Skip to content

Commit 8a7c971

Browse files
cardosocardoso
committed
ci: fips docker compose overrides
1 parent 8e39761 commit 8a7c971

5 files changed

Lines changed: 55 additions & 30 deletions

File tree

‎.github/actions/build-docker/action.yml‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,10 @@ runs:
8686
run: |
8787
set -o xtrace
8888
export DENO_VERSION="${{ inputs.deno-version }}"
89+
compose_files=(-f docker-compose-ci.yml)
90+
if [[ "${{ inputs.type }}" == 'fips' ]]; then
91+
compose_files+=(-f docker-compose-ci.fips.yml)
92+
fi
8993
9094
# Removes unnecessary swc cores and sharp binaries to reduce image size
9195
swc_arch='x64'
@@ -111,11 +115,11 @@ runs:
111115
LOAD_OR_PUSH="--load"
112116
fi
113117
114-
# Get image name from docker-compose-ci.yml since rocketchat image is different from service name (rocket.chat)
115-
IMAGE=$(docker compose -f docker-compose-ci.yml config --format json 2>/dev/null | jq -r --arg s "${{ inputs.service }}" '.services[$s].image')
118+
# Get image name from compose config since rocketchat image is different from service name (rocket.chat)
119+
IMAGE=$(docker compose "${compose_files[@]}" config --format json 2>/dev/null | jq -r --arg s "${{ inputs.service }}" '.services[$s].image')
116120
117121
docker buildx bake \
118-
-f docker-compose-ci.yml \
122+
"${compose_files[@]}" \
119123
${LOAD_OR_PUSH} \
120124
--allow=fs.read=/tmp/build \
121125
--set "*.tags+=${IMAGE}-gha-run-${{ github.run_id }}" \
@@ -156,9 +160,13 @@ runs:
156160
shell: bash
157161
run: |
158162
set -o xtrace
163+
compose_files=(-f docker-compose-ci.yml)
164+
if [[ "${{ inputs.type }}" == 'fips' ]]; then
165+
compose_files+=(-f docker-compose-ci.fips.yml)
166+
fi
159167
160-
# Get image name from docker-compose-ci.yml
161-
IMAGE=$(docker compose -f docker-compose-ci.yml config --format json 2>/dev/null | jq -r --arg s "${{ inputs.service }}" '.services[$s].image')
168+
# Get image name from compose config
169+
IMAGE=$(docker compose "${compose_files[@]}" config --format json 2>/dev/null | jq -r --arg s "${{ inputs.service }}" '.services[$s].image')
162170
163171
# Create directory for image archives
164172
mkdir -p /tmp/docker-images

‎.github/workflows/ci-test-e2e.yml‎

Lines changed: 19 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,6 @@ jobs:
7373
env:
7474
# if building for production on develop branch or release, add suffix for coverage images
7575
DOCKER_TAG_SUFFIX_ROCKETCHAT: ${{ inputs.coverage == matrix.mongodb-version && (github.event_name == 'release' || github.ref == 'refs/heads/develop') && '-cov' || '' }}
76-
DOCKER_TAG_SUFFIX_FIPS: ${{ inputs.release == 'fips' && '-fips' || '' }}
7776
MONGODB_VERSION: ${{ matrix.mongodb-version }}
7877
COVERAGE_DIR: '/tmp/coverage/${{ startsWith(inputs.type, ''api'') && ''api'' || inputs.type }}'
7978
COVERAGE_FILE_NAME: '${{ inputs.type }}-${{ matrix.shard }}.json'
@@ -88,6 +87,16 @@ jobs:
8887
name: MongoDB ${{ matrix.mongodb-version }}${{ inputs.coverage == matrix.mongodb-version && ' coverage' || '' }} (${{ matrix.shard }}/${{ inputs.total-shard }})
8988

