[SYSE-370 master] June template application #2534
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Generated by: gromit policy | |
# Distribution channels covered by this workflow | |
# - Ubuntu and Debian | |
# - RHEL and AL | |
# - docker hub | |
# - devenv ECR | |
# - Cloudsmith | |
name: Release | |
on: | |
# Trigger release every monday at midnight for master CI images | |
schedule: | |
- cron: "0 0 * * 1" | |
pull_request: | |
push: | |
branches: | |
- master | |
- release-** | |
tags: | |
- 'v*' | |
env: | |
GOPRIVATE: github.com/TykTechnologies | |
jobs: | |
goreleaser: | |
name: '${{ matrix.golang_cross }}' | |
runs-on: ubuntu-latest-m | |
permissions: | |
id-token: write # AWS OIDC JWT | |
contents: read # actions/checkout | |
strategy: | |
fail-fast: false | |
matrix: | |
golang_cross: | |
- 1.21-bookworm | |
include: | |
- golang_cross: 1.21-bookworm | |
goreleaser: 'ci/goreleaser/goreleaser.yml' | |
cgo: 0 | |
rpmvers: 'el/7 el/8 el/9 amazon/2 amazon/2023' | |
debvers: 'ubuntu/xenial ubuntu/bionic ubuntu/focal ubuntu/jammy debian/jessie debian/buster debian/bullseye debian/bookworm' | |
outputs: | |
tags: ${{ steps.ci_metadata.outputs.tags }} | |
commit_author: ${{ steps.set_outputs.outputs.commit_author}} | |
steps: | |
- name: Checkout of tyk-pump | |
uses: actions/checkout@v4 | |
with: | |
fetch-depth: 1 | |
- name: Set some outputs for later | |
id: set_outputs | |
shell: bash | |
env: | |
HEAD_REF: ${{github.head_ref}} | |
run: | | |
echo "commit_author=$(git show -s --format='%ae' HEAD)" >> $GITHUB_OUTPUT | |
echo "branch=${HEAD_REF##*/}" >> $GITHUB_OUTPUT | |
- uses: docker/setup-qemu-action@v3 | |
- uses: docker/setup-buildx-action@v3 | |
- name: Login to DockerHub | |
if: startsWith(github.ref, 'refs/tags') | |
uses: docker/login-action@v3 | |
with: | |
username: ${{ secrets.DOCKER_USERNAME }} | |
password: ${{ secrets.DOCKER_PASSWORD }} | |
- name: Login to Cloudsmith | |
if: startsWith(github.ref, 'refs/tags') | |
uses: docker/login-action@v3 | |
with: | |
registry: docker.tyk.io | |
username: ${{ secrets.CLOUDSMITH_USERNAME }} | |
password: ${{ secrets.CLOUDSMITH_API_KEY }} | |
- uses: actions/cache@v4 | |
with: | |
path: | | |
~/.cache/go-build | |
~/go/pkg/mod | |
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} | |
restore-keys: | | |
${{ runner.os }}-go-${{ hashFiles('**/go.sum') }} | |
- name: Build | |
env: | |
NFPM_PASSPHRASE: ${{ secrets.SIGNING_KEY_PASSPHRASE }} | |
PKG_SIGNING_KEY: ${{ secrets.SIGNING_KEY }} | |
PACKAGECLOUD_TOKEN: ${{ secrets.PACKAGECLOUD_TOKEN }} | |
run: | | |
echo '#!/bin/sh | |
ci/bin/unlock-agent.sh | |
git config --global url."https://${{ secrets.ORG_GH_TOKEN }}@github.com".insteadOf "https://github.com" | |
git config --global --add safe.directory /go/src/github.com/TykTechnologies/tyk-pump | |
goreleaser release --clean -f ${{ matrix.goreleaser }} ${{ !startsWith(github.ref, 'refs/tags/') && ' --snapshot --skip=sign' || '' }}' | tee /tmp/build.sh | |
chmod +x /tmp/build.sh | |
docker run --rm --privileged -e GITHUB_TOKEN=${{ github.token }} \ | |
-e GOPRIVATE=github.com/TykTechnologies \ | |
-e DEBVERS='${{ matrix.debvers }}' \ | |
-e RPMVERS='${{ matrix.rpmvers }}' \ | |
-e CGO_ENABLED=${{ matrix.cgo }} \ | |
-e NFPM_PASSPHRASE="$NFPM_PASSPHRASE" \ | |
-e GPG_FINGERPRINT=12B5D62C28F57592D1575BD51ED14C59E37DAC20 \ | |
-e PKG_SIGNING_KEY="$PKG_SIGNING_KEY" \ | |
