Skip to content

Commit c70c7a9

Browse files
cwize1cwize1
committed
GitHub actions improvements.
1. Add ARM64 build. 2. Set the correct version schema based on the build type. 3. Create a binary tarball that includes the LICENSE files. 3. Publish the binary and container tarballs as GitHub action artifacts. 4. Minor bug fix for the `build-container.sh` script. 5. Ensure all GitHub actions and jobs are explicit with what permissions are required.
1 parent 4c421f2 commit c70c7a9

10 files changed

Lines changed: 270 additions & 101 deletions

File tree

‎.github/workflows/binary-build.yml‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
# Copyright (c) Microsoft Corporation.
2+
# Licensed under the MIT License.
3+
4+
name: Build binary and container for single arch
5+
6+
permissions:
7+
contents: read
8+
9+
on:
10+
workflow_call:
11+
inputs:
12+
publishType:
13+
required: true
14+
type: string
15+
arch:
16+
required: true
17+
type: string
18+
19+
env:
20+
EXPECTED_GO_VERSION: "1.24.1"
21+
22+
jobs:
23+
build:
24+
name: go build and validate
25+
runs-on: ${{ inputs.arch == 'amd64' && 'ubuntu-24.04' || 'ubuntu-24.04-arm' }}
26+
permissions:
27+
contents: read
28+
steps:
29+
- name: checkout
30+
uses: actions/checkout@v4
31+
with:
32+
path: repo
33+
34+
- name: setup go 1.x
35+
uses: actions/setup-go@v5
36+
with:
37+
go-version: "${{ env.EXPECTED_GO_VERSION }}"
38+
id: go
39+
40+
- name: check active go version
41+
run: |
42+
go version && which go
43+
44+
- name: check go.mod
45+
run: |
46+
set -x
47+
48+
if grep -q "go $EXPECTED_GO_VERSION" ./repo/toolkit/tools/go.mod; then
49+
echo "go.mod has correct version ($EXPECTED_GO_VERSION)"
50+
else
51+
actual_version="$(grep -E '^go [0-9]+\.[0-9]+' ./repo/toolkit/tools/go.mod)"
52+
echo "go.mod has bad version expected:$EXPECTED_GO_VERSION, found: $actual_version"
53+
echo "UPDATE ./github/workflows/go-test-coverage.yml AND prerequisite documentation if minimum go version changed"
54+
exit 1
55+
fi
56+
57+
- name: Check for bad go formatting
58+
run: |
59+
set -x
60+
61+
pushd repo/toolkit
62+
sudo env "PATH=$PATH" make go-fmt-all
63+
changes=$(git diff *.go)
64+
if [ -n "$changes" ]; then
65+
echo Unformatted go files!
66+
git diff *.go
67+
exit 1
68+
fi
69+
70+
- name: check for out-of-date go modules
71+
run: |
72+
set -x
73+
74+
pushd repo/toolkit
75+
sudo env "PATH=$PATH" make go-mod-tidy
76+
modchanges=$(git diff tools/go.mod)
77+
sumchanges=$(git diff tools/go.sum)
78+
if [ -n "$modchanges$sumchanges" ]; then
79+
echo Module files out of date!
80+
git diff tools/go.mod
81+
git diff tools/go.sum
82+
exit 1
83+
fi
84+
85+
- name: check schema.json is up-to-date
86+
run: |
87+
set -x
88+
89+
pushd repo
90+
make -C toolkit/tools/imagecustomizerschemacli/
91+
92+
# Use git diff to check if the schema has changed
93+
schema_changes=$(git diff toolkit/tools/imagecustomizerapi/schema.json)
94+
if [ -n "$schema_changes" ]; then
95+
echo "Schema has changed. Please update the schema using `make -C toolkit/tools/imagecustomizerschemacli/` before committing."
96+
exit 1
97+
else
98+
echo "Schema is up-to-date!"
99+
fi
100+
101+
- name: Build binary
102+
run: |
103+
set -x
104+
105+
# Create version suffix.
106+
case "${{ inputs.publishType }}" in
107+
"official")
108+
PRERELEASE_PARAM="IMAGE_CUSTOMIZER_VERSION_PREVIEW="
109+
;;
110+
"preview")
111+
PRERELEASE_PARAM="IMAGE_CUSTOMIZER_VERSION_PREVIEW=-preview.${{github.run_id}}"
112+
;;
113+
"main")
114+
PRERELEASE_PARAM="IMAGE_CUSTOMIZER_VERSION_PREVIEW=-main.${{github.run_id}}"
115+
;;
116+
*)
117+
PRERELEASE_PARAM="IMAGE_CUSTOMIZER_VERSION_PREVIEW=-dev.${{github.run_id}}"
118+
;;
119+
esac
120+
121+
pushd repo/toolkit
122+
123+
# Build binary.
124+
sudo env "PATH=$PATH" make imagecustomizer-targz go-imager go-osmodifier $PRERELEASE_PARAM
125+
126+
# Write version to file.
127+
PACKAGE_VERSION="$(make --silent printvar-image_customizer_full_version $PRERELEASE_PARAM)"
128+
129+
popd
130+
131+
echo "$PACKAGE_VERSION" > "version.txt"
132+
133+
# Print version.
134+
echo "Version: $PACKAGE_VERSION"
135+
136+
- name: Build container
137+
run: |
138+
set -x
139+
140+
CONTAINER_TAG="imagecustomizer:build"
141+
./repo/toolkit/tools/imagecustomizer/container/build-container.sh -t "$CONTAINER_TAG" -a "${{ inputs.arch }}"
142+
143+
docker image save "$CONTAINER_TAG" | gzip > "imagecustomizer.tar.gz"
144+
145+
- name: Upload version artifact
146+
if: inputs.arch == 'amd64'
147+
uses: actions/upload-artifact@v4
148+
with:
149+
name: version
150+
path: version.txt
151+
152+
- name: Upload binary artifact
153+
uses: actions/upload-artifact@v4
154+
with:
155+
name: binary-${{ inputs.arch }}
156+
path: repo/toolkit/out/imagecustomizer.tar.gz
157+
158+
- name: Upload container artifact
159+
uses: actions/upload-artifact@v4
160+
with:
161+
name: container-${{ inputs.arch }}
162+
path: imagecustomizer.tar.gz

