Skip to content

Commit 7cf2aba

Browse files
authored
Merge branch 'main' into use-pem-kafka
Signed-off-by: Gantigmaa Selenge <39860586+tinaselenge@users.noreply.github.com>
2 parents af0239c + 59ca0c3 commit 7cf2aba

111 files changed

Lines changed: 3737 additions & 1965 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.github/actions/build/containers-load/action.yml

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
name: "Load Strimzi images"
2-
description: "Load Strimzi images"
2+
description: "Load Strimzi images from Build workflow"
33

44
inputs:
55
architecture:
@@ -13,10 +13,6 @@ inputs:
1313
runs:
1414
using: "composite"
1515
steps:
16-
- uses: actions/download-artifact@v4
17-
with:
18-
name: containers-${{ inputs.architecture }}.tar
19-
2016
- name: "Untar the ${{ inputs.architecture }} containers"
2117
shell: bash
2218
run: tar -xvf containers-${{ inputs.architecture }}.tar

.github/actions/build/containers-push/action.yml

Lines changed: 17 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -15,31 +15,29 @@ inputs:
1515
quayPass:
1616
description: "Quay.io password"
1717
required: true
18-
cosignPassword:
19-
description: "Cosign password for signing"
20-
required: true
21-
cosignPrivateKey:
22-
description: "Cosign private key for signing"
23-
required: true
2418

2519
runs:
2620
using: "composite"
2721
steps:
2822
- name: Install prerequisites
2923
shell: bash
30-
run: |
31-
.azure/scripts/install_cosign.sh
32-
.azure/scripts/install_syft.sh
24+
run: .azure/scripts/install_syft.sh
3325
env:
3426
ARCH: ${{ inputs.runnerArch }}
3527

36-
- uses: ./.github/actions/dependencies/install-docker
37-
- uses: ./.github/actions/dependencies/install-yq
28+
- name: Install Cosign
29+
uses: sigstore/cosign-installer@v3.10.0
30+
31+
- name: Install Docker
32+
uses: ./.github/actions/dependencies/install-docker
33+
34+
- name: Install yq
35+
uses: ./.github/actions/dependencies/install-yq
3836
with:
3937
architecture: ${{ inputs.runnerArch }}
4038

4139
- name: Download container artifact
42-
uses: actions/download-artifact@v5
40+
uses: actions/download-artifact@v4
4341
with:
4442
pattern: containers-*
4543
path: ./
@@ -85,33 +83,27 @@ runs:
8583
BUILD_REASON: "IndividualCI"
8684
BRANCH: ${{ github.ref }}
8785

88-
# TODO - We can use cosign in better way. See https://github.com/strimzi/strimzi-kafka-operator/issues/11826 for more details.
8986
- name: Sign container manifests
9087
shell: bash
91-
run: make docker_sign_manifest
88+
run: make docker_gha_sign_manifest
9289
env:
9390
BUILD_REASON: "IndividualCI"
9491
BRANCH: ${{ github.ref }}
9592
BUILD_ID: ${{ github.run_number }}
9693
BUILD_COMMIT: ${{ github.sha }}
97-
COSIGN_PASSWORD: ${{ inputs.cosignPassword }}
98-
COSIGN_PRIVATE_KEY: ${{ inputs.cosignPrivateKey }}
9994

100-
# TODO - We can use existing GitHub Action for SBOMs - https://github.com/strimzi/strimzi-kafka-operator/issues/11827
101-
- name: Generate SBOMs
95+
- name: Generate and sign SBOMs
10296
shell: bash
10397
run: |
10498
IFS=',' read -ra ARCH_ARRAY <<< "${{ inputs.architectures }}"
10599
for arch in "${ARCH_ARRAY[@]}"; do
106100
echo "Generating SBOM for architecture: ${arch}"
107101
export DOCKER_ARCHITECTURE="${arch}"
108-
make docker_sbom
102+
make docker_gha_sbom
109103
done
110104
env:
111105
BUILD_REASON: "IndividualCI"
112106
BRANCH: ${{ github.ref }}
113-
COSIGN_PASSWORD: ${{ inputs.cosignPassword }}
114-
COSIGN_PRIVATE_KEY: ${{ inputs.cosignPrivateKey }}
115107

