Skip to content

Commit 68516cb

Browse files
legoktmlegoktm
authored
Merge pull request #7693 from freedomofpress/enp/github
Add workflows for building and publishing container images for the demo application components to Github Packages
2 parents 57b775a + 0ed576f commit 68516cb

File tree

7 files changed

+148
-11
lines changed

7 files changed

+148
-11
lines changed

‎.github/workflows/build.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
name: Package builds
22
on:
3-
- merge_group
4-
- push
5-
- pull_request
3+
merge_group:
4+
push:
5+
branches: ["develop", "release/**"]
6+
pull_request:
7+
types: ["opened", "synchronize"]
68

79
# Only build for latest push/PR unless it's main or release/
810
concurrency:

‎.github/workflows/cargo-vet.yml‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,12 @@
22

33
name: cargo vet
44

5-
on: [push, pull_request]
5+
on:
6+
push:
7+
branches: ["develop", "release/**"]
8+
pull_request:
9+
types: ["opened", "synchronize"]
10+
merge_group:
611

712
jobs:
813
cargo-vet:

‎.github/workflows/ci.yml‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,12 @@
11
name: CI
2-
on: [push, pull_request]
2+
3+
on:
4+
push:
5+
branches: ["develop", "release/**"]
6+
pull_request:
7+
types: ["opened", "synchronize"]
8+
9+
merge_group:
310

411
defaults:
512
run:

‎.github/workflows/demo-landing.yml‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
name: Publish Demo Landing Page
3+
4+
on:
5+
push:
6+
branches: ["develop"]
7+
paths:
8+
- devops/demo/landing-page/**
9+
10+
jobs:
11+
prepare:
12+
name: Prepare
13+
runs-on: ubuntu-latest
14+
permissions:
15+
contents: read
16+
actions: read
17+
steps:
18+
- name: Determine tags
19+
id: tags
20+
env:
21+
REF: ${{ github.ref_name }}
22+
SHA: ${{ github.sha }}
23+
# So annoying that GHA doesn't have a builtin substring
24+
# function (or expose the shortened SHA). If it did then
25+
# we could drop this whole job and just set it as a statically
26+
# templated value in the build job.
27+
run: |
28+
echo "tags=$REF;$REF-${SHA:0:7}" >>$GITHUB_OUTPUT
29+
outputs:
30+
tags: ${{ steps.tags.outputs.tags }}
31+
32+
build:
33+
name: Build Landing Page
34+
uses: freedomofpress/actionslib/.github/workflows/oci-build.yaml@main
35+
needs:
36+
- prepare
37+
permissions:
38+
contents: read
39+
actions: read
40+
packages: write
41+
with:
42+
context: "."
43+
containerfile: devops/demo/landing-page/Dockerfile
44+
tags: ${{ needs.prepare.outputs.tags }}
45+
registry: ghcr.io/freedomofpress/securedrop-demo-landing-page
46+
secrets:
47+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/demo-publish.yml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
---
2+
name: Publish Demo
3+
4+
on:
5+
push:
6+
branches: ["develop"]
7+
tags: ["**"] # run for all tags
8+
9+
jobs:
10+
prepare:
11+
name: Prepare
12+
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
15+
actions: read
16+
steps:
17+
- name: Determine tags
18+
id: tags
19+
env:
20+
REF: ${{ github.ref_name }}
21+
SHA: ${{ github.sha }}
22+
# So annoying that GHA doesn't have a builtin substring
23+
# function (or expose the shortened SHA). If it did then
24+
# we could drop this whole job and just set it as a statically
25+
# templated value in the build job.
26+
run: |
27+
echo "tags=$REF;$REF-${SHA:0:7}" >>$GITHUB_OUTPUT
28+
outputs:
29+
tags: ${{ steps.tags.outputs.tags }}
30+
31+
build:
32+
name: Build
33+
uses: freedomofpress/actionslib/.github/workflows/oci-build.yaml@main
34+
needs:
35+
- prepare
36+
strategy:
37+
matrix:
38+
debian:
39+
- noble
40+
permissions:
41+
contents: read
42+
actions: read
43+
packages: write
44+
with:
45+
context: "."
46+
containerfile: securedrop/dockerfiles/${{ matrix.debian }}/python3/DemoDockerfile
47+
tags: ${{ needs.prepare.outputs.tags }}
48+
registry: ghcr.io/freedomofpress/securedrop-demo-${{ matrix.debian }}
49+
secrets:
50+
registry-password: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/demo.yml‎ renamed to ‎.github/workflows/demo-test.yml‎

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,62 @@
1-
name: Demo
1+
---
2+
name: Test Demo
23

3-
on: [push, pull_request]
4+
on:
5+
push:
6+
branches: ["develop", "release/**"]
7+
pull_request:
8+
types: ["opened", "synchronize"]
9+
merge_group:
410

511
defaults:
612
run:
713
shell: bash
814

915
jobs:
1016
build:
11-
name: Build demo
17+
name: Build Demo
18+
uses: freedomofpress/actionslib/.github/workflows/oci-build.yaml@main
19+
with:
20+
context: "."
21+
tags: demo
22+
containerfile: securedrop/dockerfiles/noble/python3/DemoDockerfile
23+
24+
test:
25+
name: Test Demo
1226
runs-on: ubuntu-24.04
27+
needs:
28+
- build
1329
env:
1430
DOCKERIZE_VERSION: v0.6.1
1531
steps:
1632
- uses: actions/checkout@v5
1733
with:
1834
persist-credentials: false
19-
- name: Build container
35+
- name: Download artifact
36+
uses: actions/download-artifact@v5
37+
with:
38+
name: ${{ needs.build.outputs.artifact-name }}
39+
- name: Restore container image
40+
env:
41+
IMAGE_FILE: ${{ needs.build.outputs.artifact-image }}
2042
run: |
21-
podman build -t demo -f securedrop/dockerfiles/noble/python3/DemoDockerfile .
43+
podman image load --input="${GITHUB_WORKSPACE}/${IMAGE_FILE}"
2244
- name: Install dockerize
2345
run: |
2446
wget https://github.com/jwilder/dockerize/releases/download/$DOCKERIZE_VERSION/dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz
2547
tar -C /usr/local/bin -xzvf dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz
2648
rm dockerize-linux-amd64-$DOCKERIZE_VERSION.tar.gz
2749
- name: Run container and verify it's up
50+
env:
51+
IMAGE: ${{ needs.build.outputs.image-url }}
2852
run: |
2953
function debug() {
3054
# Dump container logs on failure
3155
podman logs demo
3256
exit 1
3357
}
3458
# Start the container in the background
35-
podman run --name=demo -d -t -p 8080:8080 -p 8081:8081 demo
59+
podman run --name=demo -d -t -p 8080:8080 -p 8081:8081 "${IMAGE}"
3660
# And wait for both ports to be up!
3761
dockerize -wait http://127.0.0.1:8080 -timeout 2m || debug
3862
dockerize -wait http://127.0.0.1:8081 -timeout 2m || debug

‎.github/workflows/security.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,9 @@
11
name: Security
22
on:
33
push:
4+
branches: ["develop", "release/**"]
45
pull_request:
6+
types: ["opened", "synchronize"]
57
merge_group:
68
schedule:
79
- cron: '0 3 * * *'

0 commit comments

Comments
 (0)