[feat] CI. Run artifact uploads in workflow secure context

We are seperating artifacts generation/upload process, into a seperate workflow. This runs in pricileged mode, using `workflow_run` trigger. https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_run Note: This event will only trigger a workflow run if the workflow file is on the default branch.(master) Docker artifacts, are now exposed under the newly porivisioned DockerHub Org account: "mattermostdevelopment" https://hub.docker.com/repository/docker/mattermostdevelopment/mm-te-test/tags?page=1&ordering=last_updated Signed-off-by: Akis Maziotis <akis.maziotis@mattermost.com>
2023-03-27 14:56:14 +03:00
--- a/.github/workflows/artifacts.yml
+++ b/.github/workflows/artifacts.yml
@@ -0,0 +1,84 @@
+name: Artifacts generation and upload
+on:
+  workflow_run:
+    workflows: ["Mattermost Build"]
+    types:
+      - completed
+jobs:
+  upload-s3:
+    name: cd/Upload artifacts to S3
+    runs-on: ubuntu-22.04
+    env:
+      REPO_NAME: ${{ github.event.repository.name }}
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    steps:
+      - name: cd/Configure AWS
+        uses: aws-actions/configure-aws-credentials@07c2f971bac433df982ccc261983ae443861db49 # v1-node16
+        with:
+          aws-region: us-east-1
+          aws-access-key-id: ${{ secrets.PR_BUILDS_BUCKET_AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.PR_BUILDS_BUCKET_AWS_SECRET_ACCESS_KEY }}
+      - name: cd/Download artifacts
+        uses: dawidd6/action-download-artifact@0c49384d39ceb023b8040f480a25596fd6cf441b # v2.26.0
+        with:
+          workflow_conclusion: success
+          name: server-dist-artifact
+          path: server/dist
+      # Get Branch name from calling workflow
+      # Search for the string "pull" and replace it with "PR" in branch-name
+      - name: cd/Get branch name
+        run: echo "BRANCH_NAME=$(echo ${{ github.event.workflow_run.head_branch }} | sed 's/^pull\//PR-/g')" >> $GITHUB_ENV
+      - name: cd/Upload artifacts to S3
+        run: |
+          aws s3 cp server/dist/ s3://pr-builds.mattermost.com/$REPO_NAME/$BRANCH_NAME/ --acl public-read --cache-control "no-cache" --recursive --no-progress
+          aws s3 cp server/dist/ s3://pr-builds.mattermost.com/$REPO_NAME/commit/${{ github.sha }}/ --acl public-read --cache-control "no-cache" --recursive --no-progress
+  build-docker:
+    name: cd/Build and push docker image
+    needs: upload-s3
+    env:
+      REPO_NAME: ${{ github.event.repository.name }}
+    runs-on: ubuntu-22.04
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    steps:
+    - name: cd/Login to Docker Hub
+      uses: docker/login-action@3da7dc6e2b31f99ef2cb9fb4c50fb0971e0d0139 # v2.1.0
+      with:
+        username: ${{ secrets.DOCKERHUB_DEV_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_DEV_TOKEN }}
+    - name: cd/Download artifacts
+      uses: dawidd6/action-download-artifact@0c49384d39ceb023b8040f480a25596fd6cf441b # v2.26.0
+      with:
+        workflow_conclusion: success
+        name: server-build-artifact
+        path: server/build/
+    - name: cd/Setup Docker Buildx
+      uses: docker/setup-buildx-action@11e8a2e2910826a92412015c515187a2d6750279 # v2.4
+    - name: cd/Docker build and push
+      env:
+        DOCKER_CLI_EXPERIMENTAL: enabled
+      run: |
+        export TAG=$(echo "${{ github.event.pull_request.head.sha || github.sha }}" | cut -c1-7)
+        cd server/build
+        export DOCKER_CLI_EXPERIMENTAL=enabled
+        export MM_PACKAGE=https://pr-builds.mattermost.com/$REPO_NAME/commit/${{ github.sha }}/mattermost-team-linux-amd64.tar.gz
+        docker buildx build --push --build-arg MM_PACKAGE=$MM_PACKAGE -t mattermostdevelopment/mm-te-test:${TAG} .
