Skip to content

Commit 1d5aa64

Browse files
chenbachenba
committed
chore: build and push "directly" instead of using mozilla-it/deploy-actions
1 parent 685075e commit 1d5aa64

5 files changed

Lines changed: 243 additions & 86 deletions

File tree

‎.github/actions/build-and-push/action.yml‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
name: Build and Push Setup
2+
description: Checkout, version.json, image tag, buildx, GCP auth, and registry logins
3+
4+
inputs:
5+
version_json_path:
6+
description: Path for version.json
7+
required: false
8+
default: ./version.json
9+
workload_identity_provider:
10+
description: GCP Workload Identity provider
11+
required: true
12+
gcp_service_account:
13+
description: Prod GCP service account email
14+
required: true
15+
16+
outputs:
17+
image_tag:
18+
description: Computed image tag
19+
value: ${{ steps.tag.outputs.value }}
20+
21+
runs:
22+
using: composite
23+
steps:
24+
- name: Create version.json
25+
shell: bash
26+
run: |
27+
printf '{"commit":"%s","version":"%s","source":"%s","build":"%s"}\n' \
28+
"$GITHUB_SHA" "$GITHUB_REF_NAME" \
29+
"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
30+
"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
31+
> ${{ inputs.version_json_path }}
32+
33+
- name: Compute image tag
34+
id: tag
35+
shell: bash
36+
run: |
37+
if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
38+
echo "value=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
39+
else
40+
echo "value=${GITHUB_SHA:0:10}" >> "$GITHUB_OUTPUT"
41+
fi
42+
43+
- name: Set up Docker Buildx
44+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
45+
46+
- name: GCP auth
47+
id: gcp_auth
48+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
49+
with:
50+
workload_identity_provider: ${{ inputs.workload_identity_provider }}
51+
service_account: ${{ inputs.gcp_service_account }}
52+
token_format: access_token
53+
54+
- name: Log in to GAR
55+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
56+
with:
57+
registry: us-docker.pkg.dev
58+
username: oauth2accesstoken
59+
password: ${{ steps.gcp_auth.outputs.access_token }}
60+
61+
- name: Log in to GHCR
62+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
63+
with:
64+
registry: ghcr.io
65+
username: ${{ github.actor }}
66+
password: ${{ github.token }}

‎.github/workflows/mozcloud-publish.yaml‎

Lines changed: 171 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,8 @@
1-
# Mozilla Deploy Actions url: <https://github.com/mozilla-it/deploy-actions>
2-
# Note: even though Mozilla maintains the above actions, it is still suggested
3-
# when upgrading to use the full commit SHA and comment with version.
4-
# See <https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions>
5-
# Ex. `mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2`
6-
name: Build, Tag and Push Container Images to GAR Repository
1+
name: Build, Tag and Push Container Images to GAR
72

83
on:
94
pull_request:
105
types: [opened, labeled, unlabeled, synchronize]
11-
# paths:
12-
# - '**/sync*/**'
136
push:
147
branches:
158
- master
@@ -48,46 +41,88 @@ jobs:
4841
contents: read
4942
id-token: write
5043
packages: write
51-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
52-
with:
53-
image_name: syncstorage-rs
54-
gar_name: sync-prod
55-
project_id: moz-fx-sync-prod
56-
docker_build_args: |
57-
SYNCSTORAGE_DATABASE_BACKEND=spanner
58-
MYSQLCLIENT_PKG=libmysqlclient-dev
59-
should_tag_ghcr: true
44+
runs-on: ubuntu-latest
45+
steps:
46+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
47+
with:
48+
persist-credentials: false
49+
50+
- uses: ./.github/actions/build-and-push
51+
id: setup
52+
with:
53+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
54+
gcp_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
55+
56+
- uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
57+
with:
58+
context: .
59+
push: true
60+
build-args: |
61+
SYNCSTORAGE_DATABASE_BACKEND=spanner
62+
MYSQLCLIENT_PKG=libmysqlclient-dev
63+
tags: |
64+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncstorage-rs:${{ steps.setup.outputs.image_tag }}
65+
ghcr.io/${{ github.repository }}/syncstorage-rs:${{ steps.setup.outputs.image_tag }}
66+
cache-from: type=gha
67+
cache-to: type=gha,mode=max
6068

