From 5697c7b0be275b95afb2ad00b18f0c4e92b59c53 Mon Sep 17 00:00:00 2001 From: Santiago Baldassin Date: Thu, 21 Sep 2023 11:19:56 -0300 Subject: [PATCH 01/13] adding a workflow to manually publish the scrypto builder docker image --- .github/workflows/publish-simulator.yml | 30 +++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 .github/workflows/publish-simulator.yml diff --git a/.github/workflows/publish-simulator.yml b/.github/workflows/publish-simulator.yml new file mode 100644 index 00000000000..46bd5881b8c --- /dev/null +++ b/.github/workflows/publish-simulator.yml @@ -0,0 +1,30 @@ +name: Simulator + +on: + workflow_dispatch: + inputs: + image-label: + description: "Docker image label to be published" + +jobs: + build-amd: + uses: radixdlt/public-iac-resuable-artifacts/.github/workflows/docker-build.yml@main + with: + runs_on: ubuntu-latest-16-cores + image_registry: "docker.io" + image_organization: "radixdlt" + image_name: "scrypto-builder" + tag: ${{ image-label }} + context: "." + dockerfile: "Dockerfile" + platforms: "linux/amd64" + provenance: "false" + scan_image: true + snyk_target_ref: ${{ github.ref_name }} + enable_dockerhub: true + post_script: "./update-assets.sh --reuse-image --image-tag ${{ image-label }}" + secrets: + workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDP }} + service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} + role_to_assume: ${{ secrets.DOCKERHUB_RELEASER_ROLE }} + From 9554a049943a6cf4ea46083734c01e835b352287 Mon Sep 17 00:00:00 2001 From: Santiago Baldassin Date: Thu, 21 Sep 2023 11:21:06 -0300 Subject: [PATCH 02/13] updating the name --- .github/workflows/publish-simulator.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/publish-simulator.yml b/.github/workflows/publish-simulator.yml index 46bd5881b8c..72fb63984b5 100644 --- a/.github/workflows/publish-simulator.yml +++ b/.github/workflows/publish-simulator.yml @@ -1,4 +1,4 @@ -name: Simulator +name: scrypto builder publish on: workflow_dispatch: From 7413ae034ab3a57bc0918dc88919d6bbc8a04e1c Mon Sep 17 00:00:00 2001 From: Santiago Baldassin Date: Thu, 21 Sep 2023 11:22:32 -0300 Subject: [PATCH 03/13] adding a trigger to test --- .github/workflows/publish-simulator.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.github/workflows/publish-simulator.yml b/.github/workflows/publish-simulator.yml index 72fb63984b5..ab249a9db04 100644 --- a/.github/workflows/publish-simulator.yml +++ b/.github/workflows/publish-simulator.yml @@ -5,6 +5,9 @@ on: inputs: image-label: description: "Docker image label to be published" + push: + branches: + - chore/publish-simulator-image jobs: build-amd: From 2de0bdbe3d742785b574ca3ce5d0dd35f0e9e308 Mon Sep 17 00:00:00 2001 From: Santiago Baldassin Date: Thu, 21 Sep 2023 11:24:20 -0300 Subject: [PATCH 04/13] using latest --- .github/workflows/publish-simulator.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-simulator.yml b/.github/workflows/publish-simulator.yml index ab249a9db04..4742613e4c9 100644 --- a/.github/workflows/publish-simulator.yml +++ b/.github/workflows/publish-simulator.yml @@ -17,7 +17,7 @@ jobs: image_registry: "docker.io" image_organization: "radixdlt" image_name: "scrypto-builder" - tag: ${{ image-label }} + tag: latest context: "." dockerfile: "Dockerfile" platforms: "linux/amd64" @@ -25,7 +25,7 @@ jobs: scan_image: true snyk_target_ref: ${{ github.ref_name }} enable_dockerhub: true - post_script: "./update-assets.sh --reuse-image --image-tag ${{ image-label }}" + post_script: "./update-assets.sh --reuse-image --image-tag latest" secrets: workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDP }} service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} From 4a913370379a3ac9e9555ddf024e32cb33078afd Mon Sep 17 00:00:00 2001 From: Santiago Baldassin Date: Thu, 21 Sep 2023 11:28:18 -0300 Subject: [PATCH 05/13] adding an oidc debugger --- .github/workflows/publish-simulator.