116108
- name: Create SBOM archive
117109
shell: bash
@@ -129,12 +121,12 @@ runs:
129121
run: |
130122
IFS=',' read -ra ARCH_ARRAY <<< "${{ inputs.architectures }}"
131123
for arch in "${ARCH_ARRAY[@]}"; do
132-
echo "Generating SBOM for architecture: ${arch}"
124+
echo "Pushing SBOM for architecture: ${arch}"
133125
export DOCKER_ARCHITECTURE="${arch}"
134-
make docker_push_sbom
126+
make docker_gha_push_sbom
135127
done
136128
env:
137129
BUILD_REASON: "IndividualCI"
138130
BRANCH: ${{ github.ref }}
139-
COSIGN_PASSWORD: ${{ inputs.cosignPassword }}
140-
COSIGN_PRIVATE_KEY: ${{ inputs.cosignPrivateKey }}
131+
BUILD_ID: ${{ github.run_number }}
132+
BUILD_COMMIT: ${{ github.sha }}
Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
name: "Download Build Artifacts"
2+
description: "Downloads a specific artifact from the Build workflow for the same commit SHA"
3+
4+
inputs:
5+
# In Azure we use build ID of build pipeline to retrieve Strimzi artifacts
6+
# This can be achieved here as well, but after offline discussion we agreed we will try to use just commit sha
7+
# as each commit should have only one unique passed build. In case we will find it is not sufficient
8+
# we can easily add another input runId and skip find-build job and directly download artifact.
9+
# TODO - the comment can be removed once we agree it is sufficient for releases
10+
sha:
11+
description: "Commit SHA to find build artifacts for"
12+
required: true
13+
artifactName:
14+
description: "Name of the artifact to download (e.g., 'strimzi-binaries.tar', 'containers-amd64.tar')"
15+
required: true
16+
waitForBuild:
17+
description: "Wait for build to complete if it's still running"
18+
required: false
19+
default: "true"
20+
maxWaitMinutes:
21+
description: "Maximum time to wait for build completion (in minutes)"
22+
required: false
23+
default: "60"
24+
25+
outputs:
26+
buildRunId:
27+
description: "The ID of the build workflow run"
28+
value: ${{ steps.find-build.outputs.run_id }}
29+
buildStatus:
30+
description: "Status of the build workflow"
31+
value: ${{ steps.find-build.outputs.status }}
32+
33+
runs:
34+
using: "composite"
35+
steps:
36+
- name: Find Build Workflow Run
37+
id: find-build
38+
uses: actions/github-script@v7
39+
env:
40+
INPUT_SHA: ${{ inputs.sha }}
41+
WAIT_FOR_BUILD: ${{ inputs.waitForBuild }}
42+
MAX_WAIT_MINUTES: ${{ inputs.maxWaitMinutes }}
43+
with:
44+
script: |
45+
const {owner, repo} = context.repo;
46+
const sha = process.env.INPUT_SHA;
47+
const waitForBuild = process.env.WAIT_FOR_BUILD === 'true';
48+
const maxWaitMinutes = parseInt(process.env.MAX_WAIT_MINUTES);
49+
50+
core.info(`🔍 Looking for Build workflow run for commit: ${sha}`);
51+
52+
const maxWaitSeconds = maxWaitMinutes * 60;
53+
const startTime = Date.now();
54+
55+
// Function to find build run
56+
async function findBuildRun() {
57+
const runs = await github.rest.actions.listWorkflowRuns({
58+
owner,
59+
repo,
60+
workflow_id: 'build.yml',
61+
head_sha: sha,
62+
per_page: 1
