fix: fix a bug in GitHub Actions matrix variable resolution (#896) #348
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Copyright (c) 2022 - 2023, Oracle and/or its affiliates. All rights reserved. | |
| # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/. | |
| # We run checks on pushing to the specified branches. | |
| # Pushing to main also triggers a release. | |
| name: Check and Release | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - staging | |
| permissions: | |
| contents: read | |
| env: | |
| ARTIFACT_NAME: artifact-ubuntu-latest-python-3.11 | |
| # This is the username and email for the user who commits and pushes the release | |
| # commit. In an organisation that should be a dedicated devops account. | |
| USER_NAME: behnazh-w | |
| USER_EMAIL: [email protected] | |
| IMAGE_NAME: ghcr.io/oracle/macaron | |
| jobs: | |
| check: | |
| if: ${{ !startsWith(github.event.commits[0].message, 'bump:') }} | |
| uses: ./.github/workflows/_build.yaml | |
| permissions: | |
| contents: read | |
| packages: read | |
| # On pushes to the 'main' branch create a new release by bumping the version | |
| # and generating a change log. That's the new bump commit and associated tag. | |
| bump: | |
| needs: check | |
| if: github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 | |
| with: | |
| fetch-depth: 0 | |
| token: ${{ secrets.REPO_ACCESS_TOKEN }} | |
| - name: Set up Python | |
| uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0 | |
| with: | |
| python-version: '3.11' | |
| # Prepare the environment to run commitizen. | |
| - name: Create empty virtual environment for Actions | |
| run: mkdir .venv | |
| - name: Install dependencies | |
| run: make setup-github-actions | |
| - name: Set up user | |
| run: | | |
| git config --global user.name "$USER_NAME" | |
| git config --global user.email "$USER_EMAIL" | |
| git config --list --global # For debug purposes. | |
| # In some cases a user may merge commits that don't cause a version bump, which causes commitizen | |
| # to fail with error code 21 (NoneIncrementExit). Thus we silence that particular error to avoid | |
| # failing this job: https://commitizen-tools.github.io/commitizen/bump/#avoid-raising-errors | |
| - name: Create changelog and bump | |
| run: cz --no-raise 21 bump --changelog --yes | |
| - name: Push the release | |
| run: | | |
| git push | |
| git push --tags | |
| # After the bump commit was pushed to the main branch, rebase the staging branch | |
| # (to_head argument) on top of the new main branch (from_base argument), to keep | |
| # the histories of both branches in sync. | |
| rebase_staging: | |
| needs: [bump] | |
| name: Rebase staging branch on main | |
| uses: ./.github/workflows/_generate-rebase.yaml | |
| permissions: | |
| contents: read | |
| with: | |
| to_head: staging | |
| from_base: origin/main | |
| git_user_name: behnazh-w | |
| git_user_email: [email protected] | |
| secrets: | |
| REPO_ACCESS_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }} | |
| # When triggered by the version bump commit, build the package and publish the release artifacts. | |
| build: | |
| if: github.ref == 'refs/heads/main' && startsWith(github.event.commits[0].message, 'bump:') | |
| uses: ./.github/workflows/_build.yaml | |
| permissions: | |
| contents: read | |
| packages: read | |
| # Create a new Release on GitHub from the verified build artifacts, and optionally | |
| # publish the artifacts to a PyPI server. | |
| release: | |
| needs: [build] | |
| name: Release | |
| outputs: | |
| release-tag: ${{ steps.release-info.outputs.release-tag }} | |
| release-version: ${{ steps.release-info.outputs.release-version }} | |
| release-url: ${{ steps.release-info.outputs.release-url }} | |
| image-name: ${{ steps.push-docker.outputs.image-name }} | |
| image-digest: ${{ steps.push-docker.outputs.image-digest }} | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # To publish release notes. | |
| packages: write # To push the Docker image. | |
| steps: | |
| - name: Check out repository | |
| uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 | |
| with: | |
| fetch-depth: 0 | |
| # Determine the release tag and url, and set them as outputs. | |
| - name: Determine release info | |
| id: release-info | |
| run: | | |
| TAG=$(git describe --tags --abbrev=0) | |
| { | |
| echo "release-tag=$TAG" | |
| echo "release-version=${TAG#v}" | |
| echo "release-url=$(gh release view """$TAG""" --json url --jq .url)" | |
| } >> "$GITHUB_OUTPUT" | |
| - name: Download artifact | |
| uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7 | |
| with: | |
| name: ${{ env.ARTIFACT_NAME }} | |
| path: dist | |
| # Verify hashes by first computing hashes for the artifacts and then comparing them | |
| # against the hashes computed by the build job. | |
| - name: Verify the artifact hash | |
| env: | |
| ARTIFACT_HASH: ${{ needs.build.outputs.artifacts-sha256 }} | |
| run: | | |
| set -euo pipefail | |
| echo "Hash of package should be $ARTIFACT_HASH." | |
| echo "$ARTIFACT_HASH" | base64 --decode | sha256sum --strict --check --status || exit 1 | |
| # Log in to ghcr.io to push the Docker image. | |
| - name: Log in to GitHub Container Registry | |
| run: docker login ghcr.io --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }} | |
| # Build the Docker image with tags: latest and RELEASE_TAG | |
| - name: Build the Docker image | |
| env: | |
| RELEASE_TAG: ${{ steps.release-info.outputs.release-tag }} | |
| run: make build-docker | |
| # Push the Docker image as part of the release pipeline. | |
| - name: Push the Docker image | |
| id: push-docker | |
| env: | |
| RELEASE_TAG: ${{ steps.release-info.outputs.release-tag }} | |
| run: | | |
| make push-docker | |
| IMAGE_AND_DIGEST=$(docker inspect --format='{{index .RepoDigests 0}}' "$IMAGE_NAME") | |
| NAME=$(echo "$IMAGE_AND_DIGEST" | cut -d'@' -f1 | cut -d':' -f1) | |
| DIGEST=$(echo "$IMAGE_AND_DIGEST" | cut -d'@' -f2) | |
| { | |
| echo "image-name=${NAME}" | |
| echo "image-digest=${DIGEST}" | |
| } >> "$GITHUB_OUTPUT" | |
| # Generate the Docker image SBOM under the dist/ directory which will be published as part of the release assets. | |
| - name: Generate Docker sbom | |
| env: | |
| SYFT_BIN: ${{ github.workspace }}/bin | |
| RELEASE_TAG: ${{ steps.release-info.outputs.release-tag }} | |
| RELEASE_VERSION: ${{ steps.release-info.outputs.release-version }} | |
| SYFT_VERSION: 0.84.0 | |
| # We install Syft, which is an SBOM generator tool for Docker images, using the instructions from: | |
| # https://github.com/anchore/syft#installation | |
| # We only generate SBOM in CycloneDX format. | |
| run: | | |
| mkdir -p "$SYFT_BIN" | |
| ASSET_NAME="syft_${SYFT_VERSION}_linux_amd64.tar.gz" | |
| CHECKSUMS="syft_${SYFT_VERSION}_checksums.txt" | |
| # Download artifacts. | |
| echo "Downloading $ASSET_NAME" | |
| curl --output "$ASSET_NAME" --progress-bar --location \ | |
| "https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/${ASSET_NAME}" | |
| test -s "$ASSET_NAME" || (echo "Unable to download $ASSET_NAME" && exit 0) | |
| echo "Downloading $CHECKSUMS" | |
| curl --output "$CHECKSUMS" --progress-bar --location \ | |
| "https://github.com/anchore/syft/releases/download/v${SYFT_VERSION}/${CHECKSUMS}" | |
| test -s "$CHECKSUMS" || (echo "Unable to download $CHECKSUMS" && exit 0) | |
| EXPECTED=$(grep "${ASSET_NAME}" "${CHECKSUMS}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1) | |
| SYFT_DIGEST=$(sha256sum "$ASSET_NAME" | cut -d ' ' -f 1) | |
| # Check if artifact is valid. | |
| if [ "$EXPECTED" == "$SYFT_DIGEST" ]; then | |
| tar -zxvf "$ASSET_NAME" -C "$SYFT_BIN" syft | |
| "$SYFT_BIN"/syft --version | |
| "$SYFT_BIN"/syft \ | |
| ghcr.io/oracle/macaron:"$RELEASE_TAG" \ | |
| -o cyclonedx-json=dist/macaron-"$RELEASE_VERSION"-sbom-docker.json | |
| else | |
| echo "Checksum for '$ASSET_NAME' did not verify: expected $EXPECTED but got $SYFT_DIGEST" | |
| fi | |
| # Remove the downloaded artifacts. | |
| rm -f "$ASSET_NAME" | |
| rm -f "$CHECKSUMS" | |
| - name: Set up Python | |
| uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0 | |
| with: | |
| python-version: '3.11' | |
| # Prepare the environment to run commitizen. | |
| - name: Create empty virtual environment for Actions | |
| run: mkdir .venv | |
| - name: Install dependencies | |
| run: make setup-github-actions | |
| # Create the Release Notes using commitizen. | |
| - name: Create Release Notes | |
| run: cz changelog --dry-run "$(cz version --project)" > RELEASE_NOTES.md | |
| # Create the release including the artifacts and the SLSA L3 provenance. | |
| - name: Upload assets | |
| id: upload-assets | |
| env: | |
| GH_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }} | |
| RELEASE_TAG: ${{ steps.release-info.outputs.release-tag }} | |
| run: gh release create "$RELEASE_TAG" dist/* --title "$RELEASE_TAG" --notes-file RELEASE_NOTES.md | |
| # Uncomment the following steps to publish to a PyPI server. | |
| # At the moment PyPI does not provide a mechanism to publish | |
| # the provenance. So, users have to download the provenance from | |
| # the release page of the GitHub repository to verify the artifact. | |
| # Install Twine without using the package's Makefile to avoid | |
| # installing unnecessary dependencies, which is slow. | |
