Skip to content
This repository was archived by the owner on May 12, 2026. It is now read-only.

Commit c2cf8c1

Browse files
pbasgod7pbasgod7
committed
Update CI/CD docs - no secrets needed with gha-runner
1 parent 43058ad commit c2cf8c1

1 file changed

Lines changed: 107 additions & 102 deletions

File tree

‎CI-CD-SETUP.md‎

Lines changed: 107 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -2,125 +2,130 @@
22

33
This repository includes a GitHub Actions workflow that automatically builds and pushes a Grafana Docker image with the patched Quickwit datasource plugin to ECR.
44

5-
## Required GitHub Secrets
6-
7-
The workflow requires the following secret to be configured in the repository:
8-
9-
### `AWS_ROLE_ARN`
10-
AWS IAM Role ARN with permissions to push to ECR.
11-
12-
**Example format**: `arn:aws:iam::337909757619:role/github-actions-ecr-push`
13-
14-
**Required Permissions**:
15-
```json
16-
{
17-
"Version": "2012-10-17",
18-
"Statement": [
19-
{
20-
"Effect": "Allow",
21-
"Action": [
22-
"ecr:GetAuthorizationToken",
23-
"ecr:BatchCheckLayerAvailability",
24-
"ecr:GetDownloadUrlForLayer",
25-
"ecr:BatchGetImage",
26-
"ecr:PutImage",
27-
"ecr:InitiateLayerUpload",
28-
"ecr:UploadLayerPart",
29-
"ecr:CompleteLayerUpload"
30-
],
31-
"Resource": [
32-
"arn:aws:ecr:us-east-1:337909757619:repository/grafana-quickwit"
33-
]
34-
},
35-
{
36-
"Effect": "Allow",
37-
"Action": [
38-
"ecr:GetAuthorizationToken"
39-
],
40-
"Resource": "*"
41-
}
42-
]
43-
}
44-
```
5+
## Overview
456

46-
## Setting up the Secret
47-
48-
1. Go to the repository on GitHub: https://github.com/Iterable/quickwit-datasource
49-
2. Navigate to **Settings** → **Secrets and variables** → **Actions**
50-
3. Click **New repository secret**
51-
4. Name: `AWS_ROLE_ARN`
52-
5. Value: The ARN of your IAM role (e.g., `arn:aws:iam::337909757619:role/github-actions-ecr-push`)
53-
6. Click **Add secret**
54-
55-
## IAM Role Trust Policy
56-
57-
The IAM role must trust GitHub Actions from the Iterable organization:
58-
59-
```json
60-
{
61-
"Version": "2012-10-17",
62-
"Statement": [
63-
{
64-
"Effect": "Allow",
65-
"Principal": {
66-
"Federated": "arn:aws:iam::337909757619:oidc-provider/token.actions.githubusercontent.com"
67-
},
68-
"Action": "sts:AssumeRoleWithWebIdentity",
69-
"Condition": {
70-
"StringEquals": {
71-
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
72-
},
73-
"StringLike": {
74-
"token.actions.githubusercontent.com:sub": "repo:Iterable/quickwit-datasource:*"
75-
}
76-
}
77-
}
78-
]
79-
}
80-
```
7+
The workflow uses the **`gha-runner-ecr-publish`** self-hosted runner which already has AWS credentials configured. **No additional secrets are required.**
818

829
## Workflow Triggers
8310

84-
The workflow runs on:
85-
- **Push** to `disable-field-caps-all-fields` branch
86-
- **Push** to `main` branch
87-
- **Tags** matching `v*` pattern
88-
- **Manual** trigger via workflow_dispatch
89-
90-
## Image Tags
91-
92-
Images are tagged as:
93-
- `<grafana-version>-quickwit-<plugin-version>-<short-sha>` for branch builds
94-
- `<grafana-version>-quickwit-<version>` for tag builds
95-
- `latest` for main branch or tag builds
11+
The workflow runs and **publishes to ECR** on:
12+
- **Push** to `disable-field-caps-all-fields` or `main` branches
13+
- **PR merge** to these branches
14+
- **Manual** workflow dispatch with `force_publish` option
9615

97-
**Example**: `12.4.0-quickwit-0.6.0-patched-a1b2c3d`
16+
The workflow **builds but does not publish** on:
17+
- Pull request events (for testing)
18+
- Other branch pushes
9819

99-
## Target ECR Repository
20+
## Image Details
10021

22+
### Target ECR Repository
10123
- **Repository**: `grafana-quickwit`
10224
- **Region**: `us-east-1`
10325
- **Registry**: `337909757619.dkr.ecr.us-east-1.amazonaws.com`
10426

