Skip to content

Commit 3ffd038

Browse files
stackable-botstackable-bot
authored
ci: Remove Nexus jobs/workflows (#937)
chore: Generated commit to update templated files since the last template run up to stackabletech/operator-templating@b87916a Reference-to: stackabletech/operator-templating@b87916a (Remove Nexus jobs/workflows)
1 parent e8fb7c3 commit 3ffd038

File tree

2 files changed

+21
-80
lines changed

2 files changed

+21
-80
lines changed

‎.github/workflows/build.yml

+20-34
Original file line numberDiff line numberDiff line change
@@ -32,9 +32,6 @@ env:
3232
RUSTFLAGS: "-D warnings"
3333
RUSTDOCFLAGS: "-D warnings"
3434
RUST_LOG: "info"
35-
DEV_REPO_HELM_URL: https://repo.stackable.tech/repository/helm-dev
36-
TEST_REPO_HELM_URL: https://repo.stackable.tech/repository/helm-test
37-
STABLE_REPO_HELM_URL: https://repo.stackable.tech/repository/helm-stable
3835

3936
jobs:
4037
# Identify unused dependencies
@@ -63,47 +60,41 @@ jobs:
6360
- uses: stackabletech/cargo-install-action@cargo-udeps
6461
- run: cargo udeps --workspace --all-targets
6562

