Skip to content

Commit de38c72

Browse files
ddelnanok8sstormcenter-buildbot
ddelnano
authored and
k8sstormcenter-buildbot
committed
Use correct platform for container_push pusher binary (#2372)
Summary: Use correct platform for `container_push` pusher binary I'm not sure why upstream switched this to [target](bazelbuild/rules_docker@e48c7cc), but this fails on our current GitHub runners ([build link](https://github.com/pixie-io/pixie/actions/runs/25715727034/job/75507683014)): ``` Target //k8s/vizier:vizier_images_push up-to-date: bazel-bin/k8s/vizier/vizier_images_push INFO: Elapsed time: 817.792s, Critical Path: 223.45s INFO: 5492 processes: 430 remote cache hit, 48 internal, 5014 processwrapper-sandbox. INFO: Build completed successfully, 5492 total actions INFO: INFO: Running command line: bazel-bin/k8s/vizier/vizier_images_push INFO: Streaming build results to: https://app.buildbuddy.io/invocation/27eff3a9-fc64-4408-8ca4-1c57014fb23d /github/home/.cache/bazel/_bazel_root/56ec069a32c4abebc78228236a835895/execroot/px/bazel-out/k8-opt/bin/k8s/vizier/vizier_images_push.runfiles/px/k8s/vizier/vizier_images_push.0.push: line 31: /github/home/.cache/bazel/_bazel_root/56ec069a32c4abebc78228236a835895/execroot/px/bazel-out/k8-opt/bin/k8s/vizier/vizier_images_push.runfiles/px/../io_bazel_rules_docker/container/go/cmd/pusher/pusher_/pusher: cannot execute binary file: Exec format error ``` Relevant Issues: N/A Type of change: /kind bugfix Test Plan: vizier-release job tested with a similar change. I ccidentally used `cfg = "host"` on the latest build but should have same effect. Signed-off-by: Dom Del Nano <ddelnano@gmail.com> GitOrigin-RevId: ce0f158
1 parent e371be2 commit de38c72

