Snarp/zabbix
1
0
Fork 0
Code Issues Pull requests Actions 2 Packages Projects Releases Wiki Activity

Updated RHEL workflow

Browse source
This commit is contained in:
Alexey Pustovalov 2026-03-26 13:12:04 +09:00
parent 14ba024e98
commit 1648e837b3
1 changed files with 342 additions and 331 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

673
.github/workflows/images_build_rhel.yml vendored
View file

@ -2,8 +2,7 @@ name: Build images (RedHat)
on:
release:
types:
- published
types: [published]
push:
branches:
- '[0-9]+.[0-9]+'
@ -25,27 +24,27 @@ on:
description: 'Specify trunk major version'
type: string
concurrency:
group: rhel-build-${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
defaults:
run:
shell: bash
permissions:
contents: read
contents: read
env:
TRUNK_ONLY_EVENT: ${{ contains(fromJSON('["schedule"]'), github.event_name) }}
AUTO_PUSH_IMAGES: ${{ (! contains(fromJSON('["push"]'), github.event_name) && vars.AUTO_PUSH_IMAGES) || (contains(fromJSON('["workflow_dispatch"]'), github.event_name) && inputs.publish_images == 'true' ) }}
LATEST_BRANCH: ${{ github.event.repository.default_branch }}
TRUNK_GIT_BRANCH: "refs/heads/trunk"
IMAGES_PREFIX: "zabbix-"
BASE_BUILD_NAME: "build-base"
MATRIX_FILE: "build.json"
DOCKERFILES_DIRECTORY: "Dockerfiles"
OIDC_ISSUER: "https://token.actions.githubusercontent.com"
IDENITY_REGEX: "https://github.com/zabbix/zabbix-docker/.github/"
REGISTRY: "quay.io"
REGISTRY_NAMESPACE: "redhat-isv-containers"
PREFLIGHT_IMAGE: "quay.io/opdev/preflight:stable"
@ -61,7 +60,6 @@ jobs:
runs-on: ubuntu-latest
permissions:
contents: read
actions: write
outputs:
platforms: ${{ steps.platform_list.outputs.list }}
database: ${{ steps.database.outputs.list }}
@ -70,6 +68,7 @@ jobs:
current_branch: ${{ steps.branch_info.outputs.current_branch }}
sha_short: ${{ steps.branch_info.outputs.sha_short }}
secret_prefix: ${{ steps.branch_info.outputs.secret_prefix }}
steps:
- name: Block egress traffic
uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
@ -88,117 +87,104 @@ jobs:
fetch-depth: 1
sparse-checkout: ${{ env.MATRIX_FILE }}
- name: Check ${{ env.MATRIX_FILE }} file
id: build_exists
- name: Check matrix file
env:
MATRIX_FILE: ${{ env.MATRIX_FILE }}
run: |
if [[ ! -f "$MATRIX_FILE" ]]; then
echo "::error::File $MATRIX_FILE is missing"
exit 1
fi
if [[ ! -f "$MATRIX_FILE" ]]; then
echo "::error::File $MATRIX_FILE is missing"
exit 1
fi
- name: Prepare Platform list
- name: Prepare platform list
id: platform_list
env:
MATRIX_FILE: ${{ env.MATRIX_FILE }}
run: |
platform_list=$(jq -r '.["os-linux"].rhel | @json' "$MATRIX_FILE")
platform_list="$(jq -c '.["os-linux"].rhel' "$MATRIX_FILE")"
echo "::group::Platform List"
echo "$platform_list"
echo "::endgroup::"
echo "::group::Platform List"
echo "$platform_list"
echo "::endgroup::"
echo "list=$platform_list" >> $GITHUB_OUTPUT
echo "list=$platform_list" >> "$GITHUB_OUTPUT"
- name: Prepare Database engine list
- name: Prepare database engine list
id: database
env:
MATRIX_FILE: ${{ env.MATRIX_FILE }}
run: |
database_list=$(jq -r '[.components | map_values(select(.rhel == true)) | values[].base ] | sort | unique | del(.. | select ( . == "" ) ) | @json' "$MATRIX_FILE")
database_list="$(jq -c '
[.components
| map_values(select(.rhel == true))
| values[].base]
| map(select(length > 0))
| unique
' "$MATRIX_FILE")"
echo "::group::Database List"
echo "$database_list"
echo "::endgroup::"
echo "::group::Database List"
echo "$database_list"
echo "::endgroup::"
echo "list=$database_list" >> $GITHUB_OUTPUT
echo "list=$database_list" >> "$GITHUB_OUTPUT"
- name: Prepare Zabbix component list
id: components
env:
MATRIX_FILE: ${{ env.MATRIX_FILE }}
run: |
component_list=$(jq -r '.components | map_values(select(.rhel == true)) | keys | @json' "$MATRIX_FILE")
component_list="$(jq -c '
.components
| map_values(select(.rhel == true))
| keys
' "$MATRIX_FILE")"
echo "::group::Zabbix Component List"
echo "$component_list"
echo "::endgroup::"
echo "::group::Zabbix Component List"
