From 30b24681ee6e11d175325d85ebe219a75993a063 Mon Sep 17 00:00:00 2001 From: jakeymac Date: Thu, 21 Aug 2025 18:14:59 -0600 Subject: [PATCH 1/7] Updated to use github registry --- .github/workflows/build.yml | 132 ++++++++++++--------- .github/workflows/deploy_to_production.yml | 5 +- .github/workflows/deploy_to_staging.yml | 5 +- 3 files changed, 81 insertions(+), 61 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c553d25..e8769ef 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -1,62 +1,66 @@ # CI Pipeline -name: Build +name: Build -on: - push: +on: + push: branches: - "*" - tags: + tags: - "*" - pull_request: branches: - "*" +permissions: + contents: read + packages: write + env: HELM_REPO_URL: https://eccr.ecmwf.int HELM_CHART: ${{ github.workspace }}/helm/gsprestapi + HELM_REPO_USERNAME: ${{ secrets.HELM_REPO_USERNAME }} HELM_KEY_PASSPHRASE: ${{ secrets.HELM_KEY_PASSPHRASE }} HELM_REPO_PASSWORD: ${{ secrets.HELM_REPO_PASSWORD }} - CI_REGISTRY: docker.aquaveo.com - CI_REGISTRY_USER: ${{ secrets.CI_REGISTRY_USER }} - CI_REGISTRY_PASSWORD: ${{ secrets.CI_REGISTRY_PASSWORD }} - CI_REGISTRY_IMAGE: docker.aquaveo.com/tethys/gsprestapi + + CI_REGISTRY: ghcr.io + CI_REGISTRY_IMAGE: ghcr.io/aquaveo/gsprestapi + CI_COMMIT_SHORT_SHA: ${{ github.sha }} + ECCR_USER: ${{ secrets.ECCR_USER }} ECCR_PASSWORD: ${{ secrets.ECCR_PASSWORD }} + KANIKO_IMAGE: gcr.io/kaniko-project/executor:debug KANIKO_CONTEXT: /workspace KANIKO_DOCKERFILE: Dockerfile - jobs: - check-helm: - name: Check Helm - runs-on: ubuntu-latest - steps: - - name: Checkout repository - uses: actions/checkout@v4 - with: - submodules: false - - - name: Ensure HELM_CHART is set - run: | - if [[ -z "${HELM_CHART}" ]]; then - echo "HELM_CHART must be set" >&2 - exit 1 - fi - - - name: Lint Helm Chart - run: helm lint $HELM_CHART - - - name: Run Check Helm Script - run: | - chmod +x ./check_helm_chart - ./check_helm_chart $HELM_CHART - - - update-helm: + check-helm: + name: Check Helm + runs-on: ubuntu-latest + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + submodules: false + + - name: Ensure HELM_CHART is set + run: | + if [[ -z "${HELM_CHART}" ]]; then + echo "HELM_CHART must be set" >&2 + exit 1 + fi + + - name: Lint Helm Chart + run: helm lint "$HELM_CHART" + + - name: Run Check Helm Script + run: | + chmod +x ./check_helm_chart + ./check_helm_chart "$HELM_CHART" + + update-helm: runs-on: ubuntu-latest needs: check-helm steps: @@ -72,20 +76,19 @@ jobs: : "${HELM_REPO_PASSWORD:?must be set}" - name: Run Helm Lint - run: helm lint $HELM_CHART + run: helm lint "$HELM_CHART" - name: Run Check Helm Script and Upload run: | chmod +x ./check_helm_chart - ./check_helm_chart $HELM_CHART --upload + ./check_helm_chart "$HELM_CHART" --upload - kaniko-build: runs-on: ubuntu-latest strategy: matrix: build_type: [tag, stable] - + steps: - name: Checkout repository uses: actions/checkout@v4 @@ -93,32 +96,46 @@ jobs: submodules: true fetch-depth: 0 - - name: Set Docker Config + - name: Set Docker Config (GHCR + ECCR) if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master' run: | - echo "{\"auths\":{ - \"$CI_REGISTRY\": { - \"username\":\"$CI_REGISTRY_USER\", - \"password\":\"$CI_REGISTRY_PASSWORD\" - }, - \"eccr.ecmwf.int/harbor\": { - \"username\":\"$ECCR_USER\", - \"password\":\"$ECCR_PASSWORD\" + mkdir -p "${{ github.workspace }}" + AUTH_GHCR=$(printf '%s:%s' '${{ github.actor }}' '${{ github.token }}' | base64) + cat > docker-config.json <<'JSON' + { + "auths": { + "ghcr.io": { + "auth": "__AUTH_GHCR__" + }, + "eccr.ecmwf.int/harbor": { + "username": "__ECCR_USER__", + "password": "__ECCR_PASSWORD__" + } } - }}" > docker-config.json + } + JSON + sed -i "s|__AUTH_GHCR__|${AUTH_GHCR}|g" docker-config.json + sed -i "s|__ECCR_USER__|${ECCR_USER}|g" docker-config.json + sed -i "s|__ECCR_PASSWORD__|${ECCR_PASSWORD}|g" docker-config.json - name: Set Kaniko Build Variables if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master' run: | - SHORT_SHA=${GITHUB_SHA::7} + KANIKO_ARGS="" if [[ "${{ matrix.build_type }}" == "tag" ]]; then - echo "KANIKO_ARGS=--destination