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.github/workflows/publish-simulator.yml b/.github/workflows/publish-simulator.yml index 4742613e4c9..da426815065 100644 --- a/.github/workflows/publish-simulator.yml +++ b/.github/workflows/publish-simulator.yml @@ -10,7 +10,27 @@ on: - chore/publish-simulator-image jobs: + + oidc_debugger: + permissions: + contents: read + id-token: write + runs-on: ubuntu-latest + name: A test of the oidc debugger + steps: + - name: Checkout actions-oidc-debugger + uses: actions/checkout@v3 + with: + repository: github/actions-oidc-debugger + ref: main + path: ./.github/actions/actions-oidc-debugger + - name: Debug OIDC Claims + uses: ./.github/actions/actions-oidc-debugger + with: + audience: 'https://github.com/github' + build-amd: + needs: oidc_debugger uses: radixdlt/public-iac-resuable-artifacts/.github/workflows/docker-build.yml@main with: runs_on: ubuntu-latest-16-cores From 6adb6738b0b96701a0f4dc4060bb33b74ec7220a Mon Sep 17 00:00:00 2001 From: Santiago Baldassin Date: Thu, 21 Sep 2023 13:25:10 -0300 Subject: [PATCH 06/13] adding env release --- .github/workflows/publish-simulator.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/publish-simulator.yml b/.github/workflows/publish-simulator.yml index da426815065..cc5678435f1 100644 --- a/.github/workflows/publish-simulator.yml +++ b/.github/workflows/publish-simulator.yml @@ -31,6 +31,7 @@ jobs: build-amd: needs: oidc_debugger + environment: release uses: radixdlt/public-iac-resuable-artifacts/.github/workflows/docker-build.yml@main with: runs_on: ubuntu-latest-16-cores From 5ce24a8ccfcaf51d7b22376a8caee7e848098431 Mon Sep 17 00:00:00 2001 From: Santiago Baldassin Date: Thu, 21 Sep 2023 13:26:39 -0300 Subject: [PATCH 07/13] fixing syntax --- .github/workflows/publish-simulator.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/publish-simulator.yml b/.github/workflows/publish-simulator.yml index cc5678435f1..44de7811894 100644 --- a/.github/workflows/publish-simulator.yml +++ b/.github/workflows/publish-simulator.yml @@ -31,10 +31,10 @@ jobs: build-amd: needs: oidc_debugger - environment: release uses: radixdlt/public-iac-resuable-artifacts/.github/workflows/docker-build.yml@main with: - runs_on: ubuntu-latest-16-cores + runs_on: ubuntu-latest-16-cores + environment: "release" image_registry: "docker.io" image_organization: "radixdlt" image_name: "scrypto-builder" From 74b0bf3d9664796eaab7671283ab646baf16f5d3 Mon Sep 17 00:00:00 2001 From: Santiago Baldassin Date: Thu, 21 Sep 2023 13:36:49 -0300 Subject: [PATCH 08/13] avoid the post script --- .github/workflows/publish-simulator.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/publish-simulator.yml b/.github/workflows/publish-simulator.yml index 44de7811894..ccd8b83b29e 100644 --- a/.github/workflows/publish-simulator.yml +++ b/.github/workflows/publish-simulator.yml @@ -46,7 +46,6 @@ jobs: scan_image: true snyk_target_ref: ${{ github.ref_name }} enable_dockerhub: true - post_script: "./update-assets.sh --reuse-image --image-tag latest" secrets: workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDP }} service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }} From 01ad3d3e8fafc286e257e653a1999ef2b7de64be Mon Sep 17 00:00:00 2001 From: Santiago Baldassin Date: Thu, 21 Sep 2023 13:42:01 -0300 Subject: [PATCH 09/13] updating the pipeline --- .github/workflows/publish-simulator.yml | 23 +---------------------- 1 file changed, 1 insertion(+), 22 deletions(-) diff --git a/.github/workflows/publish-simulator.yml b/.github/workflows/publish-simulator.yml index ccd8b83b29e..931e48dd406 100644 --- a/.github/workflows/publish-simulator.yml +++ b/.github/workflows/publish-simulator.yml @@ -5,30 +5,9 @@ on: inputs: image-label: description: "Docker image label to be published" - push: - branches: - - chore/publish-simulator-image jobs: - oidc_debugger: - permissions: - contents: read - id-token: write - runs-on: ubuntu-latest - name: A test of the oidc debugger - steps: - - name: Checkout actions-oidc-debugger - uses: actions/checkout@v3 - with: - repository: github/actions-oidc-debugger - ref: main - path: ./.github/actions/actions-oidc-debugger - - name: Debug OIDC Claims - uses: ./.github/actions/actions-oidc-debugger - with: - audience: 'https://github.com/github' - build-amd: needs: oidc_debugger uses: radixdlt/public-iac-resuable-artifacts/.github/workflows/docker-build.yml@main @@ -38,7 +17,7 @@ jobs: image_registry: "docker.io" image_organization: "radixdlt" image_name: "scrypto-builder" - tag: latest + tag: ${{ inputs.image-label }} context: "." dockerfile: "Dockerfile" platforms: "linux/amd64" From d51bc5324457fc2ce30a15a537abeb8018aeb5b3 Mon Sep 17 00:00:00 2001 From: Santiago Baldassin Date: Thu, 21 Sep 2023 13:44:24 -0300 Subject: [PATCH 10/13] ranaming the ci pipeline --- .github/workflows/simulator.