Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 9 additions & 6 deletions .github/workflows/build.yaml
Original file line number Diff line number Diff line change
@@ -1,7 +1,10 @@
name: Build Pipeline
run-name: Build ${{ github.event.inputs.pipeline_name }}
run-name: Build ${{ github.event.inputs.pipeline_name || 'workbench-ui' }}

on:
push:
branches:
- console
workflow_dispatch:
inputs:
pipeline_name:
Expand Down Expand Up @@ -31,105 +34,105 @@

jobs:
resolve-config:
name: Resolve ${{ github.event.inputs.pipeline_name }} config
name: Resolve ${{ github.event.inputs.pipeline_name || 'workbench-ui' }} config
runs-on: ubuntu-latest
outputs:
work_dir: ${{ steps.setenv.outputs.work_dir }}
image_name: ${{ steps.setenv.outputs.image_name }}
dockerfile: ${{ steps.setenv.outputs.dockerfile }}
tag: ${{ steps.tag.outputs.tag }}
steps:
- name: Checkout Code
uses: actions/checkout@v3

- name: Install yq
run: |
VERSION="4.30.8"
URL="https://github.com/mikefarah/yq/releases/download/v${VERSION}/yq_linux_amd64"
sudo curl -sSL "$URL" -o /usr/local/bin/yq
sudo chmod +x /usr/local/bin/yq

- name: Resolve env from build-config.yml
id: setenv
run: |
PIPELINE_NAME="${{ github.event.inputs.pipeline_name }}"
PIPELINE_NAME="${{ github.event.inputs.pipeline_name || 'workbench-ui' }}"
DEFAULT_DOCKERFILE="Dockerfile"
echo "### Pipeline Name - $PIPELINE_NAME" >> $GITHUB_STEP_SUMMARY

# Find exactly one matching config block
MATCHING_CONFIGS=$(yq eval -o=json '.config[] | select(.name | test("/'"$PIPELINE_NAME"'$"))' build/build-config.yml)
MATCH_COUNT=$(echo "$MATCHING_CONFIGS" | jq -s 'length')
if [ "$MATCH_COUNT" -ne 1 ]; then
echo "ERROR: Expected exactly 1 matching pipeline config, but found $MATCH_COUNT"
exit 1
fi

# Extract fields
SERVICE_BUILD_CONFIG=$(echo "$MATCHING_CONFIGS" | jq -c '.build[] | select(.["image-name"])')
SERVICE_WORK_DIR=$(echo "$SERVICE_BUILD_CONFIG" | yq eval -r '.["work-dir"] // ""' -)
SERVICE_IMAGE_NAME=$(echo "$SERVICE_BUILD_CONFIG" | yq eval -r '.["image-name"] // ""' -)
SERVICE_DOCKERFILE=$(echo "$SERVICE_BUILD_CONFIG" | yq eval -r '.dockerfile // ""' -)

# Default Dockerfile if none specified
if [ -z "$SERVICE_DOCKERFILE" ]; then
SERVICE_DOCKERFILE="$SERVICE_WORK_DIR/$DEFAULT_DOCKERFILE"
fi

# Export
echo "SERVICE_WORK_DIR=$SERVICE_WORK_DIR" >> "$GITHUB_ENV"
echo "SERVICE_IMAGE_NAME=$SERVICE_IMAGE_NAME" >> "$GITHUB_ENV"
echo "SERVICE_DOCKERFILE=$SERVICE_DOCKERFILE" >> "$GITHUB_ENV"
echo "work_dir=$SERVICE_WORK_DIR" >> $GITHUB_OUTPUT
echo "image_name=$SERVICE_IMAGE_NAME" >> $GITHUB_OUTPUT
echo "dockerfile=$SERVICE_DOCKERFILE" >> $GITHUB_OUTPUT

# Put summary for the step
echo "#### Application Config Summary" >> $GITHUB_STEP_SUMMARY
echo "Application Work Directory - $SERVICE_WORK_DIR" >> $GITHUB_STEP_SUMMARY
echo "Image Name - $SERVICE_IMAGE_NAME" >> $GITHUB_STEP_SUMMARY
echo "Dockerfile Path - $SERVICE_DOCKERFILE" >> $GITHUB_STEP_SUMMARY

- name: Generate the Next Tag
id: tag
run: |
set -euxo pipefail
BRANCH="${GITHUB_REF##*/}"
COMMIT_HASH=$(git rev-parse --short HEAD)
SERVICE_NAME="${{ env.SERVICE_IMAGE_NAME }}"

TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \
-H "Content-Type: application/json" \
-d "{\"username\": \"$DOCKER_USERNAME\", \"password\": \"$DOCKER_PASSWORD\"}" \
| jq -r .token)

if [ -z "$TOKEN" ]; then
echo "Failed to authenticate with Docker Hub." >&2
exit 1
fi

# Check if repo exists
HTTP_CODE=$(curl -s -o /dev/null -w '%{http_code}' \
-H "Authorization: JWT $TOKEN" \
"https://hub.docker.com/v2/repositories/$DOCKER_USERNAME/$SERVICE_NAME/")

if [ "$HTTP_CODE" -ne 200 ]; then
NEXT_TAG="${BRANCH}-${COMMIT_HASH}"
else
EXISTING_TAGS=$(curl -s -H "Authorization: JWT $TOKEN" \
"https://hub.docker.com/v2/repositories/$DOCKER_USERNAME/$SERVICE_NAME/tags?page_size=100" \
| jq -r '.results[].name')
LATEST_TAG=$(echo "$EXISTING_TAGS" \
| grep "^${BRANCH}-${COMMIT_HASH}" || true \
| sort -V \
| tail -n 1)
NEXT_TAG="${LATEST_TAG:-${BRANCH}-${COMMIT_HASH}}"
fi

echo "tag=$NEXT_TAG" >> "$GITHUB_OUTPUT"
echo "NEXT_TAG=$NEXT_TAG" >> "$GITHUB_ENV"
echo "tag - $NEXT_TAG" >> $GITHUB_STEP_SUMMARY

build-matrix:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
name: Build application ${{ matrix.arch }}
needs: [resolve-config]
strategy:
Expand All @@ -156,9 +159,9 @@
uses: actions/cache@v3
with:
path: /tmp/.buildx-cache
key: ${{ runner.os }}-${{ matrix.arch }}-buildx-${{ github.event.inputs.pipeline_name }}-${{ github.ref_name }}
key: ${{ runner.os }}-${{ matrix.arch }}-buildx-${{ github.event.inputs.pipeline_name || 'workbench-ui' }}-${{ github.ref_name }}
restore-keys: |
${{ runner.os }}-${{ matrix.arch }}-buildx-${{ github.event.inputs.pipeline_name }}-
${{ runner.os }}-${{ matrix.arch }}-buildx-${{ github.event.inputs.pipeline_name || 'workbench-ui' }}-

- name: Log in to Docker Hub
uses: docker/login-action@v2
Expand Down Expand Up @@ -227,4 +230,4 @@
- name: Add summary to GitHub Actions
run: |
echo "- Image: egovio/${{ needs.resolve-config.outputs.image_name }}:${{ needs.resolve-config.outputs.tag }}" >> $GITHUB_STEP_SUMMARY
echo "- Platform: amd64, arm64" >> $GITHUB_STEP_SUMMARY
echo "- Platform: amd64, arm64" >> $GITHUB_STEP_SUMMARY