Skip to content

Commit 83aa3d3

Browse files
wrn14897wrn14897
authored
ci: update release scripts to prevent tag overrides (#977)
Ref: HDX-1976 1. Updated release-xxx commands to prevent image tag overrides 2. Updated release workflow so that notify-xxx steps won't be triggered if no new app image was pushed
1 parent 844f74c commit 83aa3d3

File tree

2 files changed

+201
-101
lines changed

2 files changed

+201
-101
lines changed

‎.github/workflows/release.yml

Lines changed: 59 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -90,16 +90,67 @@ jobs:
9090
- name: Load Environment Variables from .env
9191
uses: xom9ikk/dotenv@v2
9292
- name: Publish Images
93+
id: publish
9394
if:
9495
needs.check_changesets.outputs.changeset_outputs_hasChangesets ==
9596
'false'
96-
run: make ${{ matrix.release }}
97-
notify_helm_charts:
98-
name: Notify Helm-Charts Downstream
97+
run: |
98+
OUTPUT=$(make ${{ matrix.release }} 2>&1)
99+
echo "$OUTPUT"
100+
101+
# Store the output in a file for the specific release target
102+
echo "$OUTPUT" > /tmp/${{ matrix.release }}-output.txt
103+
104+
# Upload the output as an artifact if this is release-app
105+
if [ "${{ matrix.release }}" = "release-app" ]; then
106+
if echo "$OUTPUT" | grep -q "already exists. Skipping push."; then
107+
echo "RELEASE_APP_PUSHED=false" > /tmp/release-app-status.txt
108+
else
109+
echo "RELEASE_APP_PUSHED=true" > /tmp/release-app-status.txt
110+
fi
111+
fi
112+
- name: Upload release-app status
113+
if: matrix.release == 'release-app'
114+
uses: actions/upload-artifact@v4
115+
with:
116+
name: release-app-status
117+
path: /tmp/release-app-status.txt
118+
check_release_app_pushed:
119+
name: Check if release-app pushed
99120
needs: [check_changesets, release]
100121
runs-on: ubuntu-24.04
122+
outputs:
123+
app_was_pushed: ${{ steps.check.outputs.pushed }}
101124
if:
102125
needs.check_changesets.outputs.changeset_outputs_hasChangesets == 'false'
126+
steps:
127+
- name: Download release-app status
128+
uses: actions/download-artifact@v4
129+
with:
130+
name: release-app-status
131+
path: /tmp
132+
- name: Check if release-app was pushed
133+
id: check
134+
run: |
135+
if [ -f /tmp/release-app-status.txt ]; then
136+
STATUS=$(cat /tmp/release-app-status.txt)
137+
echo "Release app status: $STATUS"
138+
if [ "$STATUS" = "RELEASE_APP_PUSHED=true" ]; then
139+
echo "pushed=true" >> $GITHUB_OUTPUT
140+
else
141+
echo "pushed=false" >> $GITHUB_OUTPUT
142+
fi
143+
else
144+
echo "No release-app status file found, assuming not pushed"
145+
echo "pushed=false" >> $GITHUB_OUTPUT
146+
fi
147+
notify_helm_charts:
148+
name: Notify Helm-Charts Downstream
149+
needs: [check_changesets, release, check_release_app_pushed]
150+
runs-on: ubuntu-24.04
151+
if: |
152+
needs.check_changesets.outputs.changeset_outputs_hasChangesets == 'false' &&
153+
needs.check_release_app_pushed.outputs.app_was_pushed == 'true'
103154
steps:
104155
- name: Checkout
105156
uses: actions/checkout@v4
@@ -111,7 +162,7 @@ jobs:
111162
env:
112163
TAG: ${{ env.IMAGE_VERSION }}${{ env.IMAGE_VERSION_SUB_TAG }}
113164
with:
114-
github-token: ${{ secrets.GITHUB_TOKEN }}
165+
github-token: ${{ secrets.DOWNSTREAM_TOKEN }}
115166
script: |
116167
const { TAG } = process.env;
117168
const result = await github.rest.actions.createWorkflowDispatch({
@@ -125,10 +176,11 @@ jobs:
125176
});
126177
notify_ch:
127178
name: Notify CH Downstream
128-
needs: [check_changesets, release]
179+
needs: [check_changesets, release, check_release_app_pushed]
129180
runs-on: ubuntu-24.04
130-
if:
131-
needs.check_changesets.outputs.changeset_outputs_hasChangesets == 'false'
181+
if: |
182+
needs.check_changesets.outputs.changeset_outputs_hasChangesets == 'false' &&
183+
needs.check_release_app_pushed.outputs.app_was_pushed == 'true'
132184
steps:
133185
- name: Checkout
134186
uses: actions/checkout@v4