66-
# This job evaluates the github environment to determine why this action is running and selects the appropriate
67-
# target repository for published Helm charts based on this.
63+
# This job evaluates the github environment to determine why this action is running and decides if
64+
# Helm charts are published based on this.
6865
#
6966
# The following scenarios are identified:
70-
# - all pull requests land in the test repository:
67+
# - all pull requests land are published:
7168
# condition: github.event_name == "pull_request"
72-
# repository: test
7369
#
74-
# - all tagged releases land in stable:
70+
# - all tagged releases are published:
7571
# condition: github.event_name == 'push' & github.ref.startswith('refs/tags/')
76-
# repository: stable
7772
#
78-
# - all pushes to main (i.e. PR-merges) and all scheduled/manual workflow runs on main land in dev:
73+
# - all pushes to main (i.e. PR-merges) and all scheduled/manual workflow runs on main land are published:
7974
# condition: ( github.event_name == 'push' | github.event_name == 'schedule' | github.event_name == 'workflow_dispatch' ) & github.ref == 'refs/heads/main'
80-
# repository: dev
8175
#
8276
# Any other scenarios (e.g. when a branch is created/pushed) will cause the publish step to be skipped, most commonly this is expected to happen for the
8377
# branches that the GitHub merge queue feature uses internally for which the checks need to run, but we do not want artifacts to be published.
84-
select_helm_repo:
85-
name: Select target helm repository based on action trigger
78+
check_helm_publish:
79+
name: Decide if Helm charts are pushed to the helm repository based on action trigger
8680
runs-on: ubuntu-latest
8781
outputs:
88-
helm_repository: ${{ steps.selecthelmrepo.outputs.helm_repo }}
82+
skip_helm: ${{ steps.checkhelmpublish.outputs.skip_helm }}
8983
steps:
90-
- id: selecthelmrepo
84+
- id: checkhelmpublish
9185
env:
9286
TRIGGER: ${{ github.event_name }}
9387
GITHUB_REF: ${{ github.ref }}
9488
run: |
9589
if [[ "$TRIGGER" == "pull_request" ]]; then
96-
echo "exporting test as target helm repo: ${{ env.TEST_REPO_HELM_URL }}"
97-
echo "helm_repo=${{ env.TEST_REPO_HELM_URL }}" >> "$GITHUB_OUTPUT"
90+
echo "skip_helm=false" >> "$GITHUB_OUTPUT"
9891
elif [[ ( "$TRIGGER" == "push" || "$TRIGGER" == "schedule" || "$TRIGGER" == "workflow_dispatch" ) && "$GITHUB_REF" == "refs/heads/main" ]]; then
99-
echo "exporting dev as target helm repo: ${{ env.DEV_REPO_HELM_URL }}"
100-
echo "helm_repo=${{ env.DEV_REPO_HELM_URL }}" >> "$GITHUB_OUTPUT"
92+
echo "skip_helm=false" >> "$GITHUB_OUTPUT"
10193
elif [[ "$TRIGGER" == "push" && $GITHUB_REF == refs/tags/* ]]; then
102-
echo "exporting stable as target helm repo: ${{ env.STABLE_REPO_HELM_URL }}"
103-
echo "helm_repo=${{ env.STABLE_REPO_HELM_URL }}" >> "$GITHUB_OUTPUT"
94+
echo "skip_helm=false" >> "$GITHUB_OUTPUT"
10495
else
10596
echo "Unknown trigger and ref combination encountered, skipping publish step: $TRIGGER $GITHUB_REF"
106-
echo "helm_repo=skip" >> "$GITHUB_OUTPUT"
97+
echo "skip_helm=true" >> "$GITHUB_OUTPUT"
10798
fi
10899
109100
run_cargodeny:
@@ -317,7 +308,7 @@ jobs:
317308
name: Package Charts, Build Docker Image and publish them - ${{ matrix.runner }}
318309
needs:
319310
- tests_passed
320-
- select_helm_repo
311+
- check_helm_publish
321312
strategy:
322313
matrix:
323314
runner: ["ubuntu-latest", "ubicloud-standard-8-arm"]
@@ -326,13 +317,11 @@ jobs:
326317
permissions:
327318
id-token: write
328319
env:
329-
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
330-
HELM_REPO: ${{ needs.select_helm_repo.outputs.helm_repository }}
331320
OCI_REGISTRY_SDP_PASSWORD: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
332321
OCI_REGISTRY_SDP_USERNAME: "robot$sdp+github-action-build"
333322
OCI_REGISTRY_SDP_CHARTS_PASSWORD: ${{ secrets.HARBOR_ROBOT_SDP_CHARTS_GITHUB_ACTION_BUILD_SECRET }}
334323
OCI_REGISTRY_SDP_CHARTS_USERNAME: "robot$sdp-charts+github-action-build"
335-
if: needs.select_helm_repo.outputs.helm_repository != 'skip'
324+
if: needs.check_helm_publish.outputs.skip_helm != 'true'
336325
outputs:
337326
IMAGE_TAG: ${{ steps.printtag.outputs.IMAGE_TAG }}
338327
steps:
@@ -379,9 +368,7 @@ jobs:
379368
PR_VERSION="${MANIFEST_VERSION}-pr${PR_NUMBER}"
380369
sed -i "s/version = \"${MANIFEST_VERSION}\"/version = \"${PR_VERSION}\"/" Cargo.toml
381370
382-
# Recreate charts and publish charts and docker image. The "-e" is needed as we want to override the
383-
# default value in the makefile if called from this action, but not otherwise (i.e. when called locally).
384-
# This is needed for the HELM_REPO variable.
371+
# Recreate charts and publish charts and docker image.
385372
- name: Install cosign
386373
uses: sigstore/cosign-installer@d7d6bc7722e3daa8354c50bcb52f4837da5e9b6a # v3.8.1
387374
- name: Install syft
@@ -397,21 +384,21 @@ jobs:
397384
sudo wget https://github.com/mikefarah/yq/releases/latest/download/yq_linux_arm64 -O /usr/bin/yq && sudo chmod +x /usr/bin/yq
398385
fi
399386
400-
make -e build
387+
make build
401388
- name: Publish Docker image and Helm chart
402389
if: ${{ !github.event.pull_request.head.repo.fork }}
403390
run: |
404391
# We want to publish helmcharts only once as they have a common name, while still publishing both images with architecture specific tags
405392
if [ "$(uname -m)" = "x86_64" ]; then
406-
make -e publish
393+
make publish
407394
else
408-
make -e docker-publish
395+
make docker-publish
409396
fi
410397
# Output the name of the published image to the Job output for later use
411398
- id: printtag
412399
name: Output image name and tag
413400
if: ${{ !github.event.pull_request.head.repo.fork }}
414-
run: echo "IMAGE_TAG=$(make -e print-docker-tag)" >> "$GITHUB_OUTPUT"
401+
run: echo "IMAGE_TAG=$(make print-docker-tag)" >> "$GITHUB_OUTPUT"
415402

