Skip to content

Commit 5ff9142

Browse files
vikrantpuppalavikrantpuppala
committed
Move CI to Databricks protected runners with JFrog OIDC
- Add .github/actions/setup-jfrog composite action for OIDC-based JFrog authentication, configuring both pip and Poetry - Switch all workflow jobs from ubuntu-latest to databricks-protected-runner-group - Replace third-party tisonkun/actions-dco with inline bash script for DCO sign-off checking - Update actions/checkout to v4 and actions/setup-python to v5 - Add id-token: write permission for JFrog OIDC token exchange Co-authored-by: Isaac Signed-off-by: Vikrant Puppala <vikrant.puppala@databricks.com>
1 parent 349e581 commit 5ff9142

4 files changed

Lines changed: 131 additions & 33 deletions

File tree

‎.github/actions/setup-jfrog/action.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Setup JFrog OIDC
2+
description: Obtain a JFrog access token via GitHub OIDC and configure pip/Poetry to use JFrog PyPI proxy
3+
4+
runs:
5+
using: composite
6+
steps:
7+
- name: Get JFrog OIDC token
8+
shell: bash
9+
run: |
10+
set -euo pipefail
11+
ID_TOKEN=$(curl -sLS \
12+
-H "User-Agent: actions/oidc-client" \
13+
-H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
14+
"${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=jfrog-github" | jq .value | tr -d '"')
15+
echo "::add-mask::${ID_TOKEN}"
16+
ACCESS_TOKEN=$(curl -sLS -XPOST -H "Content-Type: application/json" \
17+
"https://databricks.jfrog.io/access/api/v1/oidc/token" \
18+
-d "{\"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\", \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\", \"subject_token\": \"${ID_TOKEN}\", \"provider_name\": \"github-actions\"}" | jq .access_token | tr -d '"')
19+
echo "::add-mask::${ACCESS_TOKEN}"
20+
if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "null" ]; then
21+
echo "FAIL: Could not extract JFrog access token"
22+
exit 1
23+
fi
24+
echo "JFROG_ACCESS_TOKEN=${ACCESS_TOKEN}" >> "$GITHUB_ENV"
25+
echo "JFrog OIDC token obtained successfully"
26+
27+
- name: Configure pip and Poetry
28+
shell: bash
29+
run: |
30+
set -euo pipefail
31+
32+
# Configure pip index (used by Poetry's installer under the hood)
33+
echo "PIP_INDEX_URL=https://gha-service-account:${JFROG_ACCESS_TOKEN}@databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple" >> "$GITHUB_ENV"
34+
35+
# Configure JFrog as a supplemental source for Poetry
36+
poetry config repositories.jfrog https://databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple
37+
poetry config http-basic.jfrog gha-service-account "${JFROG_ACCESS_TOKEN}"
38+
39+
echo "pip and Poetry configured to use JFrog registry"

‎.github/workflows/code-quality-checks.yml‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,10 +10,13 @@ on:
1010

1111
permissions:
1212
contents: read
13+
id-token: write
1314

1415
jobs:
1516
check-linting:
16-
runs-on: ubuntu-latest
17+
runs-on:
18+
group: databricks-protected-runner-group
19+
labels: linux-ubuntu-latest
1720
strategy:
1821
matrix:
1922
python-version: [3.9, "3.10", "3.11", "3.12"]
@@ -22,10 +25,12 @@ jobs:
2225
# check-out repo and set-up python
2326
#----------------------------------------------
2427
- name: Check out repository
25-
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
28+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
29+
- name: Setup JFrog
30+
uses: ./.github/actions/setup-jfrog
2631
- name: Set up python ${{ matrix.python-version }}
2732
id: setup-python
28-
uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2
33+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
2934
with:
3035
python-version: ${{ matrix.python-version }}
3136
#----------------------------------------------
@@ -66,7 +71,9 @@ jobs:
6671
run: poetry run black --check src
6772

6873
check-types:
69-
runs-on: ubuntu-latest
74+
runs-on:
75+
group: databricks-protected-runner-group
76+
labels: linux-ubuntu-latest
7077
strategy:
7178
matrix:
7279
python-version: [3.9, "3.10", "3.11", "3.12"]
@@ -75,10 +82,12 @@ jobs:
7582
# check-out repo and set-up python
7683
#----------------------------------------------
7784
- name: Check out repository
78-
uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
85+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
86+
- name: Setup JFrog
87+
uses: ./.github/actions/setup-jfrog
7988
- name: Set up python ${{ matrix.python-version }}
8089
id: setup-python
81-
uses: actions/setup-python@e9aba2c848f5ebd159c070c61ea2c4e2b122355e # v2
90+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
8291
with:
8392
python-version: ${{ matrix.python-version }}
8493
#----------------------------------------------
@@ -118,4 +127,4 @@ jobs:
118127
- name: Mypy
119128
run: |
120129
mkdir .mypy_cache # Workaround for bad error message "error: --install-types failed (no mypy cache directory)"; see https://github.com/python/mypy/issues/10768#issuecomment-2178450153
121-
poetry run mypy --install-types --non-interactive src
130+
poetry run mypy --install-types --non-interactive src

