Skip to content

Commit e25897e

Browse files
dskloetcgithub-advanced-security[bot]
dskloetc
and
github-advanced-security[bot]
authored
OPDATA-3845: Separate publishing images from the release (#4171)
* Test publish workflow * Revert "Test publish workflow" This reverts commit 2ca58ed. * Copy .github/workflows/release.yml * Modify workflows * Potential fix for code scanning alert no. 61: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent 5071a20 commit e25897e

File tree

3 files changed

+141
-102
lines changed

3 files changed

+141
-102
lines changed

‎.github/scripts/list-changed-public-adapters.sh‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
#!/bin/bash
2+
set -euo pipefail
3+
4+
SOURCE_DIR="$(dirname "$0")"
5+
TOP_DIR="$(git rev-parse --show-toplevel)"
6+
cd "$TOP_DIR"
7+
VERSIONS_FILE="public-adapter-versions.yml"
8+
9+
if [[ "${BUILD_ALL:-}" == "true" ]]; then
10+
yq --output-format json '{ "adapter": .adapters | map({"shortName": .name, "version": .version}) }' "$VERSIONS_FILE" | jq -c
11+
exit 0
12+
fi
13+
14+
UPSTREAM="${1:-"${UPSTREAM_BRANCH:-HEAD~1}"}"
15+
echo "Comparing against upstream: $UPSTREAM" >&2
16+
17+
# Outputs JSON to be used as matrix strategy in release.yml.
18+
git show "$UPSTREAM:$VERSIONS_FILE" | yq --output-format json '{ "adapter": [ .adapters | map({"key":(.name), "value":(.version)}) | from_entries as $old | load("'"$VERSIONS_FILE"'") | .adapters[] | select(.version != $old[.name]) | {"shortName": .name, "version": .version} ] }' | jq -c

