chore: Update templated files (26d779f) #2600
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # ============= | |
| # This file is automatically generated from the templates in stackabletech/operator-templating | |
| # DON'T MANUALLY EDIT THIS FILE | |
| # ============= | |
| --- | |
| name: Stackable Build Pipeline | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - staging | |
| - trying | |
| - "renovate/**" | |
| tags: | |
| - '[0-9][0-9].[0-9]+.[0-9]+' | |
| - '[0-9][0-9].[0-9]+.[0-9]+-rc[0-9]+' | |
| pull_request: | |
| merge_group: | |
| schedule: | |
| # Run every Saturday morning: https://crontab.guru/#15_3_*_*_6 | |
| - cron: '15 3 * * 6' | |
| workflow_dispatch: | |
| env: | |
| CARGO_TERM_COLOR: always | |
| CARGO_INCREMENTAL: '0' | |
| CARGO_PROFILE_DEV_DEBUG: '0' | |
| RUST_TOOLCHAIN_VERSION: "1.89.0" | |
| RUST_NIGHTLY_TOOLCHAIN_VERSION: "nightly-2025-10-23" | |
| PYTHON_VERSION: "3.14" | |
| RUSTFLAGS: "-D warnings" | |
| RUSTDOCFLAGS: "-D warnings" | |
| RUST_LOG: "info" | |
| jobs: | |
| # Identify unused dependencies | |
| run_udeps: | |
| name: Run Cargo Udeps | |
| runs-on: ubuntu-latest | |
| env: | |
| RUSTC_BOOTSTRAP: 1 | |
| steps: | |
| - name: Install host dependencies | |
| uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0 | |
| with: | |
| packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https | |
| version: ubuntu-latest | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| - uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921 | |
| with: | |
| toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }} | |
| - uses: Swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # v2.8.1 | |
| with: | |
| key: udeps | |
| cache-all-crates: "true" | |
| - uses: stackabletech/cargo-install-action@cargo-udeps | |
| - run: cargo udeps --workspace --all-targets | |
| # This job evaluates the github environment to determine why this action is running and decides if | |
| # Helm charts are published based on this. | |
| # | |
| # The following scenarios are identified: | |
| # - all pull requests land are published: | |
| # condition: github.event_name == "pull_request" | |
| # | |
| # - all tagged releases are published: | |
| # condition: github.event_name == 'push' & github.ref.startswith('refs/tags/') | |
| # | |
| # - all pushes to main (i.e. PR-merges) and all scheduled/manual workflow runs on main land are published: | |
| # condition: ( github.event_name == 'push' | github.event_name == 'schedule' | github.event_name == 'workflow_dispatch' ) & github.ref == 'refs/heads/main' | |
| # | |
| # Any other scenarios (e.g. when a branch is created/pushed) will cause the publish step to be skipped, most commonly this is expected to happen for the | |
| # branches that the GitHub merge queue feature uses internally for which the checks need to run, but we do not want artifacts to be published. | |
| check_helm_publish: | |
| name: Decide if Helm charts are pushed to the helm repository based on action trigger | |
| runs-on: ubuntu-latest | |
| outputs: | |
| skip_helm: ${{ steps.checkhelmpublish.outputs.skip_helm }} | |
| steps: | |
| - id: checkhelmpublish | |
| env: | |
| TRIGGER: ${{ github.event_name }} | |
| GITHUB_REF: ${{ github.ref }} | |
| run: | | |
| if [[ "$TRIGGER" == "pull_request" ]]; then | |
| echo "skip_helm=false" >> "$GITHUB_OUTPUT" | |
| elif [[ ( "$TRIGGER" == "push" || "$TRIGGER" == "schedule" || "$TRIGGER" == "workflow_dispatch" ) && "$GITHUB_REF" == "refs/heads/main" ]]; then | |
| echo "skip_helm=false" >> "$GITHUB_OUTPUT" | |
| elif [[ "$TRIGGER" == "push" && $GITHUB_REF == refs/tags/* ]]; then | |
| echo "skip_helm=false" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "Unknown trigger and ref combination encountered, skipping publish step: $TRIGGER $GITHUB_REF" | |
| echo "skip_helm=true" >> "$GITHUB_OUTPUT" | |
| fi | |
| # TODO (@Techassi): Most of these publishing and signing tasks can be done by our own actions. | |
