tests:
9696
needs: build-run-image
9797
if: ${{ success() }}

‎.github/workflows/testinfra-ami-build.yml‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
ubuntu_release: focal
3838
ubuntu_version: 20.04
3939
mcpu: neoverse-n1
40-
runs-on: ${{ matrix.runner }}
40+
runs-on: ${{ matrix.runner }}
4141
timeout-minutes: 150
4242
permissions:
4343
contents: write
@@ -53,6 +53,18 @@ jobs:
5353
with:
5454
cmd: yq 'to_entries | map(select(.value|type == "!!str")) | map(.key + "=" + .value) | join("\n")' 'ansible/vars.yml'
5555

56+
- name: Download Supabase Artifacts
57+
id: download-artifacts
58+
uses: ./.github/actions/download-supabase-artifacts
59+
with:
60+
region: ap-southeast-1
61+
auth-role: arn:aws:iam::279559813984:role/supabase-github-oidc-role
62+
download-role: arn:aws:iam::279559813984:role/supabase-repos-s3-get-role-83eb755
63+
bucket: supabase-internal-artifacts
64+
artifacts: |
65+
supabase-admin-agent,1.4.35,linux-arm64
66+
supabase-admin-agent,1.4.35,linux-amd64
67+
5668
- run: docker context create builders
5769

5870
- uses: docker/setup-buildx-action@v3
@@ -73,7 +85,7 @@ jobs:
7385
echo 'postgres-version = "'$PG_VERSION'"' > common-nix.vars.pkr.hcl
7486
# Ensure there's a newline at the end of the file
7587
echo "" >> common-nix.vars.pkr.hcl
76-
88+
7789
- name: Build AMI stage 1
7890
run: |
7991
packer init amazon-arm64-nix.pkr.hcl
@@ -84,7 +96,7 @@ jobs:
8496
run: |
8597
packer init stage2-nix-psql.pkr.hcl
8698
GIT_SHA=${{github.sha}}
87-
packer build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var "postgres_major_version=${POSTGRES_MAJOR_VERSION}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" -var "postgres-version=${{ steps.random.outputs.random_string }}" -var "region=ap-southeast-1" -var 'ami_regions=["ap-southeast-1"]' -var "force-deregister=true" -var "git_sha=${GITHUB_SHA}" stage2-nix-psql.pkr.hcl
99+
packer build -var "git-head-version=${GIT_SHA}" -var "packer-execution-id=${GITHUB_RUN_ID}" -var "postgres_major_version=${POSTGRES_MAJOR_VERSION}" -var-file="development-arm.vars.pkr.hcl" -var-file="common-nix.vars.pkr.hcl" -var "postgres-version=${{ steps.random.outputs.random_string }}" -var "region=ap-southeast-1" -var 'ami_regions=["ap-southeast-1"]' -var "force-deregister=true" -var "git_sha=${GITHUB_SHA}" stage2-nix-psql.pkr.hcl
88100
89101
- name: Run tests
90102
timeout-minutes: 10
@@ -93,8 +105,8 @@ jobs:
93105
run: |
94106
# TODO: use poetry for pkg mgmt
95107
pip3 install boto3 boto3-stubs[essential] docker ec2instanceconnectcli pytest pytest-testinfra[paramiko,docker] requests
96-
pytest -vv -s testinfra/test_ami_nix.py
97-
108+
pytest -vv -s testinfra/test_ami_nix.py
109+
98110
- name: Cleanup resources on build cancellation
99111
if: ${{ cancelled() }}
100112
run: |
@@ -111,7 +123,7 @@ jobs:
111123
# Define AMI name patterns
112124
STAGE1_AMI_NAME="supabase-postgres-ci-ami-test-stage-1"
113125
STAGE2_AMI_NAME="${{ steps.random.outputs.random_string }}"
114-
126+
115127
# Function to deregister AMIs by name pattern
116128
deregister_ami_by_name() {
117129
local ami_name_pattern=$1
@@ -121,7 +133,7 @@ jobs:
121133
aws ec2 deregister-image --region ap-southeast-1 --image-id $ami_id
122134
done
123135
}
124-
136+
125137
# Deregister AMIs
126138
deregister_ami_by_name "$STAGE1_AMI_NAME"
127139
deregister_ami_by_name "$STAGE2_AMI_NAME"

0 commit comments

Comments
 (0)