Skip to content

Commit 44d42f1

Browse files
ddelnanoddelnano
authored
Fix and modernize release workflows, complete ghcr.io migration, and parameterize jobs for easy fork usage (#2363)
Summary: Fix and modernize release workflows, complete ghcr.io migration, and parameterize jobs for easy fork usage Completes the ghcr.io migration started by earlier changes, repairs the bit-rot that accumulated since these workflows last ran, and parameterizes them via `vars.IMAGE_REPO` and `${{ github.repository }}` so forks can publish to their own registry without editing the workflows. Note: This change is best reviewed commit by commit. Relevant Issues: N/A Type of change: /kind cleanup Test Plan: Built vizier, operator, cli and cloud releases for the https://github.com/k8sstormcenter/pixie fork based off these changes * Ran a few pre-release builds that included an earlier version of these changes ([cloud-release](https://github.com/pixie-io/pixie/actions/runs/24548517833)) * Verify macos signing variable is set ``` $ gh variable --repo pixie-io/pixie get ENABLE_MACOS_SIGNING true ``` Changelog Message: Future cloud, operator and vizier release images will now pushed to ghcr.io/pixie-io instead of gcr.io --------- Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
1 parent 5db45d6 commit 44d42f1

16 files changed

Lines changed: 129 additions & 150 deletions

‎.github/workflows/cli_release.yaml‎

Lines changed: 42 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,15 @@ jobs:
1717
name: Build Release
1818
runs-on: oracle-16cpu-64gb-x86-64
1919
needs: get-dev-image
20+
permissions:
21+
contents: read
22+
packages: write
2023
container:
2124
image: ${{ needs.get-dev-image.outputs.image-with-tag }}
2225
env:
2326
ARTIFACT_UPLOAD_LOG: "artifact_uploads.json"
27+
# When macOS signing is enabled, push-signed-artifacts owns the manifest update.
28+
MANIFEST_UPDATES: ${{ vars.ENABLE_MACOS_SIGNING == 'true' && '' || 'manifest_updates.json' }}
2429
steps:
2530
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2631
with:
@@ -42,43 +47,48 @@ jobs:
4247
BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
4348
run: |
4449
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
45-
- id: gcloud-creds
46-
uses: ./.github/actions/gcloud_creds
50+
- name: Login to GHCR
51+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
4752
with:
48-
SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
53+
registry: ghcr.io
54+
username: ${{ github.actor }}
55+
password: ${{ github.token }}
4956
- name: Build & Push Artifacts
5057
env:
5158
REF: ${{ github.event.ref }}
5259
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
5360
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5461
BUILD_NUMBER: ${{ github.run_attempt }}
5562
JOB_NAME: ${{ github.job }}
56-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
63+
GH_REPO: ${{ github.repository }}
64+
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'ghcr.io/pixie-io' }}
5765
shell: bash
5866
run: |
5967
export TAG_NAME="${REF#*/tags/}"
6068
mkdir -p "artifacts/"
6169
export ARTIFACTS_DIR="$(realpath artifacts/)"
6270
./ci/save_version_info.sh
6371
./ci/cli_build_release.sh
72+
# Despite the name, linux-artifacts also contains the unsigned darwin
73+
# binaries (cli_darwin_{amd64,arm64}_unsigned). sign-release downloads
74+
# this artifact to feed cli_merge_sign.sh.
6475
- name: Upload Github Artifacts
6576
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
6677
with:
6778
name: linux-artifacts
6879
path: artifacts/
69-
- name: Update GCS Manifest
70-
env:
71-
ARTIFACT_MANIFEST_BUCKET: "pixie-dev-public"
72-
# Use the old style versions file instead of the new updates for the gcs manifest.
73-
MANIFEST_UPDATES: ""
74-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
75-
run: ./ci/update_artifact_manifest.sh
7680
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7781
