Skip to content

Commit cadd9cd

Browse files
dureradurera
committed
Merge branch 'stable' into py311
2 parents f7e8a1d + 069b1b9 commit cadd9cd

18 files changed

Lines changed: 427380 additions & 174 deletions

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
* @durera @andrercm @sanju7216 @terenceq @whitfiea
1+
* @ibm-mas/pr-review-team

‎.github/workflows/build-cli-base.yml‎

Lines changed: 29 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,11 @@ on:
55
tags-ignore: [ "**" ]
66
release:
77
types: [ published ]
8+
env:
9+
ARTIFACTORY_TOKEN: ${{ secrets.ARTIFACTORY_TOKEN }}
10+
QUAYIO_USERNAME: ${{ secrets.QUAYIO_USERNAME }}
11+
QUAYIO_PASSWORD: ${{ secrets.QUAYIO_PASSWORD }}
12+
W3_USERNAME: ${{ secrets.W3_USERNAME }}
813

914
jobs:
1015
build-amd64:
@@ -27,23 +32,7 @@ jobs:
2732
- name: Build the docker image (amd64)
2833
run: |
2934
echo "GITHUB_REF=$GITHUB_REF"
30-
echo "GITHUB_EVENT_NAME=$GITHUB_EVENT_NAME"
31-
32-
# Login to quay.io
33-
docker login --username "${{ secrets.QUAYIO_USERNAME }}" --password "${{ secrets.QUAYIO_PASSWORD }}" quay.io
34-
35-
# Build the image
36-
$GITHUB_WORKSPACE/build/bin/docker-build.sh -r quay.io/ibmmas/cli-base --target-platform amd64 -b image/cli-base
37-
38-
# Squash the image layers
39-
python3 -m pip install docker-squash
40-
docker-squash --load-image --tag quay.io/ibmmas/cli-base:${{ env.DOCKER_TAG }}-amd64 quay.io/ibmmas/cli-base:${{ env.DOCKER_TAG }}-amd64
41-
42-
# List available images
43-
docker images
44-
45-
# Push the images
46-
docker push quay.io/ibmmas/cli-base:${{ env.DOCKER_TAG }}-amd64
35+
source $GITHUB_WORKSPACE/build/bin/build.sh amd64
4736
4837
build-s390x:
4938
name: Build Image (s390x)
@@ -63,31 +52,31 @@ jobs:
6352
source $GITHUB_WORKSPACE/build/bin/.functions.sh
6453
6554
- name: Build the docker image (s390x)
66-
env:
67-
ARTIFACTORY_TOKEN: ${{ secrets.ARTIFACTORY_TOKEN }}
6855
run: |
6956
echo "GITHUB_REF=$GITHUB_REF"
70-
echo "GITHUB_EVENT_NAME=$GITHUB_EVENT_NAME"
57+
source $GITHUB_WORKSPACE/build/bin/build.sh s390x
7158
72-
# Login to quay.io
73-
docker login --username "${{ secrets.QUAYIO_USERNAME }}" --password "${{ secrets.QUAYIO_PASSWORD }}" quay.io
74-
75-
# Before we build the s390x image we need to download some pre-build dependencies from Artifactory
76-
wget --header="Authorization:Bearer $ARTIFACTORY_TOKEN" https://na.artifactory.swg-devops.com/artifactory/wiotp-generic-local/dependencies/rclone/rclone.tar.gz -O $GITHUB_WORKSPACE/image/cli-base/install/rclone.tar.gz
77-
python3 $GITHUB_WORKSPACE/build/bin/python-collect-prebuilt-wheels.py --req-file $GITHUB_WORKSPACE/image/cli-base/install/requirements.txt --dest $GITHUB_WORKSPACE/image/cli-base/install/ --add-dependency cryptography
78-
79-
# Build the images
80-
$GITHUB_WORKSPACE/build/bin/docker-build.sh -r quay.io/ibmmas/cli-base --target-platform s390x -b image/cli-base
81-
82-
# Squash the image layers
83-
python3 -m pip install docker-squash
84-
docker-squash --load-image --tag quay.io/ibmmas/cli-base:${{ env.DOCKER_TAG }}-s390x quay.io/ibmmas/cli-base:${{ env.DOCKER_TAG }}-s390x
59+
build-ppc64le:
60+
name: Build Image (ppc64le)
61+
runs-on: ubuntu-latest
62+
if: ${{ !contains(github.event.head_commit.message, '[doc]') }}
63+
steps:
64+
- name: Checkout
65+
uses: actions/checkout@v4
66+
# Without this option, we don't get the tag information
67+
with:
68+
fetch-depth: 0
8569

