Skip to content

Commit 3b1f267

Browse files
chenbachenba
committed
chore: build and push "directly" instead of using mozilla-it/deploy-actions
1 parent 5dbe6bc commit 3b1f267

5 files changed

Lines changed: 198 additions & 104 deletions

File tree

‎.github/actions/build-and-push/action.yml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
name: Build and Push Setup
2+
description: Checkout, version.json, image tag, buildx, GCP auth, and registry logins
3+
4+
inputs:
5+
version_json_path:
6+
description: Path for version.json
7+
required: false
8+
default: ./version.json
9+
workload_identity_provider:
10+
description: GCP Workload Identity provider
11+
required: true
12+
prod_service_account:
13+
description: Prod GCP service account email
14+
required: true
15+
enterprise_service_account:
16+
description: Enterprise GCP service account email
17+
required: false
18+
default: ''
19+
20+
outputs:
21+
image_tag:
22+
description: Computed image tag
23+
value: ${{ steps.tag.outputs.value }}
24+
25+
runs:
26+
using: composite
27+
steps:
28+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
29+
with:
30+
persist-credentials: false
31+
32+
- name: Create version.json
33+
shell: bash
34+
run: |
35+
printf '{"commit":"%s","version":"%s","source":"%s","build":"%s"}\n' \
36+
"$GITHUB_SHA" "$GITHUB_REF_NAME" \
37+
"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY" \
38+
"$GITHUB_SERVER_URL/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID" \
39+
> ${{ inputs.version_json_path }}
40+
41+
- name: Compute image tag
42+
id: tag
43+
shell: bash
44+
run: |
45+
if [[ "$GITHUB_REF_TYPE" == "tag" ]]; then
46+
echo "value=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
47+
else
48+
echo "value=${GITHUB_SHA:0:10}" >> "$GITHUB_OUTPUT"
49+
fi
50+
51+
- name: Set up Docker Buildx
52+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
53+
54+
- name: GCP auth for prod
55+
id: gcp_auth_prod
56+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
57+
with:
58+
workload_identity_provider: ${{ inputs.workload_identity_provider }}
59+
service_account: ${{ inputs.prod_service_account }}
60+
token_format: access_token
61+
62+
- name: Log in to prod GAR
63+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
64+
with:
65+
registry: us-docker.pkg.dev
66+
username: oauth2accesstoken
67+
password: ${{ steps.gcp_auth_prod.outputs.access_token }}
68+
69+
- name: GCP auth for enterprise
70+
id: gcp_auth_ent
71+
if: inputs.enterprise_service_account != ''
72+
uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3
73+
with:
74+
workload_identity_provider: ${{ inputs.workload_identity_provider }}
75+
service_account: ${{ inputs.enterprise_service_account }}
76+
token_format: access_token
77+
78+
- name: Log in to enterprise GAR
79+
if: inputs.enterprise_service_account != ''
80+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
81+
with:
82+
registry: us-docker.pkg.dev
83+
username: oauth2accesstoken
84+
password: ${{ steps.gcp_auth_ent.outputs.access_token }}
85+
86+
- name: Log in to GHCR
87+
uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
88+
with:
89+
registry: ghcr.io
90+
username: ${{ github.actor }}
91+
password: ${{ github.token }}

‎.github/workflows/mozcloud-publish.yaml‎

Lines changed: 101 additions & 98 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,8 @@
1-
# Mozilla Deploy Actions url: <https://github.com/mozilla-it/deploy-actions>
2-
# Note: even though Mozilla maintains the above actions, it is still suggested
3-
# when upgrading to use the full commit SHA and comment with version.
4-
# See <https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions>
5-
# Ex. `mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2`
6-
name: Build, Tag and Push Container Images to GAR Repository
1+
name: Build, Tag and Push Container Images to GAR
72

83
on:
94
pull_request:
105
types: [opened, labeled, unlabeled, synchronize]
11-
# paths:
12-
# - '**/sync*/**'
136
push:
147
branches:
158
- master
@@ -37,15 +30,26 @@ jobs:
3730
contents: read
3831
id-token: write
3932
packages: write
40-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
41-
with:
42-
image_name: syncstorage-rs
43-
gar_name: sync-prod
44-
project_id: moz-fx-sync-prod
45-
docker_build_args: |
46-
SYNCSTORAGE_DATABASE_BACKEND=spanner
47-
MYSQLCLIENT_PKG=libmysqlclient-dev
48-
should_tag_ghcr: true
33+
runs-on: ubuntu-latest
34+
steps:
35+
- uses: ./.github/actions/build-and-push
36+
id: setup
37+
with:
38+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
39+
prod_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
40+
41+
- uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
42+
with:
43+
context: .
44+
push: true
45+
build-args: |
46+
SYNCSTORAGE_DATABASE_BACKEND=spanner
47+
MYSQLCLIENT_PKG=libmysqlclient-dev
48+
tags: |
49+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncstorage-rs:${{ steps.setup.outputs.image_tag }}
50+
ghcr.io/${{ github.repository }}/syncstorage-rs:${{ steps.setup.outputs.image_tag }}
51+
cache-from: type=gha
52+
cache-to: type=gha,mode=max
4953