6169
build-and-push-syncserver-postgres:
6270
needs: check
6371
permissions:
6472
contents: read
6573
id-token: write
6674
packages: write
67-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
68-
with:
69-
image_name: syncserver-postgres
70-
gar_name: sync-prod
71-
project_id: moz-fx-sync-prod
72-
docker_build_args: |
73-
SYNCSTORAGE_DATABASE_BACKEND=postgres
74-
TOKENSERVER_DATABASE_BACKEND=postgres
75-
should_tag_ghcr: true
76-
77-
build-and-push-syncserver-postgres-enterprise-gar:
78-
needs: check
79-
permissions:
80-
contents: read
81-
id-token: write
82-
packages: write
83-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
84-
with:
85-
image_name: syncserver-postgres
86-
gar_name: fx-enterprise-private
87-
project_id: moz-fx-fx-enterprise-prod
88-
docker_build_args: |
89-
SYNCSTORAGE_DATABASE_BACKEND=postgres
90-
TOKENSERVER_DATABASE_BACKEND=postgres
75+
runs-on: ubuntu-latest
76+
steps:
77+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
78+
with:
79+
persist-credentials: false
80+
81+
- uses: ./.github/actions/build-and-push
82+
id: setup
83+
with:
84+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
85+
gcp_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
86+
87+
- name: Build and push to prod GAR and ghcr
88+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
89+
with:
90+
context: .
91+
push: true
92+
build-args: |
93+
SYNCSTORAGE_DATABASE_BACKEND=postgres
94+
TOKENSERVER_DATABASE_BACKEND=postgres
95+
tags: |
96+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-postgres:${{ steps.setup.outputs.image_tag }}
97+
ghcr.io/${{ github.repository }}/syncserver-postgres:${{ steps.setup.outputs.image_tag }}
98+
cache-from: type=gha
99+
cache-to: type=gha,mode=max
100+
101+
- name: GCP auth (enterprise)
102+
id: gcp_auth_ent
103+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
104+
with:
105+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
106+
service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-fx-enterprise-prod.iam.gserviceaccount.com"
107+
token_format: access_token
108+
109+
- name: Log in to enterprise GAR
110+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
111+
with:
112+
registry: us-docker.pkg.dev
113+
username: oauth2accesstoken
114+
password: ${{ steps.gcp_auth_ent.outputs.access_token }}
115+
116+
- name: Build and push to enterprise GAR
117+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
118+
with:
119+
context: .
120+
push: true
121+
build-args: |
122+
SYNCSTORAGE_DATABASE_BACKEND=postgres
123+
TOKENSERVER_DATABASE_BACKEND=postgres
124+
tags: us-docker.pkg.dev/moz-fx-fx-enterprise-prod/fx-enterprise-private/syncserver-postgres:${{ steps.setup.outputs.image_tag }}
125+
cache-from: type=gha
91126

92127
# Note: we are moving towards renaming all images `syncserver`, the union of sync and tokenserver.
93128
# This presently remains for the time being to simplify deploys by maintaining `image_name: syncstorage-rs-spanner-python-utils`.
@@ -98,56 +133,112 @@ jobs:
98133
contents: read
99134
id-token: write
100135
packages: write
101-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
102-
with:
103-
image_name: syncstorage-rs-spanner-python-utils
104-
gar_name: sync-prod
105-
project_id: moz-fx-sync-prod
106-
dockerfile_path: tools/spanner/Dockerfile
107-
image_build_context: tools/spanner
108-
should_tag_ghcr: true
136+
runs-on: ubuntu-latest
137+
steps:
138+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
139+
with:
140+
persist-credentials: false
141+
142+
- uses: ./.github/actions/build-and-push
143+
id: setup
144+
with:
145+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
146+
gcp_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
147+
version_json_path: ./tools/spanner/version.json
148+
149+
- uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
150+
with:
151+
context: tools/spanner
152+
file: tools/spanner/Dockerfile
153+
push: true
154+
tags: |
155+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncstorage-rs-spanner-python-utils:${{ steps.setup.outputs.image_tag }}
156+
ghcr.io/${{ github.repository }}/syncstorage-rs-spanner-python-utils:${{ steps.setup.outputs.image_tag }}
157+
cache-from: type=gha
158+
cache-to: type=gha,mode=max
109159

