Skip to content

Commit 6643e16

Browse files
uptickmetachuuptickmetachu
authored
Merge pull request #148 from uptick/sec-96/private-actions
SEC-96 chore(ci): replace uptick/actions with inline workflow steps
2 parents b8be07d + 118383f commit 6643e16

2 files changed

Lines changed: 157 additions & 51 deletions

File tree

‎.github/workflows/release-please.yaml‎

Lines changed: 54 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ on:
55
- develop
66

77
permissions:
8-
actions: read # Read the metrics
9-
contents: write # to be able to publish a GitHub release
10-
issues: write # to be able to comment on released issues
11-
pull-requests: write # to be able to comment on released pull requests
12-
id-token: write # to enable use of OIDC for npm provenance / AWS
8+
actions: read
9+
contents: write
10+
issues: write
11+
pull-requests: write
12+
id-token: write
1313

1414
env:
1515
MISE_PYTHON_COMPILE: false
@@ -35,7 +35,7 @@ jobs:
3535
needs: release-please
3636
if: ${{ needs.release-please.outputs.helm-version }}
3737
steps:
38-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
38+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6.0.1
3939
- name: Publish Helm charts
4040
uses: stefanprodan/helm-gh-pages@89c6698c192e70ed0e495bee7d3d1ca5b477fe82 # ratchet:stefanprodan/helm-gh-pages@master
4141
with:
@@ -45,36 +45,66 @@ jobs:
4545
name: Publishes tag to pypi
4646
runs-on: ubuntu-latest
4747
needs: release-please
48-
if: ${{ needs.release-please.outputs.cli-release-created}}
48+
if: ${{ needs.release-please.outputs.cli-release-created }}
4949
steps:
50-
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
50+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6.0.1
5151

52-
- uses: jdx/mise-action@c37c93293d6b742fc901e1406b8f764f6fb19dac # ratchet:jdx/mise-action@v2
52+
- uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # ratchet:jdx/mise-action@v3.5.1
5353
with:
5454
install: true
5555
cache: true
5656
experimental: true
5757

58-
- run: |
59-
mise run build
58+
- run: mise run build
6059
shell: bash
6160

6261
- name: Publish Pypi Package
6362
uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # ratchet:pypa/gh-action-pypi-publish@release/v1
6463

6564
publish_docker_image:
6665
name: Build and Push Docker Image
67-
uses: uptick/actions/.github/workflows/ci.yaml@main # ratchet:exclude
66+
runs-on: ubuntu-24.04
6867
needs: release-please
69-
if: ${{ needs.release-please.outputs.server-release-created}}
70-
secrets:
71-
SECRET_ENV: "${{ secrets.CLUSTER_KEY }}"
72-
#https://github.com/uptick/actions/blob/main/.github/workflows/ci.yaml
73-
with:
74-
aws-iam-role-arn: "arn:aws:iam::610829907584:role/default-github-actions-ci-role"
75-
docker-enabled: true
76-
docker-context: "."
77-
docker-tag: "${{ needs.release-please.outputs.server-version }}"
78-
docker-tag-latest: true
79-
docker-repository: "610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops"
80-
command: echo $SECRET_ENV | base64 -d > cluster.key
68+
if: ${{ needs.release-please.outputs.server-release-created }}
69+
steps:
70+
- name: Checkout Code
71+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6.0.1
72+
with:
73+
fetch-depth: 2
74+
75+
- name: Set environment variables
76+
run: |
77+
echo "GIT_SHORT_HASH=$(echo ${{ github.sha }} | cut -c -7)" >> $GITHUB_ENV
78+
79+
- name: Decode cluster key
80+
env:
81+
SECRET_ENV: ${{ secrets.CLUSTER_KEY }}
82+
run: echo $SECRET_ENV | base64 -d > cluster.key
83+
84+
- name: Configure AWS Credentials
85+
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # ratchet:aws-actions/configure-aws-credentials@v5.1.1
86+
with:
87+
role-to-assume: arn:aws:iam::610829907584:role/default-github-actions-ci-role
88+
role-session-name: ${{ github.repository_owner }}-${{ github.event.repository.name }}
89+
aws-region: ap-southeast-2
90+
91+
- name: Set up Docker Buildx
92+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3.12.0
93+
94+
- name: Login to Amazon ECR
95+
uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # ratchet:aws-actions/amazon-ecr-login@v2
96+
97+
- name: Build and push image
98+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
99+
with:
100+
context: "."
101+
file: Dockerfile
102+
cache-from: type=gha
103+
cache-to: type=gha, mode=max
104+
provenance: false
105+
platforms: linux/amd64,linux/arm64
106+
push: true
107+
tags: |
108+
610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:${{ env.GIT_SHORT_HASH }}
109+
610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:latest
110+
610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:${{ needs.release-please.outputs.server-version }}

‎.github/workflows/test.yml‎

Lines changed: 103 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -6,35 +6,111 @@ on:
66
pull_request: ~
77

