Skip to content

Commit 1dab7f4

Browse files
ruivieiraruivieira
authored
Merge pull request #7 from ruivieira/RHOAIENG-24444-infra
chore: Add image building GHA
2 parents ea70d03 + fe3abae commit 1dab7f4

File tree

1 file changed

+164
-0
lines changed

1 file changed

+164
-0
lines changed

‎.github/workflows/build-and-push.yaml

+164
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
name: Build and Push
2+
on:
3+
push:
4+
branches:
5+
- main
6+
tags:
7+
- v*
8+
paths-ignore:
9+
- 'LICENSE'
10+
- '**/.gitignore'
11+
- '**.md'
12+
- '**.adoc'
13+
- '*.txt'
14+
pull_request_target:
15+
paths-ignore:
16+
- 'LICENSE'
17+
- '**/.gitignore'
18+
- '**.md'
19+
- '**.adoc'
20+
- '*.txt'
21+
types: [labeled, opened, synchronize, reopened]
22+
jobs:
23+
# Ensure that tests pass before publishing a new image.
24+
build-and-push-ci:
25+
runs-on: ubuntu-latest
26+
permissions:
27+
contents: read
28+
pull-requests: write
29+
security-events: write
30+
steps: # Assign context variable for various action contexts (tag, main, CI)
31+
- name: Assigning CI context
32+
if: github.head_ref != '' && github.head_ref != 'main' && !startsWith(github.ref, 'refs/tags/v')
33+
run: echo "BUILD_CONTEXT=ci" >> $GITHUB_ENV
34+
- name: Assigning tag context
35+
if: github.head_ref == '' && startsWith(github.ref, 'refs/tags/v')
36+
run: echo "BUILD_CONTEXT=tag" >> $GITHUB_ENV
37+
- name: Assigning main context
38+
if: github.head_ref == '' && github.ref == 'refs/heads/main'
39+
run: echo "BUILD_CONTEXT=main" >> $GITHUB_ENV
40+
# Run checkouts
41+
- uses: mheap/github-action-required-labels@v4
42+
if: env.BUILD_CONTEXT == 'ci'
43+
with:
44+
mode: minimum
45+
count: 1
46+
labels: "ok-to-test, lgtm, approved"
47+
- uses: actions/checkout@v3
48+
if: env.BUILD_CONTEXT == 'ci'
49+
with:
50+
ref: ${{ github.event.pull_request.head.sha }}
51+
- uses: actions/checkout@v3
52+
if: env.BUILD_CONTEXT == 'main' || env.BUILD_CONTEXT == 'tag'
53+
# Print variables for debugging
54+
- name: Log reference variables
55+
run: |
56+
echo "CONTEXT: ${{ env.BUILD_CONTEXT }}"
57+
echo "GITHUB.REF: ${{ github.ref }}"
58+
echo "GITHUB.HEAD_REF: ${{ github.head_ref }}"
59+
echo "SHA: ${{ github.event.pull_request.head.sha }}"
60+
echo "MAIN IMAGE AT: ${{ vars.QUAY_RELEASE_REPO }}:latest"
61+
echo "CI IMAGE AT: quay.io/trustyai/trustyai-service-python-ci:${{ github.event.pull_request.head.sha }}"
62+
# Set environments depending on context
63+
- name: Set CI environment
64+
if: env.BUILD_CONTEXT == 'ci'
65+
run: |
66+
echo "TAG=${{ github.event.pull_request.head.sha }}" >> $GITHUB_ENV
67+
echo "IMAGE_NAME=quay.io/trustyai/trustyai-service-python-ci" >> $GITHUB_ENV
68+
- name: Set main-branch environment
69+
if: env.BUILD_CONTEXT == 'main'
70+
run: |
71+
echo "TAG=latest" >> $GITHUB_ENV
72+
echo "IMAGE_NAME=${{ vars.QUAY_RELEASE_REPO }}" >> $GITHUB_ENV
73+
- name: Set tag environment
74+
if: env.BUILD_CONTEXT == 'tag'
75+
run: |
76+
echo "TAG=${{ github.ref_name }}" >> $GITHUB_ENV
77+
echo "IMAGE_NAME=${{ vars.QUAY_RELEASE_REPO }}" >> $GITHUB_ENV
78+
#
79+
# Run docker commands
80+
- name: Pull prerequisite images
81+
run: |
82+
docker pull $(cat Dockerfile | grep -o -P '(?<=FROM ).*(?= AS build)')
83+
docker pull $(cat Dockerfile | grep -o -P '(?<=FROM ).*(?= AS runtime)')
84+
- name: Put expiry date on CI-tagged image
85+
if: env.BUILD_CONTEXT == 'ci'
86+
run: sed -i 's#summary="odh-trustyai-service-python\"#summary="odh-trustyai-service-python" \\ \n quay.expires-after=7d#' Dockerfile
