chore: align releases and CI with DiracX (#484)

* chore: bump diracx-charts versions when new release

* chore: use SHA instead of tags to improve security

Author: aldbr

.github/workflows/deployment.yml

@@ -150,4 +150,61 @@ jobs:
           context: .
           push: true
           tags: ghcr.io/diracgrid/diracx-web/static:${{ needs.release-please.outputs.tag_name }}
-          platforms: linux/amd64,linux/arm64
+          platforms: linux/amd64,linux/arm64
+
+  # Helm charts are updated in diracx-charts
+  # -----------------------------------------
+
+  update-charts:
+    name: Update Helm charts
+    needs:
+      - release-please
+      - build-deploy-diracx-web-release-image
+    runs-on: ubuntu-latest
+    if: ${{ needs.release-please.outputs.release_created == 'true' }}
+    steps:
+      - name: Checkout diracx-web (for update script)
+        uses: actions/checkout@v6
+        with:
+          path: diracx-web
+          sparse-checkout: .github/workflows
+
+      - name: Checkout diracx-charts
+        uses: actions/checkout@v6
+        with:
+          repository: DIRACGrid/diracx-charts
+          token: ${{ secrets.CHARTS_UPDATE_TOKEN }}
+          path: diracx-charts
+
+      - name: Configure Git
+        run: |
+          cd diracx-charts
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Update chart versions
+        run: |
+          python diracx-web/.github/workflows/update_chart_version.py \
+            --charts-dir diracx-charts \
+            --web-version "${{ needs.release-please.outputs.tag_name }}"
+
+      - name: Install pre-commit
+        run: pip install pre-commit
+
+      - name: Run pre-commit to update README
+        run: |
+          cd diracx-charts
+          pre-commit run --all-files || true
+
+      - name: Commit and push changes
+        if: success()
+        run: |
+          cd diracx-charts
+          git add -A
+
+          if ! git diff --cached --quiet; then
+            git commit -m "chore: bump diracx-web to ${{ needs.release-please.outputs.tag_name }}"
+            git push origin master
+          else
+            echo "No changes to commit"
+          fi

.github/workflows/gubbins-test.yml

@@ -54,101 +54,41 @@ jobs:
   prepare-gubbins-backend:
     runs-on: ubuntu-latest
     if: ${{ github.event_name != 'push' || github.repository == 'DIRACGrid/diracx-web' }}
-    defaults:
-      run:
-        # We need extglob for REFERENCE_BRANCH substitution
-        shell: bash -l -O extglob {0}
     steps:
       - name: Clone source
         run: |
           cd ..
           git clone https://github.com/DIRACGrid/diracx.git
 
-      # Prepare the gubbins extension
-      - name: Where the magic happens (Move extensions to a temporary directory)
-        run: |
-          # We have to copy the code to another directory
-          # and make it a git repository by itself because otherwise the
-          # root in the pyproject to do not make sense once mounted
-          # in the containers.
-          cp -r ../diracx/extensions/gubbins /tmp/
-          sed -i 's@../..@.@g' /tmp/gubbins/pyproject.toml
-          sed -i 's@../../@@g' /tmp/gubbins/gubbins-*/pyproject.toml
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@v7
-        with:
-          name: gubbins
-          path: /tmp/gubbins
-          include-hidden-files: true
-
-      # Prepare the gubbins image
-      # - Build the gubbins wheels
-      - uses: actions/setup-python@v6
-        with:
-          python-version: '3.14'
-      - name: Installing dependencies
-        run: |
-          cd ../diracx
-          python -m pip install \
-              build \
-              python-dateutil \
-              pytz \
-              readme_renderer[md] \
-              requests \
-              setuptools_scm
-      - name: Build distributions
-        run: |
-          cd ../diracx
-          for pkg_dir in $PWD/diracx-*; do
-            echo "Building $pkg_dir"
-            python -m build --outdir $PWD/dist $pkg_dir
-          done
-          # Also build the diracx metapackage
-          python -m build --outdir $PWD/dist .
-          # And build the gubbins package
-          for pkg_dir in $PWD/extensions/gubbins/gubbins-*; do
-            # Skip the testing package
-            if [[ "${pkg_dir}" =~ .*testing.* ]];
-            then
-              echo "Do not build ${pkg_dir}";
-              continue;
-            fi
-            echo "Building $pkg_dir"
-            python -m build --outdir $PWD/dist $pkg_dir
-          done
-      - name: "Find wheels"
-        id: find_wheel
-        run: |
-          cd ../diracx/dist
-          # We need to copy them there to be able to access them in the RUN --mount
-          cp diracx*.whl gubbins*.whl ../extensions/containers/services/
-          for wheel_fn in *.whl; do
-            pkg_name=$(basename "${wheel_fn}" | cut -d '-' -f 1)
-            echo "${pkg_name}-wheel-name=$(ls "${pkg_name}"-*.whl)" >> $GITHUB_OUTPUT
-          done
-
-      # - Build the gubbins image using the wheels
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+      # Build gubbins container images using pixi
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v4
 