with:
7882
name: artifact-upload-log
7983
path: ${{ env.ARTIFACT_UPLOAD_LOG }}
84+
- if: vars.ENABLE_MACOS_SIGNING != 'true'
85+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
86+
with:
87+
name: manifest-updates
88+
path: manifest_updates.json
8089
sign-release:
8190
name: Sign Release for MacOS
91+
if: vars.ENABLE_MACOS_SIGNING == 'true'
8292
runs-on: macos-latest
8393
needs: build-release
8494
steps:
@@ -87,6 +97,10 @@ jobs:
8797
fetch-depth: 0
8898
- name: Add pwd to git safe dir
8999
run: git config --global --add safe.directory `pwd`
100+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
101+
with:
102+
name: linux-artifacts
103+
path: artifacts/
90104
- name: Install gon
91105
run: brew install Bearer/tap/gon
92106
- name: Sign CLI release
@@ -101,7 +115,6 @@ jobs:
101115
export CERT_PATH="pixie.cert"
102116
echo -n "$CERT_BASE64" | base64 --decode -o "$CERT_PATH"
103117
export TAG_NAME="${REF#*/tags/}"
104-
mkdir -p "artifacts/"
105118
export ARTIFACTS_DIR="$(pwd)/artifacts"
106119
./ci/cli_merge_sign.sh
107120
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
@@ -110,6 +123,7 @@ jobs:
110123
path: artifacts/
111124
push-signed-artifacts:
112125
name: Push Signed Artifacts for MacOS
126+
if: vars.ENABLE_MACOS_SIGNING == 'true'
113127
runs-on: ubuntu-latest
114128
needs: [get-dev-image, sign-release]
115129
container:
@@ -131,19 +145,15 @@ jobs:
131145
BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
132146
run: |
133147
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
134-
- id: gcloud-creds
135-
uses: ./.github/actions/gcloud_creds
136-
with:
137-
SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
138148
- name: Add pwd to git safe dir
139149
run: |
140150
git config --global --add safe.directory `pwd`
141151
- name: Upload signed CLI
142152
env:
143153
REF: ${{ github.event.ref }}
144154
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
145-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
146155
ARTIFACT_UPLOAD_LOG: "artifact_uploads.json"
156+
GH_REPO: ${{ github.repository }}
147157
shell: bash
148158
run: |
149159
export TAG_NAME="${REF#*/tags/}"
@@ -161,7 +171,11 @@ jobs:
161171
create-github-release:
162172
name: Create Release on Github
163173
runs-on: ubuntu-latest
164-
needs: push-signed-artifacts
174+
needs: [build-release, push-signed-artifacts]
175+
if: |
176+
always() &&
177+
needs.build-release.result == 'success' &&
178+
(needs.push-signed-artifacts.result == 'success' || needs.push-signed-artifacts.result == 'skipped')
165179
permissions:
166180
contents: write
167181
steps:
@@ -186,8 +200,15 @@ jobs:
186200
gh release create "${TAG_NAME}" "${prerelease[@]}" \
187201
--title "CLI ${TAG_NAME#release/cli/}" \
188202
--notes $'Pixie CLI Release:\n'"${changelog}"
189-
gh release upload "${TAG_NAME}" linux-artifacts/* macos-artifacts/*
203+
shopt -s nullglob
204+
upload_paths=(linux-artifacts/*)
205+
if [[ -d macos-artifacts ]]; then
206+
upload_paths+=(macos-artifacts/*)
207+
fi
208+
gh release upload "${TAG_NAME}" "${upload_paths[@]}"
190209
update-gh-artifacts-manifest:
210+
if: |
211+
always() && needs.create-github-release.result == 'success'
191212
runs-on: oracle-8cpu-32gb-x86-64
192213
needs: [get-dev-image, create-github-release]
193214
container:
@@ -217,8 +238,8 @@ jobs:
217238
env:
218239
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
219240
run: |
220-
git config --global user.name 'pixie-io-buildbot'
221-
git config --global user.email 'build@pixielabs.ai'
241+
git config --global user.name "${{ vars.BUILDBOT_NAME || 'pixie-io-buildbot' }}"
242+
git config --global user.email "${{ vars.BUILDBOT_EMAIL || 'build@pixielabs.ai' }}"
222243
git config --global user.signingkey "${BUILDBOT_GPG_KEY_ID}"
223244
git config --global commit.gpgsign true
224245
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0

