Skip to content

Commit f7c550e

Browse files
jdisantijdisanti
authored
Fix CI for forks by moving merge queue runs into a separate workflow (#2359)
1 parent 9ecd7f0 commit f7c550e

File tree

2 files changed

+96
-5
lines changed

2 files changed

+96
-5
lines changed

‎.github/workflows/ci-merge-queue.yml

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
# This workflow runs CI for the GitHub merge queue.
5+
6+
name: Merge Queue CI
7+
on:
8+
merge_group:
9+
types: [checks_requested]
10+
11+
# Allow one instance of this workflow per merge
12+
concurrency:
13+
group: ci-merge-queue-yml-${{ github.ref }}
14+
cancel-in-progress: true
15+
16+
env:
17+
ecr_repository: public.ecr.aws/w0m4q9l7/github-awslabs-smithy-rs-ci
18+
19+
jobs:
20+
# This job will, if possible, save a docker login password to the job outputs. The token will
21+
# be encrypted with the passphrase stored as a GitHub secret. The login password expires after 12h.
22+
# The login password is encrypted with the repo secret DOCKER_LOGIN_TOKEN_PASSPHRASE
23+
save-docker-login-token:
24+
name: Save a docker login token
25+
outputs:
26+
docker-login-password: ${{ steps.set-token.outputs.docker-login-password }}
27+
permissions:
28+
id-token: write
29+
contents: read
30+
continue-on-error: true
31+
runs-on: ubuntu-latest
32+
steps:
33+
- name: Attempt to load a docker login password
34+
uses: aws-actions/configure-aws-credentials@v1-node16
35+
with:
36+
role-to-assume: ${{ secrets.SMITHY_RS_PUBLIC_ECR_PUSH_ROLE_ARN }}
37+
role-session-name: GitHubActions
38+
aws-region: us-west-2
39+
- name: Save the docker login password to the output
40+
id: set-token
41+
run: |
42+
ENCRYPTED_PAYLOAD=$(
43+
gpg --symmetric --batch --passphrase "${{ secrets.DOCKER_LOGIN_TOKEN_PASSPHRASE }}" --output - <(aws ecr-public get-login-password --region us-east-1) | base64 -w0
44+
)
45+
echo "docker-login-password=$ENCRYPTED_PAYLOAD" >> $GITHUB_OUTPUT
46+
47+
# This job detects if the PR made changes to build tools. If it did, then it builds a new
48+
# build Docker image. Otherwise, it downloads a build image from Public ECR. In both cases,
49+
# it uploads the image as a build artifact for other jobs to download and use.
50+
acquire-base-image:
51+
name: Acquire Base Image
52+
needs: save-docker-login-token
53+
runs-on: ubuntu-latest
54+
env:
55+
ENCRYPTED_DOCKER_PASSWORD: ${{ needs.save-docker-login-token.outputs.docker-login-password }}
56+
DOCKER_LOGIN_TOKEN_PASSPHRASE: ${{ secrets.DOCKER_LOGIN_TOKEN_PASSPHRASE }}
57+
permissions:
58+
id-token: write
59+
contents: read
60+
steps:
61+
- uses: actions/checkout@v3
62+
with:
63+
path: smithy-rs
64+
- name: Acquire base image
65+
id: acquire
66+
env:
67+
DOCKER_BUILDKIT: 1
68+
run: ./smithy-rs/.github/scripts/acquire-build-image
69+
- name: Acquire credentials
70+
uses: aws-actions/configure-aws-credentials@v1-node16
71+
with:
72+
role-to-assume: ${{ secrets.SMITHY_RS_PUBLIC_ECR_PUSH_ROLE_ARN }}
73+
role-session-name: GitHubActions
74+
aws-region: us-west-2
75+
- name: Upload image
76+
run: |
77+
IMAGE_TAG="$(./smithy-rs/.github/scripts/docker-image-hash)"
78+
docker tag "smithy-rs-base-image:${IMAGE_TAG}" "${{ env.ecr_repository }}:${IMAGE_TAG}"
79+
aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws
80+
docker push "${{ env.ecr_repository }}:${IMAGE_TAG}"
81+
82+
# Run shared CI after the Docker build image has either been rebuilt or found in ECR
83+
ci:
84+
needs:
85+
- save-docker-login-token
86+
- acquire-base-image
87+
if: ${{ github.event.pull_request.head.repo.full_name == 'awslabs/smithy-rs' || toJSON(github.event.merge_group) != '{}' }}
88+
uses: ./.github/workflows/ci.yml
89+
with:
90+
run_sdk_examples: true
91+
secrets:
92+
ENCRYPTED_DOCKER_PASSWORD: ${{ needs.save-docker-login-token.outputs.docker-login-password }}
93+
DOCKER_LOGIN_TOKEN_PASSPHRASE: ${{ secrets.DOCKER_LOGIN_TOKEN_PASSPHRASE }}

‎.github/workflows/ci-pr.yml

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,6 @@
66
name: CI
77
on:
88
pull_request:
9-
merge_group:
10-
types: [checks_requested]
119

1210
# Allow one instance of this workflow per pull request, and cancel older runs when new changes are pushed
1311
concurrency:
@@ -23,7 +21,7 @@ jobs:
2321
# The login password is encrypted with the repo secret DOCKER_LOGIN_TOKEN_PASSPHRASE
2422
save-docker-login-token:
2523
name: Save a docker login token
26-
if: ${{ github.event.pull_request.head.repo.full_name == 'awslabs/smithy-rs' || toJSON(github.event.merge_group) != '{}' }}
24+
if: ${{ github.event.pull_request.head.repo.full_name == 'awslabs/smithy-rs' }}
2725
outputs:
2826
docker-login-password: ${{ steps.set-token.outputs.docker-login-password }}
2927
permissions:
@@ -53,7 +51,7 @@ jobs:
5351
acquire-base-image:
5452
name: Acquire Base Image
5553
needs: save-docker-login-token
56-
if: ${{ github.event.pull_request.head.repo.full_name == 'awslabs/smithy-rs' || toJSON(github.event.merge_group) != '{}' }}
54+
if: ${{ github.event.pull_request.head.repo.full_name == 'awslabs/smithy-rs' }}
5755
runs-on: ubuntu-latest
5856
env:
5957
ENCRYPTED_DOCKER_PASSWORD: ${{ needs.save-docker-login-token.outputs.docker-login-password }}
@@ -88,7 +86,7 @@ jobs:
8886
needs:
8987
- save-docker-login-token
9088
- acquire-base-image
91-
if: ${{ github.event.pull_request.head.repo.full_name == 'awslabs/smithy-rs' || toJSON(github.event.merge_group) != '{}' }}
89+
if: ${{ github.event.pull_request.head.repo.full_name == 'awslabs/smithy-rs' }}
9290
uses: ./.github/workflows/ci.yml
9391
with:
9492
run_sdk_examples: true

0 commit comments

Comments
 (0)