-e PACKAGECLOUD_TOKEN=$PACKAGECLOUD_TOKEN \ | |
-v ${{github.workspace}}:/go/src/github.com/TykTechnologies/tyk-pump \ | |
-v /var/run/docker.sock:/var/run/docker.sock \ | |
-v ~/.docker/config.json:/root/.docker/config.json \ | |
-e GOCACHE=/cache/go-build \ | |
-e GOMODCACHE=/go/pkg/mod \ | |
-v ~/go/pkg/mod:/go/pkg/mod \ | |
-v ~/.cache/go-build:/cache/go-build \ | |
-v /tmp/build.sh:/tmp/build.sh \ | |
-w /go/src/github.com/TykTechnologies/tyk-pump \ | |
tykio/golang-cross:${{ matrix.golang_cross }} /tmp/build.sh | |
- uses: aws-actions/configure-aws-credentials@v4 | |
with: | |
role-to-assume: arn:aws:iam::754489498669:role/ecr_rw_tyk | |
role-session-name: cipush | |
aws-region: eu-central-1 | |
# Don't mask to pass it across job boundaries | |
mask-aws-account-id: false | |
- uses: aws-actions/amazon-ecr-login@v2 | |
id: ecr | |
if: ${{ matrix.golang_cross == '1.21-bookworm' }} | |
with: | |
mask-password: 'true' | |
- name: Docker metadata for CI | |
id: ci_metadata | |
if: ${{ matrix.golang_cross == '1.21-bookworm' }} | |
uses: docker/metadata-action@v5 | |
with: | |
images: ${{ steps.ecr.outputs.registry }}/tyk-pump | |
flavor: | | |
latest=false | |
tags: | | |
type=ref,event=branch | |
type=ref,event=pr | |
type=sha,format=long | |
type=semver,pattern={{major}},prefix=v | |
type=semver,pattern={{major}}.{{minor}},prefix=v | |
type=semver,pattern={{version}},prefix=v | |
- name: push image to CI | |
if: ${{ matrix.golang_cross == '1.21-bookworm' }} | |
uses: docker/build-push-action@v6 | |
with: | |
context: "dist" | |
platforms: linux/amd64,linux/arm64 | |
file: ci/Dockerfile.distroless | |
provenance: mode=max | |
sbom: true | |
push: true | |
cache-from: type=gha | |
cache-to: type=gha,mode=max | |
tags: ${{ steps.ci_metadata.outputs.tags }} | |
labels: ${{ steps.tag_metadata.outputs.labels }} | |
- name: Docker metadata for tag push | |
id: tag_metadata | |
uses: docker/metadata-action@v5 | |
with: | |
images: | | |
tykio/tyk-pump-docker-pub | |
docker.tyk.io/tyk-pump/tyk-pump | |
flavor: | | |
latest=false | |
prefix=v | |
tags: | | |
type=semver,pattern={{major}} | |
type=semver,pattern={{major}}.{{minor}} | |
type=semver,pattern={{version}} | |
labels: "org.opencontainers.image.title=tyk-pump (distroless) \norg.opencontainers.image.description=Tyk Analytics Pump to move analytics data from Redis to any supported back end (multiple back ends can be written to at once).\norg.opencontainers.image.vendor=tyk.io\norg.opencontainers.image.version=${{ github.ref_name }}\n" | |
- name: build multiarch image | |
if: ${{ matrix.golang_cross == '1.21-bookworm' }} | |
uses: docker/build-push-action@v6 | |
with: | |
context: "dist" | |
platforms: linux/amd64,linux/arm64 | |
file: ci/Dockerfile.distroless | |
provenance: mode=max | |
sbom: true | |
cache-from: type=gha | |
cache-to: type=gha,mode=max | |
push: ${{ startsWith(github.ref, 'refs/tags') }} | |
tags: ${{ steps.tag_metadata.outputs.tags }} | |
labels: ${{ steps.tag_metadata.outputs.labels }} | |
- uses: actions/upload-artifact@v4 | |
if: ${{ matrix.golang_cross == '1.21-bookworm' }} | |
with: | |
name: deb | |
retention-days: 1 | |
path: | | |
dist/*.deb | |
!dist/*PAYG*.deb | |
- uses: actions/upload-artifact@v4 | |
if: ${{ matrix.golang_cross == '1.21-bookworm' }} | |
with: | |
name: rpm | |
retention-days: 1 | |
path: | | |