+  sentry:
+    name: Send build info to sentry
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-22.04
+    env:
+      SENTRY_AUTH_TOKEN: ${{ secrets.MM_SERVER_SENTRY_AUTH_TOKEN }}
+      SENTRY_ORG: ${{ secrets.MM_SERVER_SENTRY_ORG }}
+      SENTRY_PROJECT: ${{ secrets.MM_SERVER_SENTRY_PROJECT }}
+    steps:
+      - name: cd/Checkout mattermost-server
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+      - name: cd/Create Sentry release
+        uses: getsentry/action-release@85e0095193a153d57c458995f99d0afd81b9e5ea # v1.3.0
+
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -232,77 +232,4 @@ jobs:
        with:
          name: server-build-artifact
          path: server/build/
-          retention-days: 14 
-  upload-s3:
-    name: Upload to S3 bucket
-    runs-on: ubuntu-22.04
-    needs: build-mattermost-server
-    env:
-      REPO_NAME: ${{ github.event.repository.name }}
-    steps:
-    - name: Download dist artifacts
-      uses: actions/download-artifact@e9ef242655d12993efdcda9058dee2db83a2cb9b  # v3.0.2
-      with:
-        name: server-dist-artifact
-        path: server/dist/
-    - name: Configure AWS
-      uses: aws-actions/configure-aws-credentials@07c2f971bac433df982ccc261983ae443861db49 # v1-node16
-      with:
-        aws-region: us-east-1
-        aws-access-key-id: ${{ secrets.MM_SERVER_AWS_ACCESS_KEY_ID }}
-        aws-secret-access-key: ${{ secrets.MM_SERVER_AWS_SECRET_ACCESS_KEY }}
-    # We need to sanitize the branch name before using it
-    - name: ci/sanitize-branch-name
-      id: branch
-      uses: transferwise/sanitize-branch-name@b10b4d524ac5a7b645b43a3527db3a6cca017b9d # v1
-    # Search for the string "pull" and replace it with "PR" in branch-name
-    - name: ci/sanitize-branch-name-replace-pull-with-PR-
-      run: echo "BRANCH_NAME=$(echo ${{ steps.branch.outputs.sanitized-branch-name }} | sed 's/^pull\//PR-/g')" >> $GITHUB_ENV
-    - name: ci/artifact-upload
-      run: |
-        aws s3 cp server/dist/ s3://pr-builds.mattermost.com/$REPO_NAME/$BRANCH_NAME/ --acl public-read --cache-control "no-cache" --recursive
-        aws s3 cp server/dist/ s3://pr-builds.mattermost.com/$REPO_NAME/commit/${{ github.sha }}/ --acl public-read --cache-control "no-cache" --recursive
-  build-docker:
-    name: Build docker image
-    runs-on: ubuntu-22.04
-    needs: upload-s3
-    steps:
-    - name: Download build artifacts
-      uses: actions/download-artifact@e9ef242655d12993efdcda9058dee2db83a2cb9b  # v3.0.2
-      with:
-        name: server-build-artifact
-        path: server/build/
-    - name: Login to Docker Hub
-      uses: docker/login-action@3da7dc6e2b31f99ef2cb9fb4c50fb0971e0d0139 # v2.1.0
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_TOKEN }}
-    - name: Setup Docker Buildx
-      uses: docker/setup-buildx-action@11e8a2e2910826a92412015c515187a2d6750279 # v2.4
-    - name: Docker build and push
-      env:
-        DOCKER_CLI_EXPERIMENTAL: enabled
-      run: |
-        export TAG=$(echo "${{ github.event.pull_request.head.sha || github.sha }}" | cut -c1-7)
-        cd server/build
-        export DOCKER_CLI_EXPERIMENTAL=enabled
-        export MM_PACKAGE=https://pr-builds.mattermost.com/mattermost-server/commit/${GITHUB_SHA}/mattermost-team-linux-amd64.tar.gz
-        docker buildx build --push --build-arg MM_PACKAGE=$MM_PACKAGE -t mattermost/mm-te-test:${TAG} .
-  sentry:
-    name: Send build info to sentry
-    runs-on: ubuntu-22.04
-    needs:
-      - test-postgres-binary
-      - test-postgres-normal
-      - test-mysql
-      - build-mattermost-server
-    if: ${{ github.event_name == 'push' }}
-    env:
-      SENTRY_AUTH_TOKEN: ${{ secrets.MM_SERVER_SENTRY_AUTH_TOKEN }}
-      SENTRY_ORG: ${{ secrets.MM_SERVER_SENTRY_ORG }}
-      SENTRY_PROJECT: ${{ secrets.MM_SERVER_SENTRY_PROJECT }}
-    steps:
-      - name: Checkout mattermost-server
-        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
-      - name: Create Sentry release
-        uses: getsentry/action-release@85e0095193a153d57c458995f99d0afd81b9e5ea # v1.3.0
+          retention-days: 14