ci: parameterize monitoring branch via STABLE_BRANCH env var #519
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: build | |
| run-name: "${{ inputs.consider_as_scheduled && 'Build triggered by webhook' || '' }}" | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| consider_as_scheduled: | |
| description: 'Treat this run as if it were a scheduled run' | |
| type: boolean | |
| default: false | |
| push: | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: kinoite | |
| # When updating this value, remember to also update the webhook | |
| UPSTREAM_VERSION: 43 | |
| # Only builds from this branch report to monitoring.lablans.net | |
| STABLE_BRANCH: stable | |
| jobs: | |
| wait-for-new-upstream-image: | |
| name: Decide whether to build | |
| runs-on: ubuntu-latest | |
| outputs: | |
| should_build: ${{ steps.decide.outputs.should_build }} | |
| upstream_digest: ${{ steps.upstream_digest.outputs.digest }} | |
| upstream_image: ${{ steps.upstream_digest.outputs.upstream_image }} | |
| permissions: | |
| actions: write | |
| steps: | |
| - name: Get current upstream digest | |
| id: upstream_digest | |
| shell: bash | |
| run: | | |
| UPSTREAM_IMAGE="quay.io/fedora-ostree-desktops/kinoite:${UPSTREAM_VERSION}" | |
| echo "UPSTREAM_IMAGE=${UPSTREAM_IMAGE}" >> "$GITHUB_ENV" | |
| echo "upstream_image=${UPSTREAM_IMAGE}" >> "$GITHUB_OUTPUT" | |
| DIGEST=$(skopeo inspect --format '{{.Digest}}' docker://${UPSTREAM_IMAGE}) | |
| echo "Newest digest for upstream image ${UPSTREAM_IMAGE}: ${DIGEST}" | |
| echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT" | |
| - name: Resolve effective trigger | |
| id: trigger | |
| run: | | |
| if [[ "${{ github.event_name }}" == "schedule" || "${{ inputs.consider_as_scheduled }}" == "true" ]]; then | |
| echo "is_scheduled=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "is_scheduled=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Check if that digest was already built | |
| id: cache | |
| uses: actions/cache/restore@v5 | |
| if: steps.trigger.outputs.is_scheduled == 'true' | |
| with: | |
| # Any small file/dir; we just need a path to bind the cache to. | |
| path: ${{ runner.temp }}/.digest-cache | |
| key: upstream-digest-${{ steps.upstream_digest.outputs.digest }} | |
| - name: Decide whether to build | |
| id: decide | |
| run: | | |
| should_build=false | |
| if [[ "${{ steps.trigger.outputs.is_scheduled }}" != "true" || "${{ steps.cache.outputs.cache-hit }}" != "true" ]]; then | |
| should_build=true | |
| else | |
| echo "::warning::Upstream digest ${{ steps.upstream_digest.outputs.digest }} was already built. Aborting build." | |
| gh run cancel ${{ github.run_id }} | |
| fi | |
| echo "should_build=${should_build}" >> "$GITHUB_OUTPUT" | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| GH_REPO: ${{ github.repository }} | |
| build-and-push: | |
| needs: wait-for-new-upstream-image | |
| if: needs.wait-for-new-upstream-image.outputs.should_build == 'true' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| env: | |
| COSIGN_PRIVATE_KEY: ${{ secrets.COSIGN_PRIVATE_KEY }} | |
| COSIGN_PASSWORD: ${{ secrets.COSIGN_PASSWORD }} | |
| UPSTREAM_IMAGE: ${{ needs.wait-for-new-upstream-image.outputs.upstream_image }} | |
| steps: | |
| - name: Report to monitoring (start) | |
| if: github.ref_name == env.STABLE_BRANCH | |
| shell: bash | |
| env: | |
| URL: ${{ secrets.MONITORING_PUSH_URL }} | |
| run: | | |
| curl "${URL}/start" | |
| - name: Checkout repository | |
| uses: actions/checkout@v3 | |
| - name: Install Cosign | |
| uses: sigstore/cosign-installer@v3 | |
| - name: Cache podman cache | |
| uses: actions/cache@v5 | |
| id: podman-cache | |
| with: | |
| path: | | |
| /var/tmp/buildah-cache/ | |
| /var/tmp/buildah-cache-*/ | |
| key: podman-${{ env.UPSTREAM_VERSION }}-${{ github.ref_name }}-${{ github.sha }} | |
| restore-keys: podman-${{ env.UPSTREAM_VERSION }}-${{ github.ref_name }}- | |
| - name: Show cache content | |
| if: steps.podman-cache.outputs.cache-hit == 'true' | |
| run: | | |
| sudo find /var/tmp/buildah* | |
| - name: Log in to the GitHub Container registry | |
| uses: redhat-actions/podman-login@v1 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Build/Push/Sign (opa) | |
| uses: ./.github/actions/build-push-sign | |
| with: | |
| image_name: ${{ env.IMAGE_NAME }} | |
| registry_path: ${{ env.REGISTRY }}/${{ github.actor }} | |
| tags: "opa-${{ github.ref_name }}" | |
| target: "opa" | |
| upstream_image: ${{ env.UPSTREAM_IMAGE }} | |
| packages_read_token: ${{ secrets.PACKAGES_READ_TOKEN }} | |
| - name: Build/Push/Sign (julia) | |
| uses: ./.github/actions/build-push-sign | |
| with: | |
| image_name: ${{ env.IMAGE_NAME }} | |
| registry_path: ${{ env.REGISTRY }}/${{ github.actor }} | |
| tags: "julia-${{ github.ref_name }}" | |
| target: "julia" | |
| upstream_image: ${{ env.UPSTREAM_IMAGE }} | |
| packages_read_token: ${{ secrets.PACKAGES_READ_TOKEN }} | |
| - name: Build/Push/Sign (surface) | |
| uses: ./.github/actions/build-push-sign | |
| with: | |
| image_name: ${{ env.IMAGE_NAME }} | |
| registry_path: ${{ env.REGISTRY }}/${{ github.actor }} | |
| tags: "surface-${{ github.ref_name }}" | |
| target: "surface" | |
| upstream_image: quay.io/fedora-ostree-desktops/silverblue:${{ env.UPSTREAM_VERSION }} | |
| packages_read_token: ${{ secrets.PACKAGES_READ_TOKEN }} | |
| - name: "Mark upstream image digest as built (1/2)" | |
| run: | | |
| mkdir -p "$RUNNER_TEMP/.digest-cache" | |
| echo "${{ needs.wait-for-new-upstream-image.outputs.upstream_digest }}" > "$RUNNER_TEMP/.digest-cache/last.txt" | |
| - name: "Mark upstream image digest as built (2/2)" | |
| uses: actions/cache/save@v4 | |
| with: | |
| path: ${{ runner.temp }}/.digest-cache | |
| key: upstream-digest-${{ needs.wait-for-new-upstream-image.outputs.upstream_digest }} | |
| - name: Report to monitoring (success) | |
| if: github.ref_name == env.STABLE_BRANCH | |
| shell: bash | |
| env: | |
| URL: ${{ secrets.MONITORING_PUSH_URL }} | |
| run: | | |
| curl "${URL}/0" | |
| re-run: | |
| name: Retry on failure | |
| needs: build-and-push | |
| if: failure() && fromJSON(github.run_attempt) < 5 | |
| runs-on: ubuntu-latest | |
| steps: | |
| - env: | |
| GH_REPO: ${{ github.repository }} | |
| GH_TOKEN: ${{ github.token }} | |
| GH_DEBUG: api | |
| run: gh workflow run retry.yml -F run_id=${{ github.run_id }} |