dist/*.rpm | |
!dist/*PAYG*.rpm | |
test-controller-api: | |
needs: | |
- goreleaser | |
runs-on: ubuntu-latest | |
outputs: | |
envfiles: ${{ steps.params.outputs.envfiles }} | |
pump: ${{ steps.params.outputs.pump }} | |
sink: ${{ steps.params.outputs.sink }} | |
steps: | |
- name: set params | |
id: params | |
shell: bash | |
env: | |
# startsWith covers pull_request_target too | |
BASE_REF: ${{startsWith(github.event_name, 'pull_request') && github.base_ref || github.ref_name}} | |
VARIATION: esteban | |
run: | | |
set -eo pipefail | |
curl -s --retry 5 --retry-delay 10 --fail-with-body "http://tui.internal.dev.tyk.technology/v2/$VARIATION/tyk-pump/$BASE_REF/${{ github.event_name}}/api.gho" | tee -a "$GITHUB_OUTPUT" | |
[[ $VARIATION =~ test ]] && { | |
echo "::warning file=release.yml,line=100,col=5,endColumn=7::Using test variation" | |
echo "### :warning: You are using VARIATION with test in test-controller-api" >> $GITHUB_STEP_SUMMARY | |
} | |
api-tests: | |
needs: | |
- test-controller-api | |
- goreleaser | |
runs-on: ubuntu-latest-m-2 | |
env: | |
XUNIT_REPORT_PATH: ${{ github.workspace}}/test-results.xml | |
permissions: | |
id-token: write # This is required for requesting the Github JWT | |
contents: read # This is required for actions/checkout | |
strategy: | |
fail-fast: false | |
matrix: | |
envfiles: ${{ fromJson(needs.test-controller-api.outputs.envfiles) }} | |
sink: ${{ fromJson(needs.test-controller-api.outputs.sink) }} | |
steps: | |
- uses: aws-actions/configure-aws-credentials@v4 | |
with: | |
role-to-assume: arn:aws:iam::754489498669:role/ecr_rw_tyk | |
role-session-name: cipush | |
aws-region: eu-central-1 | |
- id: ecr | |
uses: aws-actions/amazon-ecr-login@v2 | |
with: | |
mask-password: 'true' | |
- name: Setup tmate session only in debug mode | |
uses: mxschmitt/action-tmate@v3 | |
if: runner.debug == '1' | |
with: | |
detached: true | |
limit-access-to-actor: true | |
# Only ${{ github.actor }} has access | |
# See https://github.com/mxschmitt/action-tmate#use-registered-public-ssh-keys | |
- name: fetch env from tyk-pro | |
env: | |
GH_TOKEN: ${{ github.token }} | |
run: | | |
gh release download --repo github.com/tyklabs/tyk-pro --archive tar.gz -O env.tgz | |
mkdir auto && tar --strip-components=1 -C auto -xzvf env.tgz | |
- name: env up | |
shell: bash | |
working-directory: auto | |
id: env_up | |
env: | |
pull_policy: 'if_not_present' | |
GH_TOKEN: ${{ secrets.ORG_GH_TOKEN }} | |
TYK_DB_LICENSEKEY: ${{ secrets.DASH_LICENSE }} | |
TYK_MDCB_LICENSE: ${{ secrets.MDCB_LICENSE }} | |
BASE_REF: ${{startsWith(github.event_name, 'pull_request') && github.base_ref || github.ref_name}} | |
run: "match_tag=${{steps.ecr.outputs.registry}}/tyk-pump:$BASE_REF\ntags=(${{ needs.goreleaser.outputs.tags }})\nset -eaxo pipefail\ndocker run -q --rm -v ~/.docker/config.json:/root/.docker/config.json tykio/gromit policy match ${tags[0]} ${match_tag} 2>versions.env\necho '# alfa and beta have to come after the override\ntyk_alfa_image=$tyk_image\ntyk_beta_image=$tyk_image\nECR=${{steps.ecr.outputs.registry}}\ntyk_sink_image=${{matrix.sink}}\nconfs_dir=./pro-ha\nenv_file=local.env' >> versions.env\ncat ./confs/${{ matrix.envfiles.config }}.env local-${{ matrix.envfiles.db }}.env > local.env\necho \"::group::versions\"\ncat versions.env local.env\necho \"::endgroup::\"\n# bring up env, the project name is important\ndocker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile master-datacenter up --quiet-pull -d\n./dash-bootstrap.sh http://localhost:3000\ndocker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile slave-datacenter up --quiet-pull -d \n" | |