echo "$component_list"
echo "::endgroup::"
echo "list=$component_list" >> $GITHUB_OUTPUT
echo "list=$component_list" >> "$GITHUB_OUTPUT"
- name: Get branch info
id: branch_info
shell: bash
env:
LATEST_BRANCH: ${{ env.LATEST_BRANCH }}
github_ref: ${{ github.ref }}
GITHUB_REF_RAW: ${{ github.ref }}
TRUNK_MAJOR_VERSION: ${{ inputs.trunk_version }}
run: |
result=false
sha_short=$(git rev-parse --short HEAD)
github_ref="$GITHUB_REF_RAW"
sha_short="$(git rev-parse --short HEAD)"
if [[ "$github_ref" == "refs/tags/"* ]]; then
github_ref=${github_ref%.*}
fi
if [[ "$github_ref" == refs/tags/* ]]; then
github_ref="${github_ref%.*}"
fi
github_ref=${github_ref##*/}
github_ref="${github_ref##*/}"
if [[ "$github_ref" == "$LATEST_BRANCH" ]]; then
result=true
fi
is_default_branch=false
if [[ "$github_ref" == "$LATEST_BRANCH" ]]; then
is_default_branch=true
fi
echo "::group::Branch metadata"
echo "is_default_branch - $result"
echo "current_branch - $github_ref"
if [ "${github_ref//.}" == "trunk" ] && [ ! -z "$TRUNK_MAJOR_VERSION" ]; then
echo "secret_prefix=RHEL_${TRUNK_MAJOR_VERSION//.}"
else
echo "secret_prefix=RHEL_${github_ref//.}"
fi
echo "sha_short - $sha_short"
echo "::endgroup::"
if [[ "${github_ref//.}" == "trunk" && -n "${TRUNK_MAJOR_VERSION:-}" ]]; then
secret_prefix="RHEL_${TRUNK_MAJOR_VERSION//.}"
else
secret_prefix="RHEL_${github_ref//.}"
fi
echo "is_default_branch=$result" >> $GITHUB_OUTPUT
echo "current_branch=$github_ref" >> $GITHUB_OUTPUT
if [ "${github_ref//.}" == "trunk" ] && [ ! -z "$TRUNK_MAJOR_VERSION" ]; then
echo "secret_prefix=RHEL_${TRUNK_MAJOR_VERSION//.}" >> $GITHUB_OUTPUT
else
echo "secret_prefix=RHEL_${github_ref//.}" >> $GITHUB_OUTPUT
fi
echo "sha_short=$sha_short" >> $GITHUB_OUTPUT
echo "::group::Branch metadata"
echo "is_default_branch=$is_default_branch"
echo "current_branch=$github_ref"
echo "secret_prefix=$secret_prefix"
echo "sha_short=$sha_short"
echo "::endgroup::"
- name: Cleanup existing cache
shell: bash
env:
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
REPO: ${{ github.repository }}
BRANCH: ${{ steps.branch_info.outputs.current_branch }}
GH_RUN_ID: ${{ github.run_id }}
run: |
gh extension install actions/gh-actions-cache
cache_keys=$(gh actions-cache list -R "${REPO}" -B "${BRANCH}" -L 100 --sort created-at --order desc | cut -f 1)
## Setting this to not fail the workflow while deleting cache keys
set +e
echo "Deleting caches..."
for cache_key in $cache_keys
do
if [[ "$cache_key" == *"${GH_RUN_ID}" ]]; then
gh actions-cache delete $cache_key -R "${REPO}" -B "${BRANCH}" --confirm
fi
done
{
echo "is_default_branch=$is_default_branch"
echo "current_branch=$github_ref"
echo "secret_prefix=$secret_prefix"
echo "sha_short=$sha_short"
} >> "$GITHUB_OUTPUT"
build_base:
timeout-minutes: 30
@ -212,32 +198,23 @@ jobs:
runs-on: [self-hosted, linux, "${{ matrix.arch }}"]
permissions:
contents: read
steps:
- name: Checkout repository
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
fetch-depth: 1
- name: Install cosign
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22
with:
cosign-release: 'v2.4.0'
- name: Check cosign version
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
run: cosign version
- name: Fix string case
- name: Normalize architecture
id: lc
env:
ARCH: ${{ matrix.arch }}
run: |
echo "arch=${ARCH,,}" >> $GITHUB_OUTPUT
echo "arch=${ARCH,,}" >> "$GITHUB_OUTPUT"
- name: Generate tags
id: meta
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
with:
images: ${{ env.IMAGES_PREFIX }}${{ matrix.build }}
tags: |
@ -256,37 +233,35 @@ jobs:
--pull
--iidfile=${{ github.workspace }}/iidfile
- name: Image metadata
- name: Save image metadata
id: image_metadata
env:
IMAGE_TAG: ${{ steps.build_image.outputs.image-with-tag }}
CACHE_FILE_NAME: ${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}
GITHUB_WORKSPACE: ${{ github.workspace }}
IIDFILE: ${{ github.workspace }}/iidfile
run: |
TAG_ID=$(cat $GITHUB_WORKSPACE/iidfile)
