Skip to content

Commit 73889f1

Browse files
brendan-kellambrendan-kellam
authored
Merge branch 'main' into feature/mcp-temporal-params
2 parents 4be7cf4 + bbabfe4 commit 73889f1

116 files changed

Lines changed: 3516 additions & 1594 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.cursor/rules/cloud_agent.mdc‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
alwaysApply: true
3+
---
4+
- After creating a GitHub PR, create a follow-up commit with a Changelog entry in CHANGELOG.md with a short description of the change. Follow the existing conventions in that file, namely: 1) entries must be parented under a header (Added, Changed, Deprecated, Removed, Fixed, or Security), 2) entries must include the GitHub pull request id at the end of the line, formatted as [#<id>](<url>) (e.g., [#696](https://github.com/sourcebot-dev/sourcebot/pull/696)).
5+
- When creating a GitHub PR for a given issue, always include "Fixes #<id>" in the body of the GitHub PR description, where <id> is the id of the GitHub issue.

.github/workflows/ghcr-publish.yml renamed to .github/workflows/_build.yml

Lines changed: 41 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,38 @@
1-
name: Publish to ghcr
2-
3-
# This workflow is a modification of a example.
1+
# Internal reusable workflow for building multi-platform Docker images.
2+
#
3+
# This workflow builds Docker images for linux/amd64 and linux/arm64 platforms,
4+
# pushes them by digest to GHCR, signs them with cosign/Sigstore for supply chain
5+
# security, and uploads build artifacts for subsequent manifest creation.
6+
#
47
# @ see: https://docs.docker.com/build/ci/github-actions/multi-platform/#distribute-build-across-multiple-runners
58

9+
name: Build Multi-Platform Images
10+
611
on:
7-
push:
8-
branches: ["main"]
9-
tags: ["v*.*.*"]
1012
workflow_call:
1113
inputs:
12-
version:
13-
description: 'Version tag (e.g., v4.10.5)'
14-
required: false
14+
git_ref:
15+
description: "Git ref to checkout"
16+
required: true
17+
type: string
18+
docker_tags:
19+
description: "Docker tags configuration (JSON array or raw tags)"
20+
required: true
1521
type: string
22+
use_app_token:
23+
description: "Whether to use GitHub App token for checkout"
24+
required: false
25+
type: boolean
26+
default: false
27+
secrets:
28+
release_app_id:
29+
description: "GitHub App ID (required if use_app_token is true)"
30+
required: false
31+
release_app_private_key:
32+
description: "GitHub App private key (required if use_app_token is true)"
33+
required: false
1634

1735
env:
18-
# Use docker.io for Docker Hub if empty
1936
REGISTRY_IMAGE: ghcr.io/sourcebot-dev/sourcebot
2037

2138
jobs:
@@ -25,8 +42,8 @@ jobs:
2542
permissions:
2643
contents: read
2744
packages: write
28-
# This is used to complete the identity challenge
29-
# with sigstore/fulcio when running outside of PRs.
45+
# Required for keyless signing with cosign/Sigstore.
46+
# Allows workflow to obtain OIDC token for ephemeral certificate from Fulcio.
3047
id-token: write
3148
strategy:
3249
matrix:
@@ -38,6 +55,14 @@ jobs:
3855
runs-on: ubuntu-24.04-arm
3956

4057
steps:
58+
- name: Generate GitHub App token
59+
if: inputs.use_app_token
60+
id: generate_token
61+
uses: actions/create-github-app-token@v1
62+
with:
63+
app-id: ${{ secrets.release_app_id }}
64+
private-key: ${{ secrets.release_app_private_key }}
65+
4166
- name: Prepare
4267
run: |
4368
platform=${{ matrix.platform }}
@@ -46,8 +71,10 @@ jobs:
4671
- name: Checkout repository
4772
uses: actions/checkout@v4
4873
with:
49-
ref: ${{ inputs.version || github.ref_name }}
74+
ref: ${{ inputs.git_ref }}
5075
submodules: "true"
76+
fetch-depth: 0
77+
token: ${{ inputs.use_app_token && steps.generate_token.outputs.token || github.token }}
5178

5279
# Extract metadata (tags, labels) for Docker
5380
# https://github.com/docker/metadata-action
@@ -56,6 +83,7 @@ jobs:
5683
uses: docker/metadata-action@v5
5784
with:
5885
images: ${{ env.REGISTRY_IMAGE }}
86+
tags: ${{ inputs.docker_tags }}
5987