| # Make use of them just like we do in docker-images. | |
| package_and_publish: | |
| name: Package Charts, Build Docker Image and publish them - ${{ matrix.runner }} | |
| needs: | |
| - run_udeps | |
| - check_helm_publish | |
| strategy: | |
| matrix: | |
| runner: ["ubuntu-latest", "ubicloud-standard-8-arm"] | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 120 | |
| permissions: | |
| id-token: write | |
| env: | |
| OCI_REGISTRY_SDP_PASSWORD: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }} | |
| OCI_REGISTRY_SDP_USERNAME: "robot$sdp+github-action-build" | |
| OCI_REGISTRY_SDP_CHARTS_PASSWORD: ${{ secrets.HARBOR_ROBOT_SDP_CHARTS_GITHUB_ACTION_BUILD_SECRET }} | |
| OCI_REGISTRY_SDP_CHARTS_USERNAME: "robot$sdp-charts+github-action-build" | |
| if: needs.check_helm_publish.outputs.skip_helm != 'true' | |
| outputs: | |
| IMAGE_TAG: ${{ steps.printtag.outputs.IMAGE_TAG }} | |
| steps: | |
| - name: Install host dependencies | |
| uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0 | |
| with: | |
| packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https | |
| version: ${{ matrix.runner }} | |
| - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31.8.1 | |
| - uses: dtolnay/rust-toolchain@6d653acede28d24f02e3cd41383119e8b1b35921 | |
| with: | |
| toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }} | |
| components: rustfmt | |
| # This step checks if the current run was triggered by a push to a pr (or a pr being created). | |
| # If this is the case it changes the version of this project in all Cargo.toml files to include the suffix | |
| # "-pr<prnumber>" so that the published artifacts can be linked to this PR. | |
| - uses: stackabletech/cargo-install-action@main | |
| with: | |
| crate: cargo-edit | |
| bin: cargo-set-version | |
| - name: Update version if PR against main branch | |
| if: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' }} | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| PR_VERSION="0.0.0-pr${PR_NUMBER}" | |
| cargo set-version --offline --workspace "$PR_VERSION" | |
| - name: Update version if PR against non-main branch | |
| # For PRs to be merged against a release branch, use the version that has already been set in the calling script. | |
| # We can't rely on cargo set-version here as we will break semver rules when changing the version to make it | |
| # specific to this PR e.g. 1.2.0 --> 1.2.0-pr678, so set it manually. | |
| if: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref != 'main' }} | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| MANIFEST_VERSION=$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[0].version') | |
| PR_VERSION="${MANIFEST_VERSION}-pr${PR_NUMBER}" | |
| sed -i "s/version = \"${MANIFEST_VERSION}\"/version = \"${PR_VERSION}\"/" Cargo.toml | |
| # Recreate charts and publish charts and docker image. | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 | |
| - name: Install syft | |
| uses: anchore/sbom-action/download-syft@8e94d75ddd33f69f691467e42275782e4bfefe84 # v0.20.9 | |
| - name: Build Docker image and Helm chart | |
| run: | | |
| # Installing helm and yq on ubicloud-standard-8-arm only | |
| if [ "$(arch)" = "aarch64" ]; then | |
| curl -fsSL https://packages.buildkite.com/helm-linux/helm-debian/gpgkey | gpg --dearmor | sudo tee /usr/share/keyrings/helm.gpg > /dev/null | |
| echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/helm.gpg] https://packages.buildkite.com/helm-linux/helm-debian/any/ any main" | sudo tee /etc/apt/sources.list.d/helm-stable-debian.list | |
| sudo apt-get -y update | |
| sudo apt-get -y install helm | |
| sudo wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_arm64 -O /usr/bin/yq && sudo chmod +x /usr/bin/yq | |
| fi | |
| make build | |
| - name: Publish Docker image and Helm chart | |
| if: ${{ !github.event.pull_request.head.repo.fork }} | |
| run: | | |
| # We want to publish helmcharts only once as they have a common name, while still publishing both images with architecture specific tags | |
| if [ "$(uname -m)" = "x86_64" ]; then | |
| make publish | |
| else | |
| make docker-publish | |
| fi | |
| # Output the name of the published image to the Job output for later use | |
| - id: printtag | |
| name: Output image name and tag | |
| if: ${{ !github.event.pull_request.head.repo.fork }} | |
| run: echo "IMAGE_TAG=$(make print-docker-tag)" >> "$GITHUB_OUTPUT" | |
| create_manifest_list: | |
| name: Build and publish manifest list | |
| if: ${{ !github.event.pull_request.head.repo.fork }} | |
| needs: | |
| - package_and_publish | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| env: | |
| OCI_REGISTRY_SDP_PASSWORD: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }} | |
| OCI_REGISTRY_SDP_USERNAME: "robot$sdp+github-action-build" | |
| OCI_REGISTRY_SDP_CHARTS_PASSWORD: ${{ secrets.HARBOR_ROBOT_SDP_CHARTS_GITHUB_ACTION_BUILD_SECRET }} | |
| OCI_REGISTRY_SDP_CHARTS_USERNAME: "robot$sdp-charts+github-action-build" | |
| steps: | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0 | |
| - name: Checkout | |
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| with: | |
| persist-credentials: false | |
| submodules: recursive | |
| # This step checks if the current run was triggered by a push to a pr (or a pr being created). | |
| # If this is the case it changes the version of this project in all Cargo.toml files to include the suffix | |
| # "-pr<prnumber>" so that the published artifacts can be linked to this PR. | |
| - uses: stackabletech/cargo-install-action@main | |
| with: | |
| crate: cargo-edit | |
| bin: cargo-set-version | |
| - name: Update version if PR against main branch | |
| if: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref == 'main' }} | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| run: | | |
| PR_VERSION="0.0.0-pr${PR_NUMBER}" | |
| cargo set-version --offline --workspace "$PR_VERSION" | |
| - name: Update version if PR against non-main branch | |
| # For PRs to be merged against a release branch, use the version that has already been set in the calling script. | |
| # We can't rely on cargo set-version here as we will break semver rules when changing the version to make it | |
| # specific to this PR e.g. 1.2.0 --> 1.2.0-pr678, so set it manually. | |
| if: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref != 'main' }} | |
| env: | |
| PR_NUMBER: ${{ github.event.pull_request.number }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| MANIFEST_VERSION=$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[0].version') | |
| PR_VERSION="${MANIFEST_VERSION}-pr${PR_NUMBER}" | |
| sed -i "s/version = \"${MANIFEST_VERSION}\"/version = \"${PR_VERSION}\"/" Cargo.toml | |
| - name: Build manifest list | |
| run: | | |
| # Creating manifest list | |
| make -e docker-manifest-list-build | |
| # Pushing and signing manifest list | |
| make -e docker-manifest-list-publish | |
| openshift_preflight: | |
| name: Run the OpenShift Preflight check on the published images | |
| if: ${{ !github.event.pull_request.head.repo.fork }} | |
| needs: | |
| - create_manifest_list | |
| - package_and_publish | |
| runs-on: ubuntu-latest | |
| env: | |
| IMAGE_TAG: ${{ needs.package_and_publish.outputs.IMAGE_TAG }} | |
| steps: | |
| - name: Install preflight | |
| run: | | |
| wget https://github.com/redhat-openshift-ecosystem/openshift-preflight/releases/download/1.10.0/preflight-linux-amd64 | |
| chmod +x preflight-linux-amd64 | |
| - name: Check container | |
| run: | | |
| ARCH_FOR_PREFLIGHT="$(arch | sed -e 's#x86_64#amd64#' | sed -e 's#aarch64#arm64#')" | |
| ./preflight-linux-amd64 check container "$IMAGE_TAG" --platform "${ARCH_FOR_PREFLIGHT}" > preflight.out | |
| - name: "Passed?" | |
| run: '[ "$(jq -r .passed < preflight.out)" == true ]' |