17 files changed

Lines changed: 258 additions & 84 deletions

‎.github/workflows/cli_release.yaml‎

Lines changed: 113 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
image-base-name: "dev_image_with_extras"
1616
build-release:
1717
name: Build Release
18-
runs-on: oracle-vm-16cpu-64gb-x86-64
18+
runs-on: oracle-16cpu-64gb-x86-64
1919
needs: get-dev-image
2020
permissions:
2121
contents: read
@@ -24,7 +24,8 @@ jobs:
2424
image: ${{ needs.get-dev-image.outputs.image-with-tag }}
2525
env:
2626
ARTIFACT_UPLOAD_LOG: "artifact_uploads.json"
27-
MANIFEST_UPDATES: "manifest_updates.json"
27+
# When macOS signing is enabled, push-signed-artifacts owns the manifest update.
28+
MANIFEST_UPDATES: ${{ vars.ENABLE_MACOS_SIGNING == 'true' && '' || 'manifest_updates.json' }}
2829
steps:
2930
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3031
with:
@@ -41,31 +42,36 @@ jobs:
4142
# With some kernel configs (eg. COS), podman only works with legacy iptables.
4243
update-alternatives --set iptables /usr/sbin/iptables-legacy
4344
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
44-
- name: Login to GHCR
45-
uses: docker/login-action@v3
46-
with:
47-
registry: ghcr.io
48-
username: ${{ github.actor }}
49-
password: ${{ github.token }}
5045
- name: Import GPG key
5146
env:
5247
BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
5348
run: |
5449
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
50+
- name: Login to GHCR
51+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
52+
with:
53+
registry: ghcr.io
54+
username: ${{ github.actor }}
55+
password: ${{ github.token }}
5556
- name: Build & Push Artifacts
5657
env:
5758
REF: ${{ github.event.ref }}
5859
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
5960
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
6061
BUILD_NUMBER: ${{ github.run_attempt }}
6162
JOB_NAME: ${{ github.job }}
63+
GH_REPO: ${{ github.repository }}
64+
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'ghcr.io/pixie-io' }}
6265
shell: bash
6366
run: |
6467
export TAG_NAME="${REF#*/tags/}"
6568
mkdir -p "artifacts/"
6669
export ARTIFACTS_DIR="$(realpath artifacts/)"
6770
./ci/save_version_info.sh
6871
./ci/cli_build_release.sh
72+
# Despite the name, linux-artifacts also contains the unsigned darwin
73+
# binaries (cli_darwin_{amd64,arm64}_unsigned). sign-release downloads
74+
# this artifact to feed cli_merge_sign.sh.
6975
- name: Upload Github Artifacts
7076
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7177
with:
@@ -75,14 +81,101 @@ jobs:
7581
with:
7682
name: artifact-upload-log
7783
path: ${{ env.ARTIFACT_UPLOAD_LOG }}
84+
- if: vars.ENABLE_MACOS_SIGNING != 'true'
85+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
86+
with:
87+
name: manifest-updates
88+
path: manifest_updates.json
89+
sign-release:
90+
name: Sign Release for MacOS
91+
if: vars.ENABLE_MACOS_SIGNING == 'true'
92+
runs-on: macos-latest
93+
needs: build-release
94+
steps:
95+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
96+
with:
97+
fetch-depth: 0
98+
- name: Add pwd to git safe dir
99+
run: git config --global --add safe.directory `pwd`
100+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
101+
with:
102+
name: linux-artifacts
103+
path: artifacts/
104+
- name: Install gon
105+
run: brew install Bearer/tap/gon
106+
- name: Sign CLI release
107+
env:
108+
REF: ${{ github.event.ref }}
109+
AC_PASSWORD: ${{ secrets.APPLE_ID_PASSWORD }}
110+
KEYCHAIN_PASSWORD: ${{ secrets.APPLE_KEYCHAIN_PASSWORD }}
111+
CERT_BASE64: ${{ secrets.APPLE_SIGN_CERT_B64 }}
112+
CERT_PASSWORD: ${{ secrets.APPLE_SIGN_CERT_PASSWORD }}
113+
shell: bash
114+
run: |
115+
export CERT_PATH="pixie.cert"
116+
echo -n "$CERT_BASE64" | base64 --decode -o "$CERT_PATH"
117+
export TAG_NAME="${REF#*/tags/}"
118+
export ARTIFACTS_DIR="$(pwd)/artifacts"
119+
./ci/cli_merge_sign.sh
120+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
121+
with:
122+
name: macos-artifacts
123+
path: artifacts/
124+
push-signed-artifacts:
125+
name: Push Signed Artifacts for MacOS
126+
if: vars.ENABLE_MACOS_SIGNING == 'true'
127+
runs-on: ubuntu-latest
128+
needs: [get-dev-image, sign-release]
129+
container:
130+
image: ${{ needs.get-dev-image.outputs.image-with-tag }}
131+
env:
132+
MANIFEST_UPDATES: "manifest_updates.json"
133+
steps:
134+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
135+
with:
136+
fetch-depth: 0
137+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
138+
with:
139+
name: macos-artifacts
140+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
141+
with:
142+
name: artifact-upload-log
143+
- name: Import GPG key
144+
env:
145+
BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
146+
run: |
147+
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
148+
- name: Add pwd to git safe dir
149+
run: |
150+
git config --global --add safe.directory `pwd`
151+
- name: Upload signed CLI
152+
env:
153+
REF: ${{ github.event.ref }}
154+
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
155+
ARTIFACT_UPLOAD_LOG: "artifact_uploads.json"
156+
GH_REPO: ${{ github.repository }}
157+
shell: bash
158+
run: |
159+
export TAG_NAME="${REF#*/tags/}"
160+
mkdir -p "artifacts/"
161+
export ARTIFACTS_DIR="$(pwd)/artifacts"
162+
./ci/cli_upload_signed.sh
163+
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
164+
with:
165+
name: macos-signed-artifacts
166+
path: artifacts/
78167
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
79168
with:
80169
name: manifest-updates
81170
path: ${{ env.MANIFEST_UPDATES }}
82171
create-github-release:
83172
name: Create Release on Github
84173
runs-on: ubuntu-latest
85-
needs: build-release
174+
needs: [build-release, push-signed-artifacts]
175+
if: |
176+
always() &&
177+
needs.build-release.result == 'success' &&
178+
(needs.push-signed-artifacts.result == 'success' || needs.push-signed-artifacts.result == 'skipped')
86179
permissions:
87180
contents: write
88181
steps:
@@ -107,9 +200,16 @@ jobs:
107200
gh release create "${TAG_NAME}" "${prerelease[@]}" \
108201
--title "CLI ${TAG_NAME#release/cli/}" \
109202
--notes $'Pixie CLI Release:\n'"${changelog}"
110-
gh release upload "${TAG_NAME}" linux-artifacts/*
203+
shopt -s nullglob
204+
upload_paths=(linux-artifacts/*)
205+
if [[ -d macos-artifacts ]]; then
206+
upload_paths+=(macos-artifacts/*)
207+
fi
208+
gh release upload "${TAG_NAME}" "${upload_paths[@]}"
111209
update-gh-artifacts-manifest:
112-
runs-on: oracle-vm-16cpu-64gb-x86-64
210+
if: |
211+
always() && needs.create-github-release.result == 'success'
212+
runs-on: oracle-8cpu-32gb-x86-64
113213
needs: [get-dev-image, create-github-release]
114214
container:
115215
image: ${{ needs.get-dev-image.outputs.image-with-tag }}
@@ -138,8 +238,8 @@ jobs:
138238
env:
139239
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
140240
run: |
141-
git config --global user.name 'k8sstormcenter-buildbot'
142-
git config --global user.email 'info@fusioncore.ai'
241+
git config --global user.name "${{ vars.BUILDBOT_NAME || 'pixie-io-buildbot' }}"
242+
git config --global user.email "${{ vars.BUILDBOT_EMAIL || 'build@pixielabs.ai' }}"
143243
git config --global user.signingkey "${BUILDBOT_GPG_KEY_ID}"
144244
git config --global commit.gpgsign true
145245
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0