[[ -f "$IIDFILE" ]] || { echo "::error::iidfile is missing: $IIDFILE"; exit 1; }
echo "::group::Image tag"
echo "image_tag=$IMAGE_TAG"
echo "::endgroup::"
echo "::group::Image Tag ID"
echo "tag_id=$TAG_ID"
echo "::endgroup::"
echo "::group::Cache file name"
echo "$CACHE_FILE_NAME"
echo "::endgroup::"
TAG_ID="$(<"$IIDFILE")"
echo "$TAG_ID" > "${CACHE_FILE_NAME}_tag_id"
echo "$IMAGE_TAG" > "${CACHE_FILE_NAME}_tag"
echo "::group::Image metadata"
echo "image_tag=$IMAGE_TAG"
echo "tag_id=$TAG_ID"
echo "cache_file_name=$CACHE_FILE_NAME"
echo "::endgroup::"
echo "image_tag_id=${TAG_ID}" >> $GITHUB_OUTPUT
echo "image_tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT
printf '%s' "$TAG_ID" > "${CACHE_FILE_NAME}_tag_id"
printf '%s' "$IMAGE_TAG" > "${CACHE_FILE_NAME}_tag"
echo "image_tag_id=$TAG_ID" >> "$GITHUB_OUTPUT"
echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
- name: Cache image metadata
uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
with:
path: |
${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}_tag_id
${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}_tag
${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}_tag_id
${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}_tag
key: ${{ env.BASE_BUILD_NAME }}-${{ matrix.arch }}-${{ github.run_id }}
- name: Push image to local storage
@ -295,45 +270,57 @@ jobs:
IMAGE_TAG: ${{ steps.image_metadata.outputs.image_tag }}
IMAGE_TAG_ID: ${{ steps.image_metadata.outputs.image_tag_id }}
IMAGE_DIR: ${{ env.IMAGE_DIR }}
GITHUB_RUN_ID: ${{ github.run_id }}
run: |
echo "::group::Result"
echo "Image ${IMAGE_TAG} location: \"${IMAGE_DIR}/${IMAGE_TAG_ID}\""
podman push "${IMAGE_TAG}" dir:"${IMAGE_DIR}/${IMAGE_TAG_ID}"
echo "::endgroup::"
[[ -n "$IMAGE_TAG" ]] || { echo "::error::IMAGE_TAG is empty"; exit 1; }
[[ -n "$IMAGE_TAG_ID" ]] || { echo "::error::IMAGE_TAG_ID is empty"; exit 1; }
[[ -n "$IMAGE_DIR" ]] || { echo "::error::IMAGE_DIR is empty"; exit 1; }
- name: Post build image
run_dir="${IMAGE_DIR}/${GITHUB_RUN_ID}"
rm -rf "$run_dir"
mkdir -p "$run_dir"
echo "::group::Result"
echo "Image ${IMAGE_TAG} location: ${run_dir}/${IMAGE_TAG_ID}"
podman push "${IMAGE_TAG}" "dir:${run_dir}/${IMAGE_TAG_ID}"
echo "::endgroup::"
- name: Post build cleanup
if: ${{ success() || failure() }}
env:
GITHUB_WORKSPACE: ${{ github.workspace }}
IIDFILE: ${{ github.workspace }}/iidfile
run: |
echo "::group::Result"
echo "::group::Cleanup"
rm -rf "$GITHUB_WORKSPACE/iidfile"
rm -f "$IIDFILE"
echo "Removing working containers"
buildah rm -a 2>/dev/null || true
echo "Removing container data in storage not controlled by podman"
podman system prune --external 2>/dev/null
echo "Removing all unused container data with volumes"
podman system prune -a --volumes -f 2>/dev/null
echo "Reseting podman storage to default state"
podman system reset -f 2>/dev/null || true
echo "Removing working containers"
buildah rm -a 2>/dev/null || true
echo "::endgroup::"
echo "Removing container data in storage not controlled by podman"
podman system prune --external 2>/dev/null || true
- name: Check on failures
if: ${{ (cancelled() || failure()) && ( steps.push_image.outcome == 'failure' || steps.push_image.outcome == 'cancelled') }}
echo "Removing unused container data"
podman container prune -f 2>/dev/null || true
podman image prune -f 2>/dev/null || true
podman volume prune -f 2>/dev/null || true
echo "::endgroup::"
- name: Remove orphaned local image
if: ${{ (cancelled() || failure()) && (steps.push_image.outcome == 'failure' || steps.push_image.outcome == 'cancelled') }}
env:
IMAGE_TAG_ID: ${{ steps.image_metadata.outputs.image_tag_id }}
IMAGE_DIR: ${{ env.IMAGE_DIR }}
GITHUB_RUN_ID: ${{ github.run_id }}
run: |
echo "::group::Removing orphaned image"
rm -rf "${IMAGE_DIR}/${IMAGE_TAG_ID}"
echo "::endgroup::"
echo "::group::Removing orphaned image"
rm -rf "${IMAGE_DIR:?}/${GITHUB_RUN_ID:?}/${IMAGE_TAG_ID:?}"
echo "::endgroup::"
build_base_database:
timeout-minutes: 90
needs: [ "build_base", "init_build"]
needs: ["build_base", "init_build"]