‎.github/workflows/publish.yml‎

Lines changed: 123 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,123 @@
1+
name: Publish Adapter Images to Public ECR
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
paths:
8+
- public-adapter-versions.yml
9+
workflow_dispatch:
10+
inputs:
11+
# For this workflow, build-all will cause all adapters to have their image pulled and republished to the public ECR
12+
# NOTE: If the images haven't been already published to the private ECR, this will fail; in that case run the deploy workflow first.
13+
build-all:
14+
description: whether to run steps for all adapters, regardless of whether they were changed in this event
15+
required: false
16+
default: 'false'
17+
18+
concurrency:
19+
group: deploy-and-release
20+
cancel-in-progress: false
21+
22+
jobs:
23+
calculate-changes:
24+
name: Compute changed adapters
25+
permissions:
26+
contents: read
27+
runs-on: [ubuntu-latest]
28+
env:
29+
BUILD_ALL: ${{ inputs.build-all }}
30+
outputs:
31+
adapter-list: ${{ steps.changed-adapters.outputs.CHANGED_ADAPTERS }}
32+
steps:
33+
- uses: actions/checkout@v5
34+
with:
35+
persist-credentials: false
36+
fetch-depth: 2
37+
- name: Set up and install dependencies
38+
uses: ./.github/actions/setup
39+
with:
40+
skip-setup: true
41+
- name: Build list of changed packages and changed adapters
42+
id: changed-adapters
43+
env:
44+
UPSTREAM_BRANCH: HEAD~1
45+
run: |
46+
echo "CHANGED_ADAPTERS=$(./.github/scripts/list-changed-public-adapters.sh)" >> $GITHUB_OUTPUT
47+
48+
create-ecr:
49+
name: Create ECR for ${{ matrix.adapter.shortName }}
50+
runs-on: ubuntu-latest
51+
needs: [calculate-changes]
52+
if: needs.calculate-changes.outputs.adapter-list != '[]'
53+
permissions: # These are needed for the configure-aws-credentials action
54+
id-token: write
55+
contents: read
56+
environment: release
57+
strategy:
58+
max-parallel: 20
59+
matrix: ${{fromJson(needs.calculate-changes.outputs.adapter-list)}}
60+
env:
61+
ECR_URL: public.ecr.aws/chainlink
62+
ECR_REPO: adapters/${{ matrix.adapter.shortName }}-adapter
63+
IMAGE_VERSION: ${{ matrix.adapter.version }}
64+
steps:
65+
- uses: actions/checkout@v5
66+
with:
67+
persist-credentials: false
68+
- name: Create ECR for ${{ matrix.adapter.shortName }}
69+
uses: ./.github/actions/create-ecrs
70+
with:
71+
aws-ecr-url: ${{ env.ECR_URL }}
72+
aws-ecr-repo: ${{ env.ECR_REPO }}
73+
aws-region: us-east-1
74+
aws-role: ${{ secrets.AWS_OIDC_IAM_ROLE_ARN }}
75+
aws-ecr-private: false
76+
77+
publish-adapter-images:
78+
name: Fetch and publish ${{ matrix.adapter.shortName }}
79+
runs-on: ubuntu-latest
80+
needs:
81+
- calculate-changes
82+
environment: release
83+
permissions: # These are needed for the configure-aws-credentials action
84+
id-token: write
85+
contents: read
86+
strategy:
87+
max-parallel: 20
88+
matrix: ${{fromJson(needs.calculate-changes.outputs.adapter-list)}}
89+
env:
90+
PUBLIC_ECR_URL: public.ecr.aws/chainlink
91+
PRIVATE_ECR_URL: ${{ secrets.SDLC_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION_ECR_PRIVATE }}.amazonaws.com
92+
ECR_REPO: adapters/${{ matrix.adapter.shortName }}-adapter
93+
steps:
94+
- uses: actions/checkout@v5
95+
with:
96+
persist-credentials: false
97+
- name: Configure AWS Credentials
98+
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
99+
with:
100+
role-to-assume: ${{ secrets.AWS_OIDC_IAM_ROLE_ARN }}
101+
aws-region: ${{ secrets.AWS_REGION_ECR_PRIVATE }}
102+
mask-aws-account-id: true
103+
- name: Copy images with attestations from private to public ECR
104+
env:
105+
AWS_REGION: ${{ secrets.AWS_REGION_ECR_PRIVATE }}
106+
SOURCE_IMAGE: ${{ env.PRIVATE_ECR_URL }}/${{ env.ECR_REPO }}:${{ matrix.adapter.version }}
107+
DEST_IMAGE: ${{ env.PUBLIC_ECR_URL }}/${{ env.ECR_REPO }}:${{ matrix.adapter.version }}
108+
run: |
109+
PRIVATE_ECR_PASSWORD=$(aws ecr get-login-password --region "${AWS_REGION}")
110+
echo "::add-mask::${PRIVATE_ECR_PASSWORD}"
111+
PUBLIC_ECR_PASSWORD=$(aws ecr-public get-login-password --region us-east-1)
112+
echo "::add-mask::${PUBLIC_ECR_PASSWORD}"
113+
114+
# Copy all architectures, attestations (SBOM, provenance), and signatures
115+
echo "Copying versioned image: ${SOURCE_IMAGE} -> ${DEST_IMAGE}"
116+
skopeo copy \
117+
--all \
118+
--preserve-digests \
119+
--retry-times 3 \
120+
--src-creds AWS:${PRIVATE_ECR_PASSWORD} \
121+
--dest-creds AWS:${PUBLIC_ECR_PASSWORD} \
122+
docker://${SOURCE_IMAGE} \
123+
docker://${DEST_IMAGE}

‎.github/workflows/release.yml‎

Lines changed: 0 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -21,111 +21,9 @@ concurrency:
2121
cancel-in-progress: false
2222