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/simulator.yml b/.github/workflows/simulator.yml index d1c773a3bc4..154ef42a274 100644 --- a/.github/workflows/simulator.yml +++ b/.github/workflows/simulator.yml @@ -1,4 +1,4 @@ -name: Simulator +name: scrypto builder ci on: pull_request: @@ -25,7 +25,7 @@ jobs: needs: tags uses: radixdlt/public-iac-resuable-artifacts/.github/workflows/docker-build.yml@main with: - runs_on: ubuntu-latest + runs_on: ubuntu-latest-16-cores image_registry: "docker.io" image_organization: "radixdlt" image_name: "simulator" From 66f77d6eb371750ff0022ad7ba3edf6691ed6297 Mon Sep 17 00:00:00 2001 From: Santiago Baldassin Date: Thu, 21 Sep 2023 13:45:31 -0300 Subject: [PATCH 11/13] renaming pipeline --- .github/workflows/{simulator.yml => ci-scrypto-builder.yml} | 0 .../{publish-simulator.yml => publish-scrypto-builder.yml} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename .github/workflows/{simulator.yml => ci-scrypto-builder.yml} (100%) rename .github/workflows/{publish-simulator.yml => publish-scrypto-builder.yml} (100%) diff --git a/.github/workflows/simulator.yml b/.github/workflows/ci-scrypto-builder.yml similarity index 100% rename from .github/workflows/simulator.yml rename to .github/workflows/ci-scrypto-builder.yml diff --git a/.github/workflows/publish-simulator.yml b/.github/workflows/publish-scrypto-builder.yml similarity index 100% rename from .github/workflows/publish-simulator.yml rename to .github/workflows/publish-scrypto-builder.yml From 3cabc2bf8521093cc8ddab82892113cd56d914c3 Mon Sep 17 00:00:00 2001 From: Santiago Baldassin Date: Fri, 22 Sep 2023 09:54:02 -0300 Subject: [PATCH 12/13] updating base on the reviews --- .github/workflows/ci-scrypto-builder.yml | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci-scrypto-builder.yml b/.github/workflows/ci-scrypto-builder.yml index 154ef42a274..3fb4d4f01f8 100644 --- a/.github/workflows/ci-scrypto-builder.yml +++ b/.github/workflows/ci-scrypto-builder.yml @@ -1,9 +1,6 @@ -name: scrypto builder ci +name: Publish scrypto-builder image on: - pull_request: - release: - types: [published] push: branches: - develop @@ -28,7 +25,7 @@ jobs: runs_on: ubuntu-latest-16-cores image_registry: "docker.io" image_organization: "radixdlt" - image_name: "simulator" + image_name: "scrypto-builder" tag: ${{ needs.tags.outputs.tag }} context: "." dockerfile: "Dockerfile" @@ -36,7 +33,7 @@ jobs: provenance: "false" scan_image: false snyk_target_ref: ${{ github.ref_name }} - enable_dockerhub: ${{ github.event_name }} == 'release' + enable_dockerhub: false post_script: "./update-assets.sh --reuse-image --image-tag ${{ needs.tags.outputs.tag }}" secrets: workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDP }} From 4a8492c2aff261118b08fac355a5303aa3a67716 Mon Sep 17 00:00:00 2001 From: Santiago Baldassin Date: Fri, 22 Sep 2023 09:57:32 -0300 Subject: [PATCH 13/13] renaming the jobs --- .github/workflows/ci-scrypto-builder.yml | 2 +- .github/workflows/publish-scrypto-builder.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci-scrypto-builder.yml b/.github/workflows/ci-scrypto-builder.yml index 3fb4d4f01f8..0978212a0e2 100644 --- a/.github/workflows/ci-scrypto-builder.yml +++ b/.github/workflows/ci-scrypto-builder.yml @@ -1,4 +1,4 @@ -name: Publish scrypto-builder image +name: Build scrypto-builder image on: push: diff --git a/.github/workflows/publish-scrypto-builder.yml b/.github/workflows/publish-scrypto-builder.yml index 931e48dd406..ba2d95ee1b8 100644 --- a/.github/workflows/publish-scrypto-builder.yml +++ b/.github/workflows/publish-scrypto-builder.yml @@ -1,4 +1,4 @@ -name: scrypto builder publish +name: Publish scrypto-builder image on: workflow_dispatch: