Skip to content

Commit cd46b16

Browse files
NickLarsenNZNickLarsenNZ
authored
Merge branch 'main' into refactor/move-initialization-into-backends
2 parents 3e197fa + 1752fe0 commit cd46b16

10 files changed

Lines changed: 337 additions & 569 deletions

File tree

‎.github/workflows/build.yaml‎

Lines changed: 296 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,296 @@
1+
# =============
2+
# This file is automatically generated from the templates in stackabletech/operator-templating
3+
# DON'T MANUALLY EDIT THIS FILE
4+
# =============
5+
---
6+
name: Build opa-operator Artifacts
7+
8+
permissions: {}
9+
10+
on:
11+
push:
12+
branches:
13+
- main
14+
tags:
15+
- '[0-9][0-9].[0-9]+.[0-9]+-rc[0-9]+'
16+
- '[0-9][0-9].[0-9]+.[0-9]+'
17+
schedule:
18+
# Run every Saturday morning: https://crontab.guru/#15_3_*_*_6
19+
- cron: '15 3 * * 6'
20+
pull_request:
21+
# Do not limit by paths. This workflow contains a required job.
22+
merge_group:
23+
24+
env:
25+
OPERATOR_NAME: "opa-operator"
26+
RUST_NIGHTLY_TOOLCHAIN_VERSION: "nightly-2025-10-23"
27+
NIX_PKG_MANAGER_VERSION: "2.30.0"
28+
RUST_TOOLCHAIN_VERSION: "1.89.0"
29+
HADOLINT_VERSION: "v2.14.0"
30+
PYTHON_VERSION: "3.14"
31+
CARGO_TERM_COLOR: always
32+
33+
jobs:
34+
# This workflow contains a "required job", and GitHub Actions isn't clever
35+
# enough to detect that it should be skipped, and therefore pass (like they
36+
# allow for skipping jobs in a workflow).
37+
# Therefore, we have to move path filters/globs down to an actual job, and
38+
# emit an output that can be used to skip irrelevant jobs.
39+
detect-changes:
40+
name: Detect relevant changed files
41+
runs-on: ubuntu-latest
42+
steps:
43+
- name: Checkout Repository
44+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
45+
with:
46+
persist-credentials: false
47+
fetch-depth: 0
48+
49+
- name: Check for changed files
50+
id: check
51+
uses: stackabletech/actions/detect-changes@babe44d7b1db87f8e7731c011151d22a8a374191 # v0.12.0
52+
with:
53+
patterns: |
54+
- '.github/workflows/build.yaml'
55+
- 'rust-toolchain.toml'
56+
- '.dockerignore'
57+
- 'deploy/**'
58+
- '.cargo/**'
59+
- 'docker/**'
60+
- 'Cargo.*'
61+
- '*.rs'
62+
outputs:
63+
detected: ${{ steps.check.outputs.detected }}
64+
65+
cargo-udeps:
66+
name: Run cargo-udeps
67+
if: needs.detect-changes.outputs.detected == 'true'
68+
needs: [detect-changes]
69+
runs-on: ubuntu-latest
70+
env:
71+
RUSTC_BOOTSTRAP: 1
72+
steps:
73+
- name: Install host dependencies
74+
uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
75+
with:
76+
packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
77+
version: ubuntu-latest
78+
79+
- name: Checkout Repository
80+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
81+
with:
82+
persist-credentials: false
83+
submodules: recursive
84+
85+
- name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
86+
uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
87+
with:
88+
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
89+
90+
- name: Setup Rust Cache
91+
uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
92+
with:
93+
cache-all-crates: "true"
94+
key: udeps
95+
96+
- name: Install cargo-udeps
97+
uses: stackabletech/cargo-install-action@8f7dbbcd2ebe22717efc132d0dd61e80841994b9 # cargo-udeps
98+
99+
- name: Run cargo-udeps
100+
run: cargo udeps --workspace --all-targets
101+
102+
build-container-image:
103+
name: Build/Publish ${{ matrix.runner.arch }} Image
104+
if: (github.event_name != 'merge_group') && needs.detect-changes.outputs.detected == 'true'
105+
needs: [detect-changes]
106+
permissions:
107+
id-token: write
108+
strategy:
109+
fail-fast: false
110+
matrix:
111+
runner:
112+
- { name: "ubuntu-latest", arch: "amd64" }
113+
- { name: "ubicloud-standard-8-arm", arch: "arm64" }
114+
runs-on: ${{ matrix.runner.name }}
115+
outputs:
116+
operator-version: ${{ steps.version.outputs.OPERATOR_VERSION }}
117+
steps:
118+
- name: Install host dependencies
119+
uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
120+
with:
121+
packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
122+
version: ${{ matrix.runner.name }}
123+
124+
- name: Checkout Repository
125+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
126+
with:
127+
persist-credentials: false
128+
submodules: recursive
129+
130+
- name: Update/Extract Operator Version
131+
id: version
132+
env:
133+
PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
134+
PR_NUMBER: ${{ github.event.pull_request.number }}
135+
GITHUB_EVENT_NAME: ${{ github.event_name }}
136+
GITHUB_DEBUG: ${{ runner.debug }}
137+
shell: bash
138+
run: |
139+
set -euo pipefail
140+
[ -n "$GITHUB_DEBUG" ] && set -x
141+
142+
CURRENT_VERSION=$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[0].version')
143+
144+
if [ "$GITHUB_EVENT_NAME" == 'pull_request' ]; then
145+
# Include a PR suffix if this workflow is triggered by a PR
146+
if [ "$PR_BASE_REF" == 'main' ]; then
147+
NEW_VERSION="0.0.0-pr$PR_NUMBER"
148+
else
149+
NEW_VERSION="$CURRENT_VERSION-pr$PR_NUMBER"
150+
fi
151+
else
152+
# Just use the current version if this workflow is run on push, schedule, etc...
153+
NEW_VERSION="$CURRENT_VERSION"
154+
fi
155+
156+
sed -i "s/version = \"${CURRENT_VERSION}\"/version = \"${NEW_VERSION}\"/" Cargo.toml
157+
echo "OPERATOR_VERSION=$NEW_VERSION" | tee -a "$GITHUB_OUTPUT"
158+
159+
- name: Install Nix
160+
uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31.5.2
161+
162+
- name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain
163+
uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
164+
with:
165+
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}
166+
167+
- name: Build Container Image
168+
id: build
169+
uses: stackabletech/actions/build-container-image@babe44d7b1db87f8e7731c011151d22a8a374191 # v0.12.0
170+
with:
171+
image-name: ${{ env.OPERATOR_NAME }}
172+
image-index-manifest-tag: ${{ steps.version.outputs.OPERATOR_VERSION }}
173+
build-arguments: VERSION=${{ steps.version.outputs.OPERATOR_VERSION }}
174+
container-file: docker/Dockerfile
175+
176+
- name: Publish Container Image
177+
uses: stackabletech/actions/publish-image@babe44d7b1db87f8e7731c011151d22a8a374191 # v0.12.0
178+
with:
179+
image-registry-uri: oci.stackable.tech
180+
image-registry-username: robot$sdp+github-action-build
181+
image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
182+
image-repository: sdp/${{ env.OPERATOR_NAME }}
183+
image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
184+
source-image-uri: ${{ steps.build.outputs.image-manifest-uri }}
185+
186+
publish-index-manifest:
187+
name: Publish/Sign ${{ needs.build-container-image.outputs.operator-version }} Index
188+
if: (github.event_name != 'merge_group') && needs.detect-changes.outputs.detected == 'true'
189+
needs:
190+
- detect-changes
191+
- build-container-image
192+
permissions:
193+
id-token: write
194+
runs-on: ubuntu-latest
195+
steps:
196+
- name: Checkout Repository
197+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
198+
with:
199+
persist-credentials: false
200+
201+
- name: Publish and Sign Image Index
202+
uses: stackabletech/actions/publish-image-index-manifest@babe44d7b1db87f8e7731c011151d22a8a374191 # v0.12.0
203+
with:
204+
image-registry-uri: oci.stackable.tech
205+
image-registry-username: robot$sdp+github-action-build
206+
image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
207+
image-repository: sdp/${{ env.OPERATOR_NAME }}
208+
image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }}
209+
210+
publish-helm-chart:
211+
name: Package/Publish ${{ needs.build-container-image.outputs.operator-version }} Helm Chart
212+
if: (github.event_name != 'merge_group') && needs.detect-changes.outputs.detected == 'true'
213+
needs:
214+
- detect-changes
215+
- build-container-image
216+
permissions:
217+
id-token: write
218+
runs-on: ubuntu-latest
219+
steps:
220+
- name: Checkout Repository
221+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
222+
with:
223+
persist-credentials: false
224+
submodules: recursive
225+
226+
- name: Package, Publish, and Sign Helm Chart
227+
uses: stackabletech/actions/publish-helm-chart@babe44d7b1db87f8e7731c011151d22a8a374191 # v0.12.0
228+
with:
229+
chart-registry-uri: oci.stackable.tech
230+
chart-registry-username: robot$sdp-charts+github-action-build
231+
chart-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_CHARTS_GITHUB_ACTION_BUILD_SECRET }}
232+
chart-repository: sdp-charts
233+
chart-directory: deploy/helm/${{ env.OPERATOR_NAME }}
234+
chart-version: ${{ needs.build-container-image.outputs.operator-version }}
235+
app-version: ${{ needs.build-container-image.outputs.operator-version }}
236+
237+
openshift-preflight-check:
238+
name: Run OpenShift Preflight Check for ${{ needs.build-container-image.outputs.operator-version }}-${{ matrix.arch }}
239+
if: (github.event_name != 'merge_group') && needs.detect-changes.outputs.detected == 'true'
240+
needs:
241+
- detect-changes
242+
- build-container-image
243+
- publish-index-manifest
244+
strategy:
245+
fail-fast: false
246+
matrix:
247+
arch:
248+
- amd64
249+
- arm64
250+
runs-on: ubuntu-latest
251+
steps:
252+
- name: Run OpenShift Preflight Check
253+
uses: stackabletech/actions/run-openshift-preflight@babe44d7b1db87f8e7731c011151d22a8a374191 # v0.12.0
254+
with:
255+
image-index-uri: oci.stackable.tech/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }}
256+
image-architecture: ${{ matrix.arch }}
257+
258+
# This job is a required check in GitHub Settings for this repository.
259+
# It saves us having to list many required jobs, or work around dynamically
260+
# named jobs (since there is no concept of required settings).
261+
finished:
262+
# WARNING: Do not change the name unless you will also be changing the
263+
# Required Checks (in branch protections) in GitHub settings.
264+
name: Finished Build and Publish
265+
needs:
266+
- cargo-udeps
267+
- openshift-preflight-check
268+
- publish-helm-chart
269+
runs-on: ubuntu-latest
270+
steps:
271+
- run: echo "We are done here"
272+
273+
notify:
274+
name: Failure Notification
275+
if: (failure() || github.run_attempt > 1) && github.event_name != 'merge_group' && needs.detect-changes.outputs.detected == 'true'
276+
needs:
277+
- detect-changes
278+
- build-container-image
279+
- publish-index-manifest
280+
- publish-helm-chart
281+
runs-on: ubuntu-latest
282+
steps:
283+
- name: Checkout Repository
284+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
285+
with:
286+
persist-credentials: false
287+
288+
- name: Send Notification
289+
uses: stackabletech/actions/send-slack-notification@babe44d7b1db87f8e7731c011151d22a8a374191 # v0.12.0
290+
with:
291+
publish-helm-chart-result: ${{ needs.publish-helm-chart.result }}
292+
publish-manifests-result: ${{ needs.publish-index-manifest.result }}
293+
build-result: ${{ needs.build-container-image.result }}
294+
slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
295+
channel-id: C07UG6JH44F # notifications-container-images
296+
type: container-image-build

0 commit comments

Comments
 (0)