‎.github/workflows/cloud_release.yaml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
image-base-name: "dev_image_with_extras"
1616
build-release:
1717
name: Build Release
18-
runs-on: oracle-vm-16cpu-64gb-x86-64
18+
runs-on: oracle-16cpu-64gb-x86-64
1919
needs: get-dev-image
2020
permissions:
2121
contents: read
@@ -39,7 +39,11 @@ jobs:
3939
run: |
4040
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
4141
- name: Login to GHCR
42-
run: echo "${{ github.token }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
42+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
43+
with:
44+
registry: ghcr.io
45+
username: ${{ github.actor }}
46+
password: ${{ github.token }}
4347
- name: Build & Push Artifacts
4448
env:
4549
REF: ${{ github.event.ref }}
@@ -49,6 +53,8 @@ jobs:
4953
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
5054
COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
5155
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
56+
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'ghcr.io/pixie-io' }}
57+
GH_REPO: ${{ github.repository }}
5258
shell: bash
5359
run: |
5460
export TAG_NAME="${REF#*/tags/}"
@@ -76,8 +82,7 @@ jobs:
7682
env:
7783
REF: ${{ github.event.ref }}
7884
GH_TOKEN: ${{ secrets.BUILDBOT_GH_API_TOKEN }}
79-
OWNER: pixie-io
80-
REPO: pixie
85+
GH_REPO: ${{ github.repository }}
8186
shell: bash
8287
run: |
8388
export TAG_NAME="${REF#*/tags/}"

‎.github/workflows/filename_linter.yaml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
---
2+
name: 'filename-linter'
3+
on:
4+
pull_request:
5+
permissions:
6+
contents: read
7+
concurrency:
8+
group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
9+
cancel-in-progress: true
10+
jobs:
11+
check-files-changed:
12+
permissions:
13+
contents: read
14+
pull-requests: read
15+
runs-on: ubuntu-latest
16+
steps:
17+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
18+
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
19+
id: changes
20+
with:
21+
filters: |
22+
private:
23+
- '**/*private*/**'
24+
- '**/*private*'
25+
- name: Fail on private
26+
if: ${{ steps.changes.outputs.private == 'true' }}
27+
run: echo "This repo disallows dirnames or filenames with 'private' in it." && exit 1

