Update meteor to 3.5 #562
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Build MATS Apps" | |
| on: | |
| push: | |
| branches: [main, development] | |
| tags: | |
| - 'v[0-9]+.[0-9]+.[0-9]+' | |
| - 'v[0-9]+.[0-9]+.[0-9]+-rc[0-9]+' | |
| paths-ignore: | |
| - "home/**" | |
| - "kubernetes/**" | |
| pull_request: | |
| paths-ignore: | |
| - "home/**" | |
| - "kubernetes/**" | |
| workflow_dispatch: | |
| env: | |
| DEV_REGISTRY: ghcr.io/noaa-gsl/mats/development | |
| jobs: | |
| lint: | |
| runs-on: ubuntu-latest | |
| strategy: | |
| fail-fast: true | |
| matrix: | |
| app: | |
| - airQuality | |
| - cb-metar | |
| - ceil-vis | |
| - ceil-vis15 | |
| - ensemble | |
| - landuse | |
| - precipAccum | |
| - precipGauge | |
| - precipitation1hr | |
| - radar | |
| - scorecard | |
| - surface | |
| - surfrad | |
| - upperair | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| with: | |
| submodules: recursive | |
| - uses: actions/setup-node@v6 | |
| with: | |
| node-version: '22' | |
| - name: Install dependencies | |
| working-directory: apps/${{ matrix.app }} | |
| run: npm ci | |
| - name: Lint | |
| working-directory: apps/${{ matrix.app }} | |
| run: npm run lint | |
| build: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 45 | |
| permissions: | |
| actions: read | |
| contents: read | |
| packages: write | |
| security-events: write | |
| strategy: | |
| fail-fast: false # Temporary workaround for job timeouts (ESOCKETTIMEDOUT errors) | |
| matrix: | |
| app: | |
| - airQuality | |
| - cb-metar | |
| - ceil-vis | |
| - ceil-vis15 | |
| - ensemble | |
| - landuse | |
| - precipAccum | |
| - precipGauge | |
| - precipitation1hr | |
| - radar | |
| - scorecard | |
| - surface | |
| - surfrad | |
| - upperair | |
| steps: | |
| - name: Gather Resource Metrics | |
| run: | # Temporary workaround to help debug job timeouts (ESOCKETTIMEDOUT errors) | |
| while true; do | |
| echo "========== $(date -u) ==========" >> resource-metrics.log | |
| echo "--- Memory ---" >> resource-metrics.log | |
| free -m >> resource-metrics.log | |
| echo "--- CPU & Load ---" >> resource-metrics.log | |
| top -b -n 1 -E=m -e=m | head -n 15 >> resource-metrics.log | |
| echo "--- Disk I/O ---" >> resource-metrics.log | |
| # Print column headers for /proc/diskstats manually for readability | |
| echo "Major Minor Name Reads ReadMerges SectorsRead MsReading Writes WriteMerges SectorsWritten MsWriting I/O_InProgress MsIO WeightedMsIO Discards DiscardMerges SectorsDiscarded MsDiscarding Flushing FlushTicks" >> resource-metrics.log | |
| # Filter out loop devices (virtual filesystems) to reduce noise | |
| cat /proc/diskstats | grep -v 'loop' >> resource-metrics.log | |
| echo "--- Network I/O ---" >> resource-metrics.log | |
| cat /proc/net/dev | grep -E 'eth0|docker0' >> resource-metrics.log | |
| echo "" >> resource-metrics.log | |
| sleep 5 | |
| done & | |
| - name: Checkout code | |
| uses: actions/checkout@v6 | |
| with: | |
| submodules: recursive | |
| - name: Set env variables | |
| shell: bash | |
| # Note - this doesn't support branch names with "/" in them | |
| run: | | |
| DATE=$(git show -s --format=%cd --date=format:'%Y-%m-%d.%H:%M:%S.%z' ${{ github.sha }}) | |
| if [[ "${GITHUB_EVENT_NAME}" == "pull_request" ]]; then | |
| # PR build | |
| echo "BRANCH=${GITHUB_HEAD_REF}" >> $GITHUB_ENV | |