‎Makefile

Lines changed: 142 additions & 94 deletions
Original file line numberDiff line numberDiff line change
@@ -157,118 +157,166 @@ build-all-in-one-nightly:
157157

158158
.PHONY: release-otel-collector
159159
release-otel-collector:
160-
docker buildx build --platform ${BUILD_PLATFORMS} ./docker/otel-collector \
161-
-t ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} \
162-
-t ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION} \
163-
-t ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_LATEST_TAG} \
164-
--target prod \
165-
--push \
166-
--cache-from=type=gha \
167-
--cache-to=type=gha,mode=max
160+
@TAG_EXISTS=$$(docker manifest inspect ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} > /dev/null 2>&1 && echo "true" || echo "false"); \
161+
if [ "$$TAG_EXISTS" = "true" ]; then \
162+
echo "Tag ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \
163+
else \
164+
echo "Tag ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \
165+
docker buildx build --platform ${BUILD_PLATFORMS} ./docker/otel-collector \
166+
-t ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} \
167+
-t ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION} \
168+
-t ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_LATEST_TAG} \
169+
--target prod \
170+
--push \
171+
--cache-from=type=gha \
172+
--cache-to=type=gha,mode=max; \
173+
fi
168174

169175
.PHONY: release-local
170176
release-local:
171-
docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
172-
--build-context clickhouse=./docker/clickhouse \
173-
--build-context otel-collector=./docker/otel-collector \
174-
--build-context hyperdx=./docker/hyperdx \
175-
--build-context api=./packages/api \
176-
--build-context app=./packages/app \
177-
--build-arg CODE_VERSION=${CODE_VERSION} \
178-
--platform ${BUILD_PLATFORMS} \
179-
-t ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} \
180-
-t ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION} \
181-
-t ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_LATEST_TAG} \
182-
--target all-in-one-noauth \
183-
--push \
184-
--cache-from=type=gha \
185-
--cache-to=type=gha,mode=max
177+
@TAG_EXISTS=$$(docker manifest inspect ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} > /dev/null 2>&1 && echo "true" || echo "false"); \
178+
if [ "$$TAG_EXISTS" = "true" ]; then \
179+
echo "Tag ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \
180+
else \
181+
echo "Tag ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \
182+
docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
183+
--build-context clickhouse=./docker/clickhouse \
184+
--build-context otel-collector=./docker/otel-collector \
185+
--build-context hyperdx=./docker/hyperdx \
186+
--build-context api=./packages/api \
187+
--build-context app=./packages/app \
188+
--build-arg CODE_VERSION=${CODE_VERSION} \
189+
--platform ${BUILD_PLATFORMS} \
190+
-t ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} \
191+
-t ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION} \
192+
-t ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_LATEST_TAG} \
193+
--target all-in-one-noauth \
194+
--push \
195+
--cache-from=type=gha \
196+
--cache-to=type=gha,mode=max; \
197+
fi
186198

187199
.PHONY: release-all-in-one
188200
release-all-in-one:
189-
docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
190-
--build-context clickhouse=./docker/clickhouse \
191-
--build-context otel-collector=./docker/otel-collector \
192-
--build-context hyperdx=./docker/hyperdx \
193-
--build-context api=./packages/api \
194-
--build-context app=./packages/app \
195-
--build-arg CODE_VERSION=${CODE_VERSION} \
196-
--platform ${BUILD_PLATFORMS} \
197-
-t ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} \
198-
-t ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION} \
199-
-t ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_LATEST_TAG} \
200-
--target all-in-one-auth \
201-
--push \
202-
--cache-from=type=gha \
203-
--cache-to=type=gha,mode=max
201+
@TAG_EXISTS=$$(docker manifest inspect ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} > /dev/null 2>&1 && echo "true" || echo "false"); \
202+
if [ "$$TAG_EXISTS" = "true" ]; then \
203+
echo "Tag ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \
204+
else \
205+
echo "Tag ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \
206+
docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
207+
--build-context clickhouse=./docker/clickhouse \
208+
--build-context otel-collector=./docker/otel-collector \
209+
--build-context hyperdx=./docker/hyperdx \
210+
--build-context api=./packages/api \
211+
--build-context app=./packages/app \
212+
--build-arg CODE_VERSION=${CODE_VERSION} \
213+
--platform ${BUILD_PLATFORMS} \
214+
-t ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} \
215+
-t ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION} \
216+
-t ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_LATEST_TAG} \
217+
--target all-in-one-auth \
218+
--push \
219+
--cache-from=type=gha \
220+
--cache-to=type=gha,mode=max; \
221+
fi
204222

