Enabling OAuth for the origin and cache, adding support for Globus as another auth server #432
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Push Prod Image | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| repository_dispatch: | |
| types: | |
| - dispatch-build | |
| workflow_dispatch: | |
| workflow_call: | |
| inputs: | |
| from_workflow_call: | |
| required: false | |
| type: boolean | |
| default: true | |
| tag: | |
| description: 'Tag to use for the Docker image' | |
| required: false | |
| type: string | |
| permissions: | |
| contents: write | |
| jobs: | |
| build-base-image: | |
| runs-on: ubuntu-latest | |
| steps: | |
| # For release, the worflow call (from pre-release.yaml) is triggered by a tag push | |
| # like 7.5.1 Here, we want to set the *branch* name to 7.5.x, | |
| # which is the branch for a feature version | |
| - name: Set Branch for Release | |
| id: set_branch | |
| if: ${{ inputs.from_workflow_call }} | |
| run: | | |
| echo "branch=${GITHUB_REF_NAME%.*}.x" >> $GITHUB_OUTPUT | |
| - name: Checkout for release with a tag | |
| uses: actions/checkout@v4 | |
| if: ${{ inputs.from_workflow_call }} | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ steps.set_branch.outputs.branch }} | |
| - name: Checkout for push to main | |
| uses: actions/checkout@v4 | |
| if: ${{ !inputs.from_workflow_call }} | |
| - name: Cache base image | |
| uses: actions/cache@v4 | |
| with: | |
| path: /tmp/.base-buildx-cache | |
| key: base-buildx-${{ github.sha }}-${{ github.run_id }} | |
| # allow cache hits from previous runs of the current branch, | |
| # parent branch, then upstream branches, in that order | |
| restore-keys: | | |
| base-buildx- | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| with: | |
| buildkitd-flags: --debug | |
| # Free disk space | |
| - name: Free Disk space | |
| shell: bash | |
| run: | | |
| sudo rm -rf /usr/local/lib/android # will release about 10 GB if you don't need Android | |
| - name: Build and push Docker images | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| file: ./images/Dockerfile | |
| target: final-stage | |
| build-args: | | |
| IS_PR_BUILD=${{ github.event_name == 'pull_request' }} | |
| cache-from: type=local,src=/tmp/.base-buildx-cache | |
| cache-to: type=local,dest=/tmp/.base-buildx-cache,mode=max | |
| make-date-tag: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| dtag: ${{ steps.mkdatetag.outputs.dtag }} | |
| steps: | |
| - name: make date tag | |
| id: mkdatetag | |
| run: echo "dtag=$(date +%Y%m%d-%H%M)" >> $GITHUB_OUTPUT | |
| build-server-images: | |
| needs: [build-base-image, make-date-tag] | |
| strategy: | |
| fail-fast: False | |
| matrix: | |
| image: | |
| - cache | |
| - origin | |
| - director | |
| - registry | |
| - osdf-cache | |
| - osdf-origin | |
| - osdf-director | |
| - osdf-registry | |
| runs-on: ubuntu-latest | |
| steps: | |
| # For release, the worflow call (from pre-release.yaml) is triggered by a tag push | |
| # like 7.5.1 Here, we want to set the *branch* name to 7.5.x, | |
| # which is the branch for a feature version | |
| - name: Set Branch for Release | |
| id: set_branch | |
| if: ${{ inputs.from_workflow_call }} | |
| run: | | |
| echo "branch=${GITHUB_REF_NAME%.*}.x" >> $GITHUB_OUTPUT | |
| - name: Checkout for release with a tag | |
| uses: actions/checkout@v4 | |
| if: ${{ inputs.from_workflow_call }} | |
| with: | |
| fetch-depth: 0 | |
| ref: ${{ steps.set_branch.outputs.branch }} | |
| - name: Checkout for push to main | |
| uses: actions/checkout@v4 | |
| if: ${{ !inputs.from_workflow_call }} | |
| - name: Generate tag list | |
| id: generate-tag-list | |
| env: | |
| TIMESTAMP: ${{ needs.make-date-tag.outputs.dtag }} | |
| # Here, we either tag the container with the "latest" tag if | |
| # the commit that triggered this action doesn't have a tag, | |
| # or we tag it with the commit's tag if one exists | |
| run: | | |
| # Check if we're working with a tagged version | |
| if [ -z "${{ inputs.tag }}" ] | |
| then | |
| # Use regex to check for a semver tag match | |
| if [[ ${GITHUB_REF##*/} =~ v[0-9]+\.[0-9]+\.[0-9]+ ]] | |
| then | |
| GITHUB_TAG=${GITHUB_REF##*/} | |
| else | |
| GITHUB_TAG="latest" | |
| fi | |
| else | |
| GITHUB_TAG=${{ inputs.tag }} | |
| fi | |
| echo "Master SHA:" | |
| echo $(git rev-parse $GITHUB_REF_NAME) | |
| echo "Current SHA:" | |
| echo $(git rev-parse HEAD) | |
| echo $GITHUB_TAG | |
| docker_repo="pelican_platform" | |
| image_name=${{ matrix.image }} | |
| tag_list=() | |
| for registry in hub.opensciencegrid.org; do | |
| for image_tag in "$GITHUB_TAG"; do | |
| tag_list+=("$registry/$docker_repo/$image_name":"$image_tag") | |
| done | |
| done | |
| # This causes the tag_list array to be comma-separated below, | |
| # which is required for build-push-action | |
| IFS=, | |
| echo "::set-output name=taglist::${tag_list[*]}" | |
| - name: Load cached base image | |
| uses: actions/cache@v4 | |
| with: | |
| path: /tmp/.base-buildx-cache | |
| key: base-buildx-${{ github.sha }}-${{ github.run_id }} | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| with: | |
| buildkitd-flags: --debug | |
| - name: Log in to OSG Harbor | |
| uses: docker/login-action@v3 | |
| if: github.repository == 'PelicanPlatform/pelican' && github.event_name != 'pull_request' | |
| with: | |
| registry: hub.opensciencegrid.org | |
| username: ${{ secrets.PELICAN_HARBOR_ROBOT_USER }} | |
| password: ${{ secrets.PELICAN_HARBOR_ROBOT_PASSWORD }} | |
| - name: Build and push Docker images | |
| uses: docker/build-push-action@v5 | |
| with: | |
| context: . | |
| file: ./images/Dockerfile | |
| push: ${{ github.repository == 'PelicanPlatform/pelican' && github.event_name != 'pull_request' }} | |
| tags: "${{ steps.generate-tag-list.outputs.taglist }}" | |
| target: ${{ matrix.image }} | |
| build-args: | | |
| IS_PR_BUILD=${{ github.event_name == 'pull_request' }} | |
| cache-from: type=local,src=/tmp/.base-buildx-cache |