63+
});
64+
return runs.data.workflow_runs[0];
65+
}
66+
67+
// Initial attempt to find build
68+
let buildRun = await findBuildRun();
69+
70+
if (!buildRun) {
71+
if (waitForBuild) {
72+
core.info('⏳ No build found yet. Waiting for build workflow to start...');
73+
74+
// Wait for build to appear
75+
while (!buildRun) {
76+
const elapsed = Math.floor((Date.now() - startTime) / 1000);
77+
78+
if (elapsed >= maxWaitSeconds) {
79+
core.setFailed(`❌ Timeout: No build workflow found after waiting ${maxWaitMinutes} minutes`);
80+
core.setFailed(`Please ensure the Build workflow has been triggered for commit ${sha}`);
81+
return;
82+
}
83+
84+
core.info(`Waiting... (${elapsed}s elapsed, max: ${maxWaitSeconds}s)`);
85+
await new Promise(resolve => setTimeout(resolve, 30000)); // Sleep 30 seconds
86+
buildRun = await findBuildRun();
87+
}
88+
} else {
89+
core.setFailed(`❌ No build workflow run found for commit ${sha}`);
90+
core.setFailed('Please trigger the Build workflow first or enable waitForBuild');
91+
return;
92+
}
93+
}
94+
95+
core.info(`✅ Found Build workflow run: #${buildRun.id}`);
96+
core.info(`📊 Status: ${buildRun.status}, Conclusion: ${buildRun.conclusion}`);
97+
98+
// Wait for build to complete if it's still running
99+
if (buildRun.status !== 'completed' && waitForBuild) {
100+
core.info('⏳ Build is still running. Waiting for completion...');
101+
102+
while (buildRun.status !== 'completed') {
103+
const elapsed = Math.floor((Date.now() - startTime) / 1000);
104+
105+
if (elapsed >= maxWaitSeconds) {
106+
core.setFailed(`❌ Timeout: Build did not complete within ${maxWaitMinutes} minutes`);
107+
core.setFailed(`Build run: ${context.serverUrl}/${owner}/${repo}/actions/runs/${buildRun.id}`);
108+
return;
109+
}
110+
111+
core.info(`Build still running... (${elapsed}s elapsed, max: ${maxWaitSeconds}s)`);
112+
await new Promise(resolve => setTimeout(resolve, 60000)); // Sleep 60 seconds
113+
114+
buildRun = await findBuildRun();
115+
}
116+
117+
core.info(`✅ Build completed with status: ${buildRun.conclusion}`);
118+
}
119+
120+
// Check if build was successful
121+
if (buildRun.status === 'completed' && buildRun.conclusion !== 'success') {
122+
core.setFailed(`❌ Build workflow failed with conclusion: ${buildRun.conclusion}`);
123+
core.setFailed(`Build run: ${context.serverUrl}/${owner}/${repo}/actions/runs/${buildRun.id}`);
124+
return;
125+
}
126+
127+
// Output results
128+
core.setOutput('run_id', buildRun.id.toString());
129+
core.setOutput('status', buildRun.status);
130+
core.setOutput('conclusion', buildRun.conclusion || '');
131+
132+
core.info(`🎯 Build workflow run #${buildRun.id} is ready for artifact download`);
133+
core.info(`Build URL: ${context.serverUrl}/${owner}/${repo}/actions/runs/${buildRun.id}`);
134+
135+
- name: Download Artifact
136+
uses: actions/download-artifact@v4
137+
with:
138+
name: ${{ inputs.artifactName }}
139+
run-id: ${{ steps.find-build.outputs.run_id }}
140+
github-token: ${{ github.token }}

