forked from bitnami/charts
-
Notifications
You must be signed in to change notification settings - Fork 0
183 lines (180 loc) · 8.59 KB
/
ci-pipeline.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
name: '[CI/CD] CI Pipeline'
on: # rebuild any PRs and main branch changes
pull_request_target:
types:
- opened
- reopened
- synchronize
- labeled
branches:
- main
- bitnami:main
# Remove all permissions by default
permissions: {}
env:
CSP_API_URL: https://console.cloud.vmware.com
CSP_API_TOKEN: ${{ secrets.CSP_API_TESTING_TOKEN }}
VIB_PUBLIC_URL: https://cp.bromelia.vmware.com
# Avoid concurrency over the same PR
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
jobs:
get-chart:
runs-on: ubuntu-latest
name: Get modified charts
permissions:
contents: read
if: ${{ github.event.pull_request.state != 'closed' }}
outputs:
chart: ${{ steps.get-chart.outputs.chart }}
result: ${{ steps.get-chart.outputs.result }}
steps:
- name: Install dependencies
run: sudo apt-get install -y patchutils
- id: get-chart
name: Get modified charts
env:
DIFF_URL: "${{github.event.pull_request.diff_url}}"
TEMP_FILE: "${{runner.temp}}/pr-${{github.event.number}}.diff"
run: |
# This request doesn't consume API calls.
curl -Lkso $TEMP_FILE $DIFF_URL
files_changed="$(sed -nr 's/[\-\+]{3} [ab]\/(.*)/\1/p' $TEMP_FILE | sort | uniq)"
# Adding || true to avoid "Process exited with code 1" errors
charts_dirs_changed="$(echo "$files_changed" | xargs dirname | grep -o "bitnami/[^/]*" | sort | uniq || true)"
# Using grep -c as a better alternative to wc -l when dealing with empty strings."
num_charts_changed="$(echo "$charts_dirs_changed" | grep -c "bitnami" || true)"
num_version_bumps="$(filterdiff -s -i "*Chart.yaml" $TEMP_FILE | grep -c "+version" || true)"
non_readme_files=$(echo "$files_changed" | grep -vc "\.md" || true)
if [[ "$non_readme_files" -le "0" ]]; then
# The only changes are .md files -> SKIP
echo "result=skip" >> $GITHUB_OUTPUT
elif [[ "$num_charts_changed" -ne "$num_version_bumps" ]]; then
# Changes done in charts but version not bumped -> ERROR
charts_changed_str="$(echo ${charts_dirs_changed[@]})"
echo "error=Detected changes in charts without version bump in Chart.yaml. Charts changed: ${num_charts_changed} ${charts_changed_str}. Version bumps detected: ${num_version_bumps}" >> $GITHUB_OUTPUT
echo "result=fail" >> $GITHUB_OUTPUT
elif [[ "$num_charts_changed" -eq "1" ]]; then
# Changes done in only one chart -> OK
chart_name=$(echo "$charts_dirs_changed" | sed "s|bitnami/||g")
echo "chart=${chart_name}" >> $GITHUB_OUTPUT
echo "result=ok" >> $GITHUB_OUTPUT
elif [[ "$num_charts_changed" -le "0" ]]; then
# Changes done in the bitnami/ folder but not inside a chart subfolder -> SKIP
echo "error=No changes detected in charts. The rest of the tests will be skipped." >> $GITHUB_OUTPUT
echo "result=skip" >> $GITHUB_OUTPUT
else
# Changes done in more than chart -> SKIP
charts_changed_str="$(echo ${charts_dirs_changed[@]})"
echo "error=Changes detected in more than one chart directory: ${charts_changed_str}. It is strongly advised to change only one chart in a PR. The rest of the tests will be skipped." >> $GITHUB_OUTPUT
echo "result=skip" >> $GITHUB_OUTPUT
fi
# Using actions/github-scripts because using exit 1 in the script above would not provide any output
# Source: https://github.community/t/no-output-on-process-completed-with-exit-code-1/123821/3
- id: show-error
name: Show error
if: ${{ steps.get-chart.outputs.result != 'ok' }}
uses: actions/github-script@v6
with:
script: |
let message='${{ steps.get-chart.outputs.error }}';
if ('${{ steps.get-chart.outputs.result }}' === 'fail' ) {
core.setFailed(message);
} else {
core.warning(message);
}
vib-verify:
