Skip to content

Commit afeed6a

Browse files
jgreatjgreat
committed
add initial dockerfile and config
1 parent c4d9c85 commit afeed6a

File tree

9 files changed

+360
-1
lines changed

9 files changed

+360
-1
lines changed

‎.githooks/pre-commit‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
#!/bin/bash
2+
# Copyright (c) 2022-2023 MobileCoin Inc.
3+
4+
# Set fancy pants colors
5+
no_color='\033[0m'
6+
bold_white='\033[1;37m'
7+
red='\033[0;31m'
8+
green='\033[0;32m'
9+
10+
# Set default headers
11+
header="${bold_white}[pre-commit]${no_color}"
12+
ok="${green}[ OK ]${no_color}"
13+
failed="${red}[ FAILED ]${no_color}"
14+
15+
# Check the results and print output if there are errors.
16+
check_results()
17+
{
18+
if [[ "${error}" == "true" ]]
19+
then
20+
echo -e "${failed}"
21+
echo -e "${out}"
22+
exit 1
23+
else
24+
echo -e "${ok}"
25+
fi
26+
}
27+
28+
# error flag starts off as false
29+
error="false"
30+
31+
# Get list of files included in the commit. We don't need to necessarily check the whole project.
32+
files=$(git diff --cached --name-only --diff-filter=ACM)
33+
34+
# Run shellcheck if installed
35+
if which shellcheck >/dev/null 2>&1
36+
then
37+
echo -e -n "${header} Run shellcheck on files included in the commit "
38+
39+
out=""
40+
for f in ${files}
41+
do
42+
# check only files that have proper shebang headers
43+
if grep -E "^#!.*(sh|bash|ksh)$" "${f}" >/dev/null 2>&1
44+
then
45+
if ! out+=$(shellcheck -Calways -x "${f}" 2>&1)
46+
then
47+
error="true"
48+
fi
49+
fi
50+
done
51+
52+
# check for error status and print results
53+
check_results
54+
fi
55+
56+
# Run actionlint to check GHA workflow syntax
57+
if which actionlint >/dev/null 2>&1
58+
then
59+
echo -e -n "${header} Run actionlint on GHA workflow files "
60+
61+
out=""
62+
if ! out+=$(actionlint -color 2>&1)
63+
then
64+
error="true"
65+
fi
66+
67+
# check for error status and print results
68+
check_results
69+
fi
70+
71+
# Run hadolint on Dockerfiles included in .internal-ci/docker
72+
if which hadolint >/dev/null 2>&1
73+
then
74+
echo -e -n "${header} Run hadolint on Dockerfiles "
75+
76+
out=""
77+
78+
# Find Dockerfile files
79+
docker_files=$(find . -name "Dockerfile*" -type f | grep -v "dockerignore")
80+
81+
# helm lint on directories where there are chart.yaml files
82+
for f in ${docker_files}
83+
do
84+
if ! out+=$(hadolint "${f}" 2>&1)
85+
then
86+
error="true"
87+
fi
88+
done
89+
90+
# check for error status and print results
91+
check_results
92+
fi

‎.github/actionlint.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
self-hosted-runner:
2+
# Labels of self-hosted runner in array of string
3+
labels:
4+
- small
5+
- large

‎.github/workflows/build-and-publish.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Copyright (c) 2023 MobileCoin Inc.
2+
name: build-and-publish
3+
4+
on:
5+
push:
6+
tags:
7+
- '*.*.*'
8+
pull_request: {}
9+
10+
env:
11+
DOCKER_ORG: mobilecoin
12+
13+
jobs:
14+
docker:
15+
runs-on: ubuntu-22.04
16+
steps:
17+
- name: Checkout
18+
uses: mobilecoinofficial/gh-actions/checkout@v0
19+
20+
- name: Build/Publish Image
21+
uses: mobilecoinofficial/gh-actions/docker@v0
22+
with:
23+
dockerfile: ./Dockerfile
24+
flavor: latest=true
25+
images: mobilecoin/gha-runner
26+
password: ${{ secrets.DOCKERHUB_TOKEN }}
27+
push: ${{ github.event_name == 'pull_request' && 'false' || 'true' }}
28+
tags: |
29+
type=semver,pattern={{version}},priority=20
30+
type=sha,priority=10
31+
username: ${{ secrets.DOCKERHUB_USERNAME }}