9089
steps:
90+
- name: Set compose files
91+
run: |
92+
if [[ '${{ inputs.release }}' == 'fips' ]]; then
93+
echo 'COMPOSE_FILES=-f docker-compose-ci.yml -f docker-compose-ci.fips.yml' >> $GITHUB_ENV
94+
echo 'COMPOSE_FILES_METEOR=-f ../../docker-compose-ci.yml -f ../../docker-compose-ci.fips.yml' >> $GITHUB_ENV
95+
else
96+
echo 'COMPOSE_FILES=-f docker-compose-ci.yml' >> $GITHUB_ENV
97+
echo 'COMPOSE_FILES_METEOR=-f ../../docker-compose-ci.yml' >> $GITHUB_ENV
98+
fi
99+
91100
- name: Collect Workflow Telemetry
92101
if: inputs.type == 'perf'
93102
uses: catchpoint/workflow-telemetry-action@v2
@@ -172,7 +181,7 @@ jobs:
172181
- name: Start httpbin container and wait for it to be ready
173182
if: inputs.type == 'api' || inputs.type == 'api-livechat'
174183
run: |
175-
docker compose -f docker-compose-ci.yml up -d httpbin
184+
docker compose $COMPOSE_FILES up -d httpbin
176185
177186
- name: Prepare code coverage directory
178187
run: |
@@ -185,15 +194,15 @@ jobs:
185194
if: inputs.release == 'ce'
186195
run: |
187196
# when we are testing CE, we only need to start the rocketchat container
188-
DEBUG_LOG_LEVEL=${DEBUG_LOG_LEVEL:-0} docker compose -f docker-compose-ci.yml up -d rocketchat --wait
197+
DEBUG_LOG_LEVEL=${DEBUG_LOG_LEVEL:-0} docker compose $COMPOSE_FILES up -d rocketchat --wait
189198
190199
- name: Start containers for EE
191200
if: inputs.release == 'ee' || inputs.release == 'fips'
192201
env:
193202
ENTERPRISE_LICENSE: ${{ inputs.enterprise-license }}
194203
TRANSPORTER: ${{ inputs.transporter }}
195204
run: |
196-
DEBUG_LOG_LEVEL=${DEBUG_LOG_LEVEL:-0} docker compose -f docker-compose-ci.yml up -d --wait
205+
DEBUG_LOG_LEVEL=${DEBUG_LOG_LEVEL:-0} docker compose $COMPOSE_FILES up -d --wait
197206
198207
- uses: ./.github/actions/setup-playwright
199208
if: inputs.type == 'ui'
@@ -203,9 +212,9 @@ jobs:
203212
run: |
204213
docker ps
205214
206-
until echo "$(docker compose -f docker-compose-ci.yml logs ddp-streamer-service)" | grep -q "NetworkBroker started successfully"; do
215+
until echo "$(docker compose $COMPOSE_FILES logs ddp-streamer-service)" | grep -q "NetworkBroker started successfully"; do
207216
echo "Waiting 'ddp-streamer' to start up"
208-
((c++)) && ((c==10)) && docker compose -f docker-compose-ci.yml logs ddp-streamer-service && exit 1
217+
((c++)) && ((c==10)) && docker compose $COMPOSE_FILES logs ddp-streamer-service && exit 1
209218
sleep 10
210219
done;
211220
@@ -223,7 +232,7 @@ jobs:
223232
224233
npm run testapi
225234
226-
docker compose -f ../../docker-compose-ci.yml stop
235+
docker compose $COMPOSE_FILES_METEOR stop
227236
228237
ls -la $COVERAGE_DIR
229238
exit $s
@@ -239,7 +248,7 @@ jobs:
239248
240249
npm run testapi:livechat
241250
242-
docker compose -f ../../docker-compose-ci.yml stop
251+
docker compose $COMPOSE_FILES_METEOR stop
243252
244253
ls -la $COVERAGE_DIR
245254
exit $s
@@ -288,11 +297,11 @@ jobs:
288297

289298
- name: Show server logs if E2E test failed
290299
if: failure()
291-
run: docker compose -f docker-compose-ci.yml logs rocketchat authorization-service queue-worker-service ddp-streamer-service account-service presence-service omnichannel-transcript-service
300+
run: docker compose $COMPOSE_FILES logs rocketchat authorization-service queue-worker-service ddp-streamer-service account-service presence-service omnichannel-transcript-service
292301

293302
- name: Show mongo logs if E2E test failed
294303
if: failure()
295-
run: docker compose -f docker-compose-ci.yml logs mongo
304+
run: docker compose $COMPOSE_FILES logs mongo
296305