205223
.PHONY: release-app
206224
release-app:
207-
docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
208-
--build-context hyperdx=./docker/hyperdx \
209-
--build-context api=./packages/api \
210-
--build-context app=./packages/app \
211-
--build-arg CODE_VERSION=${CODE_VERSION} \
212-
--platform ${BUILD_PLATFORMS} \
213-
-t ${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} \
214-
-t ${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION} \
215-
-t ${IMAGE_NAME_DOCKERHUB}:${IMAGE_LATEST_TAG} \
216-
--target prod \
217-
--push \
218-
--cache-from=type=gha \
219-
--cache-to=type=gha,mode=max
225+
@TAG_EXISTS=$$(docker manifest inspect ${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} > /dev/null 2>&1 && echo "true" || echo "false"); \
226+
if [ "$$TAG_EXISTS" = "true" ]; then \
227+
echo "Tag ${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} already exists. Skipping push."; \
228+
else \
229+
echo "Tag ${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} does not exist. Building and pushing..."; \
230+
docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
231+
--build-context hyperdx=./docker/hyperdx \
232+
--build-context api=./packages/api \
233+
--build-context app=./packages/app \
234+
--build-arg CODE_VERSION=${CODE_VERSION} \
235+
--platform ${BUILD_PLATFORMS} \
236+
-t ${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION}${IMAGE_VERSION_SUB_TAG} \
237+
-t ${IMAGE_NAME_DOCKERHUB}:${IMAGE_VERSION} \
238+
-t ${IMAGE_NAME_DOCKERHUB}:${IMAGE_LATEST_TAG} \
239+
--target prod \
240+
--push \
241+
--cache-from=type=gha \
242+
--cache-to=type=gha,mode=max; \
243+
fi
220244

221245
.PHONY: release-otel-collector-nightly
222246
release-otel-collector-nightly:
223-
docker buildx build --platform ${BUILD_PLATFORMS} ./docker/otel-collector \
224-
-t ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} \
225-
--target prod \
226-
--push \
227-
--cache-from=type=gha \
228-
--cache-to=type=gha,mode=max
247+
@TAG_EXISTS=$$(docker manifest inspect ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} > /dev/null 2>&1 && echo "true" || echo "false"); \
248+
if [ "$$TAG_EXISTS" = "true" ]; then \
249+
echo "Tag ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} already exists. Skipping push."; \
250+
else \
251+
echo "Tag ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} does not exist. Building and pushing..."; \
252+
docker buildx build --platform ${BUILD_PLATFORMS} ./docker/otel-collector \
253+
-t ${OTEL_COLLECTOR_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} \
254+
--target prod \
255+
--push \
256+
--cache-from=type=gha \
257+
--cache-to=type=gha,mode=max; \
258+
fi
229259

230260
.PHONY: release-app-nightly
231261
release-app-nightly:
232-
docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
233-
--build-context hyperdx=./docker/hyperdx \
234-
--build-context api=./packages/api \
235-
--build-context app=./packages/app \
236-
--build-arg CODE_VERSION=${IMAGE_NIGHTLY_TAG} \
237-
--platform ${BUILD_PLATFORMS} \
238-
-t ${IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} \
239-
--target prod \
240-
--push \
241-
--cache-from=type=gha \
242-
--cache-to=type=gha,mode=max
262+
@TAG_EXISTS=$$(docker manifest inspect ${IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} > /dev/null 2>&1 && echo "true" || echo "false"); \
263+
if [ "$$TAG_EXISTS" = "true" ]; then \
264+
echo "Tag ${IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} already exists. Skipping push."; \
265+
else \
266+
echo "Tag ${IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} does not exist. Building and pushing..."; \
267+
docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
268+
--build-context hyperdx=./docker/hyperdx \
269+
--build-context api=./packages/api \
270+
--build-context app=./packages/app \
271+
--build-arg CODE_VERSION=${IMAGE_NIGHTLY_TAG} \
272+
--platform ${BUILD_PLATFORMS} \
273+
-t ${IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} \
274+
--target prod \
275+
--push \
276+
--cache-from=type=gha \
277+
--cache-to=type=gha,mode=max; \
278+
fi
243279