-      - name: Build and export service
+      - name: Build gubbins services image
         uses: docker/build-push-action@v7
         with:
-          context: ../diracx/extensions/containers/services
-          tags: gubbins/services:dev
+          context: ../diracx
+          file: ../diracx/containers/Dockerfile
+          build-args: |
+            PIXI_ENV=gubbins-container-services
+          tags: ghcr.io/gubbins/services:dev
           outputs: type=docker,dest=/tmp/gubbins_services_image.tar
+
+      - name: Build gubbins client image
+        uses: docker/build-push-action@v7
+        with:
+          context: ../diracx
+          file: ../diracx/containers/Dockerfile
           build-args: |
-            EXTRA_PACKAGES_TO_INSTALL=git+https://github.com/DIRACGrid/DIRAC.git@integration
-            EXTENSION_CUSTOM_SOURCES_TO_INSTALL=/bindmount/gubbins_db*.whl,/bindmount/gubbins_routers*.whl,/bindmount/gubbins_client*.whl
+            PIXI_ENV=gubbins-container-client
+          tags: ghcr.io/gubbins/client:dev
+          outputs: type=docker,dest=/tmp/gubbins_client_image.tar
 
-      - name: Upload artifact
+      - name: Upload gubbins images
         uses: actions/upload-artifact@v7
         with:
-          name: gubbins-services-img
-          path: /tmp/gubbins_services_image.tar
+          name: gubbins-images
+          path: /tmp/gubbins_*_image.tar
 
   prepare-gubbins-frontend-as-a-standalone:
     runs-on: ubuntu-latest
@@ -226,7 +166,7 @@ jobs:
       # WARNING: In your CI/CD pipeline, you should remove the following steps  #
       # ------------------------------------------------------------------------#
       - name: Download gubbins-web
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v7
         with:
           name: gubbins-web
           path: /tmp/gubbins-web
@@ -258,43 +198,57 @@ jobs:
     # ========================================================================#
     # WARNING: In your CI/CD pipeline, you should remove the following steps  #
     # ------------------------------------------------------------------------#
-    - name: Download gubbins
-      uses: actions/download-artifact@v8
-      with:
-        name: gubbins
-        path: /tmp/gubbins
-
-    - name: Create a new git repository
-      run: |
-        git init /tmp/gubbins/
-
-    - name: Clone diracx source 
+    - name: Clone diracx source
       run: |
         cd ..
         git clone https://github.com/DIRACGrid/diracx.git
 
-    - name: Download gubbins:services image
-      uses: actions/download-artifact@v8
+    - name: Download gubbins images
+      uses: actions/download-artifact@v7
       with:
-        name: gubbins-services-img
+        name: gubbins-images
         path: /tmp/
 
-    - name: Load docker image
-      run: docker load --input /tmp/gubbins_services_image.tar
+    - name: Load gubbins images
+      run: |
+        docker load --input /tmp/gubbins_services_image.tar
+        rm -f /tmp/gubbins_services_image.tar
+        docker load --input /tmp/gubbins_client_image.tar
+        rm -f /tmp/gubbins_client_image.tar
 
     - name: Download gubbins-web
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@v7
       with:
         name: gubbins-web
         path: /tmp/gubbins-web
     # ------------------------------------------------------------------------#
     # ========================================================================#
-  
+
     # Runs the demo with the extension source code
-    - name: Start demo 
+    - name: Start demo
       run: |
         cd ..
-        diracx-charts/run_demo.sh --exit-when-done --set-value developer.autoReload=false --ci-values ./diracx/extensions/gubbins_values.yaml --load-docker-image "gubbins/services:dev" diracx/ /tmp/gubbins/ /tmp/gubbins-web/
+
+        # Download helm/kubectl/kind first
+        diracx-charts/run_demo.sh --only-download-deps
+
+        # Copy gubbins-charts to a temporary location and build dependencies
+        cp -r ./diracx/extensions/gubbins-charts /tmp/
+        diracx-charts/.demo/helm dependency build /tmp/gubbins-charts
+        # Replace the downloaded subchart with the locally-cloned one to
+        # ensure we have the pixi-compatible ConfigMap entrypoint
+        rm -f /tmp/gubbins-charts/charts/diracx-*.tgz
+        diracx-charts/.demo/helm package diracx-charts/diracx -d /tmp/gubbins-charts/charts/
+
+        diracx-charts/run_demo.sh \
+          --exit-when-done \
+          --set-value diracx.developer.autoReload=false \
+          --extension-chart-path /tmp/gubbins-charts \
+          --ci-values ./diracx/extensions/gubbins_values.yaml \
+          --load-docker-image "ghcr.io/gubbins/services:dev" \
+          --load-docker-image "ghcr.io/gubbins/client:dev" \
+          --prune-loaded-images \
+          /tmp/gubbins-web/
     