.github/actions/utils/determine-ref/action.yml

Lines changed: 40 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -12,34 +12,44 @@ outputs:
1212
runs:
1313
using: "composite"
1414
steps:
15-
- name: Determine ref
15+
- name: Determine ref and SHA
1616
id: determine
17-
shell: bash
18-
run: |
19-
if [[ "${{ github.event_name }}" == "pull_request" ]]; then
20-
# For PR events, use merge ref to test the merged state
21-
REF="refs/pull/${{ github.event.pull_request.number }}/merge"
22-
SHA="${{ github.event.pull_request.merge_commit_sha }}"
23-
if [[ "$SHA" == "" || "$SHA" == "null" ]]; then
24-
SHA="HEAD"
25-
fi
26-
echo "PR event detected: Using merge ref for PR #${{ github.event.pull_request.number }}"
27-
elif [[ "${{ github.event_name }}" == "issue_comment" ]] && [[ "${{ github.event.issue.pull_request }}" != "" && "${{ github.event.issue.pull_request }}" != "null" ]]; then
28-
# For PR comments, use merge ref to test against merge commit
29-
REF="refs/pull/${{ github.event.issue.number }}/merge"
30-
SHA="HEAD"
31-
echo "PR comment detected: Using merge ref for PR #${{ github.event.issue.number }}"
32-
else
33-
# For workflow_dispatch and other events, use the current branch
34-
REF="${{ github.ref }}"
35-
SHA="${{ github.sha }}"
36-
echo "Standard event: Using current ref $REF"
37-
fi
38-
39-
echo "ref=$REF" >> $GITHUB_OUTPUT
40-
echo "sha=$SHA" >> $GITHUB_OUTPUT
41-
echo "REF=$REF" >> $GITHUB_ENV
42-
echo "SHA=$SHA" >> $GITHUB_ENV
43-
44-
echo "Determined ref: $REF"
45-
echo "Determined SHA: $SHA"
17+
uses: actions/github-script@v7
18+
with:
19+
script: |
20+
const {owner, repo} = context.repo;
21+
let ref, sha;
22+
23+
if (context.eventName === 'pull_request') {
24+
// For PR events, use merge ref to test the merged state
25+
const prNumber = context.payload.pull_request.number;
26+
ref = `refs/pull/${prNumber}/merge`;
27+
sha = context.payload.pull_request.head.sha;
28+
core.info(`PR event detected: Using merge ref for PR #${prNumber}`);
29+
core.info(`Head SHA: ${sha}`);
30+
} else if (context.eventName === 'issue_comment' && context.payload.issue?.pull_request) {
31+
// For PR comments, fetch the PR to get head SHA
32+
const prNumber = context.payload.issue.number;
33+
ref = `refs/pull/${prNumber}/merge`;
34+
35+
const pr = await github.rest.pulls.get({
36+
owner,
37+
repo,
38+
pull_number: prNumber
39+
});
40+
sha = pr.data.head.sha;
41+
42+
core.info(`PR comment detected: Using merge ref for PR #${prNumber}`);
43+
core.info(`Head SHA: ${sha}`);
44+
} else {
45+
// For workflow_dispatch and other events, use the current branch
46+
ref = context.ref;
47+
sha = context.sha;
48+
core.info(`Standard event: Using current ref ${ref}`);
49+
core.info(`SHA: ${sha}`);
50+
}
51+
52+
core.setOutput('ref', ref);
53+
core.setOutput('sha', sha);
54+
core.exportVariable('REF', ref);
55+
core.exportVariable('SHA', sha);

.github/docs/README.md

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -62,25 +62,28 @@ Build process actions:
6262
- [build-strimzi-binaries](../actions/build/build-strimzi-binaries)
6363
- [containers-build](../actions/build/containers-build)
6464
- [containers-load](../actions/build/containers-load)
65+
- [download-build-artifacts](../actions/build/download-build-artifacts)
66+
- [build-docs](../actions/build/build-docs)
67+
- [publish-docs](../actions/build/publish-docs)
68+
- [test-strimzi](../actions/build/test-strimzi)
6569

6670
System tests execution actions:
6771
- [generate-matrix](../actions/systemtests/generate-matrix)
68-
- [set-defaults](../actions/utils/set-defaults)
69-
- [log-variables](../actions/utils/log-variables)
7072
- [parse-comment](../actions/systemtests/parse-comment)
71-
- [determine-ref](../actions/utils/determine-ref)
73+
- [validate-matrix](../actions/systemtests/validate-matrix)
7274

7375
Utils actions:
7476
- [check-permissions](../actions/utils/check-permissions)
7577
- [add-comment](../actions/utils/add-comment)
7678
- [check-and-status](../actions/utils/check-and-status)
79+
- [set-defaults](../actions/utils/set-defaults)
80+
- [log-variables](../actions/utils/log-variables)
81+
- [determine-ref](../actions/utils/determine-ref)
7782

7883
To make the build 1:1 to Azure we miss few actions that do the missing steps:
79-
- Run unit/integration tests
80-
- Build docs
81-
- Push docs
82-
- Push containers
83-
- Deploy Java artifacts
84+
- Push docs (uncomment usage & properly test)
85+
- Push containers (uncomment usage & properly test)
86+
- Deploy Java artifacts (uncomment usage & properly test)
8487

8588
The actions also had to be put together into workflow as we have in Azure:
8689
- `build pipeline` -> `build workflow`

.github/docs/sts-workflow.png

-370 KB
Loading

0 commit comments

Comments
 (0)