| # - name: Set up Twine | |
| # run: | | |
| # pip install --upgrade pip wheel | |
| # pip install 'twine ==4.0.1' | |
| # Pass the username, password, and PYPI repository URL via env variables. | |
| # Read the password from GitHub secrets or via other trusted mechanisms. | |
| # Do not hardcode the password in the workflow. | |
| # - name: Publish to PyPI server | |
| # run: twine upload --verbose dist/*.tar.gz dist/*.whl | |
| # env: | |
| # TWINE_USERNAME=<USERNAME> | |
| # TWINE_PASSWORD=<PASSWORD> | |
| # TWINE_REPOSITORY_URL=<REPOSITORY_URL> | |
| # Uncomment the provenance generation once we have approval for running its third-party | |
| # GitHub Actions. See https://github.com/slsa-framework/slsa-github-generator/issues/2204. | |
| # Generate the build provenance. The generator should be referenced with a semantic version. | |
| # The build will fail if we reference it using the commit SHA. To avoid using a pre-built | |
| # provenance generator which depends on an external service Rekor (https://github.com/sigstore/rekor) | |
| # we build this generator from source for now. For more information see this discussion: | |
| # https://github.com/slsa-framework/slsa-github-generator/issues/942 | |
| # provenance: | |
| # needs: [build, release] | |
| # uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected] | |
| # with: | |
| # base64-subjects: ${{ needs.build.outputs.artifacts-sha256 }} | |
| # compile-generator: true # Build the generator from source. | |
| # # Set private-repository to true for private repositories. Note that the repository name is | |
| # # uploaded as part of the transparency log entry on the public Rekor instance (rekor.sigstore.dev). | |
| # private-repository: false | |
| # provenance-name: macaron-${{ needs.release.outputs.release-version }}.intoto.jsonl | |
| # permissions: | |
| # actions: read # To read the workflow path. | |
| # id-token: write # To sign the provenance. | |
| # contents: write # To add assets to a release. | |
| # Generate SLSA provenance for the Docker image and push it to the container registry. | |
| # provenance-docker: | |
| # needs: [release] | |
| # permissions: | |
| # actions: read # To detect the GitHub Actions environment. | |
| # id-token: write # To create OIDC tokens for signing. | |
| # packages: write # To upload provenance. | |
| # uses: slsa-framework/slsa-github-generator/.github/workflows/[email protected] | |
| # with: | |
| # image: ${{ needs.release.outputs.image-name }} | |
| # digest: ${{ needs.release.outputs.image-digest }} | |
| # registry-username: ${{ github.actor }} | |
| # secrets: | |
| # registry-password: ${{ secrets.GITHUB_TOKEN }} | |
| # Publish the SLSA provenance as the GitHub release asset. | |
| # publish_provenance: | |
| # needs: [release, provenance] | |
| # name: Publish provenance | |
| # runs-on: ubuntu-latest | |
| # permissions: | |
| # contents: write # To publish release notes. | |
| # steps: | |
| # - name: Check out repository | |
| # uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0 | |
| # with: | |
| # fetch-depth: 0 | |
| # - name: Download provenance | |
| # uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7 | |
| # with: | |
| # name: ${{ needs.provenance.outputs.provenance-name }} | |
| # - name: Upload provenance | |
| # run: gh release upload ${{ needs.release.outputs.release-tag }} ${{ needs.provenance.outputs.provenance-name }} | |
| # env: | |
| # GH_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }} | |
| # Publish docs to GitHub pages. | |
| github-pages: | |
| needs: [build, release] | |
| name: Deploy GitHub pages | |
| uses: ./.github/workflows/_deploy-github-pages.yaml | |
| permissions: | |
| contents: read | |
| pages: write | |
| id-token: write | |
| with: | |
| # TODO: use ${{ env.ARTIFACT_NAME }} when this issue is addressed: | |
| # https://github.com/actions/runner/issues/2394. | |
| artifact-name: artifact-ubuntu-latest-python-3.11 | |
| artifact-sha256: ${{ needs.build.outputs.artifacts-sha256 }} | |
| # Send out release notifications after the Release was published on GitHub. | |
| # Uncomment the `if` to disable sending release notifications. | |
| notifications: | |
| if: ${{ false }} | |
| needs: [release] | |
| name: Send Release notifications | |
| uses: ./.github/workflows/_release-notifications.yaml | |
| permissions: | |
| contents: read | |
| with: | |
| repo_name: ${{ github.event.repository.name }} | |
| release_tag: ${{ needs.release.outputs.release-tag }} | |
| release_url: ${{ needs.release.outputs.release-url }} | |
| secrets: | |
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }} |