5054
build-and-push-syncserver-postgres:
5155
if: >
@@ -63,40 +67,28 @@ jobs:
6367
contents: read
6468
id-token: write
6569
packages: write
66-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
67-
with:
68-
image_name: syncserver-postgres
69-
gar_name: sync-prod
70-
project_id: moz-fx-sync-prod
71-
docker_build_args: |
72-
SYNCSTORAGE_DATABASE_BACKEND=postgres
73-
TOKENSERVER_DATABASE_BACKEND=postgres
74-
should_tag_ghcr: true
70+
runs-on: ubuntu-latest
71+
steps:
72+
- uses: ./.github/actions/build-and-push
73+
id: setup
74+
with:
75+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
76+
prod_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
77+
enterprise_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-fx-enterprise-prod.iam.gserviceaccount.com"
7578

76-
build-and-push-syncserver-postgres-enterprise-gar:
77-
if: >
78-
github.event_name == 'workflow_dispatch' ||
79-
(
80-
github.event_name == 'push' &&
81-
(github.ref_name == 'master' || startsWith(github.ref, 'refs/tags/'))
82-
) ||
83-
(
84-
github.event_name == 'pull_request' &&
85-
contains(github.event.pull_request.labels.*.name, 'preview') &&
86-
github.event.pull_request.head.repo.full_name == github.repository
87-
)
88-
permissions:
89-
contents: read
90-
id-token: write
91-
packages: write
92-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
93-
with:
94-
image_name: syncserver-postgres
95-
gar_name: fx-enterprise-private
96-
project_id: moz-fx-fx-enterprise-prod
97-
docker_build_args: |
98-
SYNCSTORAGE_DATABASE_BACKEND=postgres
99-
TOKENSERVER_DATABASE_BACKEND=postgres
79+
- uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
80+
with:
81+
context: .
82+
push: true
83+
build-args: |
84+
SYNCSTORAGE_DATABASE_BACKEND=postgres
85+
TOKENSERVER_DATABASE_BACKEND=postgres
86+
tags: |
87+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-postgres:${{ steps.setup.outputs.image_tag }}
88+
us-docker.pkg.dev/moz-fx-fx-enterprise-prod/fx-enterprise-private/syncserver-postgres:${{ steps.setup.outputs.image_tag }}
89+
ghcr.io/${{ github.repository }}/syncserver-postgres:${{ steps.setup.outputs.image_tag }}
90+
cache-from: type=gha
91+
cache-to: type=gha,mode=max
10092

10193
# Note: we are moving towards renaming all images `syncserver`, the union of sync and tokenserver.
10294
# This presently remains for the time being to simplify deploys by maintaining `image_name: syncstorage-rs-spanner-python-utils`.
@@ -117,14 +109,25 @@ jobs:
117109
contents: read
118110
id-token: write
119111
packages: write
120-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
121-
with:
122-
image_name: syncstorage-rs-spanner-python-utils
123-
gar_name: sync-prod
124-
project_id: moz-fx-sync-prod
125-
dockerfile_path: tools/spanner/Dockerfile
126-
image_build_context: tools/spanner
127-
should_tag_ghcr: true
112+
runs-on: ubuntu-latest
113+
steps:
114+
- uses: ./.github/actions/build-and-push
115+
id: setup
116+
with:
117+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
118+
prod_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
119+
version_json_path: ./tools/spanner/version.json
120+
121+
- uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
122+
with:
123+
context: tools/spanner
124+
file: tools/spanner/Dockerfile
125+
push: true
126+
tags: |
127+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncstorage-rs-spanner-python-utils:${{ steps.setup.outputs.image_tag }}
128+
ghcr.io/${{ github.repository }}/syncstorage-rs-spanner-python-utils:${{ steps.setup.outputs.image_tag }}
129+
cache-from: type=gha
130+
cache-to: type=gha,mode=max
128131