‎.github/workflows/dco-check.yml‎

Lines changed: 68 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,74 @@
11
name: DCO Check
22

3-
on: [pull_request]
3+
on:
4+
pull_request:
5+
types: [opened, synchronize, reopened]
6+
branches: [main]
47

58
permissions:
6-
contents: read
7-
pull-requests: write
9+
contents: read
810

911
jobs:
10-
check:
11-
runs-on: ubuntu-latest
12-
steps:
13-
- name: Check for DCO
14-
id: dco-check
15-
uses: tisonkun/actions-dco@6d1f8a197db1b04df1769707b46b9366b1eca902 # v1.1
16-
- name: Comment about DCO status
17-
uses: actions/github-script@00f12e3e20659f42342b1c0226afda7f7c042325 # v6
18-
if: ${{ failure() }}
19-
with:
20-
script: |
21-
github.rest.issues.createComment({
22-
issue_number: context.issue.number,
23-
owner: context.repo.owner,
24-
repo: context.repo.repo,
25-
body: `Thanks for your contribution! To satisfy the DCO policy in our \
26-
[contributing guide](https://github.com/databricks/databricks-sqlalchemy/blob/main/CONTRIBUTING.md) \
27-
every commit message must include a sign-off message. One or more of your commits is missing this message. \
28-
You can reword previous commit messages with an interactive rebase (\`git rebase -i main\`).`
29-
})
12+
dco-check:
13+
runs-on:
14+
group: databricks-protected-runner-group
15+
labels: linux-ubuntu-latest
16+
name: Check DCO Sign-off
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
20+
with:
21+
fetch-depth: 0
22+
23+
- name: Check DCO Sign-off
24+
env:
25+
BASE_SHA: ${{ github.event.pull_request.base.sha }}
26+
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
27+
run: |
28+
#!/bin/bash
29+
set -e
30+
31+
echo "Checking commits from $BASE_SHA to $HEAD_SHA"
32+
33+
COMMITS=$(git rev-list --no-merges "$BASE_SHA..$HEAD_SHA")
34+
35+
if [ -z "$COMMITS" ]; then
36+
echo "No commits found in this PR"
37+
exit 0
38+
fi
39+
40+
FAILED_COMMITS=()
41+
42+
for commit in $COMMITS; do
43+
echo "Checking commit: $commit"
44+
COMMIT_MSG=$(git log --format=%B -n 1 "$commit")
45+
if echo "$COMMIT_MSG" | grep -q "^Signed-off-by: "; then
46+
echo " Commit $commit has DCO sign-off"
47+
else
48+
echo " Commit $commit is missing DCO sign-off"
49+
FAILED_COMMITS+=("$commit")
50+
fi
51+
done
52+
53+
if [ ${#FAILED_COMMITS[@]} -ne 0 ]; then
54+
echo ""
55+
echo "DCO Check Failed!"
56+
echo "The following commits are missing the required 'Signed-off-by' line:"
57+
for commit in "${FAILED_COMMITS[@]}"; do
58+
echo " - $commit: $(git log --format=%s -n 1 "$commit")"
59+
done
60+
echo ""
61+
echo "To fix this, you need to sign off your commits. You can:"
62+
echo "1. Add sign-off to new commits: git commit -s -m 'Your commit message'"
63+
echo "2. Amend existing commits: git commit --amend --signoff"
64+
echo "3. For multiple commits, use: git rebase --signoff HEAD~N (where N is the number of commits)"
65+
echo ""
66+
echo "The sign-off should be in the format:"
67+
echo "Signed-off-by: Your Name <your.email@example.com>"
68+
echo ""
69+
echo "For more details, see CONTRIBUTING.md"
70+
exit 1
71+
else
72+
echo ""
73+
echo "All commits have proper DCO sign-off!"
74+
fi

‎.github/workflows/integration.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,13 @@ on:
99

1010
permissions:
1111
contents: read
12+
id-token: write
1213

1314
jobs:
1415
run-e2e-tests:
15-
runs-on: ubuntu-latest
16+
runs-on:
17+
group: databricks-protected-runner-group
18+
labels: linux-ubuntu-latest
1619
environment: azure-prod
1720
env:
1821
DATABRICKS_SERVER_HOSTNAME: ${{ secrets.DATABRICKS_HOST }}
@@ -26,10 +29,12 @@ jobs:
2629
# check-out repo and set-up python
2730
#----------------------------------------------
2831
- name: Check out repository
29-
uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
32+
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
33+
- name: Setup JFrog
34+
uses: ./.github/actions/setup-jfrog
3035
- name: Set up python
3136
id: setup-python
32-
uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
37+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
3338
with:
3439
python-version: "3.10"
3540
#----------------------------------------------

0 commit comments

Comments
 (0)