From d0bee0162c872dca6fc535c87d84cc5b56c26eff Mon Sep 17 00:00:00 2001 From: Akis Maziotis Date: Mon, 27 Mar 2023 14:56:14 +0300 Subject: [PATCH] [feat] CI. Run artifact uploads in workflow secure context We are seperating artifacts generation/upload process, into a seperate workflow. This runs in pricileged mode, using `workflow_run` trigger. https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_run Note: This event will only trigger a workflow run if the workflow file is on the default branch.(master) Docker artifacts, are now exposed under the newly porivisioned DockerHub Org account: "mattermostdevelopment" https://hub.docker.com/repository/docker/mattermostdevelopment/mm-te-test/tags?page=1&ordering=last_updated Signed-off-by: Akis Maziotis --- .github/workflows/artifacts.yml | 84 +++++++++++++++++++++++++++++++++ .github/workflows/ci.yml | 75 +---------------------------- 2 files changed, 85 insertions(+), 74 deletions(-) create mode 100644 .github/workflows/artifacts.yml diff --git a/.github/workflows/artifacts.yml b/.github/workflows/artifacts.yml new file mode 100644 index 0000000000..20c95c3c7c --- /dev/null +++ b/.github/workflows/artifacts.yml @@ -0,0 +1,84 @@ +name: Artifacts generation and upload +on: + workflow_run: + workflows: ["Mattermost Build"] + types: + - completed +jobs: + upload-s3: + name: cd/Upload artifacts to S3 + runs-on: ubuntu-22.04 + env: + REPO_NAME: ${{ github.event.repository.name }} + if: > + github.event.workflow_run.event == 'pull_request' && + github.event.workflow_run.conclusion == 'success' + steps: + - name: cd/Configure AWS + uses: aws-actions/configure-aws-credentials@07c2f971bac433df982ccc261983ae443861db49 # v1-node16 + with: + aws-region: us-east-1 + aws-access-key-id: ${{ secrets.PR_BUILDS_BUCKET_AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.PR_BUILDS_BUCKET_AWS_SECRET_ACCESS_KEY }} + - name: cd/Download artifacts + uses: dawidd6/action-download-artifact@0c49384d39ceb023b8040f480a25596fd6cf441b # v2.26.0 + with: + workflow_conclusion: success + name: server-dist-artifact + path: server/dist + # Get Branch name from calling workflow + # Search for the string "pull" and replace it with "PR" in branch-name + - name: cd/Get branch name + run: echo "BRANCH_NAME=$(echo ${{ github.event.workflow_run.head_branch }} | sed 's/^pull\//PR-/g')" >> $GITHUB_ENV + - name: cd/Upload artifacts to S3 + run: | + aws s3 cp server/dist/ s3://pr-builds.mattermost.com/$REPO_NAME/$BRANCH_NAME/ --acl public-read --cache-control "no-cache" --recursive --no-progress + aws s3 cp server/dist/ s3://pr-builds.mattermost.com/$REPO_NAME/commit/${{ github.sha }}/ --acl public-read --cache-control "no-cache" --recursive --no-progress + build-docker: + name: cd/Build and push docker image + needs: upload-s3 + env: + REPO_NAME: ${{ github.event.repository.name }} + runs-on: ubuntu-22.04 + if: > + github.event.workflow_run.event == 'pull_request' && + github.event.workflow_run.conclusion == 'success' + steps: + - name: cd/Login to Docker Hub + uses: docker/login-action@3da7dc6e2b31f99ef2cb9fb4c50fb0971e0d0139 # v2.1.0 + with: + username: ${{ secrets.DOCKERHUB_DEV_USERNAME }} + password: ${{ secrets.DOCKERHUB_DEV_TOKEN }} + - name: cd/Download artifacts + uses: dawidd6/action-download-artifact@0c49384d39ceb023b8040f480a25596fd6cf441b # v2.26.0 + with: + workflow_conclusion: success + name: server-build-artifact + path: server/build/ + - name: cd/Setup Docker Buildx + uses: docker/setup-buildx-action@11e8a2e2910826a92412015c515187a2d6750279 # v2.4 + - name: cd/Docker build and push + env: + DOCKER_CLI_EXPERIMENTAL: enabled + run: | + export TAG=$(echo "${{ github.event.pull_request.head.sha || github.sha }}" | cut -c1-7) + cd server/build + export DOCKER_CLI_EXPERIMENTAL=enabled + export MM_PACKAGE=https://pr-builds.mattermost.com/$REPO_NAME/commit/${{ github.sha }}/mattermost-team-linux-amd64.tar.gz + docker buildx build --push --build-arg MM_PACKAGE=$MM_PACKAGE -t mattermostdevelopment/mm-te-test:${TAG} . + sentry: + name: Send build info to sentry + if: > + github.event.workflow_run.event == 'pull_request' && + github.event.workflow_run.conclusion == 'success' + runs-on: ubuntu-22.04 + env: + SENTRY_AUTH_TOKEN: ${{ secrets.MM_SERVER_SENTRY_AUTH_TOKEN }} + SENTRY_ORG: ${{ secrets.MM_SERVER_SENTRY_ORG }} + SENTRY_PROJECT: ${{ secrets.MM_SERVER_SENTRY_PROJECT }} + steps: + - name: cd/Checkout mattermost-server + uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 + - name: cd/Create Sentry release + uses: getsentry/action-release@85e0095193a153d57c458995f99d0afd81b9e5ea # v1.3.0 + diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 1f83ea90c1..24ec4e83a1 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -232,77 +232,4 @@ jobs: with: name: server-build-artifact path: server/build/ - retention-days: 14 - upload-s3: - name: Upload to S3 bucket - runs-on: ubuntu-22.04 - needs: build-mattermost-server - env: - REPO_NAME: ${{ github.event.repository.name }} - steps: - - name: Download dist artifacts - uses: actions/download-artifact@e9ef242655d12993efdcda9058dee2db83a2cb9b # v3.0.2 - with: - name: server-dist-artifact - path: server/dist/ - - name: Configure AWS - uses: aws-actions/configure-aws-credentials@07c2f971bac433df982ccc261983ae443861db49 # v1-node16 - with: - aws-region: us-east-1 - aws-access-key-id: ${{ secrets.MM_SERVER_AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.MM_SERVER_AWS_SECRET_ACCESS_KEY }} - # We need to sanitize the branch name before using it - - name: ci/sanitize-branch-name - id: branch - uses: transferwise/sanitize-branch-name@b10b4d524ac5a7b645b43a3527db3a6cca017b9d # v1 - # Search for the string "pull" and replace it with "PR" in branch-name - - name: ci/sanitize-branch-name-replace-pull-with-PR- - run: echo "BRANCH_NAME=$(echo ${{ steps.branch.outputs.sanitized-branch-name }} | sed 's/^pull\//PR-/g')" >> $GITHUB_ENV - - name: ci/artifact-upload - run: | - aws s3 cp server/dist/ s3://pr-builds.mattermost.com/$REPO_NAME/$BRANCH_NAME/ --acl public-read --cache-control "no-cache" --recursive - aws s3 cp server/dist/ s3://pr-builds.mattermost.com/$REPO_NAME/commit/${{ github.sha }}/ --acl public-read --cache-control "no-cache" --recursive - build-docker: - name: Build docker image - runs-on: ubuntu-22.04 - needs: upload-s3 - steps: - - name: Download build artifacts - uses: actions/download-artifact@e9ef242655d12993efdcda9058dee2db83a2cb9b # v3.0.2 - with: - name: server-build-artifact - path: server/build/ - - name: Login to Docker Hub - uses: docker/login-action@3da7dc6e2b31f99ef2cb9fb4c50fb0971e0d0139 # v2.1.0 - with: - username: ${{ secrets.DOCKERHUB_USERNAME }} - password: ${{ secrets.DOCKERHUB_TOKEN }} - - name: Setup Docker Buildx - uses: docker/setup-buildx-action@11e8a2e2910826a92412015c515187a2d6750279 # v2.4 - - name: Docker build and push - env: - DOCKER_CLI_EXPERIMENTAL: enabled - run: | - export TAG=$(echo "${{ github.event.pull_request.head.sha || github.sha }}" | cut -c1-7) - cd server/build - export DOCKER_CLI_EXPERIMENTAL=enabled - export MM_PACKAGE=https://pr-builds.mattermost.com/mattermost-server/commit/${GITHUB_SHA}/mattermost-team-linux-amd64.tar.gz - docker buildx build --push --build-arg MM_PACKAGE=$MM_PACKAGE -t mattermost/mm-te-test:${TAG} . - sentry: - name: Send build info to sentry - runs-on: ubuntu-22.04 - needs: - - test-postgres-binary - - test-postgres-normal - - test-mysql - - build-mattermost-server - if: ${{ github.event_name == 'push' }} - env: - SENTRY_AUTH_TOKEN: ${{ secrets.MM_SERVER_SENTRY_AUTH_TOKEN }} - SENTRY_ORG: ${{ secrets.MM_SERVER_SENTRY_ORG }} - SENTRY_PROJECT: ${{ secrets.MM_SERVER_SENTRY_PROJECT }} - steps: - - name: Checkout mattermost-server - uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0 - - name: Create Sentry release - uses: getsentry/action-release@85e0095193a153d57c458995f99d0afd81b9e5ea # v1.3.0 + retention-days: 14