Skip to content

Commit 180c2e6

Browse files
chenbachenba
committed
chore: build and push "directly" instead of using mozilla-it/deploy-actions
1 parent 5dbe6bc commit 180c2e6

5 files changed

Lines changed: 216 additions & 106 deletions

File tree

‎.github/actions/build-and-push/action.yml‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
name: Build and Push Setup
2+
description: Checkout, version.json, image tag, buildx, GCP auth, and registry logins
3+
4+
inputs:
5+
version_json_path:
6+
description: Path for version.json
7+
required: false
8+
default: ./version.json
9+
workload_identity_provider:
10+
description: GCP Workload Identity provider
11+
required: true
12+
prod_service_account:
13+
description: Prod GCP service account email
14+
required: true
15+
enterprise_service_account:
16+
description: Enterprise GCP service account email
17+
required: false
18+
default: ''
19+
20+
outputs:
21+
image_tag:
22+
description: Computed image tag
23+
value: ${{ steps.tag.outputs.value }}
24+
25+
runs:
26+
using: composite
27+
steps:
28+
- name: Create version.json
29+
shell: bash
30+
run: |
31+
printf '{"commit":"%s","version":"%s","source":"%s","build":"%s"}\n' \
32+
"$GITHUB_SHA" "$GITHUB_REF_NAME" \
33+
"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
34+
"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
35+
> ${{ inputs.version_json_path }}
36+
37+
- name: Compute image tag
38+
id: tag
39+
shell: bash
40+
run: |
41+
if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
42+
echo "value=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
43+
else
44+
echo "value=${GITHUB_SHA:0:10}" >> "$GITHUB_OUTPUT"
45+
fi
46+
47+
- name: Set up Docker Buildx
48+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
49+
50+
- name: GCP auth for prod
51+
id: gcp_auth_prod
52+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
53+
with:
54+
workload_identity_provider: ${{ inputs.workload_identity_provider }}
55+
service_account: ${{ inputs.prod_service_account }}
56+
token_format: access_token
57+
create_credentials_file: false
58+
59+
- name: Log in to prod GAR
60+
shell: bash
61+
run: <<< "$PROD_TOKEN" docker login us-docker.pkg.dev -u oauth2accesstoken --password-stdin
62+
env:
63+
PROD_TOKEN: ${{ steps.gcp_auth_prod.outputs.access_token }}
64+
65+
- name: GCP auth for enterprise
66+
id: gcp_auth_ent
67+
if: inputs.enterprise_service_account != ''
68+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
69+
with:
70+
workload_identity_provider: ${{ inputs.workload_identity_provider }}
71+
service_account: ${{ inputs.enterprise_service_account }}
72+
token_format: access_token
73+
create_credentials_file: false
74+
75+
- name: Log in to enterprise GAR
76+
if: inputs.enterprise_service_account != ''
77+
shell: bash
78+
run: <<< "$ENT_TOKEN" docker login us-docker.pkg.dev -u oauth2accesstoken --password-stdin
79+
env:
80+
ENT_TOKEN: ${{ steps.gcp_auth_ent.outputs.access_token }}
81+
82+
- name: Log in to GHCR
83+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
84+
with:
85+
registry: ghcr.io
86+
username: ${{ github.actor }}
87+
password: ${{ github.token }}

‎.github/workflows/mozcloud-publish.yaml‎

Lines changed: 123 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,8 @@
1-
# Mozilla Deploy Actions url: <https://github.com/mozilla-it/deploy-actions>
2-
# Note: even though Mozilla maintains the above actions, it is still suggested
3-
# when upgrading to use the full commit SHA and comment with version.
4-
# See <https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions>
5-
# Ex. `mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2`
6-
name: Build, Tag and Push Container Images to GAR Repository
1+
name: Build, Tag and Push Container Images to GAR
72

83
on:
94
pull_request:
105
types: [opened, labeled, unlabeled, synchronize]
11-
# paths:
12-
# - '**/sync*/**'
136
push:
147
branches:
158
- master
@@ -37,15 +30,30 @@ jobs:
3730
contents: read
3831
id-token: write
3932
packages: write
40-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
41-
with:
42-
image_name: syncstorage-rs
43-
gar_name: sync-prod
44-
project_id: moz-fx-sync-prod
45-
docker_build_args: |
46-
SYNCSTORAGE_DATABASE_BACKEND=spanner
47-
MYSQLCLIENT_PKG=libmysqlclient-dev
48-
should_tag_ghcr: true
33+
runs-on: ubuntu-latest
34+
steps:
35+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
36+
with:
37+
persist-credentials: false
38+
39+
- uses: ./.github/actions/build-and-push
40+
id: setup
41+
with:
42+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
43+
prod_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
44+
45+
- uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
46+
with:
47+
context: .
48+
push: true
49+
build-args: |
50+
SYNCSTORAGE_DATABASE_BACKEND=spanner
51+
MYSQLCLIENT_PKG=libmysqlclient-dev
52+
tags: |
53+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncstorage-rs:${{ steps.setup.outputs.image_tag }}
54+
ghcr.io/${{ github.repository }}/syncstorage-rs:${{ steps.setup.outputs.image_tag }}
55+
cache-from: type=gha
56+
cache-to: type=gha,mode=max
4957