‎.github/workflows/cloud_release.yaml‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ jobs:
1717
name: Build Release
1818
runs-on: oracle-16cpu-64gb-x86-64
1919
needs: get-dev-image
20+
permissions:
21+
contents: read
22+
packages: write
2023
container:
2124
image: ${{ needs.get-dev-image.outputs.image-with-tag }}
2225
steps:
@@ -30,15 +33,17 @@ jobs:
3033
with:
3134
download_toplevel: 'true'
3235
BB_API_KEY: ${{ secrets.BB_IO_API_KEY }}
33-
- id: gcloud-creds
34-
uses: ./.github/actions/gcloud_creds
35-
with:
36-
SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
3736
- name: Import GPG key
3837
env:
3938
BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
4039
run: |
4140
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
41+
- name: Login to GHCR
42+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
43+
with:
44+
registry: ghcr.io
45+
username: ${{ github.actor }}
46+
password: ${{ github.token }}
4247
- name: Build & Push Artifacts
4348
env:
4449
REF: ${{ github.event.ref }}
@@ -47,8 +52,9 @@ jobs:
4752
GH_API_KEY: ${{ secrets.GITHUB_TOKEN }}
4853
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
4954
COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
50-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
5155
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
56+
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'ghcr.io/pixie-io' }}
57+
GH_REPO: ${{ github.repository }}
5258
shell: bash
5359
run: |
5460
export TAG_NAME="${REF#*/tags/}"
@@ -76,8 +82,7 @@ jobs:
7682
env:
7783
REF: ${{ github.event.ref }}
7884
GH_TOKEN: ${{ secrets.BUILDBOT_GH_API_TOKEN }}
79-
OWNER: pixie-io
80-
REPO: pixie
85+
GH_REPO: ${{ github.repository }}
8186
shell: bash
8287
run: |
8388
export TAG_NAME="${REF#*/tags/}"

‎.github/workflows/operator_release.yaml‎

Lines changed: 14 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ jobs:
1717
name: Build Release
1818
runs-on: oracle-16cpu-64gb-x86-64
1919
needs: get-dev-image
20+
permissions:
21+
contents: read
22+
packages: write
2023
container:
2124
image: ${{ needs.get-dev-image.outputs.image-with-tag }}
2225
env:
@@ -33,25 +36,27 @@ jobs:
3336
with:
3437
download_toplevel: 'true'
3538
BB_API_KEY: ${{ secrets.BB_IO_API_KEY }}
36-
- id: gcloud-creds
37-
uses: ./.github/actions/gcloud_creds
38-
with:
39-
SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
4039
- name: Import GPG key
4140
env:
4241
BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
4342
run: |
4443
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
44+
- name: Login to GHCR
45+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
46+
with:
47+
registry: ghcr.io
48+
username: ${{ github.actor }}
49+
password: ${{ github.token }}
4550
- name: Build & Push Artifacts
4651
env:
4752
REF: ${{ github.event.ref }}
4853
BUILD_NUMBER: ${{ github.run_attempt }}
4954
JOB_NAME: ${{ github.job }}
5055
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
5156
COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
52-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
5357
GH_REPO: ${{ github.repository }}
5458
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
59+
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'ghcr.io/pixie-io' }}
5560
shell: bash
5661
run: |
5762
export TAG_NAME="${REF#*/tags/}"
@@ -60,13 +65,6 @@ jobs:
6065
mkdir -p "${ARTIFACTS_DIR}"
6166
./ci/save_version_info.sh
6267
./ci/operator_build_release.sh
63-
- name: Update GCS Manifest
64-
env:
65-
ARTIFACT_MANIFEST_BUCKET: "pixie-dev-public"
66-
# Use the old style versions file instead of the new updates for the gcs manifest.
67-
MANIFEST_UPDATES: ""
68-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
69-
run: ./ci/update_artifact_manifest.sh
7068
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7169
with:
7270
name: manifest-updates
@@ -127,8 +125,8 @@ jobs:
127125
env:
128126
GIT_SSH_COMMAND: "ssh -i /tmp/ssh.key"
129127
run: |
130-
git config --global user.name 'pixie-io-buildbot'
131-
git config --global user.email 'build@pixielabs.ai'
128+
git config --global user.name "${{ vars.BUILDBOT_NAME || 'pixie-io-buildbot' }}"
129+
git config --global user.email "${{ vars.BUILDBOT_EMAIL || 'build@pixielabs.ai' }}"
132130
- name: Push Helm YAML to gh-pages
133131
shell: bash
134132
env:
@@ -171,8 +169,8 @@ jobs:
171169
env:
172170
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
173171
run: |
174-
git config --global user.name 'pixie-io-buildbot'
175-
git config --global user.email 'build@pixielabs.ai'
172+
git config --global user.name "${{ vars.BUILDBOT_NAME || 'pixie-io-buildbot' }}"
173+
git config --global user.email "${{ vars.BUILDBOT_EMAIL || 'build@pixielabs.ai' }}"
176174
git config --global user.signingkey "${BUILDBOT_GPG_KEY_ID}"
177175
git config --global commit.gpgsign true
178176
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0