86-
# List available images
87-
docker images
70+
- name: Initialise the build system
71+
run: |
72+
chmod u+x $GITHUB_WORKSPACE/build/bin/*.sh
73+
$GITHUB_WORKSPACE/build/bin/initbuild.sh
74+
source $GITHUB_WORKSPACE/build/bin/.functions.sh
8875
89-
# Push the images
90-
docker push quay.io/ibmmas/cli-base:${{ env.DOCKER_TAG }}-s390x
76+
- name: Build the docker image (ppc64le)
77+
run: |
78+
echo "GITHUB_REF=$GITHUB_REF"
79+
source $GITHUB_WORKSPACE/build/bin/build.sh ppc64le
9180
9281
build-arm64:
9382
name: Build Image (arm64)
@@ -108,24 +97,7 @@ jobs:
10897
10998
- name: Build the docker image (arm64)
11099
run: |
111-
echo "GITHUB_REF=$GITHUB_REF"
112-
echo "GITHUB_EVENT_NAME=$GITHUB_EVENT_NAME"
113-
114-
# Login to quay.io
115-
docker login --username "${{ secrets.QUAYIO_USERNAME }}" --password "${{ secrets.QUAYIO_PASSWORD }}" quay.io
116-
117-
# Build the image
118-
$GITHUB_WORKSPACE/build/bin/docker-build.sh -r quay.io/ibmmas/cli-base --target-platform arm64 -b image/cli-base
119-
120-
# # Squash the image layers
121-
python3 -m pip install docker-squash
122-
docker-squash --load-image --tag quay.io/ibmmas/cli-base:${{ env.DOCKER_TAG }}-arm64 quay.io/ibmmas/cli-base:${{ env.DOCKER_TAG }}-arm64
123-
124-
# List available images
125-
docker images
126-
127-
# Push the images
128-
docker push quay.io/ibmmas/cli-base:${{ env.DOCKER_TAG }}-arm64
100+
source $GITHUB_WORKSPACE/build/bin/build.sh arm64
129101
130102
build-manifest:
131103
name: Build Manifest
@@ -134,6 +106,7 @@ jobs:
134106
- build-amd64
135107
- build-s390x
136108
- build-arm64
109+
- build-ppc64le
137110
if: ${{ !contains(github.event.head_commit.message, '[doc]') }}
138111
steps:
139112
- name: Checkout
@@ -157,7 +130,7 @@ jobs:
157130
docker login --username "${{ secrets.QUAYIO_USERNAME }}" --password "${{ secrets.QUAYIO_PASSWORD }}" quay.io
158131
159132
# Publish the manifest
160-
$GITHUB_WORKSPACE/build/bin/docker-manifest.sh -r quay.io/ibmmas/cli-base --target-platforms amd64,s390x,arm64
133+
$GITHUB_WORKSPACE/build/bin/docker-manifest.sh -r quay.io/ibmmas/cli-base --target-platforms amd64,s390x,arm64,ppc64le
161134
162135
# Re-issue the manifest under an alias where needed
163136
# https://github.com/docker/buildx/issues/1744#issuecomment-1896645786

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,3 +23,5 @@ Provides:
2323
| `rosa` | ✔️ | ❌ ️ | ✔️ |
2424
| `boto3` | ✔️ | ✔️ | ✔️ |
2525
| `argocd` | ✔️ | ✔️ | ✔️ |
26+
27+
Note: IBM Cloud `Container-Registry` plugin is supported on ppc64le, however the `Container-Service` plugin is not.