5058
build-and-push-syncserver-postgres:
5159
if: >
@@ -63,40 +71,32 @@ jobs:
6371
contents: read
6472
id-token: write
6573
packages: write
66-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
67-
with:
68-
image_name: syncserver-postgres
69-
gar_name: sync-prod
70-
project_id: moz-fx-sync-prod
71-
docker_build_args: |
72-
SYNCSTORAGE_DATABASE_BACKEND=postgres
73-
TOKENSERVER_DATABASE_BACKEND=postgres
74-
should_tag_ghcr: true
75-
76-
build-and-push-syncserver-postgres-enterprise-gar:
77-
if: >
78-
github.event_name == 'workflow_dispatch' ||
79-
(
80-
github.event_name == 'push' &&
81-
(github.ref_name == 'master' || startsWith(github.ref, 'refs/tags/'))
82-
) ||
83-
(
84-
github.event_name == 'pull_request' &&
85-
contains(github.event.pull_request.labels.*.name, 'preview') &&
86-
github.event.pull_request.head.repo.full_name == github.repository
87-
)
88-
permissions:
89-
contents: read
90-
id-token: write
91-
packages: write
92-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
93-
with:
94-
image_name: syncserver-postgres
95-
gar_name: fx-enterprise-private
96-
project_id: moz-fx-fx-enterprise-prod
97-
docker_build_args: |
98-
SYNCSTORAGE_DATABASE_BACKEND=postgres
99-
TOKENSERVER_DATABASE_BACKEND=postgres
74+
runs-on: ubuntu-latest
75+
steps:
76+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
77+
with:
78+
persist-credentials: false
79+
80+
- uses: ./.github/actions/build-and-push
81+
id: setup
82+
with:
83+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
84+
prod_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
85+
enterprise_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-fx-enterprise-prod.iam.gserviceaccount.com"
86+
87+
- uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
88+
with:
89+
context: .
90+
push: true
91+
build-args: |
92+
SYNCSTORAGE_DATABASE_BACKEND=postgres
93+
TOKENSERVER_DATABASE_BACKEND=postgres
94+
tags: |
95+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-postgres:${{ steps.setup.outputs.image_tag }}
96+
us-docker.pkg.dev/moz-fx-fx-enterprise-prod/fx-enterprise-private/syncserver-postgres:${{ steps.setup.outputs.image_tag }}
97+
ghcr.io/${{ github.repository }}/syncserver-postgres:${{ steps.setup.outputs.image_tag }}
98+
cache-from: type=gha
99+
cache-to: type=gha,mode=max
100100

101101
# Note: we are moving towards renaming all images `syncserver`, the union of sync and tokenserver.
102102
# This presently remains for the time being to simplify deploys by maintaining `image_name: syncstorage-rs-spanner-python-utils`.
@@ -117,14 +117,29 @@ jobs:
117117
contents: read
118118
id-token: write
119119
packages: write
120-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
121-
with:
122-
image_name: syncstorage-rs-spanner-python-utils
123-
gar_name: sync-prod
124-
project_id: moz-fx-sync-prod
125-
dockerfile_path: tools/spanner/Dockerfile
126-
image_build_context: tools/spanner
127-
should_tag_ghcr: true
120+
runs-on: ubuntu-latest
121+
steps:
122+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
123+
with:
124+
persist-credentials: false
125+
126+
- uses: ./.github/actions/build-and-push
127+
id: setup
128+
with:
129+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
130+
prod_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
131+
version_json_path: ./tools/spanner/version.json
132+
133+
- uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
134+
with:
135+
context: tools/spanner
136+
file: tools/spanner/Dockerfile
137+
push: true
138+
tags: |
139+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncstorage-rs-spanner-python-utils:${{ steps.setup.outputs.image_tag }}
140+
ghcr.io/${{ github.repository }}/syncstorage-rs-spanner-python-utils:${{ steps.setup.outputs.image_tag }}
141+
cache-from: type=gha
142+
cache-to: type=gha,mode=max
128143

