diff --git a/.github/workflows/publish_tool.yaml b/.github/workflows/publish_tool.yaml index d338dc43c1..d4d45eb1a0 100644 --- a/.github/workflows/publish_tool.yaml +++ b/.github/workflows/publish_tool.yaml @@ -11,13 +11,16 @@ env: GHCR: ghcr.io jobs: - tool: - runs-on: oracle-vm-8cpu-32gb-x86-64 - timeout-minutes: 30 - permissions: - packages: write + # Build images for each platform in parallel using native runners + build: strategy: + fail-fast: false matrix: + platform: + - runner: ubuntu-24.04 + arch: amd64 + - runner: ubuntu-24.04-arm + arch: arm64 image: - actions-gh-release - actions-plan-preview @@ -25,6 +28,10 @@ jobs: - piped-base - piped-base-okd - firestore-emulator + runs-on: ${{ matrix.platform.runner }} + timeout-minutes: 30 + permissions: + packages: write steps: - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: @@ -32,11 +39,9 @@ jobs: - name: Determine version run: echo "PIPECD_VERSION=$(git describe --tags --always --abbrev=7 --match 'v[0-9]*.*')" >> $GITHUB_ENV - - uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3.2.0 - - - uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1 - # Login to push container images. - name: Log in to the container registry uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 with: @@ -44,14 +49,77 @@ jobs: username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - # Building and pushing container images. - - name: Build and push ${{ matrix.image }} image - uses: docker/build-push-action@0565240e2d4ab88bba5387d719585280857ece09 #v5.0.0 + - name: Build and push ${{ matrix.image }} image (${{ matrix.platform.arch }}) + id: build + uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0 with: context: tool/${{ matrix.image }} - tags: ${{ env.GHCR }}/pipe-cd/${{ matrix.image }}:${{ env.PIPECD_VERSION }} - platforms: linux/amd64,linux/arm64 - push: true - # parameter to use inline cache. ref; https://docs.docker.com/build/ci/github-actions/cache/#inline-cache + platforms: linux/${{ matrix.platform.arch }} + outputs: type=image,name=${{ env.GHCR }}/pipe-cd/${{ matrix.image }},push-by-digest=true,name-canonical=true,push=true cache-from: type=registry,ref=${{ env.GHCR }}/pipe-cd/${{ matrix.image }}:latest cache-to: type=inline + + - name: Export digest + run: | + mkdir -p /tmp/digests + digest="${{ steps.build.outputs.digest }}" + touch "/tmp/digests/${digest#sha256:}" + + - name: Upload digest + uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + with: + name: digests-${{ matrix.image }}-${{ matrix.platform.arch }} + path: /tmp/digests/* + if-no-files-found: error + retention-days: 1 + + # Merge platform-specific images into multi-arch manifest + merge: + runs-on: ubuntu-24.04 + needs: build + timeout-minutes: 15 + permissions: + packages: write + strategy: + matrix: + image: + - actions-gh-release + - actions-plan-preview + - codegen + - piped-base + - piped-base-okd + - firestore-emulator + steps: + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + fetch-depth: 0 + - name: Determine version + run: echo "PIPECD_VERSION=$(git describe --tags --always --abbrev=7 --match 'v[0-9]*.*')" >> $GITHUB_ENV + + - name: Download digests + uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + with: + path: /tmp/digests + pattern: digests-${{ matrix.image }}-* + merge-multiple: true + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3.7.1 + + - name: Log in to the container registry + uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0 + with: + registry: ${{ env.GHCR }} + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Create manifest list and push + working-directory: /tmp/digests + run: | + docker buildx imagetools create \ + -t ${{ env.GHCR }}/pipe-cd/${{ matrix.image }}:${{ env.PIPECD_VERSION }} \ + $(printf '${{ env.GHCR }}/pipe-cd/${{ matrix.image }}@sha256:%s ' *) + + - name: Inspect