88
permissions:
9-
actions: read # Read the metrics
10-
contents: write # to be able to publish a GitHub release
11-
issues: write # to be able to comment on released issues
12-
pull-requests: write # to be able to comment on released pull requests
13-
id-token: write # to enable use of OIDC for npm provenance / AWS
9+
actions: read
10+
contents: write
11+
issues: write
12+
pull-requests: write
13+
id-token: write
14+
15+
env:
16+
PYTHONUNBUFFERED: 1
1417

1518
jobs:
1619
ci:
17-
uses: uptick/actions/.github/workflows/ci.yaml@main # ratchet:exclude
18-
secrets: inherit
19-
with:
20-
praise-on-fix: false
21-
python-version: 3.12
22-
mise: true
23-
mise-install: true
24-
command: |
25-
mise run install
26-
mise run ci
20+
runs-on: ubuntu-24.04
21+
steps:
22+
- name: Checkout Code
23+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6.0.1
24+
with:
25+
fetch-depth: 2
26+
27+
- name: Install Python
28+
uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # ratchet:actions/setup-python@v6.1.0
29+
with:
30+
python-version: "3.12"
31+
32+
- name: Setup mise
33+
uses: jdx/mise-action@146a28175021df8ca24f8ee1828cc2a60f980bd5 # ratchet:jdx/mise-action@v3.5.1
34+
with:
35+
install: true
36+
cache: true
37+
experimental: true
38+
39+
- name: Run CI
40+
env:
41+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
42+
run: |
43+
mise run install
44+
mise run ci
45+
2746
build:
2847
name: Build and Push Docker Image
29-
uses: uptick/actions/.github/workflows/ci.yaml@main # ratchet:exclude
30-
secrets:
31-
SECRET_ENV: "${{ secrets.CLUSTER_KEY }}"
32-
#https://github.com/uptick/actions/blob/main/.github/workflows/ci.yaml
33-
with:
34-
aws-iam-role-arn: "arn:aws:iam::610829907584:role/default-github-actions-ci-role"
35-
docker-enabled: true
36-
docker-context: "."
37-
docker-prefix: test
38-
docker-tag-latest: false
39-
docker-repository: "610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops"
40-
command: echo $SECRET_ENV | base64 -d > cluster.key
48+
runs-on: ubuntu-24.04
49+
steps:
50+
- name: Checkout Code
51+
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # ratchet:actions/checkout@v6.0.1
52+
with:
53+
fetch-depth: 2
54+
55+
- name: Set environment variables
56+
run: |
57+
if [[ ${{ github.event_name }} != 'pull_request' ]]; then
58+
echo "GIT_SHORT_HASH=$(echo ${{ github.sha }} | cut -c -7)" >> $GITHUB_ENV
59+
else
60+
echo "GIT_SHORT_HASH=$(echo ${{ github.event.pull_request.head.sha }} | cut -c -7)" >> $GITHUB_ENV
61+
fi
62+
63+
- name: Decode cluster key
64+
env:
65+
SECRET_ENV: ${{ secrets.CLUSTER_KEY }}
66+
run: echo $SECRET_ENV | base64 -d > cluster.key
67+
68+
- name: Configure AWS Credentials
69+
uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # ratchet:aws-actions/configure-aws-credentials@v5.1.1
70+
with:
71+
role-to-assume: arn:aws:iam::610829907584:role/default-github-actions-ci-role
72+
role-session-name: ${{ github.repository_owner }}-${{ github.event.repository.name }}
73+
aws-region: ap-southeast-2
74+
75+
- name: Set up Docker Buildx
76+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # ratchet:docker/setup-buildx-action@v3.12.0
77+
78+
- name: Login to Amazon ECR
79+
uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076 # ratchet:aws-actions/amazon-ecr-login@v2
80+
81+
- name: Build and push image
82+
uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # ratchet:docker/build-push-action@v6
83+
with:
84+
context: "."
85+
file: Dockerfile
86+
cache-from: type=gha
87+
cache-to: type=gha, mode=max
88+
provenance: false
89+
platforms: linux/amd64,linux/arm64
90+
push: true
91+
tags: |
92+
610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:test-${{ env.GIT_SHORT_HASH }}
93+
94+
- name: Prepare Docker image comment
95+
id: docker_comment
96+
if: github.event_name == 'pull_request'
97+
run: |
98+
{
99+
echo "comment<<EOF"
100+
echo "## Docker Images"
101+
echo ""
102+
echo "**Commit:** \`${{ github.event.pull_request.head.sha }}\`"
103+
echo ""
104+
echo "| Tag |"
105+
echo "| --- |"
106+
echo "| \`610829907584.dkr.ecr.ap-southeast-2.amazonaws.com/gitops:test-${{ env.GIT_SHORT_HASH }}\` |"
107+
echo "EOF"
108+
} >> "$GITHUB_OUTPUT"
109+
110+
- name: Comment Docker images on PR
111+
if: github.event_name == 'pull_request'
112+
uses: marocchino/sticky-pull-request-comment@67d0dec7b07ed060a405f9b2a64b8ab319fdd7db # ratchet:marocchino/sticky-pull-request-comment@v2.9.2
113+
with:
114+
header: docker-image-tags
115+
message: ${{ steps.docker_comment.outputs.comment }}
116+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

0 commit comments

Comments
 (0)