416403
create_manifest_list:
417404
name: Build and publish manifest list
@@ -422,7 +409,6 @@ jobs:
422409
permissions:
423410
id-token: write
424411
env:
425-
NEXUS_PASSWORD: ${{ secrets.NEXUS_PASSWORD }}
426412
OCI_REGISTRY_SDP_PASSWORD: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
427413
OCI_REGISTRY_SDP_USERNAME: "robot$sdp+github-action-build"
428414
OCI_REGISTRY_SDP_CHARTS_PASSWORD: ${{ secrets.HARBOR_ROBOT_SDP_CHARTS_GITHUB_ACTION_BUILD_SECRET }}

‎Makefile

+1-46
Original file line numberDiff line numberDiff line change
@@ -14,13 +14,10 @@ OPERATOR_NAME := zookeeper-operator
1414
VERSION := $(shell cargo metadata --format-version 1 | jq -r '.packages[] | select(.name=="stackable-${OPERATOR_NAME}") | .version')
1515
ARCH := $(shell uname -m | sed -e 's#x86_64#amd64#' | sed -e 's#aarch64#arm64#')
1616

17-
DOCKER_REPO := docker.stackable.tech
18-
ORGANIZATION := stackable
1917
OCI_REGISTRY_HOSTNAME := oci.stackable.tech
2018
OCI_REGISTRY_PROJECT_IMAGES := sdp
2119
OCI_REGISTRY_PROJECT_CHARTS := sdp-charts
2220
# This will be overwritten by an environmental variable if called from the github action
23-
HELM_REPO := https://repo.stackable.tech/repository/helm-dev
2421
HELM_CHART_NAME := ${OPERATOR_NAME}
2522
HELM_CHART_ARTIFACT := target/helm/${OPERATOR_NAME}-${VERSION}.tgz
2623

@@ -34,35 +31,9 @@ render-docs:
3431

3532
## Docker related targets
3633
docker-build:
37-
docker build --force-rm --build-arg VERSION=${VERSION} -t "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}-${ARCH}" -f docker/Dockerfile .
38-
docker tag "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}-${ARCH}" "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-${ARCH}"
34+
docker build --force-rm --build-arg VERSION=${VERSION} -t "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-${ARCH}" -f docker/Dockerfile .
3935

4036
docker-publish:
41-
# Push to Nexus
42-
echo "${NEXUS_PASSWORD}" | docker login --username github --password-stdin "${DOCKER_REPO}"
43-
DOCKER_OUTPUT=$$(docker push --all-tags "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}");\
44-
# Obtain the digest of the pushed image from the output of `docker push`, because signing by tag is deprecated and will be removed from cosign in the future\
45-
REPO_DIGEST_OF_IMAGE=$$(echo "$$DOCKER_OUTPUT" | awk '/^${VERSION}-${ARCH}: digest: sha256:[0-9a-f]{64} size: [0-9]+$$/ { print $$3 }');\
46-
if [ -z "$$REPO_DIGEST_OF_IMAGE" ]; then\
47-
echo 'Could not find repo digest for container image: ${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}-${ARCH}';\
48-
exit 1;\
49-
fi;\
50-
# This generates a signature and publishes it to the registry, next to the image\
51-
# Uses the keyless signing flow with Github Actions as identity provider\
52-
cosign sign -y "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}@$$REPO_DIGEST_OF_IMAGE";\
53-
# Generate the SBOM for the operator image, this leverages the already generated SBOM for the operator binary by cargo-cyclonedx\
54-
syft scan --output [email protected]=sbom.json --select-catalogers "-cargo-auditable-binary-cataloger,+sbom-cataloger" --scope all-layers --source-name "${OPERATOR_NAME}" --source-version "${VERSION}-${ARCH}" "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}@$$REPO_DIGEST_OF_IMAGE";\
55-
# Determine the PURL for the container image\
56-
URLENCODED_REPO_DIGEST_OF_IMAGE=$$(echo "$$REPO_DIGEST_OF_IMAGE" | sed 's/:/%3A/g');\
57-
PURL="pkg:oci/${OPERATOR_NAME}@$$URLENCODED_REPO_DIGEST_OF_IMAGE?arch=${ARCH}&repository_url=${DOCKER_REPO}%2F${ORGANIZATION}%2F${OPERATOR_NAME}";\
58-
# Get metadata from the image\
59-
IMAGE_DESCRIPTION=$$(docker inspect --format='{{.Config.Labels.description}}' "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}-${ARCH}");\
60-
IMAGE_NAME=$$(docker inspect --format='{{.Config.Labels.name}}' "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}-${ARCH}");\
61-
# Merge the SBOM with the metadata for the operator\
62-
jq -s '{"metadata":{"component":{"description":"'"$$IMAGE_NAME. $$IMAGE_DESCRIPTION"'","supplier":{"name":"Stackable GmbH","url":["https://stackable.tech/"]},"author":"Stackable GmbH","purl":"'"$$PURL"'","publisher":"Stackable GmbH"}}} * .[0]' sbom.json > sbom.merged.json;\
63-
# Attest the SBOM to the image\
64-
cosign attest -y --predicate sbom.merged.json --type cyclonedx "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}@$$REPO_DIGEST_OF_IMAGE"
65-
6637
# Push to Harbor
6738
# We need to use "value" here to prevent the variable from being recursively expanded by make (username contains a dollar sign, since it's a Harbor bot)
6839
docker login --username '${value OCI_REGISTRY_SDP_USERNAME}' --password '${OCI_REGISTRY_SDP_PASSWORD}' '${OCI_REGISTRY_HOSTNAME}'
@@ -91,21 +62,9 @@ docker-publish:
9162