‎.github/workflows/operator_release.yaml‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
image-base-name: "dev_image_with_extras"
1616
build-release:
1717
name: Build Release
18-
runs-on: oracle-vm-16cpu-64gb-x86-64
18+
runs-on: oracle-16cpu-64gb-x86-64
1919
needs: get-dev-image
2020
permissions:
2121
contents: read
@@ -42,7 +42,11 @@ jobs:
4242
run: |
4343
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
4444
- name: Login to GHCR
45-
run: echo "${{ github.token }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
45+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
46+
with:
47+
registry: ghcr.io
48+
username: ${{ github.actor }}
49+
password: ${{ github.token }}
4650
- name: Build & Push Artifacts
4751
env:
4852
REF: ${{ github.event.ref }}
@@ -52,6 +56,7 @@ jobs:
5256
COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
5357
GH_REPO: ${{ github.repository }}
5458
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
59+
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'ghcr.io/pixie-io' }}
5560
shell: bash
5661
run: |
5762
export TAG_NAME="${REF#*/tags/}"
@@ -120,8 +125,8 @@ jobs:
120125
env:
121126
GIT_SSH_COMMAND: "ssh -i /tmp/ssh.key"
122127
run: |
123-
git config --global user.name 'k8sstormcenter-buildbot'
124-
git config --global user.email 'info@fusioncore.ai'
128+
git config --global user.name "${{ vars.BUILDBOT_NAME || 'pixie-io-buildbot' }}"
129+
git config --global user.email "${{ vars.BUILDBOT_EMAIL || 'build@pixielabs.ai' }}"
125130
- name: Push Helm YAML to gh-pages
126131
shell: bash
127132
env:
@@ -135,7 +140,7 @@ jobs:
135140
git commit -s -m "Release Helm chart ${VERSION}"
136141
git push origin "gh-pages"
137142
update-gh-artifacts-manifest:
138-
runs-on: oracle-vm-16cpu-64gb-x86-64
143+
runs-on: oracle-8cpu-32gb-x86-64
139144
needs: [get-dev-image, create-github-release]
140145
container:
141146
image: ${{ needs.get-dev-image.outputs.image-with-tag }}
@@ -164,8 +169,8 @@ jobs:
164169
env:
165170
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
166171
run: |
167-
git config --global user.name 'k8sstormcenter-buildbot'
168-
git config --global user.email 'info@fusioncore.ai'
172+
git config --global user.name "${{ vars.BUILDBOT_NAME || 'pixie-io-buildbot' }}"
173+
git config --global user.email "${{ vars.BUILDBOT_EMAIL || 'build@pixielabs.ai' }}"
169174
git config --global user.signingkey "${BUILDBOT_GPG_KEY_ID}"
170175
git config --global commit.gpgsign true
171176
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0

‎.github/workflows/vizier_release.yaml‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ jobs:
1515
image-base-name: "dev_image_with_extras"
1616
build-release:
1717
name: Build Release
18-
runs-on: oracle-vm-16cpu-64gb-x86-64
18+
runs-on: oracle-16cpu-64gb-x86-64
1919
needs: get-dev-image
2020
permissions:
2121
contents: read
@@ -42,7 +42,11 @@ jobs:
4242
run: |
4343
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
4444
- name: Login to GHCR
45-
run: echo "${{ github.token }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
45+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
46+
with:
47+
registry: ghcr.io
48+
username: ${{ github.actor }}
49+
password: ${{ github.token }}
4650
- name: Build & Push Artifacts
4751
env:
4852
REF: ${{ github.event.ref }}
@@ -52,6 +56,7 @@ jobs:
5256
COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
5357
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
5458
GH_REPO: ${{ github.repository }}
59+
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'ghcr.io/pixie-io' }}
5560
shell: bash
5661
run: |
5762
export TAG_NAME="${REF#*/tags/}"
@@ -120,8 +125,8 @@ jobs:
120125
env:
121126
GIT_SSH_COMMAND: "ssh -i /tmp/ssh.key"
122127
run: |
123-
git config --global user.name 'k8sstormcenter-buildbot'
124-
git config --global user.email 'info@fusioncore.ai'
128+
git config --global user.name "${{ vars.BUILDBOT_NAME || 'pixie-io-buildbot' }}"
129+
git config --global user.email "${{ vars.BUILDBOT_EMAIL || 'build@pixielabs.ai' }}"
125130
- name: Push Helm YAML to gh-pages
126131
shell: bash
127132
env:
@@ -135,7 +140,7 @@ jobs:
135140
git commit -s -m "Release Helm chart Vizier ${VERSION}"
136141
git push origin "gh-pages"
137142
update-gh-artifacts-manifest:
138-
runs-on: oracle-vm-16cpu-64gb-x86-64
143+
runs-on: oracle-8cpu-32gb-x86-64
139144
needs: [get-dev-image, create-github-release]
140145
container:
141146
image: ${{ needs.get-dev-image.outputs.image-with-tag }}
@@ -164,8 +169,8 @@ jobs:
164169
env:
165170
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
166171
run: |
167-
git config --global user.name 'k8sstormcenter-buildbot'
168-
git config --global user.email 'info@fusioncore.ai'
172+
git config --global user.name "${{ vars.BUILDBOT_NAME || 'pixie-io-buildbot' }}"
173+
git config --global user.email "${{ vars.BUILDBOT_EMAIL || 'build@pixielabs.ai' }}"
169174
git config --global user.signingkey "${BUILDBOT_GPG_KEY_ID}"
170175
git config --global commit.gpgsign true
171176
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0

0 commit comments

Comments
 (0)