2323
jobs:
24-
calculate-changes:
25-
name: Compute changed adapters
26-
runs-on: [ubuntu-latest]
27-
env:
28-
BUILD_ALL: ${{ inputs.build-all }}
29-
outputs:
30-
adapter-list: ${{ steps.changed-adapters.outputs.CHANGED_ADAPTERS }}
31-
steps:
32-
- uses: actions/checkout@v5
33-
with:
34-
persist-credentials: false
35-
fetch-depth: 2
36-
- name: Set up and install dependencies
37-
uses: ./.github/actions/setup
38-
with:
39-
skip-setup: true
40-
- name: Build list of changed packages and changed adapters
41-
id: changed-adapters
42-
env:
43-
UPSTREAM_BRANCH: HEAD~1
44-
run: |
45-
./.github/scripts/changed-adapters.sh
46-
47-
create-ecr:
48-
name: Create ECR for ${{ matrix.adapter.shortName }}
49-
runs-on: ubuntu-latest
50-
needs: [calculate-changes]
51-
if: needs.calculate-changes.outputs.adapter-list != '[]'
52-
permissions: # These are needed for the configure-aws-credentials action
53-
id-token: write
54-
contents: read
55-
environment: release
56-
strategy:
57-
max-parallel: 20
58-
matrix: ${{fromJson(needs.calculate-changes.outputs.adapter-list)}}
59-
env:
60-
ECR_URL: public.ecr.aws/chainlink
61-
ECR_REPO: adapters/${{ matrix.adapter.shortName }}-adapter
62-
IMAGE_VERSION: ${{ matrix.adapter.version }}
63-
steps:
64-
- uses: actions/checkout@v5
65-
with:
66-
persist-credentials: false
67-
- name: Create ECR for ${{ matrix.adapter.shortName }}
68-
uses: ./.github/actions/create-ecrs
69-
with:
70-
aws-ecr-url: ${{ env.ECR_URL }}
71-
aws-ecr-repo: ${{ env.ECR_REPO }}
72-
aws-region: us-east-1
73-
aws-role: ${{ secrets.AWS_OIDC_IAM_ROLE_ARN }}
74-
aws-ecr-private: false
75-
76-
publish-adapter-images:
77-
name: Fetch and publish ${{ matrix.adapter.shortName }}
78-
runs-on: ubuntu-latest
79-
needs:
80-
- calculate-changes
81-
environment: release
82-
permissions: # These are needed for the configure-aws-credentials action
83-
id-token: write
84-
contents: read
85-
strategy:
86-
max-parallel: 20
87-
matrix: ${{fromJson(needs.calculate-changes.outputs.adapter-list)}}
88-
env:
89-
PUBLIC_ECR_URL: public.ecr.aws/chainlink
90-
PRIVATE_ECR_URL: ${{ secrets.SDLC_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_REGION_ECR_PRIVATE }}.amazonaws.com
91-
ECR_REPO: adapters/${{ matrix.adapter.shortName }}-adapter
92-
steps:
93-
- uses: actions/checkout@v5
94-
with:
95-
persist-credentials: false
96-
- name: Configure AWS Credentials
97-
uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
98-
with:
99-
role-to-assume: ${{ secrets.AWS_OIDC_IAM_ROLE_ARN }}
100-
aws-region: ${{ secrets.AWS_REGION_ECR_PRIVATE }}
101-
mask-aws-account-id: true
102-
- name: Copy images with attestations from private to public ECR
103-
env:
104-
AWS_REGION: ${{ secrets.AWS_REGION_ECR_PRIVATE }}
105-
SOURCE_IMAGE: ${{ env.PRIVATE_ECR_URL }}/${{ env.ECR_REPO }}:${{ matrix.adapter.version }}
106-
DEST_IMAGE: ${{ env.PUBLIC_ECR_URL }}/${{ env.ECR_REPO }}:${{ matrix.adapter.version }}
107-
run: |
108-
PRIVATE_ECR_PASSWORD=$(aws ecr get-login-password --region "${AWS_REGION}")
109-
echo "::add-mask::${PRIVATE_ECR_PASSWORD}"
110-
PUBLIC_ECR_PASSWORD=$(aws ecr-public get-login-password --region us-east-1)
111-
echo "::add-mask::${PUBLIC_ECR_PASSWORD}"
112-
113-
# Copy all architectures, attestations (SBOM, provenance), and signatures
114-
echo "Copying versioned image: ${SOURCE_IMAGE} -> ${DEST_IMAGE}"
115-
skopeo copy \
116-
--all \
117-
--preserve-digests \
118-
--retry-times 3 \
119-
--src-creds AWS:${PRIVATE_ECR_PASSWORD} \
120-
--dest-creds AWS:${PUBLIC_ECR_PASSWORD} \
121-
docker://${SOURCE_IMAGE} \
122-
docker://${DEST_IMAGE}
123-
12424
gh-release:
12525
name: GH Release
12626
runs-on: ubuntu-latest
127-
needs:
128-
- publish-adapter-images
12927
env:
13028
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
13129
steps:

0 commit comments

Comments
 (0)