297306
- name: Store coverage
298307
if: inputs.coverage == matrix.mongodb-version

‎.github/workflows/ci.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,6 @@ concurrency:
2020

2121
env:
2222
TOOL_NODE_FLAGS: ${{ vars.TOOL_NODE_FLAGS }}
23-
FIPS_ENABLED_SERVICES: '["ddp-streamer-service","presence-service"]'
2423

2524
jobs:
2625
release-versions:
@@ -319,8 +318,6 @@ jobs:
319318
env:
320319
# add suffix for the extra images with coverage if building for production
321320
DOCKER_TAG_SUFFIX_ROCKETCHAT: ${{ matrix.type == 'coverage' && (github.event_name == 'release' || github.ref == 'refs/heads/develop') && '-cov' || '' }}
322-
DOCKER_TAG_SUFFIX_FIPS: ${{ contains(fromJSON(env.FIPS_ENABLED_SERVICES), matrix.service[0]) && matrix.type == 'fips' && '-fips' || '' }}
323-
BUILD_TARGET: ${{ contains(fromJSON(env.FIPS_ENABLED_SERVICES), matrix.service[0]) && matrix.type == 'fips' && 'release-fips' || '' }}
324321
with:
325322
CR_USER: ${{ secrets.CR_USER }}
326323
CR_PAT: ${{ secrets.CR_PAT }}
@@ -337,8 +334,6 @@ jobs:
337334
if: matrix.service[1] && github.actor != 'dependabot[bot]'
338335
env:
339336
DOCKER_TAG_SUFFIX_ROCKETCHAT: ${{ matrix.type == 'coverage' && '-cov' || '' }}
340-
DOCKER_TAG_SUFFIX_FIPS: ${{ contains(fromJSON(env.FIPS_ENABLED_SERVICES), matrix.service[1]) && matrix.type == 'fips' && '-fips' || '' }}
341-
BUILD_TARGET: ${{ contains(fromJSON(env.FIPS_ENABLED_SERVICES), matrix.service[1]) && matrix.type == 'fips' && 'release-fips' || '' }}
342337
with:
343338
CR_USER: ${{ secrets.CR_USER }}
344339
CR_PAT: ${{ secrets.CR_PAT }}
@@ -356,8 +351,6 @@ jobs:
356351
if: matrix.service[2] && github.actor != 'dependabot[bot]'
357352
env:
358353
DOCKER_TAG_SUFFIX_ROCKETCHAT: ${{ matrix.type == 'coverage' && '-cov' || '' }}
359-
DOCKER_TAG_SUFFIX_FIPS: ${{ contains(fromJSON(env.FIPS_ENABLED_SERVICES), matrix.service[2]) && matrix.type == 'fips' && '-fips' || '' }}
360-
BUILD_TARGET: ${{ contains(fromJSON(env.FIPS_ENABLED_SERVICES), matrix.service[2]) && matrix.type == 'fips' && 'release-fips' || '' }}
361354
with:
362355
CR_USER: ${{ secrets.CR_USER }}
363356
CR_PAT: ${{ secrets.CR_PAT }}
@@ -375,8 +368,6 @@ jobs:
375368
if: matrix.service[3] && github.actor != 'dependabot[bot]'
376369
env:
377370
DOCKER_TAG_SUFFIX_ROCKETCHAT: ${{ matrix.type == 'coverage' && '-cov' || '' }}
378-
DOCKER_TAG_SUFFIX_FIPS: ${{ contains(fromJSON(env.FIPS_ENABLED_SERVICES), matrix.service[3]) && matrix.type == 'fips' && '-fips' || '' }}
379-
BUILD_TARGET: ${{ contains(fromJSON(env.FIPS_ENABLED_SERVICES), matrix.service[3]) && matrix.type == 'fips' && 'release-fips' || '' }}
380371
with:
381372
CR_USER: ${{ secrets.CR_USER }}
382373
CR_PAT: ${{ secrets.CR_PAT }}
@@ -404,6 +395,7 @@ jobs:
404395
with:
405396
sparse-checkout: |
406397
docker-compose-ci.yml
398+
docker-compose-ci.fips.yml
407399
sparse-checkout-cone-mode: false
408400
ref: ${{ github.ref }}
409401