- name: Run API tests | |
id: test_execution | |
env: | |
# Cover pull_request_target too | |
BASE_REF: ${{startsWith(github.event_name, 'pull_request') && github.base_ref || github.ref_name }} | |
run: | | |
# Generate report id | |
echo "id=$(date +%s%N)" >> $GITHUB_OUTPUT | |
pytest_file="/app/pytest_ci.ini" | |
pytest="pytest -c $pytest_file --junitxml=${XUNIT_REPORT_PATH} --ci -m ${{ matrix.envfiles.apimarkers }}" | |
touch $XUNIT_REPORT_PATH | |
cmd="docker run --rm --network auto_default -v $XUNIT_REPORT_PATH:$XUNIT_REPORT_PATH ${{ steps.ecr.outputs.registry }}/tyk-automated-tests:$BASE_REF $pytest" | |
# Run tests | |
eval $cmd | |
- name: Generate metadata and upload test reports | |
if: always() && steps.test_execution.outcome != 'skipped' | |
id: metadata_report | |
env: | |
BASE_REF: ${{startsWith(github.event_name, 'pull_request') && github.base_ref || github.ref}} | |
REPORT_NAME: ${{ github.repository }}_${{ github.run_id }}_${{ github.run_attempt }}-${{steps.test_execution.outputs.id}} | |
METADATA_REPORT_PATH: /tmp/metadata.toml | |
run: | | |
# Generate metadata report | |
echo "[metadata] | |
repo = ${{ github.repository }} | |
branch = ${{ github.ref }} | |
commit = ${{ github.sha }} | |
test_suite_version = $BASE_REF | |
test_suite_name = ${{ github.job }} | |
test_suite_run = ${{ github.run_id }}-${{ github.run_attempt }} | |
db = ${{ matrix.envfiles.db }} | |
conf = ${{ matrix.envfiles.config }} | |
cache = ${{ matrix.envfiles.cache }} | |
pump_compatibility = ${{ matrix.pump }} | |
sink_compatibility = ${{ matrix.sink }} | |
" > ${METADATA_REPORT_PATH} | |
# Print metadata report | |
if [[ "${{ runner.debug }}" == "1" ]]; then | |
echo "::group::metadata report" | |
cat ${METADATA_REPORT_PATH} | |
echo "::endgroup::" | |
fi | |
aws s3 cp ${XUNIT_REPORT_PATH} s3://assets.dev.tyk.technology/testreports/${REPORT_NAME#*/}.xml | |
aws s3 cp ${METADATA_REPORT_PATH} s3://assets.dev.tyk.technology/testreports/${REPORT_NAME#*/}.metadata.toml | |
- name: Docker logs for all components | |
if: failure() && (steps.test_execution.outcome != 'success' || steps.env_up.outcome != 'success') | |
working-directory: auto | |
env: | |
pull_policy: 'if_not_present' | |
GH_TOKEN: ${{ secrets.ORG_GH_TOKEN }} | |
TYK_DB_LICENSEKEY: ${{ secrets.DASH_LICENSE }} | |
TYK_MDCB_LICENSE: ${{ secrets.MDCB_LICENSE }} | |
ECR: ${{ steps.ecr.outputs.registry }} | |
run: | | |
docker compose -p auto -f pro-ha.yml -f deps_pro-ha.yml -f ${{ matrix.envfiles.db }}.yml -f ${{ matrix.envfiles.cache }}.yml --env-file versions.env --profile all logs | sort > ${{ github.workspace }}/docker-compose.log | |
echo "::group::DockerLogs" | |
cat ${{ github.workspace }}/docker-compose.log | |
echo "::endgroup::" | |
- name: Upload compose logs | |
uses: actions/upload-artifact@v4 | |
if: failure() && (steps.test_execution.outcome != 'success' || steps.env_up.outcome != 'success') | |
with: | |
name: docker-compose-logs-${{ github.job }}-${{ matrix.envfiles.db }}-${{ matrix.envfiles.conf }}-${{ github.run_id }} | |
path: ${{ github.workspace }}/docker-compose.log | |
retention-days: 3 | |