eccr.ecmwf.int/geoglows_api/geoglows_api:${{ github.ref_name }} --destination eccr.ecmwf.int/geoglows_api/geoglows_api:latest" >> $GITHUB_ENV + KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:${{ github.ref_name }}" + KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:latest" + KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:${{ github.ref_name }}" + KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:latest" elif [[ "${{ matrix.build_type }}" == "stable" && "${{ github.ref_name }}" == "master" ]]; then - echo "KANIKO_ARGS=--destination eccr.ecmwf.int/geoglows_api/geoglows_api:stable" >> $GITHUB_ENV + KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:stable" + # Uncomment to also push stable to ECCR: + # KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:stable" else echo "No valid build type" >&2 exit 1 fi + echo "KANIKO_ARGS=${KANIKO_ARGS}" >> "$GITHUB_ENV" - name: Run Kaniko Build & Push if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master' @@ -127,16 +144,13 @@ jobs: [[ -z "${KANIKO_CONTEXT}" ]] && echo "KANIKO_CONTEXT must be set" && exit 1 [[ -z "${KANIKO_ARGS}" ]] && echo "KANIKO_ARGS must be set" && exit 1 - # Combine final args - KANIKO_ARGS="--context ${KANIKO_CONTEXT} --dockerfile ${KANIKO_DOCKERFILE} ${KANIKO_ARGS} --cache=true --cache-repo ${CI_REGISTRY_IMAGE}/cache --force" + FINAL_ARGS="--context ${KANIKO_CONTEXT} --dockerfile ${KANIKO_DOCKERFILE} ${KANIKO_ARGS} --cache=true --cache-repo ${CI_REGISTRY_IMAGE}/cache --force" echo "Running Kaniko with:" - echo "$KANIKO_ARGS" + echo "${FINAL_ARGS}" docker run --rm \ -v "${{ github.workspace }}:/workspace" \ -v "${{ github.workspace }}/docker-config.json:/kaniko/.docker/config.json" \ ${{ env.KANIKO_IMAGE }} \ - $KANIKO_ARGS - - \ No newline at end of file + ${FINAL_ARGS} diff --git a/.github/workflows/deploy_to_production.yml b/.github/workflows/deploy_to_production.yml index 511a230..dcc42bb 100644 --- a/.github/workflows/deploy_to_production.yml +++ b/.github/workflows/deploy_to_production.yml @@ -12,7 +12,10 @@ jobs: name: Deploy to Production runs-on: ubuntu-latest container: - image: docker.aquaveo.com/tethys/kubernetes/helm-docker:2.0.0-rc1 + image: ghcr.io/aquaveo/helm-docker:2.0.0-rc1 + credentials: + username: ${{ github.actor }} + password: ${{ github.token }} steps: - name: Deploy to Production diff --git a/.github/workflows/deploy_to_staging.yml b/.github/workflows/deploy_to_staging.yml index 657fabf..5e5df60 100644 --- a/.github/workflows/deploy_to_staging.yml +++ b/.github/workflows/deploy_to_staging.yml @@ -12,7 +12,10 @@ jobs: name: Deploy to Staging runs-on: ubuntu-latest container: - image: docker.aquaveo.com/tethys/kubernetes/helm-docker:2.0.0-rc1 + image: ghcr.io/aquaveo/helm-docker:2.0.0-rc1 + credentials: + username: ${{ github.actor }} + password: ${{ github.token }} steps: - name: Deploy to Staging From 829c6e424ded81a6e472b0f7c185b3ab92e97e4f Mon Sep 17 00:00:00 2001 From: jakeymac Date: Thu, 21 Aug 2025 19:20:12 -0600 Subject: [PATCH 2/7] Testing on CI-CD-pipeline branch --- .github/workflows/build.yml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e8769ef..4f84376 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -97,7 +97,9 @@ jobs: fetch-depth: 0 - name: Set Docker Config (GHCR + ECCR) - if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master' + if: | + (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || + (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) run: | mkdir -p "${{ github.workspace }}" AUTH_GHCR=$(printf '%s:%s' '${{ github.actor }}' '${{ github.token }}' | base64) @@ -119,7 +121,9 @@ jobs: sed -i "s|__ECCR_PASSWORD__|${ECCR_PASSWORD}|g" docker-config.json - name: Set Kaniko Build Variables - if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master' + if: | + (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || + (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) run: | KANIKO_ARGS="" if [[ "${{ matrix.build_type }}" == "tag" ]]; then @@ -127,7 +131,7 @@ jobs: KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:latest" KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:${{ github.ref_name }}" KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:latest" - elif [[ "${{ matrix.build_type }}" == "stable" && "${{ github.ref_name }}" == "master" ]]; then + elif [[ "${{ matrix.build_type }}" == "stable" && ( "${{ github.ref_name }}" == "master" || "${{ github.ref_name }}" == "ci-cd-pipeline" ) ]]; then KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:stable" # Uncomment to also push stable to ECCR: # KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:stable" @@ -138,7 +142,9 @@ jobs: echo "KANIKO_ARGS=${KANIKO_ARGS}" >> "$GITHUB_ENV" - name: Run Kaniko Build & Push - if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master' + if: | + (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || + (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) run: | [[ -z "${KANIKO_DOCKERFILE}" ]] && echo "KANIKO_DOCKERFILE must be set" && exit 1 [[ -z "${KANIKO_CONTEXT}" ]] && echo "KANIKO_CONTEXT must be set" && exit 1 From 565772ae55bfb81f8a9685c08b2561951744a0f6 Mon Sep 17 00:00:00 2001 From: jakeymac Date: Thu, 21 Aug 2025 19:51:07 -0600 Subject: [PATCH 3/7] Added permissions to fix errors in deployment workflows --- .github/workflows/deploy_to_production.yml | 4 ++++ .github/workflows/deploy_to_staging.yml | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/.github/workflows/deploy_to_production.yml b/.github/workflows/deploy_to_production.yml index dcc42bb..2c9a9a7 100644 --- a/.github/workflows/deploy_to_production.yml +++ b/.github/workflows/deploy_to_production.yml @@ -4,6 +4,10 @@ name: Deploy to Production on: workflow_dispatch: +permissions: + contents: read + packages: read + env: ECCR_GEOGLOWS_TOKEN: ${{ secrets.ECCR_GEOGLOWS_TOKEN }} diff --git a/.github/workflows/deploy_to_staging.yml b/.github/workflows/deploy_to_staging.yml index 5e5df60..a28ecaa 100644 --- a/.github/workflows/deploy_to_staging.yml +++ b/.github/workflows/deploy_to_staging.yml @@ -4,6 +4,10 @@ name: Deploy to Staging on: workflow_dispatch: +permissions: + contents: read + packages: read + env: ECCR_GEOGLOWS_TOKEN: ${{ secrets.ECCR_GEOGLOWS_TOKEN }} From d83784966b82d2bebece4599a0639ca92c83c80c Mon Sep 17 00:00:00 2001 From: jakeymac Date: Thu, 21 Aug 2025 20:05:50 -0600 Subject: [PATCH 4/7] Removed container on deployment workflows --- .github/workflows/deploy_to_production.yml | 7 +------ .github/workflows/deploy_to_staging.yml | 5 ----- 2 files changed, 1 insertion(+), 11 deletions(-) diff --git a/.github/workflows/deploy_to_production.yml b/.github/workflows/deploy_to_production.yml index 2c9a9a7..9ccefa1 100644 --- a/.github/workflows/deploy_to_production.yml +++ b/.github/workflows/deploy_to_production.yml @@ -7,7 +7,7 @@ on: permissions: contents: read packages: read - + env: ECCR_GEOGLOWS_TOKEN: ${{ secrets.ECCR_GEOGLOWS_TOKEN }} @@ -15,11 +15,6 @@ jobs: deploy: name: Deploy to Production runs-on: ubuntu-latest - container: - image: ghcr.io/aquaveo/helm-docker:2.0.0-rc1 - credentials: - username: ${{ github.actor }} - password: ${{ github.token }} steps: - name: Deploy to Production diff --git a/.github/workflows/deploy_to_staging.yml b/.github/workflows/deploy_to_staging.yml index a28ecaa..06735c1 100644 --- a/.github/workflows/deploy_to_staging.yml +++ b/.github/workflows/deploy_to_staging.yml @@ -15,11 +15,6 @@ jobs: deploy: name: Deploy to Staging runs-on: ubuntu-latest - container: - image: ghcr.io/aquaveo/helm-docker:2.0.0-rc1 - credentials: - username: ${{ github.actor }} - password: ${{ github.token }} steps: - name: Deploy to Staging From df57662c672f779288e1bb47975beb4426de469a Mon Sep 17 00:00:00 2001 From: jakeymac Date: Thu, 21 Aug 2025 20:09:23 -0600 Subject: [PATCH 5/7] Removed CI-CD-pipeline branch option --- .github/workflows/build.yml | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 4f84376..e8769ef 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -97,9 +97,7 @@ jobs: fetch-depth: 0 - name: Set Docker Config (GHCR + ECCR) - if: | - (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || - (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) + if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master' run: | mkdir -p "${{ github.workspace }}" AUTH_GHCR=$(printf '%s:%s' '${{ github.actor }}' '${{ github.token }}' | base64) @@ -121,9 +119,7 @@ jobs: sed -i "s|__ECCR_PASSWORD__|${ECCR_PASSWORD}|g" docker-config.json - name: Set Kaniko Build Variables - if: | - (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || - (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) + if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master' run: | KANIKO_ARGS="" if [[ "${{ matrix.build_type }}" == "tag" ]]; then @@ -131,7 +127,7 @@ jobs: KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:latest" KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:${{ github.ref_name }}" KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:latest" - elif [[ "${{ matrix.build_type }}" == "stable" && ( "${{ github.ref_name }}" == "master" || "${{ github.ref_name }}" == "ci-cd-pipeline" ) ]]; then + elif [[ "${{ matrix.build_type }}" == "stable" && "${{ github.ref_name }}" == "master" ]]; then KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:stable" # Uncomment to also push stable to ECCR: # KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:stable" @@ -142,9 +138,7 @@ jobs: echo "KANIKO_ARGS=${KANIKO_ARGS}" >> "$GITHUB_ENV" - name: Run Kaniko Build & Push - if: | - (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || - (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) + if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master' run: | [[ -z "${KANIKO_DOCKERFILE}" ]] && echo "KANIKO_DOCKERFILE must be set" && exit 1 [[ -z "${KANIKO_CONTEXT}" ]] && echo "KANIKO_CONTEXT must be set" && exit 1 From 877ae44cad5a728e88bfb9b0e1fc3a3e4c7eaef6 Mon Sep 17 00:00:00 2001 From: jakeymac Date: Fri, 22 Aug 2025 14:08:04 -0600 Subject: [PATCH 6/7] * Updated to use docker login to avoid writing secrets to docker config file for security * Added ci-cd-pipeline branch for testing purposes --- .github/workflows/build.yml | 52 +++++++++++++++++++------------------ 1 file changed, 27 insertions(+), 25 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e8769ef..acb149a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -96,30 +96,30 @@ jobs: submodules: true fetch-depth: 0 - - name: Set Docker Config (GHCR + ECCR) - if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master' - run: | - mkdir -p "${{ github.workspace }}" - AUTH_GHCR=$(printf '%s:%s' '${{ github.actor }}' '${{ github.token }}' | base64) - cat > docker-config.json <<'JSON' - { - "auths": { - "ghcr.io": { - "auth": "__AUTH_GHCR__" - }, - "eccr.ecmwf.int/harbor": { - "username": "__ECCR_USER__", - "password": "__ECCR_PASSWORD__" - } - } - } - JSON - sed -i "s|__AUTH_GHCR__|${AUTH_GHCR}|g" docker-config.json - sed -i "s|__ECCR_USER__|${ECCR_USER}|g" docker-config.json - sed -i "s|__ECCR_PASSWORD__|${ECCR_PASSWORD}|g" docker-config.json + - name: Login to GHCR + if: | + (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || + (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ github.token }} + + - name: Login to ECCR Harbor + if: | + (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || + (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) + uses: docker/login-action@v3 + with: + registry: eccr.ecmwf.int/harbor + username: ${{ env.ECCR_USER }} + password: ${{ env.ECCR_PASSWORD }} - name: Set Kaniko Build Variables - if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master' + if: | + (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || + (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) run: | KANIKO_ARGS="" if [[ "${{ matrix.build_type }}" == "tag" ]]; then @@ -127,7 +127,7 @@ jobs: KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:latest" KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:${{ github.ref_name }}" KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:latest" - elif [[ "${{ matrix.build_type }}" == "stable" && "${{ github.ref_name }}" == "master" ]]; then + elif [[ "${{ matrix.build_type }}" == "stable" && ( "${{ github.ref_name }}" == "master" || "${{ github.ref_name }}" == "ci-cd-pipeline" ) ]]; then KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:stable" # Uncomment to also push stable to ECCR: # KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:stable" @@ -138,7 +138,9 @@ jobs: echo "KANIKO_ARGS=${KANIKO_ARGS}" >> "$GITHUB_ENV" - name: Run Kaniko Build & Push - if: matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/') || matrix.build_type == 'stable' && github.ref_name == 'master' + if: | + (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || + (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) run: | [[ -z "${KANIKO_DOCKERFILE}" ]] && echo "KANIKO_DOCKERFILE must be set" && exit 1 [[ -z "${KANIKO_CONTEXT}" ]] && echo "KANIKO_CONTEXT must be set" && exit 1 @@ -151,6 +153,6 @@ jobs: docker run --rm \ -v "${{ github.workspace }}:/workspace" \ - -v "${{ github.workspace }}/docker-config.json:/kaniko/.docker/config.json" \ + -v "$HOME/.docker:/kaniko/.docker:ro" \ ${{ env.KANIKO_IMAGE }} \ ${FINAL_ARGS} From bb4d3b3c474901c8d19efc1f6f478c8537091b88 Mon Sep 17 00:00:00 2001 From: jakeymac Date: Fri, 22 Aug 2025 14:45:03 -0600 Subject: [PATCH 7/7] * Updated registry name to use github repository name variable * Removed ci-cd-pipeline branch option for running --- .github/workflows/build.yml | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index acb149a..7be2e37 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -24,7 +24,7 @@ env: HELM_REPO_PASSWORD: ${{ secrets.HELM_REPO_PASSWORD }} CI_REGISTRY: ghcr.io - CI_REGISTRY_IMAGE: ghcr.io/aquaveo/gsprestapi + CI_REGISTRY_IMAGE: ghcr.io/${{ github.repository }} CI_COMMIT_SHORT_SHA: ${{ github.sha }} @@ -97,9 +97,7 @@ jobs: fetch-depth: 0 - name: Login to GHCR - if: | - (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || - (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) + if: (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || (matrix.build_type == 'stable' && github.ref_name == 'master') uses: docker/login-action@v3 with: registry: ghcr.io @@ -107,9 +105,7 @@ jobs: password: ${{ github.token }} - name: Login to ECCR Harbor - if: | - (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || - (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) + if: (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || (matrix.build_type == 'stable' && github.ref_name == 'master') uses: docker/login-action@v3 with: registry: eccr.ecmwf.int/harbor @@ -117,9 +113,7 @@ jobs: password: ${{ env.ECCR_PASSWORD }} - name: Set Kaniko Build Variables - if: | - (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || - (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) + if: (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || (matrix.build_type == 'stable' && github.ref_name == 'master') run: | KANIKO_ARGS="" if [[ "${{ matrix.build_type }}" == "tag" ]]; then @@ -127,7 +121,7 @@ jobs: KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:latest" KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:${{ github.ref_name }}" KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:latest" - elif [[ "${{ matrix.build_type }}" == "stable" && ( "${{ github.ref_name }}" == "master" || "${{ github.ref_name }}" == "ci-cd-pipeline" ) ]]; then + elif [[ "${{ matrix.build_type }}" == "stable" && "${{ github.ref_name }}" == "master" ]]; then KANIKO_ARGS+=" --destination ${CI_REGISTRY_IMAGE}:stable" # Uncomment to also push stable to ECCR: # KANIKO_ARGS+=" --destination eccr.ecmwf.int/geoglows_api/geoglows_api:stable" @@ -138,9 +132,7 @@ jobs: echo "KANIKO_ARGS=${KANIKO_ARGS}" >> "$GITHUB_ENV" - name: Run Kaniko Build & Push - if: | - (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || - (matrix.build_type == 'stable' && contains(fromJson('["master","ci-cd-pipeline"]'), github.ref_name)) + if: (matrix.build_type == 'tag' && startsWith(github.ref, 'refs/tags/')) || (matrix.build_type == 'stable' && github.ref_name == 'master') run: | [[ -z "${KANIKO_DOCKERFILE}" ]] && echo "KANIKO_DOCKERFILE must be set" && exit 1 [[ -z "${KANIKO_CONTEXT}" ]] && echo "KANIKO_CONTEXT must be set" && exit 1