‎.github/workflows/vizier_release.yaml‎

Lines changed: 14 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ jobs:
1717
name: Build Release
1818
runs-on: oracle-16cpu-64gb-x86-64
1919
needs: get-dev-image
20+
permissions:
21+
contents: read
22+
packages: write
2023
container:
2124
image: ${{ needs.get-dev-image.outputs.image-with-tag }}
2225
env:
@@ -33,25 +36,27 @@ jobs:
3336
with:
3437
download_toplevel: 'true'
3538
BB_API_KEY: ${{ secrets.BB_IO_API_KEY }}
36-
- id: gcloud-creds
37-
uses: ./.github/actions/gcloud_creds
38-
with:
39-
SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
4039
- name: Import GPG key
4140
env:
4241
BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
4342
run: |
4443
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
44+
- name: Login to GHCR
45+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
46+
with:
47+
registry: ghcr.io
48+
username: ${{ github.actor }}
49+
password: ${{ github.token }}
4550
- name: Build & Push Artifacts
4651
env:
4752
REF: ${{ github.event.ref }}
4853
BUILD_NUMBER: ${{ github.run_attempt }}
4954
JOB_NAME: ${{ github.job }}
5055
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
5156
COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
52-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
5357
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
5458
GH_REPO: ${{ github.repository }}
59+
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'ghcr.io/pixie-io' }}
5560
shell: bash
5661
run: |
5762
export TAG_NAME="${REF#*/tags/}"
@@ -60,20 +65,6 @@ jobs:
6065
export INDEX_FILE="$(pwd)/index.yaml"
6166
./ci/save_version_info.sh
6267
./ci/vizier_build_release.sh
63-
- name: Build & Export Docs
64-
env:
65-
PXL_DOCS_GCS_PATH: "gs://pixie-dev-public/pxl-docs.json"
66-
run: |
67-
docs="$(mktemp)"
68-
bazel run //src/carnot/docstring:docstring -- --output_json "${docs}"
69-
gsutil cp "${docs}" "${PXL_DOCS_GCS_PATH}"
70-
- name: Update GCS Manifest
71-
env:
72-
ARTIFACT_MANIFEST_BUCKET: "pixie-dev-public"
73-
# Use the old style versions file instead of the new updates for the gcs manifest.
74-
MANIFEST_UPDATES: ""
75-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
76-
run: ./ci/update_artifact_manifest.sh
7768
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7869
with:
7970
name: manifest-updates
@@ -134,8 +125,8 @@ jobs:
134125
env:
135126
GIT_SSH_COMMAND: "ssh -i /tmp/ssh.key"
136127
run: |
137-
git config --global user.name 'pixie-io-buildbot'
138-
git config --global user.email 'build@pixielabs.ai'
128+
git config --global user.name "${{ vars.BUILDBOT_NAME || 'pixie-io-buildbot' }}"
129+
git config --global user.email "${{ vars.BUILDBOT_EMAIL || 'build@pixielabs.ai' }}"
139130
- name: Push Helm YAML to gh-pages
140131
shell: bash
141132
env:
@@ -178,8 +169,8 @@ jobs:
178169
env:
179170
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
180171
run: |
181-
git config --global user.name 'pixie-io-buildbot'
182-
git config --global user.email 'build@pixielabs.ai'
172+
git config --global user.name "${{ vars.BUILDBOT_NAME || 'pixie-io-buildbot' }}"
173+
git config --global user.email "${{ vars.BUILDBOT_EMAIL || 'build@pixielabs.ai' }}"
183174
git config --global user.signingkey "${BUILDBOT_GPG_KEY_ID}"
184175
git config --global commit.gpgsign true
185176
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0

‎ci/artifact_mirrors.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,3 @@
44
- name: gh-releases
55
type: gh-releases
66
url_format: 'https://github.com/${gh_repo}/releases/download/release/${component}/v${version}/${artifact_name}'
7-
- name: pixie-oss-gcs
8-
type: gcs
9-
bucket: pixie-dev-public
10-
path_format: '${component}/${version}/${artifact_name}'
11-
url_format: 'https://storage.googleapis.com/pixie-dev-public/${component}/${version}/${artifact_name}'

0 commit comments

Comments
 (0)