‎.github/workflows/checks.yaml‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
# Copyright (c) 2023 MobileCoin Inc.
2+
name: checks
3+
4+
on:
5+
pull_request: {}
6+
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.ref }}
9+
cancel-in-progress: true
10+
11+
permissions:
12+
pull-requests: write
13+
contents: read
14+
15+
jobs:
16+
lint-docker:
17+
runs-on: ubuntu-22.04
18+
steps:
19+
- name: Checkout
20+
uses: mobilecoinofficial/gh-actions/checkout@v0
21+
22+
- name: Run hadolint with reviewdog
23+
uses: reviewdog/action-hadolint@v1
24+
with:
25+
fail_on_error: true
26+
reporter: github-pr-review
27+
exclude: |
28+
*.dockerignore
29+
30+
lint-shell:
31+
runs-on: ubuntu-22.04
32+
steps:
33+
- name: Checkout
34+
uses: mobilecoinofficial/gh-actions/checkout@v0
35+
36+
- name: Run shellcheck with reviewdog
37+
uses: reviewdog/action-shellcheck@v1
38+
with:
39+
fail_on_error: true
40+
reporter: github-pr-review
41+
42+
lint-actions:
43+
runs-on: ubuntu-22.04
44+
steps:
45+
- name: Checkout
46+
uses: mobilecoinofficial/gh-actions/checkout@v0
47+
48+
- name: Run actionlint with reviewdog
49+
uses: reviewdog/action-actionlint@v1
50+
with:
51+
fail_on_error: true
52+
reporter: github-pr-review
53+
54+
workflow-ok:
55+
needs:
56+
- lint-docker
57+
- lint-shell
58+
- lint-actions
59+
runs-on: ubuntu-22.04
60+
steps:
61+
- name: All Checks OK!
62+
run: |
63+
true

‎.github/workflows/release.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Copyright (c) 2023 MobileCoin Inc.
2+
name: release
3+
4+
on:
5+
push:
6+
tags:
7+
- '*.*.*'
8+
9+
permissions:
10+
contents: write
11+
12+
jobs:
13+
gh-release:
14+
runs-on: ubuntu-22.04
15+
steps:
16+
- name: Checkout
17+
uses: mobilecoinofficial/gh-actions/checkout@v0
18+
19+
- name: Create a GitHub Release
20+
uses: softprops/action-gh-release@v1
21+
with:
22+
generate_release_notes: true

‎.github/workflows/tag.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
# Copyright (c) 2023 MobileCoin Inc.
2+
name: tag
3+
4+
on:
5+
push:
6+
branches:
7+
- main
8+
9+
# when the gh publishes a new ghcr.io/actions/actions-runner image renovate should PR.
10+
# we want the tag from renovate update?
11+
# can we get renovate to add something like `[tag/2.310.0]` to the commit message?
12+
# something we can scrape?
13+
14+
jobs:
15+
tag:
16+
runs-on: ubuntu-22.04
17+
steps:
18+
# We need to use an external PAT here because GHA will not run downstream events if we use the built in token.
19+
- name: Checkout
20+
uses: mobilecoinofficial/gh-actions/checkout@2839c84b9279bfc02df70884d42700769bfbfc39
21+
with:
22+
token: ${{ secrets.ACTIONS_TOKEN }}
23+
24+
# - name: Bump GitHub tag
25+
# id: bump
26+
# uses: anothrNick/[email protected]
27+
# env:
28+
# GITHUB_TOKEN: ${{ secrets.ACTIONS_TOKEN }}
29+
# WITH_V: 'true'
30+
# DEFAULT_BUMP: patch
31+
# DRY_RUN: 'true'
32+
33+
# # Doing manual tags because anothrNick/github-tag-action won't retag a commit.
34+
# - name: Get major and minor values for new tag
35+
# id: tags
36+
# env:
37+
# TAG: ${{ steps.bump.outputs.new_tag }}
38+
# run: |
39+
# export MAJOR_MINOR=${TAG%.*}
40+
# export MAJOR=${MAJOR_MINOR%.*}
41+
# git tag --force "${MAJOR}"
42+
# git tag --force "${MAJOR_MINOR}"
43+
# git tag --force "${TAG}"
44+
# git push --tags --force