name: Build ${{ matrix.build }} base (${{ matrix.arch }})
strategy:
fail-fast: false
@ -343,59 +330,73 @@ jobs:
runs-on: [self-hosted, linux, "${{ matrix.arch }}"]
permissions:
contents: read
steps:
- name: Checkout repository
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
fetch-depth: 1
- name: Fix string case
- name: Normalize architecture
id: lc
env:
ARCH: ${{ matrix.arch }}
run: |
echo "arch=${ARCH,,}" >> $GITHUB_OUTPUT
echo "arch=${ARCH,,}" >> "$GITHUB_OUTPUT"
- name: Download metadata of ${{ env.BASE_BUILD_NAME }}:${{ matrix.arch }}
uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
with:
path: |
${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}_tag_id
${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}_tag
${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}_tag_id
${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}_tag
key: ${{ env.BASE_BUILD_NAME }}-${{ matrix.arch }}-${{ github.run_id }}
- name: Pull ${{ env.BASE_BUILD_NAME }}:${{ matrix.arch }} image from local storage
id: base_build
env:
MATRIX_ARCH: ${{ matrix.arch }}
BASE_IMAGE: ${{ env.BASE_BUILD_NAME }}
IMAGES_PREFIX: ${{ env.IMAGES_PREFIX }}
MATRIX_ARCH: ${{ matrix.arch }}
BASE_IMAGE: ${{ env.BASE_BUILD_NAME }}
IMAGES_PREFIX: ${{ env.IMAGES_PREFIX }}
IMAGE_DIR: ${{ env.IMAGE_DIR }}
GITHUB_RUN_ID: ${{ github.run_id }}
run: |
BASE_TAG_ID=$(cat "${BASE_IMAGE}_${MATRIX_ARCH}_tag_id")
BASE_IMAGE_TAG=$(cat "${BASE_IMAGE}_${MATRIX_ARCH}_tag")
tag_id_file="${BASE_IMAGE}_${MATRIX_ARCH}_tag_id"
tag_file="${BASE_IMAGE}_${MATRIX_ARCH}_tag"
echo "::group::Pull image"
echo "podman pull dir:\"${IMAGE_DIR}/${BASE_TAG_ID}\""
podman pull dir:"${IMAGE_DIR}/${BASE_TAG_ID}"
echo "::endgroup::"
[[ -f "$tag_id_file" ]] || { echo "::error::Missing file: $tag_id_file"; exit 1; }
[[ -f "$tag_file" ]] || { echo "::error::Missing file: $tag_file"; exit 1; }
[[ -n "$IMAGE_DIR" ]] || { echo "::error::IMAGE_DIR is empty"; exit 1; }
echo "::group::Tag image"
echo "podman tag \"${BASE_TAG_ID}\" \"${BASE_IMAGE_TAG}\""
podman tag "${BASE_TAG_ID}" "${BASE_IMAGE_TAG}"
echo "::endgroup::"
BASE_TAG_ID="$(<"$tag_id_file")"
BASE_IMAGE_TAG="$(<"$tag_file")"
echo "::group::SHA256 tag"
DIGEST=$(podman inspect "${BASE_TAG_ID}" --format '{{ .Digest }}')
BASE_BUILD_IMAGE="${IMAGES_PREFIX}${BASE_IMAGE}@${DIGEST}"
run_dir="${IMAGE_DIR}/${GITHUB_RUN_ID}"
echo "base_build_image=${BASE_BUILD_IMAGE}"
echo "::endgroup::"
echo "::group::Pull image"
echo "podman pull dir:${run_dir}/${BASE_TAG_ID}"
podman pull "dir:${run_dir}/${BASE_TAG_ID}"
echo "::endgroup::"
echo "base_build_image=${BASE_BUILD_IMAGE}" >> $GITHUB_OUTPUT
echo "::group::Tag image"
echo "podman tag ${BASE_TAG_ID} ${BASE_IMAGE_TAG}"
podman tag "${BASE_TAG_ID}" "${BASE_IMAGE_TAG}"
echo "::endgroup::"
DIGEST="$(podman inspect "${BASE_TAG_ID}" --format '{{ .Digest }}')"
[[ -n "$DIGEST" && "$DIGEST" != "<no value>" ]] || { echo "::error::Image digest is empty"; exit 1; }
BASE_BUILD_IMAGE="${IMAGES_PREFIX}${BASE_IMAGE}@${DIGEST}"
echo "::group::SHA256 tag"
echo "base_build_image=${BASE_BUILD_IMAGE}"
echo "::endgroup::"
echo "base_build_image=${BASE_BUILD_IMAGE}" >> "$GITHUB_OUTPUT"
- name: Generate tags
id: meta
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
with:
images: ${{ env.IMAGES_PREFIX }}${{ matrix.build }}
tags: |
@ -416,37 +417,35 @@ jobs:
--build-context sources=./sources/
--build-context config_templates=./config_templates/
- name: Prepare image metadata
- name: Save image metadata
id: image_metadata
env:
IMAGE_TAG: ${{ steps.build_image.outputs.image-with-tag }}
CACHE_FILE_NAME: ${{ matrix.build }}_${{ matrix.arch }}
GITHUB_WORKSPACE: ${{ github.workspace }}
IIDFILE: ${{ github.workspace }}/iidfile
run: |
TAG_ID=$(cat $GITHUB_WORKSPACE/iidfile)
[[ -f "$IIDFILE" ]] || { echo "::error::iidfile is missing: $IIDFILE"; exit 1; }
echo "::group::Image tag"
echo "image_tag=$IMAGE_TAG"
echo "::endgroup::"
echo "::group::Image Tag ID"
echo "tag_id=$TAG_ID"
echo "::endgroup::"