@@ -980,6 +972,7 @@ jobs:
980972
with:
981973
sparse-checkout: |
982974
docker-compose-ci.yml
975+
docker-compose-ci.fips.yml
983976
sparse-checkout-cone-mode: false
984977
ref: ${{ github.ref }}
985978

@@ -1062,8 +1055,15 @@ jobs:
10621055
IMAGE_NAME="${{ needs.release-versions.outputs.lowercase-repo }}/${service}"
10631056
fi
10641057
1065-
# Get image name from docker-compose-ci.yml since rocketchat image is different from service name (rocket.chat)
1066-
SRC=$(docker compose -f docker-compose-ci.yml config --format json 2>/dev/null | jq -r --arg s "${service}" '.services[$s].image')
1058+
# Get image name from compose config since rocketchat image is different from service name (rocket.chat)
1059+
if [ "$service" == "rocketchat-cov" ]; then
1060+
SRC=$(docker compose -f docker-compose-ci.yml config --format json 2>/dev/null | jq -r --arg s "rocketchat" '.services[$s].image')-cov
1061+
elif [[ "$service" == *"-fips" ]]; then
1062+
base_service="${service%-fips}"
1063+
SRC=$(docker compose -f docker-compose-ci.yml -f docker-compose-ci.fips.yml config --format json 2>/dev/null | jq -r --arg s "$base_service" '.services[$s].image')
1064+
else
1065+
SRC=$(docker compose -f docker-compose-ci.yml config --format json 2>/dev/null | jq -r --arg s "${service}" '.services[$s].image')
1066+
fi
10671067
DEST_REPO="docker.io/${IMAGE_NAME}"
10681068
10691069
echo "Copying $SRC to ${DEST_REPO}:${PRIMARY}"

‎docker-compose-ci.fips.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
services:
2+
presence-service:
3+
build:
4+
target: release-fips
5+
image: ghcr.io/${LOWERCASE_REPOSITORY}/presence-service:${DOCKER_TAG}-fips
6+
7+
ddp-streamer-service:
8+
build:
9+
target: release-fips
10+
image: ghcr.io/${LOWERCASE_REPOSITORY}/ddp-streamer-service:${DOCKER_TAG}-fips

‎docker-compose-ci.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -88,14 +88,13 @@ services:
8888
build:
8989
dockerfile: ee/apps/presence-service/Dockerfile
9090
context: .
91-
target: ${BUILD_TARGET:-release-standard}
9291
x-bake:
9392
platforms:
9493
- linux/amd64
9594
- linux/arm64
9695
args:
9796
SERVICE: presence-service
98-
image: ghcr.io/${LOWERCASE_REPOSITORY}/presence-service:${DOCKER_TAG}${DOCKER_TAG_SUFFIX_FIPS:-}
97+
image: ghcr.io/${LOWERCASE_REPOSITORY}/presence-service:${DOCKER_TAG}
9998
environment:
10099
- MONGO_URL=mongodb://mongo:27017/rocketchat?replicaSet=rs0
101100
- 'TRANSPORTER=${TRANSPORTER:-}'
@@ -109,14 +108,13 @@ services:
109108
build:
110109
dockerfile: ee/apps/ddp-streamer/Dockerfile
111110
context: .
112-
target: ${BUILD_TARGET:-release-standard}
113111
x-bake:
114112
platforms:
115113
- linux/amd64
116114
- linux/arm64
117115
args:
118116
SERVICE: ddp-streamer
119-
image: ghcr.io/${LOWERCASE_REPOSITORY}/ddp-streamer-service:${DOCKER_TAG}${DOCKER_TAG_SUFFIX_FIPS:-}
117+
image: ghcr.io/${LOWERCASE_REPOSITORY}/ddp-streamer-service:${DOCKER_TAG}
120118
environment:
121119
- MONGO_URL=mongodb://mongo:27017/rocketchat?replicaSet=rs0
122120
- 'TRANSPORTER=${TRANSPORTER:-}'

0 commit comments

Comments
 (0)