105-
## Verifying the Workflow
27+
### Image Tags
28+
Images are tagged as:
29+
- `<grafana-version>-quickwit-<plugin-version>-<short-sha>`
30+
- Example: `12.4.0-quickwit-0.6.0-patched-a1b2c3d`
31+
- `latest` (always points to the most recent build)
32+
33+
### Image Contents
34+
- **Base**: Grafana 12.4.0
35+
- **Plugin**: Quickwit datasource v0.6.0 (patched to disable field_caps)
36+
- **Platform**: linux/amd64
37+
38+
## What the Workflow Does
39+
40+
1. **Build Plugin**
41+
- Installs Node.js and Go dependencies
42+
- Builds frontend (TypeScript → JavaScript)
43+
- Builds backend (Go binaries for Linux)
44+
- Removes signature files (since plugin is patched)
45+
- Packages as ZIP
46+
47+
2. **Build Docker Image**
48+
- Creates Dockerfile dynamically
49+
- Copies patched plugin into Grafana base image
50+
- Configures unsigned plugin loading
51+
- Adds metadata labels
52+
53+
3. **Publish to ECR** (conditional)
54+
- Authenticates to ECR using runner's AWS credentials
55+
- Tags image with git hash and `latest`
56+
- Pushes both tags to ECR
57+
- Generates build summary
58+
59+
## Running the Workflow
60+
61+
### Automatic (Recommended)
62+
Just push commits to `disable-field-caps-all-fields` branch:
63+
```bash
64+
git push origin disable-field-caps-all-fields
65+
```
10666

107-
After setting up the secret, the workflow will run automatically on the next push. You can also trigger it manually:
67+
The workflow will automatically build and push to ECR.
10868

109-
1. Go to **Actions** tab
69+
### Manual Trigger
70+
1. Go to the **Actions** tab in GitHub
11071
2. Select **Build and Push Grafana with Quickwit Plugin**
11172
3. Click **Run workflow**
112-
4. Select the branch and click **Run workflow**
73+
4. Select branch: `disable-field-caps-all-fields`
74+
5. Check **force_publish** if you want to publish to ECR
75+
6. Click **Run workflow**
76+
77+
## Verifying the Build
78+
79+
After the workflow completes:
80+
81+
1. **Check GitHub Actions**: The workflow summary will show the published image tags
82+
2. **Check ECR**:
83+
```bash
84+
aws ecr describe-images \
85+
--repository-name grafana-quickwit \
86+
--region us-east-1 \
87+
--query 'sort_by(imageDetails,& imagePushedAt)[-5:]' \
88+
--output table
89+
```
90+
91+
## Using the Image
92+
93+
Once published, reference the image in your deployments:
94+
95+
```yaml
96+
# Using specific version
97+
image: 337909757619.dkr.ecr.us-east-1.amazonaws.com/grafana-quickwit:12.4.0-quickwit-0.6.0-patched-a1b2c3d
98+
99+
# Or using latest
100+
image: 337909757619.dkr.ecr.us-east-1.amazonaws.com/grafana-quickwit:latest
101+
```
113102
114103
## Troubleshooting
115104
116-
**Error: Unable to locate credentials**
117-
- Verify the `AWS_ROLE_ARN` secret is set correctly
118-
- Check that the IAM role exists and the ARN is correct
105+
### Build Fails on Plugin Build
106+
- Check Node.js and Go versions in the workflow match requirements
107+
- Review build logs for npm or go errors
108+
109+
### Docker Build Fails
110+
- Verify the Grafana base image version exists
111+
- Check that plugin ZIP was created successfully
112+
113+
### ECR Push Fails
114+
- Verify the `gha-runner-ecr-publish` runner has ECR write permissions
115+
- Check that the ECR repository `grafana-quickwit` exists
116+
- Verify AWS credentials on the runner are valid
117+
118+
### Workflow Doesn't Trigger
119+
- Ensure you're pushing to the correct branch
120+
- Check workflow file syntax in `.github/workflows/build-and-push.yml`
121+
- Verify GitHub Actions are enabled for the repository
122+
123+
## Comparing with Backstage Setup
119124

120-
**Error: AccessDenied**
121-
- Verify the IAM role has the correct permissions policy
122-
- Verify the IAM role's trust policy allows GitHub Actions from this repository
125+
This workflow follows the same pattern as `Iterable/backstage`:
126+
- Uses `gha-runner-ecr-publish` runner
127+
- Authenticates with `aws ecr get-login-password`
128+
- Conditionally publishes based on event type
129+
- Generates summary with published tags
123130

124-
**Error: Repository does not exist**
125-
- Verify the ECR repository `grafana-quickwit` exists in `us-east-1`
126-
- Check the repository name in the workflow matches exactly
131+
No IAM roles or GitHub secrets are required because the self-hosted runner already has the necessary AWS permissions.

0 commit comments

Comments
 (0)