trino-lb/.github/workflows/release.yaml at main · stackabletech/trino-lb · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
name: Release pipeline
on:
  push:
    tags: ['v[0-9]+.[0-9]+.[0-9]+']

permissions: {}

env:
  RUST_TOOLCHAIN_VERSION: "1.94.0"
  RUSTFLAGS: "-D warnings"
  RUSTDOCFLAGS: "-D warnings"
  CARGO_TERM_COLOR: always

jobs:
  test:
    name: Run tests
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
      - run: cargo test --all-features

  clippy:
    name: Check clippy
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}" --component clippy
      - run: cargo clippy --all-targets -- -D warnings

  fmt:
    name: Check formatting
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}" --component clippy
      - run: cargo fmt --all -- --check

  docs:
    name: Generate docs
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - run: rustup toolchain install "${RUST_TOOLCHAIN_VERSION}"
      - run: cargo doc --document-private-items

  docker-image:
    name: Build and push docker image
    needs: [test, clippy, fmt, docs]
    permissions:
      id-token: write
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - name: Set up Cosign
        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
      - name: Login to Stackable Harbor
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: oci.stackable.tech
          username: robot$stackable+github-action-build
          password: ${{ secrets.HARBOR_ROBOT_STACKABLE_GITHUB_ACTION_BUILD_SECRET }}
      - name: Build and push docker image
        env:
          GITHUB_REF: ${{ github.ref }}
        run: |
          # trino-lb is not (yet) a product as the SDP, but a community project, so use "stackable" instead of "sdp"
          IMAGE_NAME="oci.stackable.tech/stackable/trino-lb"
          TAG_NAME="${GITHUB_REF#refs/tags/v}"

          docker build -f docker/Dockerfile . -t "$IMAGE_NAME:$TAG_NAME"

          # Store the output of `docker image push` into a variable, so we can parse it for the digest
          PUSH_OUTPUT=$(docker image push "$IMAGE_NAME:$TAG_NAME" 2>&1)
          echo "$PUSH_OUTPUT"

          # Obtain the digest of the pushed image from the output of `docker image push`, because signing by tag is deprecated and will be removed from cosign in the future
          DIGEST=$(echo "$PUSH_OUTPUT" | awk "/: digest: sha256:[a-f0-9]{64} size: [0-9]+$/ { print \$3 }")

          # Refer to image via its digest (oci.stackable.tech/stackable/trino-dev@sha256:0a1b2c...)
          # This generates a signature and publishes it to the registry, next to the image
          # Uses the keyless signing flow with Github Actions as identity provider
          cosign sign -y "$IMAGE_NAME@$DIGEST"