echo "::group::Cache file name"
echo "$CACHE_FILE_NAME"
echo "::endgroup::"
TAG_ID="$(<"$IIDFILE")"
echo "$TAG_ID" > "${CACHE_FILE_NAME}_tag_id"
echo "$IMAGE_TAG" > "${CACHE_FILE_NAME}_tag"
echo "::group::Image metadata"
echo "image_tag=$IMAGE_TAG"
echo "tag_id=$TAG_ID"
echo "cache_file_name=$CACHE_FILE_NAME"
echo "::endgroup::"
echo "image_tag_id=${TAG_ID}" >> $GITHUB_OUTPUT
echo "image_tag=${IMAGE_TAG}" >> $GITHUB_OUTPUT
printf '%s' "$TAG_ID" > "${CACHE_FILE_NAME}_tag_id"
printf '%s' "$IMAGE_TAG" > "${CACHE_FILE_NAME}_tag"
echo "image_tag_id=$TAG_ID" >> "$GITHUB_OUTPUT"
echo "image_tag=$IMAGE_TAG" >> "$GITHUB_OUTPUT"
- name: Cache image metadata
uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
with:
path: |
${{ matrix.build }}_${{ matrix.arch }}_tag_id
${{ matrix.build }}_${{ matrix.arch }}_tag
${{ matrix.build }}_${{ matrix.arch }}_tag_id
${{ matrix.build }}_${{ matrix.arch }}_tag
key: ${{ matrix.build }}-${{ matrix.arch }}-${{ github.run_id }}
- name: Push image to local storage
@ -455,45 +454,56 @@ jobs:
IMAGE_TAG: ${{ steps.image_metadata.outputs.image_tag }}
IMAGE_TAG_ID: ${{ steps.image_metadata.outputs.image_tag_id }}
IMAGE_DIR: ${{ env.IMAGE_DIR }}
GITHUB_RUN_ID: ${{ github.run_id }}
run: |
echo "::group::Result"
echo "podman push \"${IMAGE_TAG}\" dir:\"${IMAGE_DIR}/${IMAGE_TAG_ID}\""
podman push "${IMAGE_TAG}" dir:"${IMAGE_DIR}/${IMAGE_TAG_ID}"
echo "::endgroup::"
[[ -n "$IMAGE_TAG" ]] || { echo "::error::IMAGE_TAG is empty"; exit 1; }
[[ -n "$IMAGE_TAG_ID" ]] || { echo "::error::IMAGE_TAG_ID is empty"; exit 1; }
[[ -n "$IMAGE_DIR" ]] || { echo "::error::IMAGE_DIR is empty"; exit 1; }
- name: Post build image
run_dir="${IMAGE_DIR}/${GITHUB_RUN_ID}"
mkdir -p "$run_dir"
echo "::group::Result"
echo "Image ${IMAGE_TAG} location: ${run_dir}/${IMAGE_TAG_ID}"
podman push "${IMAGE_TAG}" "dir:${run_dir}/${IMAGE_TAG_ID}"
echo "::endgroup::"
- name: Post build cleanup
if: ${{ success() || failure() }}
env:
GITHUB_WORKSPACE: ${{ github.workspace }}
IIDFILE: ${{ github.workspace }}/iidfile
run: |
echo "::group::Result"
echo "::group::Cleanup"
rm -rf "$GITHUB_WORKSPACE/iidfile"
rm -f "$IIDFILE"
echo "Removing working containers"
buildah rm -a 2>/dev/null || true
echo "Removing container data in storage not controlled by podman"
podman system prune --external 2>/dev/null
echo "Removing all unused container data with volumes"
podman system prune -a --volumes -f 2>/dev/null
echo "Reseting podman storage to default state"
podman system reset -f 2>/dev/null || true
echo "Removing working containers"
buildah rm -a 2>/dev/null || true
echo "::endgroup::"
echo "Removing container data in storage not controlled by podman"
podman system prune --external 2>/dev/null || true
- name: Check on failures
if: ${{ (cancelled() || failure()) && ( steps.push_image.outcome == 'failure' || steps.push_image.outcome == 'cancelled') }}
echo "Removing unused container data"
podman container prune -f 2>/dev/null || true
podman image prune -f 2>/dev/null || true
podman volume prune -f 2>/dev/null || true
echo "::endgroup::"
- name: Remove orphaned local image
if: ${{ (cancelled() || failure()) && (steps.push_image.outcome == 'failure' || steps.push_image.outcome == 'cancelled') }}
env:
IMAGE_TAG_ID: ${{ steps.image_metadata.outputs.image_tag_id }}
IMAGE_DIR: ${{ env.IMAGE_DIR }}
GITHUB_RUN_ID: ${{ github.run_id }}
run: |
echo "::group::Removing orphaned image"
rm -rf "${IMAGE_DIR}/${IMAGE_TAG_ID}"
echo "::endgroup::"
echo "::group::Removing orphaned image"
rm -rf "${IMAGE_DIR:?}/${GITHUB_RUN_ID:?}/${IMAGE_TAG_ID:?}"
echo "::endgroup::"
build_images:
timeout-minutes: 30
needs: [ "build_base_database", "init_build"]
needs: ["build_base_database", "init_build"]
name: Build ${{ matrix.build }} image (${{ matrix.arch }})
strategy:
fail-fast: false
@ -503,88 +513,98 @@ jobs:
runs-on: [self-hosted, linux, "${{ matrix.arch }}"]
permissions:
contents: read
steps:
- name: Checkout repository
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
with:
fetch-depth: 1
- name: Variables formating
- name: Format variables
id: var_format
env:
MATRIX_BUILD: ${{ matrix.build }}
run: |
MATRIX_BUILD=${MATRIX_BUILD^^}
MATRIX_BUILD=${MATRIX_BUILD//-/_}
matrix_build="${MATRIX_BUILD^^}"
matrix_build="${matrix_build//-/_}"
echo "::group::Result"
echo "matrix_build=${MATRIX_BUILD}"
echo "::endgroup::"
echo "matrix_build=${MATRIX_BUILD}" >> $GITHUB_OUTPUT
echo "::group::Result"
echo "matrix_build=${matrix_build}"
echo "::endgroup::"
- name: Detect Build Base Image
echo "matrix_build=${matrix_build}" >> "$GITHUB_OUTPUT"
- name: Detect build base image
id: build_base_image
if: ${{ matrix.build != 'snmptraps' }}
env:
MATRIX_BUILD: ${{ matrix.build }}
MATRIX_FILE: ${{ env.MATRIX_FILE }}
run: |
BUILD_BASE=$(jq -r ".components.\"$MATRIX_BUILD\".base" "$MATRIX_FILE")
build_base="$(jq -r ".components.\"$MATRIX_BUILD\".base" "$MATRIX_FILE")"
[[ -n "$build_base" && "$build_base" != "null" ]] || { echo "::error::Base image is not defined for $MATRIX_BUILD"; exit 1; }
echo "::group::Base Build Image"
echo "$BUILD_BASE"
echo "::endgroup::"
echo "::group::Base Build Image"
echo "$build_base"
echo "::endgroup::"
echo "build_base=${BUILD_BASE}" >> $GITHUB_OUTPUT
echo "build_base=$build_base" >> "$GITHUB_OUTPUT"
- name: Download metadata of ${{ steps.build_base_image.outputs.build_base }}:${{ matrix.arch }}
if: ${{ matrix.build != 'snmptraps' }}
uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
with:
path: |
${{ steps.build_base_image.outputs.build_base }}_${{ matrix.arch }}_tag_id
${{ steps.build_base_image.outputs.build_base }}_${{ matrix.arch }}_tag
${{ steps.build_base_image.outputs.build_base }}_${{ matrix.arch }}_tag_id
${{ steps.build_base_image.outputs.build_base }}_${{ matrix.arch }}_tag
key: ${{ steps.build_base_image.outputs.build_base }}-${{ matrix.arch }}-${{ github.run_id }}
- name: Pull ${{ steps.build_base_image.outputs.build_base }}:${{ matrix.arch }} image
id: base_build
if: ${{ matrix.build != 'snmptraps' }}
env:
MATRIX_ARCH: ${{ matrix.arch }}
BASE_IMAGE: ${{ steps.build_base_image.outputs.build_base }}
IMAGES_PREFIX: ${{ env.IMAGES_PREFIX }}
MATRIX_ARCH: ${{ matrix.arch }}
BASE_IMAGE: ${{ steps.build_base_image.outputs.build_base }}
IMAGES_PREFIX: ${{ env.IMAGES_PREFIX }}
IMAGE_DIR: ${{ env.IMAGE_DIR }}
GITHUB_RUN_ID: ${{ github.run_id }}
run: |
BASE_TAG_ID=$(cat "${BASE_IMAGE}_${MATRIX_ARCH}_tag_id")
BASE_IMAGE_TAG=$(cat "${BASE_IMAGE}_${MATRIX_ARCH}_tag")
tag_id_file="${BASE_IMAGE}_${MATRIX_ARCH}_tag_id"
tag_file="${BASE_IMAGE}_${MATRIX_ARCH}_tag"
echo "::group::Pull image"
echo "podman pull dir:\"${IMAGE_DIR}/${BASE_TAG_ID}\""
podman pull dir:"${IMAGE_DIR}/${BASE_TAG_ID}"
echo "::endgroup::"
[[ -f "$tag_id_file" ]] || { echo "::error::Missing file: $tag_id_file"; exit 1; }
[[ -f "$tag_file" ]] || { echo "::error::Missing file: $tag_file"; exit 1; }
[[ -n "$IMAGE_DIR" ]] || { echo "::error::IMAGE_DIR is empty"; exit 1; }
echo "::group::Tag image"
echo "podman tag \"${BASE_TAG_ID}\" \"${BASE_IMAGE_TAG}\""
podman tag "${BASE_TAG_ID}" "${BASE_IMAGE_TAG}"
echo "::endgroup::"
base_tag_id="$(<"$tag_id_file")"
base_image_tag="$(<"$tag_file")"
echo "::group::SHA256 tag"
DIGEST=$(podman inspect "${BASE_TAG_ID}" --format '{{ .Digest }}')
BASE_BUILD_IMAGE="${IMAGES_PREFIX}${BASE_IMAGE}@${DIGEST}"
echo "digest=${BASE_BUILD_IMAGE}"
echo "::endgroup::"
run_dir="${IMAGE_DIR}/${GITHUB_RUN_ID}"
echo "base_build_image=${BASE_BUILD_IMAGE}" >> $GITHUB_OUTPUT
echo "::group::Pull image"
echo "podman pull dir:${run_dir}/${base_tag_id}"
podman pull "dir:${run_dir}/${base_tag_id}"
echo "::endgroup::"
- name: Remove smartmontools
if: ${{ matrix.build == 'agent2' }}
env:
DOCKERFILES_DIRECTORY: ${{ env.DOCKERFILES_DIRECTORY }}
run: |
sed -i '/smartmontools/d' "$DOCKERFILES_DIRECTORY/agent2/rhel/Dockerfile"
echo "::group::Tag image"
echo "podman tag ${base_tag_id} ${base_image_tag}"
podman tag "${base_tag_id}" "${base_image_tag}"
echo "::endgroup::"
digest="$(podman inspect "${base_tag_id}" --format '{{ .Digest }}')"