‎.hadolint.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
ignored:
2+
- DL3008
3+
- DL3015

‎Dockerfile‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
FROM ghcr.io/actions/actions-runner:2.311.0
2+
3+
USER root
4+
5+
RUN apt-get update \
6+
&& apt-get install -y --no-install-recommends \
7+
curl \
8+
ca-certificates \
9+
zstd \
10+
gzip \
11+
tar \
12+
jq \
13+
git \
14+
zip \
15+
unzip \
16+
&& apt-get clean \
17+
&& rm -r /var/lib/apt/lists/*
18+
19+
USER runner

‎README.md‎

Lines changed: 81 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,82 @@
11
# gha-runner
2-
`FROM actions/action-runner` image with utilities installed so actions actually work.
2+
3+
Automated updated builds starting with `ghcr.io/actions/actions-runner` image. Adds with utilities installed so actions actually work.
4+
5+
Adds the following packages to the base image.
6+
7+
```
8+
curl
9+
ca-certificates
10+
zstd
11+
gzip
12+
tar
13+
jq
14+
git
15+
zip
16+
unzip
17+
```
18+
19+
### How to use
20+
21+
Replace `ghcr.io/actions/actions-runner` with `mobilecoin/gha-runner` in your `gha-runner-scale-set` helm releases.
22+
23+
Example `values.yaml`. See the [gha-runner-scale-set docs](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/deploying-runner-scale-sets-with-actions-runner-controller#using-advanced-configuration-options) for full details on customizing your install.
24+
25+
```yaml
26+
runnerScaleSetName: dev-small-x64
27+
githubConfigUrl: https://github.com/<GitHub Org>
28+
githubConfigSecret: <GitHub App Secret>
29+
maxRunners: 25
30+
minRunners: 0
31+
runnerGroup: default
32+
33+
template:
34+
spec:
35+
imagePullSecrets:
36+
- name: docker-credentials
37+
initContainers:
38+
- name: init-dind-externals
39+
image: mobilecoin/gha-runner:latest
40+
command: ["cp", "-r", "-v", "/home/runner/externals/.", "/home/runner/tmpDir/"]
41+
volumeMounts:
42+
- name: dind-externals
43+
mountPath: /home/runner/tmpDir
44+
containers:
45+
- name: runner
46+
image: mobilecoin/gha-runner:latest
47+
command: ["/home/runner/run.sh"]
48+
env:
49+
- name: DOCKER_HOST
50+
value: unix:///run/docker/docker.sock
51+
volumeMounts:
52+
- name: work
53+
mountPath: /home/runner/_work
54+
- name: dind-sock
55+
mountPath: /run/docker
56+
readOnly: true
57+
- name: dind
58+
image: docker:dind
59+
args:
60+
- dockerd
61+
- --host=unix:///run/docker/docker.sock
62+
- --group=$(DOCKER_GROUP_GID)
63+
env:
64+
- name: DOCKER_GROUP_GID
65+
value: "123"
66+
securityContext:
67+
privileged: true
68+
volumeMounts:
69+
- name: work
70+
mountPath: /home/runner/_work
71+
- name: dind-sock
72+
mountPath: /run/docker
73+
- name: dind-externals
74+
mountPath: /home/runner/externals
75+
volumes:
76+
- name: work
77+
emptyDir: {}
78+
- name: dind-sock
79+
emptyDir: {}
80+
- name: dind-externals
81+
emptyDir: {}
82+
```

0 commit comments

Comments
 (0)