overwrite: true | |
test-controller-distros: | |
needs: | |
- goreleaser | |
runs-on: ubuntu-latest | |
outputs: | |
deb: ${{ steps.params.outputs.deb }} | |
rpm: ${{ steps.params.outputs.rpm }} | |
steps: | |
- name: set params | |
id: params | |
shell: bash | |
env: | |
# startsWith covers pull_request_target too | |
BASE_REF: ${{startsWith(github.event_name, 'pull_request') && github.base_ref || github.ref_name}} | |
VARIATION: test | |
run: | | |
set -eo pipefail | |
curl -s --retry 5 --retry-delay 10 --fail-with-body "http://tui.internal.dev.tyk.technology/v2/$VARIATION/tyk-pump/$BASE_REF/${{ github.event_name}}/api/Distros.gho" | tee -a "$GITHUB_OUTPUT" | |
[[ $VARIATION =~ test ]] && echo "::warning file=release.yml,line=100,col=5,endColumn=7::Using test variation" | |
upgrade-deb: | |
services: | |
httpbin.org: | |
image: kennethreitz/httpbin | |
runs-on: ubuntu-latest | |
needs: | |
- test-controller-distros | |
strategy: | |
fail-fast: true | |
matrix: | |
arch: | |
- amd64 | |
- arm64 | |
distro: ${{ fromJson(needs.test-controller-distros.outputs.deb) }} | |
steps: | |
- uses: actions/checkout@v4 | |
with: | |
fetch-depth: 1 | |
- uses: actions/download-artifact@v4 | |
with: | |
name: deb | |
- uses: docker/setup-qemu-action@v3 | |
- uses: docker/setup-buildx-action@v3 | |
- name: generate dockerfile | |
run: "echo 'FROM ${{ matrix.distro }}\nARG TARGETARCH\nCOPY tyk-pump*_${TARGETARCH}.deb /tyk-pump.deb\nRUN apt-get update && apt-get install -y curl\nRUN curl -fsSL https://packagecloud.io/install/repositories/tyk/tyk-pump/script.deb.sh | bash && apt-get install -y tyk-pump=1.6.0\nRUN dpkg -i /tyk-pump.deb \n' > Dockerfile\n" | |
- name: install on ${{ matrix.distro }} | |
uses: docker/build-push-action@v6 | |
with: | |
context: "." | |
platforms: linux/${{ matrix.arch }} | |
file: Dockerfile | |
push: false | |
upgrade-rpm: | |
services: | |
httpbin.org: | |
image: kennethreitz/httpbin | |
runs-on: ubuntu-latest | |
needs: | |
- test-controller-distros | |
strategy: | |
fail-fast: true | |
matrix: | |
arch: | |
- amd64 | |
- arm64 | |
distro: ${{ fromJson(needs.test-controller-distros.outputs.rpm) }} | |
steps: | |
- uses: actions/checkout@v4 | |
with: | |
fetch-depth: 1 | |
- uses: actions/download-artifact@v4 | |
with: | |
name: deb | |
- uses: docker/setup-qemu-action@v3 | |
- uses: docker/setup-buildx-action@v3 | |
- name: generate dockerfile | |
run: "echo 'FROM ${{ matrix.distro }}\nARG TARGETARCH\nCOPY tyk-pump*.x86_64.rpm /tyk-pump.rpm\nRUN command -v curl || yum install -y curl\nRUN command -v useradd || yum install -y shadow-utils\nRUN curl -fsSL https://packagecloud.io/install/repositories/tyk/tyk-pump/script.rpm.sh | bash && yum install -y tyk-pump-1.6.0-1\nRUN curl https://keyserver.tyk.io/tyk.io.rpm.signing.key.2020 -o tyk-pump.key && rpm --import tyk-pump.key\nRUN rpm --checksig /tyk-pump.rpm\nRUN rpm -Uvh --force /tyk-pump.rpm \n' > Dockerfile\n" | |
- name: install on ${{ matrix.distro }} | |
uses: docker/build-push-action@v6 | |
with: | |
context: "." | |
platforms: linux/${{ matrix.arch }} | |
file: Dockerfile | |
push: false | |
sbom: | |
needs: goreleaser | |
uses: TykTechnologies/github-actions/.github/workflows/sbom.yaml@main | |
secrets: | |
DEPDASH_URL: ${{ secrets.DEPDASH_URL }} | |
DEPDASH_KEY: ${{ secrets.DEPDASH_KEY }} | |
ORG_GH_TOKEN: ${{ secrets.ORG_GH_TOKEN }} |