[[ -n "$digest" && "$digest" != "<no value>" ]] || { echo "::error::Image digest is empty"; exit 1; }
base_build_image="${IMAGES_PREFIX}${BASE_IMAGE}@${digest}"
echo "::group::SHA256 tag"
echo "digest=${base_build_image}"
echo "::endgroup::"
echo "base_build_image=${base_build_image}" >> "$GITHUB_OUTPUT"
- name: Generate tags
id: meta
uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0
with:
images: ${{ env.REGISTRY }}/${{ env.REGISTRY_NAMESPACE }}/${{ secrets[format('{0}_{1}_PROJECT', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)] || matrix.build }}
tags: |
@ -608,13 +628,23 @@ jobs:
${{ env.DOCKERFILES_DIRECTORY }}/${{ matrix.build }}/rhel/Dockerfile
extra-args: |
--iidfile=${{ github.workspace }}/iidfile
build-args: BUILD_BASE_IMAGE=localhost/${{ steps.base_build.outputs.base_build_image }}
build-args: |
BUILD_BASE_IMAGE=${{ matrix.build != 'snmptraps' && format('localhost/{0}', steps.base_build.outputs.base_build_image) || '' }}
- name: Validate registry secrets
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
env:
PROJECT_NAME: ${{ secrets[format('{0}_{1}_PROJECT', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)] }}
PROJECT_SECRET: ${{ secrets[format('{0}_{1}_SECRET', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)] }}
run: |
[[ -n "${PROJECT_NAME:-}" ]] || { echo "::error::Registry project secret is missing"; exit 1; }
[[ -n "${PROJECT_SECRET:-}" ]] || { echo "::error::Registry robot secret is missing"; exit 1; }
- name: Log in to ${{ env.REGISTRY }}
uses: redhat-actions/podman-login@9184318aae1ee5034fbfbacc0388acf12669171f # v1.6
if: ${{ env.AUTO_PUSH_IMAGES == 'true' }}
with:
username: ${{ format('redhat-isv-containers+{0}-robot', secrets[format('{0}_{1}_PROJECT', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)]) }}
username: ${{ format('redhat-isv-containers+{0}-robot', secrets[format('{0}_{1}_PROJECT', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)]) }}
password: ${{ secrets[format('{0}_{1}_SECRET', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)] }}
registry: ${{ env.REGISTRY }}
auth_file_path: /tmp/.docker_${{ matrix.build }}_${{ matrix.arch }}_${{ needs.init_build.outputs.sha_short }}
@ -637,27 +667,27 @@ jobs:
IMAGE_TAG: ${{ steps.build_image.outputs.image-with-tag }}
PREFLIGHT_IMAGE: ${{ env.PREFLIGHT_IMAGE }}
run: |
mkdir -p $PFLT_ARTIFACTS
echo "::group::Pull preflight \"$PREFLIGHT_IMAGE\" image"
podman pull "$PREFLIGHT_IMAGE"
echo "::endgroup::"
mkdir -p "$PFLT_ARTIFACTS"
echo "::group::Perform certification tests"
podman run \
-it \
--rm \
--security-opt=label=disable \
--env PFLT_LOGLEVEL=$PFLT_LOGLEVEL \
--env PFLT_ARTIFACTS=/artifacts \
--env PFLT_LOGFILE=/artifacts/preflight.log \
--env PFLT_CERTIFICATION_COMPONENT_ID=$PFLT_CERTIFICATION_PROJECT_ID \
--env PFLT_PYXIS_API_TOKEN=$PFLT_PYXIS_API_TOKEN \
--env PFLT_DOCKERCONFIG=/temp-authfile.json \
-v $PFLT_ARTIFACTS:/artifacts \
-v $PFLT_DOCKERCONFIG:/temp-authfile.json:ro \
"$PREFLIGHT_IMAGE" check container $IMAGE_TAG --submit
podman rmi -i -f "$PREFLIGHT_IMAGE"
echo "::endgroup::"
echo "::group::Pull preflight image"
podman pull "$PREFLIGHT_IMAGE"
echo "::endgroup::"
echo "::group::Perform certification tests"
podman run \
-it \
--rm \
--security-opt=label=disable \
--env PFLT_LOGLEVEL="$PFLT_LOGLEVEL" \
--env PFLT_ARTIFACTS=/artifacts \
--env PFLT_LOGFILE=/artifacts/preflight.log \
--env PFLT_CERTIFICATION_COMPONENT_ID="$PFLT_CERTIFICATION_PROJECT_ID" \
--env PFLT_PYXIS_API_TOKEN="$PFLT_PYXIS_API_TOKEN" \
--env PFLT_DOCKERCONFIG=/temp-authfile.json \
-v "$PFLT_ARTIFACTS:/artifacts" \
-v "$PFLT_DOCKERCONFIG:/temp-authfile.json:ro" \
"$PREFLIGHT_IMAGE" check container "$IMAGE_TAG" --submit
echo "::endgroup::"
- name: Push to RedHat certification procedure (all tags)
id: push_to_registry_all_tags
@ -666,97 +696,78 @@ jobs:
with:
tags: ${{ steps.meta.outputs.tags }}
- name: Post Preflight certification
- name: Post preflight cleanup
if: ${{ env.AUTO_PUSH_IMAGES == 'true' && (success() || failure()) }}