image + run: | + docker buildx imagetools inspect ${{ env.GHCR }}/pipe-cd/${{ matrix.image }}:${{ env.PIPECD_VERSION }} diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml index 321a598289..b79d88ffec 100644 --- a/.github/workflows/stale.yaml +++ b/.github/workflows/stale.yaml @@ -21,5 +21,4 @@ jobs: close-pr-message: 'This PR was closed because it has been stalled for 7 days with no activity. Feel free to reopen if still applicable.' days-before-pr-stale: 30 days-before-pr-close: 7 - delete-branch: true - exempt-pr-labels: 'not-auto-close' \ No newline at end of file + exempt-pr-labels: 'not-auto-close' diff --git a/.github/workflows/thank-you.yaml b/.github/workflows/thank-you.yaml index 782c4a68f4..314b9ea6fe 100644 --- a/.github/workflows/thank-you.yaml +++ b/.github/workflows/thank-you.yaml @@ -11,13 +11,13 @@ permissions: jobs: thank-you: - # Only run if the PR was actually merged - if: github.event.pull_request.merged + if: github.event.pull_request.merged == true runs-on: ubuntu-latest steps: - # We must check out the code to read the MAINTAINERS.json file - name: Checkout repository uses: actions/checkout@v4 + with: + ref: ${{ github.event.pull_request.base.sha }} - name: Leave a Thank You Comment uses: actions/github-script@v7 @@ -26,29 +26,24 @@ jobs: const fs = require('fs'); const creator = context.payload.pull_request.user.login; - // Skip bots to avoid comment loops if (creator.endsWith('[bot]')) { console.log('Skipping bot account.'); return; } - // Read maintainers list from JSON file const maintainersData = JSON.parse(fs.readFileSync('MAINTAINERS.json', 'utf8')); const maintainers = maintainersData.maintainers.map(m => m.toLowerCase()); - // Skip core maintainers to avoid spamming the team if (maintainers.includes(creator.toLowerCase())) { console.log(`Skipping maintainer account: ${creator}`); return; } - const message = 'Thank you for contributing to PipeCD! The changes in this pull request will be part of the upcoming release!'; + const message = `Thank you for contributing to PipeCD, @${creator}! The changes in this pull request will be part of the upcoming release!`; - // Post the comment to the PR await github.rest.issues.createComment({ owner: context.repo.owner, repo: context.repo.repo, issue_number: context.payload.pull_request.number, body: message }); - \ No newline at end of file diff --git a/docs/README.md b/docs/README.md index 7624567e64..cc951bcb29 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,4 +1,4 @@ -# Documentation +# Documentation XYZ CHANGE FOR TESTING The source files for the documentation is placing in [content](https://github.com/pipe-cd/pipecd/tree/master/docs/content) directory. diff --git a/workflow-audit/issues/maintenance-publish-tool-qemu-vs-native-arm.md b/workflow-audit/issues/maintenance-publish-tool-qemu-vs-native-arm.md new file mode 100644 index 0000000000..26742b621d --- /dev/null +++ b/workflow-audit/issues/maintenance-publish-tool-qemu-vs-native-arm.md @@ -0,0 +1,15 @@ +# Maintenance: publish_tool.yaml uses QEMU emulation while build_tool.yaml uses native ARM runners + +**Files:** `.github/workflows/build_tool.yaml`, `.github/workflows/publish_tool.yaml` + +## Problem + +`build_tool.yaml` (PR check) builds tool images using native `ubuntu-24.04-arm` runners — fast and architecturally correct. + +`publish_tool.yaml` (merge/tag publish) builds the same images using QEMU emulation on a single x86 runner — slow and can produce subtly incorrect binaries for architecture-specific code. + +`publish_pipedv1_exp.yaml` uses the correct pattern: native runners per arch + digest merge into a multi-arch manifest. + +## Fix + +Migrate `publish_tool.yaml` to the same native runner + digest merge pattern used in `publish_pipedv1_exp.yaml`. This ensures that what is validated in CI is exactly what gets published.