129144
build-and-push-syncserver-postgres-python-utils:
130145
if: >
@@ -142,38 +157,31 @@ jobs:
142157
contents: read
143158
id-token: write
144159
packages: write
145-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
146-
with:
147-
image_name: syncserver-postgres-python-utils
148-
gar_name: sync-prod
149-
project_id: moz-fx-sync-prod
150-
dockerfile_path: tools/postgres/Dockerfile
151-
image_build_context: tools/postgres
152-
should_tag_ghcr: true
153-
154-
build-and-push-syncserver-postgres-python-utils-enterprise-gar:
155-
if: >
156-
github.event_name == 'workflow_dispatch' ||
157-
(
158-
github.event_name == 'push' &&
159-
(github.ref_name == 'master' || startsWith(github.ref, 'refs/tags/'))
160-
) ||
161-
(
162-
github.event_name == 'pull_request' &&
163-
contains(github.event.pull_request.labels.*.name, 'preview') &&
164-
github.event.pull_request.head.repo.full_name == github.repository
165-
)
166-
permissions:
167-
contents: read
168-
id-token: write
169-
packages: write
170-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
171-
with:
172-
image_name: syncserver-postgres-python-utils
173-
gar_name: fx-enterprise-private
174-
project_id: moz-fx-fx-enterprise-prod
175-
dockerfile_path: tools/postgres/Dockerfile
176-
image_build_context: tools/postgres
160+
runs-on: ubuntu-latest
161+
steps:
162+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
163+
with:
164+
persist-credentials: false
165+
166+
- uses: ./.github/actions/build-and-push
167+
id: setup
168+
with:
169+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
170+
prod_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
171+
enterprise_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-fx-enterprise-prod.iam.gserviceaccount.com"
172+
version_json_path: ./tools/postgres/version.json
173+
174+
- uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
175+
with:
176+
context: tools/postgres
177+
file: tools/postgres/Dockerfile
178+
push: true
179+
tags: |
180+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-postgres-python-utils:${{ steps.setup.outputs.image_tag }}
181+
us-docker.pkg.dev/moz-fx-fx-enterprise-prod/fx-enterprise-private/syncserver-postgres-python-utils:${{ steps.setup.outputs.image_tag }}
182+
ghcr.io/${{ github.repository }}/syncserver-postgres-python-utils:${{ steps.setup.outputs.image_tag }}
183+
cache-from: type=gha
184+
cache-to: type=gha,mode=max
177185

178186
build-and-push-syncserver-mysql:
179187
if: >
@@ -191,12 +199,27 @@ jobs:
191199
contents: read
192200
id-token: write
193201
packages: write
194-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
195-
with:
196-
image_name: syncserver-mysql
197-
gar_name: sync-prod
198-
project_id: moz-fx-sync-prod
199-
docker_build_args: |
200-
SYNCSTORAGE_DATABASE_BACKEND=mysql
201-
TOKENSERVER_DATABASE_BACKEND=mysql
202-
should_tag_ghcr: true
202+
runs-on: ubuntu-latest
203+
steps:
204+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
205+
with:
206+
persist-credentials: false
207+
208+
- uses: ./.github/actions/build-and-push
209+
id: setup
210+
with:
211+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
212+
prod_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
213+
214+
- uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
215+
with:
216+
context: .
217+
push: true
218+
build-args: |
219+
SYNCSTORAGE_DATABASE_BACKEND=mysql
220+
TOKENSERVER_DATABASE_BACKEND=mysql
221+
tags: |
222+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-mysql:${{ steps.setup.outputs.image_tag }}
223+
ghcr.io/${{ github.repository }}/syncserver-mysql:${{ steps.setup.outputs.image_tag }}
224+
cache-from: type=gha
225+
cache-to: type=gha,mode=max

‎.github/workflows/mysql.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -161,10 +161,10 @@ jobs:
161161
GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
162162

163163
- name: Set up Docker Buildx
164-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
164+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
165165

166166
- name: Build MySQL Docker image
167-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
167+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
168168
with:
169169
context: .
170170
push: false

‎.github/workflows/postgres.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,10 +168,10 @@ jobs:
168168
GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
169169

170170
- name: Set up Docker Buildx
171-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
171+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
172172

173173
- name: Build Postgres Docker image
174-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
174+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
175175
with:
176176
context: .
177177
push: false

‎.github/workflows/spanner.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -195,10 +195,10 @@ jobs:
195195
GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
196196

197197
- name: Set up Docker Buildx
198-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
198+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
199199

200200
- name: Build Spanner Docker image (local artifact)
201-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
201+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
202202
with:
203203
context: .
204204
push: false

0 commit comments

Comments
 (0)