9263
# This assumes "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-amd64 and "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-arm64 are built and pushed
9364
docker-manifest-list-build:
94-
docker manifest create "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}" --amend "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}-amd64" --amend "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}-arm64"
9565
docker manifest create "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}" --amend "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-amd64" --amend "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}-arm64"
9666

9767
docker-manifest-list-publish:
98-
# Push to Nexus
99-
echo "${NEXUS_PASSWORD}" | docker login --username github --password-stdin "${DOCKER_REPO}"
100-
# `docker manifest push` directly returns the digest of the manifest list
101-
# As it is an experimental feature, this might change in the future
102-
# Further reading: https://docs.docker.com/reference/cli/docker/manifest/push/
103-
DIGEST_NEXUS=$$(docker manifest push "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}");\
104-
# Refer to image via its digest (oci.stackable.tech/sdp/airflow@sha256:0a1b2c...)\
105-
# This generates a signature and publishes it to the registry, next to the image\
106-
# Uses the keyless signing flow with Github Actions as identity provider\
107-
cosign sign -y "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}@$$DIGEST_NEXUS"
108-
10968
# Push to Harbor
11069
# We need to use "value" here to prevent the variable from being recursively expanded by make (username contains a dollar sign, since it's a Harbor bot)
11170
docker login --username '${value OCI_REGISTRY_SDP_USERNAME}' --password '${OCI_REGISTRY_SDP_PASSWORD}' '${OCI_REGISTRY_HOSTNAME}'
@@ -122,9 +81,6 @@ print-docker-tag:
12281
@echo "${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}"
12382

12483
helm-publish:
125-
# Push to Nexus
126-
curl --fail -u "github:${NEXUS_PASSWORD}" --upload-file "${HELM_CHART_ARTIFACT}" "${HELM_REPO}/"
127-
12884
# Push to Harbor
12985
# We need to use "value" here to prevent the variable from being recursively expanded by make (username contains a dollar sign, since it's a Harbor bot)
13086
helm registry login --username '${value OCI_REGISTRY_SDP_CHARTS_USERNAME}' --password '${OCI_REGISTRY_SDP_CHARTS_PASSWORD}' '${OCI_REGISTRY_HOSTNAME}'
@@ -170,7 +126,6 @@ chart-lint: compile-chart
170126

171127
clean: chart-clean
172128
cargo clean
173-
docker rmi --force "${DOCKER_REPO}/${ORGANIZATION}/${OPERATOR_NAME}:${VERSION}"
174129
docker rmi --force '${OCI_REGISTRY_HOSTNAME}/${OCI_REGISTRY_PROJECT_IMAGES}/${OPERATOR_NAME}:${VERSION}'
175130

176131
regenerate-charts: chart-clean compile-chart

0 commit comments

Comments
 (0)