110160
build-and-push-syncserver-postgres-python-utils:
111161
needs: check
112162
permissions:
113163
contents: read
114164
id-token: write
115165
packages: write
116-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
117-
with:
118-
image_name: syncserver-postgres-python-utils
119-
gar_name: sync-prod
120-
project_id: moz-fx-sync-prod
121-
dockerfile_path: tools/postgres/Dockerfile
122-
image_build_context: tools/postgres
123-
should_tag_ghcr: true
124-
125-
build-and-push-syncserver-postgres-python-utils-enterprise-gar:
126-
needs: check
127-
permissions:
128-
contents: read
129-
id-token: write
130-
packages: write
131-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
132-
with:
133-
image_name: syncserver-postgres-python-utils
134-
gar_name: fx-enterprise-private
135-
project_id: moz-fx-fx-enterprise-prod
136-
dockerfile_path: tools/postgres/Dockerfile
137-
image_build_context: tools/postgres
166+
runs-on: ubuntu-latest
167+
steps:
168+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
169+
with:
170+
persist-credentials: false
171+
172+
- uses: ./.github/actions/build-and-push
173+
id: setup
174+
with:
175+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
176+
gcp_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
177+
version_json_path: ./tools/postgres/version.json
178+
179+
- name: Build and push to prod GAR and ghcr
180+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
181+
with:
182+
context: tools/postgres
183+
file: tools/postgres/Dockerfile
184+
push: true
185+
tags: |
186+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-postgres-python-utils:${{ steps.setup.outputs.image_tag }}
187+
ghcr.io/${{ github.repository }}/syncserver-postgres-python-utils:${{ steps.setup.outputs.image_tag }}
188+
cache-from: type=gha
189+
cache-to: type=gha,mode=max
190+
191+
- name: GCP auth (enterprise)
192+
id: gcp_auth_ent
193+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
194+
with:
195+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
196+
service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-fx-enterprise-prod.iam.gserviceaccount.com"
197+
token_format: access_token
198+
199+
- name: Log in to enterprise GAR
200+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
201+
with:
202+
registry: us-docker.pkg.dev
203+
username: oauth2accesstoken
204+
password: ${{ steps.gcp_auth_ent.outputs.access_token }}
205+
206+
- name: Build and push to enterprise GAR
207+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
208+
with:
209+
context: tools/postgres
210+
file: tools/postgres/Dockerfile
211+
push: true
212+
tags: us-docker.pkg.dev/moz-fx-fx-enterprise-prod/fx-enterprise-private/syncserver-postgres-python-utils:${{ steps.setup.outputs.image_tag }}
213+
cache-from: type=gha
138214

139215
build-and-push-syncserver-mysql:
140216
needs: check
141217
permissions:
142218
contents: read
143219
id-token: write
144220
packages: write
145-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
146-
with:
147-
image_name: syncserver-mysql
148-
gar_name: sync-prod
149-
project_id: moz-fx-sync-prod
150-
docker_build_args: |
151-
SYNCSTORAGE_DATABASE_BACKEND=mysql
152-
TOKENSERVER_DATABASE_BACKEND=mysql
153-
should_tag_ghcr: true
221+
runs-on: ubuntu-latest
222+
steps:
223+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
224+
with:
225+
persist-credentials: false
226+
227+
- uses: ./.github/actions/build-and-push
228+
id: setup
229+
with:
230+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
231+
gcp_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
232+
233+
- uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
234+
with:
235+
context: .
236+
push: true
237+
build-args: |
238+
SYNCSTORAGE_DATABASE_BACKEND=mysql
239+
TOKENSERVER_DATABASE_BACKEND=mysql
240+
tags: |
241+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-mysql:${{ steps.setup.outputs.image_tag }}
242+
ghcr.io/${{ github.repository }}/syncserver-mysql:${{ steps.setup.outputs.image_tag }}
243+
cache-from: type=gha
244+
cache-to: type=gha,mode=max

‎.github/workflows/mysql.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -161,10 +161,10 @@ jobs:
161161
GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
162162

163163
- name: Set up Docker Buildx
164-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
164+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
165165

166166
- name: Build MySQL Docker image
167-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
167+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
168168
with:
169169
context: .
170170
push: false

‎.github/workflows/postgres.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,10 +168,10 @@ jobs:
168168
GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
169169

170170
- name: Set up Docker Buildx
171-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
171+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
172172

173173
- name: Build Postgres Docker image
174-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
174+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
175175
with:
176176
context: .
177177
push: false

‎.github/workflows/spanner.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -195,10 +195,10 @@ jobs:
195195
GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
196196

197197
- name: Set up Docker Buildx
198-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
198+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
199199

200200
- name: Build Spanner Docker image (local artifact)
201-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
201+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
202202
with:
203203
context: .
204204
push: false

0 commit comments

Comments
 (0)