diff --git a/.github/workflows/dev_dbt.yaml b/.github/workflows/dev_dbt.yaml index 3395e2eb..fca4a7ae 100644 --- a/.github/workflows/dev_dbt.yaml +++ b/.github/workflows/dev_dbt.yaml @@ -1,5 +1,6 @@ --- name: Build and publish dbt-demo +permissions: {} on: workflow_dispatch: @@ -12,11 +13,15 @@ on: - demos/airflow-scheduled-job/dbt/Dockerfile - demos/airflow-scheduled-job/dbt/requirements.txt - .github/workflows/dev_dbt.yaml + - .github/workflows/reusable_build_image.yaml jobs: build_image: name: Reusable Workflow uses: ./.github/workflows/reusable_build_image.yaml + permissions: + contents: read + id-token: write # Needed for cosign keyless signing in the reusable workflow secrets: harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_DEMOS_GITHUB_ACTION_BUILD_SECRET }} slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }} diff --git a/.github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml b/.github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml index 3216ef36..b29f4335 100644 --- a/.github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml +++ b/.github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml @@ -1,5 +1,6 @@ --- name: Build and publish jupyter-pyspark-with-alibi-detect +permissions: {} on: workflow_dispatch: @@ -12,11 +13,15 @@ on: - demos/signal-processing/Dockerfile-jupyter - demos/signal-processing/requirements.txt - .github/workflows/dev_jupyter-pyspark-with-alibi-detect.yaml + - .github/workflows/reusable_build_image.yaml jobs: build_image: name: Reusable Workflow uses: ./.github/workflows/reusable_build_image.yaml + permissions: + contents: read + id-token: write # Needed for cosign keyless signing in the reusable workflow secrets: harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_DEMOS_GITHUB_ACTION_BUILD_SECRET }} slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }} diff --git a/.github/workflows/dev_jupyterhub-keycloak-spark.yaml b/.github/workflows/dev_jupyterhub-keycloak-spark.yaml index 97e3c241..74ea2d2e 100644 --- a/.github/workflows/dev_jupyterhub-keycloak-spark.yaml +++ b/.github/workflows/dev_jupyterhub-keycloak-spark.yaml @@ -1,5 +1,6 @@ --- name: Build and publish Spark for jupyterhub-keycloak demo +permissions: {} on: workflow_dispatch: @@ -13,11 +14,15 @@ on: paths: - demos/jupyterhub-keycloak/Dockerfile - .github/workflows/dev_jupyterhub-keycloak-spark.yaml + - .github/workflows/reusable_build_image.yaml jobs: build_image: name: Reusable Workflow uses: ./.github/workflows/reusable_build_image.yaml + permissions: + contents: read + id-token: write # Needed for cosign keyless signing in the reusable workflow secrets: harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_DEMOS_GITHUB_ACTION_BUILD_SECRET }} slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }} diff --git a/.github/workflows/dev_nifi.yaml b/.github/workflows/dev_nifi.yaml index b7598bf1..0d8c5447 100644 --- a/.github/workflows/dev_nifi.yaml +++ b/.github/workflows/dev_nifi.yaml @@ -1,5 +1,6 @@ --- name: Build and publish NiFi for signal-processing demo +permissions: {} on: workflow_dispatch: @@ -13,11 +14,15 @@ on: paths: - demos/signal-processing/Dockerfile-nifi - .github/workflows/dev_nifi.yaml + - .github/workflows/reusable_build_image.yaml jobs: build_image: name: Reusable Workflow uses: ./.github/workflows/reusable_build_image.yaml + permissions: + contents: read + id-token: write # Needed for cosign keyless signing in the reusable workflow secrets: harbor-robot-secret: ${{ secrets.HARBOR_ROBOT_DEMOS_GITHUB_ACTION_BUILD_SECRET }} slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }} diff --git a/.github/workflows/pr_pre-commit.yml b/.github/workflows/pr_pre-commit.yml deleted file mode 100644 index b66abb08..00000000 --- a/.github/workflows/pr_pre-commit.yml +++ /dev/null @@ -1,18 +0,0 @@ ---- -name: pre-commit - -on: - pull_request: - merge_group: - -permissions: {} - -jobs: - pre-commit: - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 - with: - persist-credentials: false - fetch-depth: 0 - - uses: stackabletech/actions/run-pre-commit@4bfd3b65f22af597fe784599c077dc34bf5894a7 # v0.8.0 diff --git a/.github/workflows/pr_prek.yml b/.github/workflows/pr_prek.yml new file mode 100644 index 00000000..8c618ce1 --- /dev/null +++ b/.github/workflows/pr_prek.yml @@ -0,0 +1,19 @@ +--- +name: prek +permissions: {} + +on: + pull_request: + merge_group: + +jobs: + prek: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + fetch-depth: 0 + - uses: stackabletech/actions/run-prek@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 diff --git a/.github/workflows/reusable_build_image.yaml b/.github/workflows/reusable_build_image.yaml index a35bf813..1544e57f 100644 --- a/.github/workflows/reusable_build_image.yaml +++ b/.github/workflows/reusable_build_image.yaml @@ -19,20 +19,23 @@ on: description: The Slack token used to post failure notifications required: true +permissions: {} + jobs: build: name: Build/Publish ${{ inputs.image-version }}-${{ matrix.runner.arch }} Image permissions: - id-token: write + contents: read + id-token: write # Needed for cosign keyless signing in publish-image runs-on: ${{ matrix.runner.name }} strategy: matrix: runner: - - {name: "ubuntu-latest", arch: "amd64"} - - {name: "ubicloud-standard-8-arm", arch: "arm64"} + - { name: "ubuntu-latest", arch: "amd64" } + - { name: "ubicloud-standard-8-arm", arch: "arm64" } steps: - name: Checkout Repository - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -42,7 +45,7 @@ jobs: CONTAINERFILE_PATH: ${{ inputs.containerfile-path }} IMAGE_VERSION: ${{ inputs.image-version }} IMAGE_NAME: ${{ inputs.image-name }} - uses: stackabletech/actions/build-container-image@4bfd3b65f22af597fe784599c077dc34bf5894a7 # v0.8.0 + uses: stackabletech/actions/build-container-image@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 with: image-name: ${{ env.IMAGE_NAME }} image-index-manifest-tag: ${{ env.IMAGE_VERSION }} @@ -51,24 +54,26 @@ jobs: - name: Publish Container Image on oci.stackable.tech env: IMAGE_NAME: ${{ inputs.image-name }} - uses: stackabletech/actions/publish-image@4bfd3b65f22af597fe784599c077dc34bf5894a7 # v0.8.0 + uses: stackabletech/actions/publish-image@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 with: image-registry-uri: oci.stackable.tech image-registry-username: robot$demos+github-action-build image-registry-password: ${{ secrets.harbor-robot-secret }} image-repository: demos/${{ env.IMAGE_NAME }} image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }} - source-image-uri: ${{ steps.build.outputs.image-manifest-uri }} + canonical-image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }} + canonical-source-image-uri: ${{ steps.build.outputs.image-manifest-uri }} publish_manifests: name: Build/Publish Manifest needs: [build] permissions: - id-token: write + contents: read + id-token: write # Needed for cosign keyless signing in publish-image-index-manifest runs-on: ubuntu-latest steps: - name: Checkout Repository - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false @@ -76,51 +81,24 @@ jobs: env: IMAGE_VERSION: ${{ inputs.image-version }} IMAGE_NAME: ${{ inputs.image-name }} - uses: stackabletech/actions/publish-index-manifest@4bfd3b65f22af597fe784599c077dc34bf5894a7 # v0.8.0 + uses: stackabletech/actions/publish-image-index-manifest@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 with: image-registry-uri: oci.stackable.tech image-registry-username: robot$demos+github-action-build image-registry-password: ${{ secrets.harbor-robot-secret }} image-repository: demos/${{ env.IMAGE_NAME }} - image-index-manifest-tag: ${{ env.IMAGE_VERSION }} + canonical-image-index-manifest-tag: ${{ env.IMAGE_VERSION }} notify: name: Failure Notification needs: [build, publish_manifests] runs-on: ubuntu-latest - if: failure() + if: failure() || (github.run_attempt > 1 && !cancelled()) steps: - - uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0 # v1.27.0 + - uses: stackabletech/actions/send-slack-notification@e8aed001d347bcf693e41b61f4098b0cb94b4ab6 # v0.18.0 with: + publish-manifests-result: ${{ needs.publish_manifests.result }} + build-result: ${{ needs.build.result }} + slack-token: ${{ secrets.slack-token }} + type: container-image-build channel-id: "C07UG6JH44F" # notifications-container-images - payload: | - { - "text": "*${{ github.workflow }}* failed (attempt ${{ github.run_attempt }})", - "attachments": [ - { - "pretext": "See the details below for a summary of which job(s) failed.", - "color": "#aa0000", - "fields": [ - { - "title": "Build/Publish Image", - "short": true, - "value": "${{ needs.build.result }}" - }, - { - "title": "Build/Publish Manifests", - "short": true, - "value": "${{ needs.publish_manifests.result }}" - } - ], - "actions": [ - { - "type": "button", - "text": "Go to workflow run", - "url": "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}/attempts/${{ github.run_attempt }}" - } - ] - } - ] - } - env: - SLACK_BOT_TOKEN: ${{ secrets.slack-token }}