129132
build-and-push-syncserver-postgres-python-utils:
130133
if: >
@@ -142,38 +145,27 @@ jobs:
142145
contents: read
143146
id-token: write
144147
packages: write
145-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
146-
with:
147-
image_name: syncserver-postgres-python-utils
148-
gar_name: sync-prod
149-
project_id: moz-fx-sync-prod
150-
dockerfile_path: tools/postgres/Dockerfile
151-
image_build_context: tools/postgres
152-
should_tag_ghcr: true
148+
runs-on: ubuntu-latest
149+
steps:
150+
- uses: ./.github/actions/build-and-push
151+
id: setup
152+
with:
153+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
154+
prod_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
155+
enterprise_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-fx-enterprise-prod.iam.gserviceaccount.com"
156+
version_json_path: ./tools/postgres/version.json
153157

154-
build-and-push-syncserver-postgres-python-utils-enterprise-gar:
155-
if: >
156-
github.event_name == 'workflow_dispatch' ||
157-
(
158-
github.event_name == 'push' &&
159-
(github.ref_name == 'master' || startsWith(github.ref, 'refs/tags/'))
160-
) ||
161-
(
162-
github.event_name == 'pull_request' &&
163-
contains(github.event.pull_request.labels.*.name, 'preview') &&
164-
github.event.pull_request.head.repo.full_name == github.repository
165-
)
166-
permissions:
167-
contents: read
168-
id-token: write
169-
packages: write
170-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
171-
with:
172-
image_name: syncserver-postgres-python-utils
173-
gar_name: fx-enterprise-private
174-
project_id: moz-fx-fx-enterprise-prod
175-
dockerfile_path: tools/postgres/Dockerfile
176-
image_build_context: tools/postgres
158+
- uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
159+
with:
160+
context: tools/postgres
161+
file: tools/postgres/Dockerfile
162+
push: true
163+
tags: |
164+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-postgres-python-utils:${{ steps.setup.outputs.image_tag }}
165+
us-docker.pkg.dev/moz-fx-fx-enterprise-prod/fx-enterprise-private/syncserver-postgres-python-utils:${{ steps.setup.outputs.image_tag }}
166+
ghcr.io/${{ github.repository }}/syncserver-postgres-python-utils:${{ steps.setup.outputs.image_tag }}
167+
cache-from: type=gha
168+
cache-to: type=gha,mode=max
177169

178170
build-and-push-syncserver-mysql:
179171
if: >
@@ -191,12 +183,23 @@ jobs:
191183
contents: read
192184
id-token: write
193185
packages: write
194-
uses: mozilla-it/deploy-actions/.github/workflows/build-and-push.yml@4784cb70739a4f32ce010921f60fb1ebbc791a38 # v6.2.2
195-
with:
196-
image_name: syncserver-mysql
197-
gar_name: sync-prod
198-
project_id: moz-fx-sync-prod
199-
docker_build_args: |
200-
SYNCSTORAGE_DATABASE_BACKEND=mysql
201-
TOKENSERVER_DATABASE_BACKEND=mysql
202-
should_tag_ghcr: true
186+
runs-on: ubuntu-latest
187+
steps:
188+
- uses: ./.github/actions/build-and-push
189+
id: setup
190+
with:
191+
workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }}
192+
prod_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com"
193+
194+
- uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
195+
with:
196+
context: .
197+
push: true
198+
build-args: |
199+
SYNCSTORAGE_DATABASE_BACKEND=mysql
200+
TOKENSERVER_DATABASE_BACKEND=mysql
201+
tags: |
202+
us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-mysql:${{ steps.setup.outputs.image_tag }}
203+
ghcr.io/${{ github.repository }}/syncserver-mysql:${{ steps.setup.outputs.image_tag }}
204+
cache-from: type=gha
205+
cache-to: type=gha,mode=max

‎.github/workflows/mysql.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -161,10 +161,10 @@ jobs:
161161
GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
162162

163163
- name: Set up Docker Buildx
164-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
164+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
165165

166166
- name: Build MySQL Docker image
167-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
167+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
168168
with:
169169
context: .
170170
push: false

‎.github/workflows/postgres.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,10 +168,10 @@ jobs:
168168
GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
169169

170170
- name: Set up Docker Buildx
171-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
171+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
172172

173173
- name: Build Postgres Docker image
174-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
174+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
175175
with:
176176
context: .
177177
push: false

‎.github/workflows/spanner.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -195,10 +195,10 @@ jobs:
195195
GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
196196

197197
- name: Set up Docker Buildx
198-
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
198+
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4
199199

200200
- name: Build Spanner Docker image (local artifact)
201-
uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
201+
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7
202202
with:
203203
context: .
204204
push: false

0 commit comments

Comments
 (0)