‎.github/workflows/build-and-test.yml‎

Lines changed: 0 additions & 95 deletions
This file was deleted.

‎.github/workflows/build-dev.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Copyright (c) Microsoft Corporation.
2+
# Licensed under the MIT License.
3+
4+
name: Build (dev)
5+
6+
permissions:
7+
contents: read
8+
9+
on:
10+
pull_request:
11+
branches:
12+
- main
13+
- release/*
14+
# Allow pipeline to be run manually.
15+
workflow_dispatch: {}
16+
17+
jobs:
18+
build:
19+
uses: ./.github/workflows/build.yml
20+
with:
21+
publishType: dev

‎.github/workflows/build-main.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Copyright (c) Microsoft Corporation.
2+
# Licensed under the MIT License.
3+
4+
name: Build (main)
5+
6+
permissions:
7+
contents: read
8+
9+
on:
10+
push:
11+
branches:
12+
- main
13+
14+
jobs:
15+
build:
16+
uses: ./.github/workflows/build.yml
17+
with:
18+
publishType: main

‎.github/workflows/build-preview.yml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# Copyright (c) Microsoft Corporation.
2+
# Licensed under the MIT License.
3+
4+
name: Build (preview)
5+
6+
permissions:
7+
contents: read
8+
9+
on:
10+
push:
11+
branches:
12+
- release/*
13+
14+
jobs:
15+
build:
16+
uses: ./.github/workflows/build.yml
17+
with:
18+
publishType: preview

‎.github/workflows/build.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Copyright (c) Microsoft Corporation.
2+
# Licensed under the MIT License.
3+
4+
name: Build binary, container, and docs
5+
6+
permissions:
7+
contents: read
8+
9+
on:
10+
workflow_call:
11+
inputs:
12+
publishType:
13+
required: true
14+
type: string
15+
16+
jobs:
17+
binary-build-amd64:
18+
name: Build AMD64
19+
uses: ./.github/workflows/binary-build.yml
20+
with:
21+
publishType: ${{ inputs.publishType }}
22+
arch: amd64
23+
24+
binary-build-arm64:
25+
name: Build ARM64
26+
uses: ./.github/workflows/binary-build.yml
27+
with:
28+
publishType: ${{ inputs.publishType }}
29+
arch: arm64
30+
31+
build-docs:
32+
uses: ./.github/workflows/docs-build.yml

‎.github/workflows/docs-build.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@ jobs:
1010
build-docs:
1111
name: jekyll github pages build
1212
runs-on: ubuntu-latest
13+
permissions:
14+
contents: read
1315
steps:
1416
- name: Checkout
1517
uses: actions/checkout@v4

‎.github/workflows/github-pages-publishing.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
name: update GitHub pages
22

3-
on:
4-
push:
5-
branches: ["stable"]
6-
workflow_dispatch:
7-
83
permissions:
94
contents: read
105
pages: write
116
id-token: write
127

8+
on:
9+
push:
10+
branches:
11+
- stable
12+
1313
# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
1414
# However, do NOT cancel in-progress runs as we want to allow these in-progress deployments to complete.
1515
concurrency:
@@ -21,6 +21,9 @@ jobs:
2121
uses: ./.github/workflows/docs-build.yml
2222

2323
deploy:
24+
permissions:
25+
pages: write
26+
id-token: write
2427
environment:
2528
name: github-pages
2629
url: ${{ steps.deployment.outputs.page_url }}

0 commit comments

Comments
 (0)