6088
# Install the cosign tool except on PR
6189
# https://github.com/sigstore/cosign-installer
@@ -112,43 +140,4 @@ jobs:
112140
# This step uses the identity token to provision an ephemeral certificate
113141
# against the sigstore community Fulcio instance.
114142
run: echo "${TAGS}" | xargs -I {} cosign sign --yes {}@${DIGEST}
115-
116-
merge:
117-
runs-on: ubuntu-latest
118-
permissions:
119-
packages: write
120-
needs:
121-
- build
122-
steps:
123-
- name: Download digests
124-
uses: actions/download-artifact@v4
125-
with:
126-
path: /tmp/digests
127-
pattern: digests-*
128-
merge-multiple: true
129-
130-
- name: Set up Docker Buildx
131-
uses: docker/setup-buildx-action@v3
132-
133-
- name: Extract Docker metadata
134-
id: meta
135-
uses: docker/metadata-action@v5
136-
with:
137-
images: ${{ env.REGISTRY_IMAGE }}
138143

139-
- name: Login to GitHub Packages Docker Registry
140-
uses: docker/login-action@v3
141-
with:
142-
registry: ghcr.io
143-
username: ${{ github.actor }}
144-
password: ${{ secrets.GITHUB_TOKEN }}
145-
146-
- name: Create manifest list and push
147-
working-directory: /tmp/digests
148-
run: |
149-
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
150-
$(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
151-
152-
- name: Inspect image
153-
run: |
154-
docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}

‎.github/workflows/_merge.yml‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# Internal reusable workflow for merging platform-specific image digests into a
2+
# single multi-platform manifest and pushing to GHCR.
3+
#
4+
# This workflow takes the individual platform image digests created by _build.yml,
5+
# combines them into a multi-platform manifest, and pushes the final tagged images.
6+
7+
name: Merge Multi-Platform Manifest
8+
9+
on:
10+
workflow_call:
11+
inputs:
12+
docker_tags:
13+
description: "Docker tags configuration (JSON array or raw tags)"
14+
required: true
15+
type: string
16+
17+
env:
18+
REGISTRY_IMAGE: ghcr.io/sourcebot-dev/sourcebot
19+
20+
jobs:
21+
merge:
22+
runs-on: ubuntu-latest
23+
permissions:
24+
packages: write
25+
steps:
26+
- name: Download digests
27+
uses: actions/download-artifact@v4
28+
with:
29+
path: /tmp/digests
30+
pattern: digests-*
31+
merge-multiple: true
32+
33+
- name: Set up Docker Buildx
34+
uses: docker/setup-buildx-action@v3
35+
36+
- name: Extract Docker metadata
37+
id: meta
38+
uses: docker/metadata-action@v5
39+
with:
40+
images: ${{ env.REGISTRY_IMAGE }}
41+
tags: ${{ inputs.docker_tags }}
42+
43+
- name: Login to GitHub Packages Docker Registry
44+
uses: docker/login-action@v3
45+
with:
46+
registry: ghcr.io
47+
username: ${{ github.actor }}
48+
password: ${{ secrets.GITHUB_TOKEN }}
49+
50+
- name: Create manifest list and push
51+
working-directory: /tmp/digests
52+
run: |
53+
docker buildx imagetools create $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
54+
$(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
55+
56+
- name: Inspect image
57+
run: |
58+
docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
59+

‎.github/workflows/deploy-demo.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ on:
77

88
jobs:
99
deploy-demo:
10+
# Demo instance is down so skip this job for now
11+
if: false
1012
uses: ./.github/workflows/_gcp-deploy.yml
1113
secrets: inherit
1214
permissions:

‎.github/workflows/release-dev.yml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
name: Release Sourcebot (Development)
2+
3+
permissions:
4+
contents: read
5+
packages: write
6+
id-token: write
7+
8+
on:
9+
push:
10+
branches: ["main"]
11+
12+
jobs:
13+
build:
14+
uses: ./.github/workflows/_build.yml
15+
with:
16+
git_ref: ${{ github.ref_name }}
17+
docker_tags: type=raw,value=main
18+
use_app_token: false
19+
secrets: inherit
20+
21+
publish-to-registry:
22+
needs: build
23+
uses: ./.github/workflows/_merge.yml
24+
with:
25+
docker_tags: type=raw,value=main

0 commit comments

Comments
 (0)