| echo "VERSION=dev-${{ github.sha }}-$DATE" >> $GITHUB_ENV | |
| elif [[ "${GITHUB_EVENT_NAME}" == "push" || "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then | |
| # Handle differences between branches/tags | |
| if [[ "${GITHUB_REF}" == *"heads"* ]]; then | |
| # Branch build | |
| echo "BRANCH=${GITHUB_REF#refs/heads/}" >> $GITHUB_ENV | |
| echo "VERSION=dev-${{ github.sha }}-$DATE" >> $GITHUB_ENV | |
| elif [[ "${GITHUB_REF}" == *"tags"* ]]; then | |
| # Tag build | |
| echo "BRANCH=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV | |
| echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV | |
| else | |
| echo "ERROR: Unanticipated Git Ref - ${GITHUB_REF}" | |
| exit 1 | |
| fi | |
| else | |
| echo "ERROR: Unanticipated GitHub Event - ${GITHUB_EVENT_NAME}" | |
| exit 1 | |
| fi | |
| - name: Create lowercase app names | |
| # Docker tags must be lowercase | |
| env: | |
| APP: '${{ matrix.app }}' | |
| run: | | |
| echo "APP_LOWERCASE=${APP,,}" >> $GITHUB_ENV | |
| - name: Login to GitHub Container Registry | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: docker/setup-qemu-action@v4 | |
| - uses: docker/setup-buildx-action@v4 | |
| - name: Build image and push | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| tags: ${{ env.DEV_REGISTRY }}/${{ env.APP_LOWERCASE }}:${{ env.BRANCH }} | |
| build-args: | | |
| APPNAME=${{ matrix.app }} | |
| BUILDVER=${{ env.VERSION }} | |
| COMMITBRANCH=${{ env.BRANCH }} | |
| COMMITSHA=${{ github.sha }} | |
| cache-from: type=gha,scope=${{ github.ref_name }}-${{ matrix.app }} # add each app to GHA cache to avoid redownloading dependencies if they haven't changed | |
| cache-to: type=gha,mode=min,scope=${{ github.ref_name }}-${{ matrix.app }} # add each app to GHA cache to avoid redownloading dependencies if they haven't changed | |
| push: true | |
| # Disable provenance & sbom generation for single-arch builds as | |
| # they confuse the docker client and result in "manifest unknown" errors | |
| provenance: false | |
| sbom: false | |
| - name: Scan image with Trivy | |
| uses: aquasecurity/trivy-action@master | |
| with: | |
| image-ref: '${{ env.DEV_REGISTRY }}/${{ env.APP_LOWERCASE }}:${{ env.BRANCH }}' | |
| format: 'sarif' | |
| output: 'trivy-results-${{ env.APP_LOWERCASE }}.sarif' | |
| ignore-unfixed: true | |
| - name: Upload Trivy scan results to GitHub Security tab | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: 'trivy-results-${{ env.APP_LOWERCASE }}.sarif' | |
| - name: Scan image with Sysdig | |
| id: scan | |
| uses: sysdiglabs/scan-action@v6 | |
| with: | |
| sysdig-secure-token: ${{ secrets.SYSDIG_SECURE_TOKEN }} | |
| sysdig-secure-url: ${{ vars.SYSDIG_SECURE_ENDPOINT }} | |
| image-tag: '${{ env.DEV_REGISTRY }}/${{ env.APP_LOWERCASE }}:${{ env.BRANCH }}' | |
| stop-on-failed-policy-eval: false # TODO - switch to true once we're ready to use sysdig as our primary scanner | |
| stop-on-processing-error: true | |
| severity-at-least: high | |
| group-by-package: true | |
| - name: Upload Sysdig scan results | |
| if: success() || failure() | |
| uses: github/codeql-action/upload-sarif@v4 | |
| with: | |
| sarif_file: ${{ github.workspace }}/sarif.json | |
| - name: Upload Resource Metrics | |
| if: always() | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: resource-metrics-${{ matrix.app }}.log | |
| path: resource-metrics.log |