Merge pull request #1405 from NVIDIA/update-release-ci

[no-relnote] Update release pipeline to update nspect before release

Author: cdesiniotis

.nvidia-ci.yml

@@ -203,72 +203,110 @@ push-images-to-staging:
     OUT_IMAGE_NAME: "${NGC_STAGING_REGISTRY}/k8s-device-plugin"
     OUT_IMAGE_TAG: "${CI_COMMIT_SHORT_SHA}"
 
-.publish-images:
+.ngc-publish-variables:
+  variables:
+    PROJECT_NAME: "k8s-device-plugin"
+    VERSIONS_FILE: "build-info-${CI_PIPELINE_ID}.txt"
+  before_script:
+    - |
+      if [ -n "${CI_COMMIT_TAG}" ]; then
+        echo "${CI_COMMIT_SHORT_SHA} ${CI_COMMIT_TAG}" > "${VERSIONS_FILE}"
+      else
+        echo "${CI_COMMIT_SHORT_SHA} publish-${CI_COMMIT_SHORT_SHA}" > "${VERSIONS_FILE}"
+      fi
+
+.update-nspect:
   stage: ngc-publish
   needs:
-    - scan-images
     - push-images-to-staging
+  extends:
+    - .ngc-publish-variables
   image:
     name: "${CNT_NGC_PUBLISH_IMAGE}"
     pull_policy: always
   variables:
+    REPO_URL: "https://github.com/NVIDIA/${PROJECT_NAME}.git"
+  script:
+    - |
+      cnt-ngc-publish nspect --versions-file "${VERSIONS_FILE}"
 
+# Update the nspect staging environment to test the nspect publishing logic
+update-nspect-staging:
+  extends:
+    - .update-nspect
+  rules:
+    - if: $CI_COMMIT_TAG == null || $CI_COMMIT_TAG == ""
   variables:
-    GITLAB_ACCESS_TOKEN: "${CNT_GITLAB_TOKEN}"
+    ENV: "stage"
+    RELEASE_VERSION: "test"
+    NSPECT_CLIENT_ID: "${NSPECT_STAGING_CLIENT_ID}"
+    NSPECT_CLIENT_SECRET: "${NSPECT_STAGING_CLIENT_SECRET}"
 
-    IN_IMAGE_TAG: "${CI_COMMIT_SHORT_SHA}"
-    OUT_IMAGE_TAG: "${CI_COMMIT_TAG}"
+# Update the nspect production environment with the new release
+update-nspect:
+  extends:
+    - .update-nspect
+  rules:
+    - if: $CI_COMMIT_TAG
+  variables:
+    OSRB_BUG_ID: "${OSRB_BUG_ID}"
+    ENV: "prod"
+    RELEASE_VERSION: "${CI_COMMIT_TAG}"
+    NSPECT_CLIENT_ID: "${NSPECT_PROD_CLIENT_ID}"
+    NSPECT_CLIENT_SECRET: "${NSPECT_PROD_CLIENT_SECRET}"
 
-    VERSION_FILE: "build-info-${CI_PIPELINE_ID}.txt"
-    PROJECT_NAME: "k8s-device-plugin"
+.publish-images:
+  stage: ngc-publish
+  extends:
+    - .ngc-publish-variables
+  image:
+    name: "${CNT_NGC_PUBLISH_IMAGE}"
+    pull_policy: always
+  variables:
+    GITLAB_ACCESS_TOKEN: "${CNT_GITLAB_TOKEN}"
     # Allow for setting nspect program version manually.
     # The default empty string value results in the key
     # being omitted from the publishing doc (which is
     # valid).
     NSPECT_PROGRAM_VERSION: ""
-  before_script:
+  script:
     - |
-      if [ -n "${OVERRIDE_PUBLISHING_PROJECT_PATH}" ]; then
-        NGC_PUBLISHING_PROJECT_PATH="${OVERRIDE_PUBLISHING_PROJECT_PATH}"
-      fi
-
       if [ -z "${NGC_PUBLISHING_PROJECT_PATH}" ]; then
         echo "NGC_PUBLISHING_PROJECT_PATH not set"
         exit 1
       fi
 
       echo "publishing to ${NGC_PUBLISHING_PROJECT_PATH}"
 
-      rm -f ${VERSION_FILE}
-      echo "${IN_IMAGE_TAG} ${OUT_IMAGE_TAG}" >> ${VERSION_FILE}
-      cat ${VERSION_FILE}
-  script:
-    - |
       cnt-ngc-publish render \
           --project-name "${PROJECT_NAME}" \
-          --versions-file "${VERSION_FILE}" \
-          --output "${PROJECT_NAME}".yaml \
+          --versions-file "${VERSIONS_FILE}" \
+          --output "${PROJECT_NAME}.yaml" \
           --nspect-program-version "${NSPECT_PROGRAM_VERSION}"
     - cnt-ngc-publish merge-request --files "${PROJECT_NAME}.yaml"
   artifacts:
     paths:
       - "${VERSION_FILE}"
       - "${PROJECT_NAME}.yaml"
 
-
-publish-images-to-ngc:
+# Raise an MR to publish the image to NGC
+ngc-image-publish:
   extends:
     - .publish-images
   rules:
     - if: $CI_COMMIT_TAG
+  needs:
+    - job: update-nspect
+  variables:
+    NGC_PUBLISHING_PROJECT_PATH: "${NGC_PUBLISHING_PROD_PROJECT_PATH}"
 
-# We create a dummy MR that exercises the publishing logic.
-# TODO: This MR should be closed automatically.
-publish-images-dummy:
+# Create a dummy MR that exercises the publishing logic
+mock-image-publish:
   extends:
     - .publish-images
-  variables:
-    OVERRIDE_PUBLISHING_PROJECT_PATH: "dl/container-dev/ngc-automation"
-    OUT_IMAGE_TAG: "publish-${CI_COMMIT_SHORT_SHA}"
   rules:
     - if: $CI_COMMIT_TAG == null || $CI_COMMIT_TAG == ""
+  needs:
+    - job: update-nspect-staging
+  variables:
+    NGC_PUBLISHING_PROJECT_PATH: "${NGC_PUBLISHING_TEST_PROJECT_PATH}"