‎build/bin/.env.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,12 @@
55

66
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
77
export PATH=$PATH:$DIR:$DIR/ptc
8+
CONFIG_DIR=$DIR/config
9+
10+
# Use OSCAP tools to produce image hardening report for built images
11+
export OSCAP_ENABLED=${OSCAP_ENABLED:-true}
12+
export OSCAP_DIR=$GITHUB_WORKSPACE/.oscap
13+
814

915
# Version file (semver)
1016
export VERSION_FILE=${GITHUB_WORKSPACE}/.version

‎build/bin/.functions.sh‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,3 +101,9 @@ function artifactory_upload() {
101101
echo "Uploading $1 to $2"
102102
curl -H "Authorization:Bearer $ARTIFACTORY_TOKEN" -H "X-Checksum-Md5: $md5Value" -H "X-Checksum-Sha1: $sha1Value" -T $1 $2 || exit 1
103103
}
104+
105+
# install oscap tools
106+
function install_oscap() {
107+
sudo apt-get update
108+
sudo apt-get install -y openscap-scanner
109+
}

‎build/bin/build.sh‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#!/bin/bash
2+
set -e
3+
4+
TARGET_PLATFORM=$1
5+
echo "GITHUB_REF=$GITHUB_REF"
6+
echo "GITHUB_EVENT_NAME=$GITHUB_EVENT_NAME"
7+
8+
export ARTIFACTORY_GENERIC_RELEASE_URL=${ARTIFACTORY_GENERIC_RELEASE_URL:-https://na.artifactory.swg-devops.com/artifactory/wiotp-generic-release}
9+
export ARTIFACTORY_GENERIC_LOCAL_URL=${ARTIFACTORY_GENERIC_LOCAL_URL:-https://na.artifactory.swg-devops.com/artifactory/wiotp-generic-local}
10+
export OSCAP_REMEDIATION_URL=${ARTIFACTORY_GENERIC_LOCAL_URL}/dependencies/oscap/ubi9/remediate.sh
11+
export OSCAP_REMEDIATION_FILE=${GITHUB_WORKSPACE}/image/cli-base/remediate.sh
12+
13+
echo "OSCAP_REMEDIATION_URL: $OSCAP_REMEDIATION_URL"
14+
echo "OSCAP_REMEDIATION_FILE: $OSCAP_REMEDIATION_FILE"
15+
16+
# Copy OSCAP remediation file from artifactory
17+
wget --header="Authorization:Bearer ${ARTIFACTORY_TOKEN}" ${OSCAP_REMEDIATION_URL} -O ${OSCAP_REMEDIATION_FILE}
18+
19+
# Login to quay.io
20+
docker login --username $QUAYIO_USERNAME --password $QUAYIO_PASSWORD quay.io
21+
if [[ "$TARGET_PLATFORM" == "s390x" || "$TARGET_PLATFORM" == "ppc64le" ]]; then
22+
# Before we build the s390x image we need to download some pre-build dependencies from Artifactory
23+
echo "in ... $TARGET_PLATFORM"
24+
wget --header="Authorization:Bearer $ARTIFACTORY_TOKEN" https://na.artifactory.swg-devops.com/artifactory/wiotp-generic-local/dependencies/rclone/$TARGET_PLATFORM/rclone.tar.gz -O $GITHUB_WORKSPACE/image/cli-base/install/rclone.tar.gz
25+
python3 $GITHUB_WORKSPACE/build/bin/python-collect-prebuilt-wheels.py --req-file $GITHUB_WORKSPACE/image/cli-base/install/requirements.txt --dest $GITHUB_WORKSPACE/image/cli-base/install/ --add-dependency cryptography --target-platform $TARGET_PLATFORM
26+
fi
27+
# Build the image
28+
$GITHUB_WORKSPACE/build/bin/docker-build.sh -r quay.io/ibmmas/cli-base --target-platform $TARGET_PLATFORM -b image/cli-base --scap-data-stream ssg-rhel9-ds
29+
30+
# Squash the image layers
31+
python3 -m pip install docker-squash
32+
docker-squash --load-image --tag quay.io/ibmmas/cli-base:$DOCKER_TAG-$TARGET_PLATFORM quay.io/ibmmas/cli-base:$DOCKER_TAG-$TARGET_PLATFORM
33+
34+
# List available images
35+
docker images
36+
37+
# Push the images
38+
docker push quay.io/ibmmas/cli-base:$DOCKER_TAG-$TARGET_PLATFORM

0 commit comments

Comments
 (0)