env:
PREFLIGHT_IMAGE: ${{ env.PREFLIGHT_IMAGE }}
PFLT_ARTIFACTS: ${{ env.PFLT_ARTIFACTS }}
run: |
echo "::group::Result"
rm -rf "$PFLT_ARTIFACTS"
podman rmi -i -f "$PREFLIGHT_IMAGE"
echo "::endgroup::"
echo "::group::Cleanup"
rm -rf "$PFLT_ARTIFACTS"
podman rmi -i -f "$PREFLIGHT_IMAGE" 2>/dev/null || true
echo "::endgroup::"
- name: Image digest
env:
GITHUB_WORKSPACE: ${{ github.workspace }}
IIDFILE: ${{ github.workspace }}/iidfile
run: |
TAG_ID=$(cat $GITHUB_WORKSPACE/iidfile)
echo "::group::Image digest"
echo "$TAG_ID"
echo "::endgroup::"
[[ -f "$IIDFILE" ]] || { echo "::error::iidfile is missing: $IIDFILE"; exit 1; }
tag_id="$(<"$IIDFILE")"
- name: Post build image
echo "::group::Image digest"
echo "$tag_id"
echo "::endgroup::"
- name: Post build cleanup
if: ${{ success() || failure() }}
env:
GITHUB_WORKSPACE: ${{ github.workspace }}
IIDFILE: ${{ github.workspace }}/iidfile
run: |
echo "::group::Result"
echo "::group::Cleanup"
rm -rf "$GITHUB_WORKSPACE/iidfile"
rm -f "$IIDFILE"
echo "Removing working containers"
buildah rm -a 2>/dev/null || true
echo "Removing container data in storage not controlled by podman"
podman system prune --external 2>/dev/null
echo "Removing all unused container data with volumes"
podman system prune -a --volumes -f 2>/dev/null
echo "Reseting podman storage to default state"
podman system reset -f 2>/dev/null || true
echo "Removing working containers"
buildah rm -a 2>/dev/null || true
echo "::endgroup::"
echo "Removing container data in storage not controlled by podman"
podman system prune --external 2>/dev/null || true
echo "Removing unused container data"
podman container prune -f 2>/dev/null || true
podman image prune -f 2>/dev/null || true
podman volume prune -f 2>/dev/null || true
echo "::endgroup::"
clear_artifacts:
timeout-minutes: 10
needs: [ "build_images", "init_build"]
name: Clear ${{ matrix.build }} image cache (${{ matrix.arch }})
needs: ["build_images", "build_base_database", "init_build"]
name: Clear images cache (${{ matrix.arch }})
strategy:
fail-fast: false
matrix:
build: ${{ fromJson(needs.init_build.outputs.database) }}
arch: ${{ fromJson(needs.init_build.outputs.platforms) }}
runs-on: [self-hosted, linux, "${{ matrix.arch }}"]
if: ${{ needs.build_base_database.result == 'success' }}
permissions: {}
steps:
- name: Download metadata of ${{ matrix.build }}:${{ matrix.arch }}
uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
with:
path: |
${{ matrix.build }}_${{ matrix.arch }}_tag_id
${{ matrix.build }}_${{ matrix.arch }}_tag
key: ${{ matrix.build }}-${{ matrix.arch }}-${{ github.run_id }}
- name: Remove ${{ matrix.build }}:${{ matrix.arch }} cache
- name: Remove local image storage for current run
if: ${{ always() }}
env:
CACHE_FILE_NAME: ${{ matrix.build }}_${{ matrix.arch }}
IMAGE_DIR: ${{ env.IMAGE_DIR }}
IMAGE_DIR: ${{ env.IMAGE_DIR }}
GITHUB_RUN_ID: ${{ github.run_id }}
run: |
echo "::group::Result"
set -u
BASE_TAG=$(cat "${CACHE_FILE_NAME}_tag_id")
echo "Removing ${IMAGE_DIR}/${BASE_TAG}"
rm -rf "${IMAGE_DIR}/${BASE_TAG}"
run_dir="${IMAGE_DIR}/${GITHUB_RUN_ID}"
echo "::endgroup::"
- name: Download metadata of ${{ env.BASE_BUILD_NAME }}:${{ matrix.arch }}
uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
with:
path: |
${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}_tag_id
${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}_tag
key: ${{ env.BASE_BUILD_NAME }}-${{ matrix.arch }}-${{ github.run_id }}
- name: Remove ${{ env.BASE_BUILD_NAME }}:${{ matrix.arch }} cache
env:
CACHE_FILE_NAME: ${{ env.BASE_BUILD_NAME }}_${{ matrix.arch }}
IMAGE_DIR: ${{ env.IMAGE_DIR }}
run: |
echo "::group::Result"
BASE_TAG=$(cat "${CACHE_FILE_NAME}_tag_id")
echo "Removing ${IMAGE_DIR}/${BASE_TAG}"
rm -rf "${IMAGE_DIR}/${BASE_TAG}"
echo "::endgroup::"
echo "::group::Cleanup run storage"
if [[ -d "$run_dir" ]]; then
echo "Removing $run_dir"
rm -rf "${run_dir:?}"
else
echo "Run directory does not exist: $run_dir"
fi
echo "::endgroup::"