runs-on: ubuntu-latest
needs: get-chart
permissions:
contents: read
# Given performance issues of the action feature on GH's side, we need to be very restrictive in the job's triggers:
# -> The 'Get modified charts' job suceededs AND
# ( ---> The pipeline was triggered due to a label addition and said label was the 'verify' one OR
# ---> the PR already contains the 'verify' label )
if: |
needs.get-chart.outputs.result == 'ok' &&
(
contains(github.event.pull_request.labels.*.name, 'verify') || (github.event.action == 'labeled' && github.event.label.name == 'verify')
)
name: VIB Verify
steps:
- uses: actions/checkout@v3
name: Checkout Repository
with:
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}
- id: get-asset-vib-config
name: Get asset-specific configuration for VIB action
run: |
config_file=".vib/${{ needs.get-chart.outputs.chart }}/vib-action.config"
# Supported configuration customizations and default values
verification_mode="PARALLEL"
if [[ -f $config_file ]]; then
verification_mode="$(cat $config_file | grep 'verification-mode' | cut -d'=' -f2)"
fi
runtime_parameters_file=""
if [[ -f ".vib/${{ needs.get-chart.outputs.chart }}/runtime-parameters.yaml" ]]; then
# The path is relative to the .vib folder
runtime_parameters_file="${{ needs.get-chart.outputs.chart }}/runtime-parameters.yaml"
fi
echo "verification_mode=${verification_mode}" >> $GITHUB_OUTPUT
echo "runtime_parameters_file=${runtime_parameters_file}" >> $GITHUB_OUTPUT
- uses: vmware-labs/vmware-image-builder-action@v0
name: Verify ${{ needs.get-chart.outputs.chart }}
with:
pipeline: ${{ needs.get-chart.outputs.chart }}/vib-verify.json
verification-mode: ${{ steps.get-asset-vib-config.outputs.verification_mode }}
runtime-parameters-file: ${{ steps.get-asset-vib-config.outputs.runtime_parameters_file }}
env:
# Target-Platform used by default
VIB_ENV_TARGET_PLATFORM: ${{ secrets.VIB_ENV_TARGET_PLATFORM }}
# Alternative Target-Platform to be used in case of incompatibilities
VIB_ENV_ALTERNATIVE_TARGET_PLATFORM: ${{ secrets.VIB_ENV_ALTERNATIVE_TARGET_PLATFORM }}
auto-pr-review:
runs-on: ubuntu-latest
needs: vib-verify
name: Reviewal for automated PRs
permissions:
pull-requests: write
# Job to be run only when the triage for automated PRs did as well,
# not taking into account whether 'VIB Verify' succeeded
if: |
always() &&
contains(github.event.pull_request.labels.*.name, 'auto-merge') &&
github.event.pull_request.user.login == 'bitnami-bot'
steps:
# Approve the CI's PR if the 'VIB Verify' job succeeded
# Approved by the 'github-actions' user; a PR can't be approved by its author
- name: PR approval
if: ${{ needs.vib-verify.result == 'success' }}
uses: hmarr/[email protected]
with:
pull-request-number: ${{ github.event.number }}
- name: Merge
id: merge
if: ${{ needs.vib-verify.result == 'success' }}
uses: actions/github-script@v6
with:
result-encoding: string
retries: 3
github-token: ${{ secrets.BITNAMI_BOT_TOKEN }}
script: |
github.rest.pulls.merge({
pull_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
merge_method: 'squash'
})
# If the CI did not succeed ('VIB Verify' failed or skipped),
# post a comment on the PR and assign a maintainer agent to review it
- name: Manual review required
if: ${{ always() && (needs.vib-verify.result != 'success' || steps.merge.outcome != 'success' ) }}
uses: peter-evans/[email protected]
with:
issue-number: ${{ github.event.number }}
# Necessary to trigger support workflows
token: ${{ secrets.BITNAMI_BOT_TOKEN }}
body: |
There has been an error during the automated release process. Manual revision is now required.
Please check the related [action_run#${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more information.