87+
- name: Build image
88+
run: docker build -t ${{ env.IMAGE_NAME }}:$TAG .
89+
- name: Log in to Quay
90+
run: docker login -u ${{ secrets.QUAY_ROBOT_USERNAME }} -p ${{ secrets.QUAY_ROBOT_SECRET }} quay.io
91+
- name: Push to Quay CI repo
92+
run: docker push ${{ env.IMAGE_NAME }}:$TAG
93+
94+
# Create CI Manifests
95+
- name: Set up manifests for CI
96+
if: env.BUILD_CONTEXT == 'ci'
97+
run: |
98+
git clone https://github.com/trustyai-explainability/trustyai-service-operator
99+
cd trustyai-service-operator
100+
sed -i "s#quay.io/trustyai/trustyai-service:latest#${{ env.IMAGE_NAME }}:$TAG#" ./config/base/params.env
101+
sed -i "s#quay.io/trustyai/trustyai-service:latest#${{ env.IMAGE_NAME }}:$TAG#" ./config/overlays/odh/params.env
102+
sed -i "s#quay.io/trustyai/trustyai-service:latest#${{ env.IMAGE_NAME }}:$TAG#" ./config/overlays/rhoai/params.env
103+
rm -Rf $(ls . | grep -v config)
104+
rm -Rf .gitignore .dockerignore .github .git .yamllint.yaml
105+
echo "## Automatically Generated Manifests for Service CI" > README.md
106+
echo "Generated by [Service PR #${{ github.event.number }}](https://github.com/trustyai-explainability/trustyai-service/pull/${{ github.event.number }})" >> README.md
107+
108+
# push to ci-manifest repo
109+
- uses: cpina/github-action-push-to-another-repository@main
110+
if: env.BUILD_CONTEXT == 'ci'
111+
env:
112+
SSH_DEPLOY_KEY: ${{ secrets.TRUSTYAI_CI_BOT_SSH_KEY}}
113+
with:
114+
source-directory: 'trustyai-service-operator'
115+
destination-github-username: 'trustyai-ci-bot'
116+
destination-repository-username: 'trustyai-explainability'
117+
destination-repository-name: 'trustyai-service-operator-ci'
118+
target-branch: service-python-${{ env.TAG }}
119+
create-target-branch-if-needed: 'true'
120+
121+
# Leave comment
122+
- uses: peter-evans/find-comment@v3
123+
name: Find Comment
124+
id: fc
125+
with:
126+
issue-number: ${{ github.event.pull_request.number }}
127+
comment-author: 'github-actions[bot]'
128+
body-includes: PR image build and manifest generation completed successfully
129+
- uses: peter-evans/create-or-update-comment@v4
130+
name: Generate/update success message comment
131+
with:
132+
comment-id: ${{ steps.fc.outputs.comment-id }}
133+
issue-number: ${{ github.event.pull_request.number }}
134+
edit-mode: replace
135+
body: |
136+
PR image build and manifest generation completed successfully!
137+
138+
📦 [PR image](https://quay.io/trustyai/trustyai-service-python-ci:${{ github.event.pull_request.head.sha }}): `quay.io/trustyai/trustyai-service-python-ci:${{ github.event.pull_request.head.sha }}`
139+
140+
🗂️ [CI manifests](https://github.com/trustyai-explainability/trustyai-service-operator-ci/tree/service-python-${{ env.TAG }})
141+
142+
```
143+
devFlags:
144+
manifests:
145+
- contextDir: config
146+
sourcePath: ''
147+
uri: https://api.github.com/repos/trustyai-explainability/trustyai-service-operator-ci/tarball/service-python-${{ env.TAG }}
148+
```
149+
- name: Trivy scan
150+
uses: aquasecurity/[email protected]
151+
with:
152+
scan-type: 'image'
153+
image-ref: "${{ env.IMAGE_NAME }}:${{ env.TAG }}"
154+
format: 'sarif'
155+
output: 'trivy-results.sarif'
156+
severity: 'MEDIUM,HIGH,CRITICAL'
157+
exit-code: '0'
158+
ignore-unfixed: false
159+
vuln-type: 'os,library'
160+
161+
- name: Update Security tab
162+
uses: github/codeql-action/upload-sarif@v3
163+
with:
164+
sarif_file: 'trivy-results.sarif'

0 commit comments

Comments
 (0)