     - name: Debugging information
       run: |

.github/workflows/update_chart_version.py

@@ -0,0 +1,90 @@
+#!/usr/bin/env python3
+"""Update diracx-charts with a new diracx-web version.
+
+Bumps the chart version and updates the web image tag in values.yaml.
+Does NOT modify appVersion (that tracks the diracx server version).
+"""
+
+from __future__ import annotations
+
+import argparse
+import re
+import sys
+from pathlib import Path
+
+
+def bump_version(current_version: str) -> str:
+    """Bump a version: increment alpha number if present, otherwise patch."""
+    match = re.match(
+        r"^(\d+\.\d+\.\d+)-alpha\.(\d+)$", current_version
+    )
+    if match:
+        base, alpha = match.group(1), int(match.group(2))
+        return f"{base}-alpha.{alpha + 1}"
+
+    match = re.match(r"^(\d+)\.(\d+)\.(\d+)$", current_version)
+    if match:
+        major, minor, patch = match.groups()
+        return f"{major}.{minor}.{int(patch) + 1}"
+
+    raise ValueError(f"Invalid version format: {current_version}")
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        description="Update diracx-charts for a new diracx-web release"
+    )
+    parser.add_argument(
+        "--charts-dir",
+        type=Path,
+        required=True,
+        help="Path to the diracx-charts repository",
+    )
+    parser.add_argument(
+        "--web-version",
+        required=True,
+        help="New diracx-web version (e.g., v0.1.0)",
+    )
+    args = parser.parse_args()
+
+    chart_yaml = args.charts_dir / "diracx" / "Chart.yaml"
+    values_yaml = args.charts_dir / "diracx" / "values.yaml"
+
+    for path in (chart_yaml, values_yaml):
+        if not path.exists():
+            print(f"Error: {path} not found")
+            sys.exit(1)
+
+    # Read and bump chart version
+    chart_content = chart_yaml.read_text()
+    version_match = re.search(r'^version:\s*"?([^"\n]+)"?', chart_content, re.MULTILINE)
+    if not version_match:
+        print("Error: could not find version in Chart.yaml")
+        sys.exit(1)
+
+    current_chart_version = version_match.group(1)
+    new_chart_version = bump_version(current_chart_version)
+
+    chart_content = re.sub(
+        r'^version:\s*.*$',
+        f'version: "{new_chart_version}"',
+        chart_content,
+        flags=re.MULTILINE,
+    )
+    chart_yaml.write_text(chart_content)
+    print(f"Chart version: {current_chart_version} -> {new_chart_version}")
+
+    # Update web image tag in values.yaml
+    values_content = values_yaml.read_text()
+    values_content = re.sub(
+        r'(^    web:\s*\n      tag:\s*).*$',
+        rf'\g<1>{args.web_version}',
+        values_content,
+        flags=re.MULTILINE,
+    )
+    values_yaml.write_text(values_content)
+    print(f"Web image tag: {args.web_version}")
+
+
+if __name__ == "__main__":
+    main()

packages/diracx-web/test/e2e/dashboard.cy.ts

@@ -11,7 +11,7 @@ describe("DashboardDrawer", { retries: { runMode: 5, openMode: 3 } }, () => {
       );
     });
 
-    cy.visit("/");
+    cy.visitApp();
   });
 
   it("should render the drawer", () => {

packages/diracx-web/test/e2e/importExportState.cy.ts

@@ -5,7 +5,7 @@ describe("Export and import app state", () => {
   beforeEach(() => {
     cy.login();
 
-    cy.visit("/");
+    cy.visitApp();
 
     // Open 2 Job Monitor apps
     cy.get('[data-testid="add-application-button"]').click();

packages/diracx-web/test/e2e/jobMonitor.columns.cy.ts

@@ -9,9 +9,8 @@ import {
 describe("Job Monitor - Columns", () => {
   beforeEach(() => {
     cy.login();
-
-    cy.visit("/");
     setupJobMonitorDashboard();
+    cy.visitApp();
 
     cy.contains("Job Monitor").click();