244280
.PHONY: release-local-nightly
245281
release-local-nightly:
246-
docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
247-
--build-context clickhouse=./docker/clickhouse \
248-
--build-context otel-collector=./docker/otel-collector \
249-
--build-context hyperdx=./docker/hyperdx \
250-
--build-context api=./packages/api \
251-
--build-context app=./packages/app \
252-
--build-arg CODE_VERSION=${IMAGE_NIGHTLY_TAG} \
253-
--platform ${BUILD_PLATFORMS} \
254-
-t ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} \
255-
--target all-in-one-noauth \
256-
--push \
257-
--cache-from=type=gha \
258-
--cache-to=type=gha,mode=max
282+
@TAG_EXISTS=$$(docker manifest inspect ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} > /dev/null 2>&1 && echo "true" || echo "false"); \
283+
if [ "$$TAG_EXISTS" = "true" ]; then \
284+
echo "Tag ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} already exists. Skipping push."; \
285+
else \
286+
echo "Tag ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} does not exist. Building and pushing..."; \
287+
docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
288+
--build-context clickhouse=./docker/clickhouse \
289+
--build-context otel-collector=./docker/otel-collector \
290+
--build-context hyperdx=./docker/hyperdx \
291+
--build-context api=./packages/api \
292+
--build-context app=./packages/app \
293+
--build-arg CODE_VERSION=${IMAGE_NIGHTLY_TAG} \
294+
--platform ${BUILD_PLATFORMS} \
295+
-t ${LOCAL_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} \
296+
--target all-in-one-noauth \
297+
--push \
298+
--cache-from=type=gha \
299+
--cache-to=type=gha,mode=max; \
300+
fi
259301

260302
.PHONY: release-all-in-one-nightly
261303
release-all-in-one-nightly:
262-
docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
263-
--build-context clickhouse=./docker/clickhouse \
264-
--build-context otel-collector=./docker/otel-collector \
265-
--build-context hyperdx=./docker/hyperdx \
266-
--build-context api=./packages/api \
267-
--build-context app=./packages/app \
268-
--build-arg CODE_VERSION=${IMAGE_NIGHTLY_TAG} \
269-
--platform ${BUILD_PLATFORMS} \
270-
-t ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} \
271-
--target all-in-one-auth \
272-
--push \
273-
--cache-from=type=gha \
274-
--cache-to=type=gha,mode=max
304+
@TAG_EXISTS=$$(docker manifest inspect ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} > /dev/null 2>&1 && echo "true" || echo "false"); \
305+
if [ "$$TAG_EXISTS" = "true" ]; then \
306+
echo "Tag ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} already exists. Skipping push."; \
307+
else \
308+
echo "Tag ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} does not exist. Building and pushing..."; \
309+
docker buildx build --squash . -f ./docker/hyperdx/Dockerfile \
310+
--build-context clickhouse=./docker/clickhouse \
311+
--build-context otel-collector=./docker/otel-collector \
312+
--build-context hyperdx=./docker/hyperdx \
313+
--build-context api=./packages/api \
314+
--build-context app=./packages/app \
315+
--build-arg CODE_VERSION=${IMAGE_NIGHTLY_TAG} \
316+
--platform ${BUILD_PLATFORMS} \
317+
-t ${ALL_IN_ONE_IMAGE_NAME_DOCKERHUB}:${IMAGE_NIGHTLY_TAG} \
318+
--target all-in-one-auth \
319+
--push \
320+
--cache-from=type=gha \
321+
--cache-to=type=gha,mode=max; \
322+
fi

0 commit comments

Comments
 (0)