Skip to content

ci: Improve build workflow #713

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 10 commits into from
Closed

ci: Improve build workflow #713

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
26675af
ci: Improve build workflow
Techassi Nov 24, 2025
cefff11
ci: Use correct password
Techassi Nov 24, 2025
f02424f
ci: Comment out cargo-udeps, use released action
Techassi Nov 24, 2025
f492d2c
ci: Use updated actions, add notify job
Techassi Nov 26, 2025
162eae9
chore: Add comment about release arg
Techassi Nov 26, 2025
c8c4b98
ci: Checkout repo when publishing index manifest
Techassi Nov 26, 2025
85d7766
ci: Use correct chart repository
Techassi Nov 26, 2025
e1f8efb
ci: Use correct action name
Techassi Nov 26, 2025
521de4e
ci: Use correct robot user
Techassi Nov 26, 2025
5439645
ci: Provide id-token permission
Techassi Nov 26, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
245 changes: 245 additions & 0 deletions .github/workflows/build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,245 @@
# =============
# This file is automatically generated from the templates in stackabletech/operator-templating
# DON'T MANUALLY EDIT THIS FILE
# =============
---
# TODO: Template operator name
name: Build Airflow Operator Artifacts

permissions: {}

on:
push:
branches:
- main
tags:
- '[0-9][0-9].[0-9]+.[0-9]+-rc[0-9]+'
- '[0-9][0-9].[0-9]+.[0-9]+'
schedule:
# Run every Saturday morning: https://crontab.guru/#15_3_*_*_6
- cron: '15 3 * * 6'
pull_request:
paths:
- '.github/workflows/build.yaml'
- 'rust-toolchain.toml'
- '.dockerignore'
- 'deploy/**'
- '.cargo/**'
- 'docker/**'
- 'Cargo.*'
- '*.rs'

# These are pretty much all templated
env:
# TODO: Template env var for operator name
OPERATOR_NAME: airflow-operator
RUST_NIGHTLY_TOOLCHAIN_VERSION: "nightly-2025-10-23"
NIX_PKG_MANAGER_VERSION: "2.30.0"
RUST_TOOLCHAIN_VERSION: "1.89.0"
HADOLINT_VERSION: "v2.12.0"
PYTHON_VERSION: "3.13"
CARGO_TERM_COLOR: always

jobs:
# cargo-udeps:
# name: Run cargo-udeps
# runs-on: ubuntu-latest
# env:
# RUSTC_BOOTSTRAP: 1
# steps:
# - name: Install host dependencies
# uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
# with:
# packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
# version: ubuntu-latest

# - name: Checkout Repository
# uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
# with:
# persist-credentials: false
# submodules: recursive

# - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} toolchain
# uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
# with:
# toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}

# - name: Setup Rust Cache
# uses: Swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
# with:
# cache-all-crates: "true"
# key: udeps

# - name: Install cargo-udeps
# uses: stackabletech/cargo-install-action@8f7dbbcd2ebe22717efc132d0dd61e80841994b9 # cargo-udeps

# - name: Run cargo-udeps
# run: cargo udeps --workspace --all-targets

build-container-image:
name: Build/Publish ${{ matrix.runner.arch }} Image
# needs:
# - cargo-udeps
permissions:
id-token: write
strategy:
fail-fast: false
matrix:
runner:
- { name: "ubuntu-latest", arch: "amd64" }
- { name: "ubicloud-standard-8-arm", arch: "arm64" }
runs-on: ${{ matrix.runner.name }}
outputs:
operator-version: ${{ steps.version.outputs.OPERATOR_VERSION }}
steps:
- name: Install host dependencies
uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
with:
packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
version: ${{ matrix.runner.name }}

- name: Checkout Repository
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
submodules: recursive

- name: Update/Extract Operator Version
id: version
if: github.event_name == 'pull_request'
env:
PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
PR_NUMBER: ${{ github.event.pull_request.number }}
GITHUB_DEBUG: ${{ runner.debug }}
shell: bash
run: |
set -euo pipefail
[ -n "$GITHUB_DEBUG" ] && set -x

CURRENT_VERSION=$(cargo metadata --format-version 1 --no-deps | jq -r '.packages[0].version')

if [ "$PR_BASE_REF" == 'main' ]; then
NEW_VERSION="0.0.0-pr$PR_NUMBER"
else
NEW_VERSION="$CURRENT_VERSION-pr$PR_NUMBER"
fi

sed -i "s/version = \"${CURRENT_VERSION}\"/version = \"${NEW_VERSION}\"/" Cargo.toml
echo "OPERATOR_VERSION=$NEW_VERSION" | tee -a "$GITHUB_OUTPUT"

- name: Install Nix
uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31.5.2

- name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain
uses: dtolnay/rust-toolchain@b3b07ba8b418998c39fb20f53e8b695cdcc8de1b
with:
toolchain: ${{ env.RUST_TOOLCHAIN_VERSION }}

- name: Build Container Image
id: build
uses: stackabletech/actions/build-container-image@29bea1b451c0c2e994bd495969286f95bf49ed6a # TODO: Use released action
with:
image-name: ${{ env.OPERATOR_NAME }}
image-index-manifest-tag: ${{ steps.version.outputs.OPERATOR_VERSION }}
build-arguments: VERSION=${{ steps.version.outputs.OPERATOR_VERSION }}
container-file: docker/Dockerfile

- name: Publish Container Image
uses: stackabletech/actions/publish-image@29bea1b451c0c2e994bd495969286f95bf49ed6a # TODO: Use released action
with:
image-registry-uri: oci.stackable.tech
image-registry-username: robot$sdp+github-action-build
image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
image-repository: sdp/${{ env.OPERATOR_NAME }}
image-manifest-tag: ${{ steps.build.outputs.image-manifest-tag }}
source-image-uri: ${{ steps.build.outputs.image-manifest-uri }}

publish-index-manifest:
name: Publish/Sign ${{ needs.build-container-image.outputs.operator-version }} Index
needs:
- build-container-image
permissions:
id-token: write
runs-on: ubuntu-latest
steps:
- name: Checkout Repository
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false

- name: Publish and Sign Image Index
uses: stackabletech/actions/publish-image-index-manifest@29bea1b451c0c2e994bd495969286f95bf49ed6a # TODO: Use released action
with:
image-registry-uri: oci.stackable.tech
image-registry-username: robot$sdp+github-action-build
image-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_GITHUB_ACTION_BUILD_SECRET }}
image-repository: sdp/${{ env.OPERATOR_NAME }}
image-index-manifest-tag: ${{ needs.build-container-image.outputs.operator-version }}

publish-helm-chart:
name: Package/Publish ${{ needs.build-container-image.outputs.operator-version }} Helm Chart
needs:
- build-container-image
permissions:
id-token: write
runs-on: ubuntu-latest
steps:
- name: Checkout Repository
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false
submodules: recursive

- name: Package, Publish, and Sign Helm Chart
uses: stackabletech/actions/publish-helm-chart@29bea1b451c0c2e994bd495969286f95bf49ed6a # TODO: Use released action
with:
chart-registry-uri: oci.stackable.tech
chart-registry-username: robot$sdp-charts+github-action-build
chart-registry-password: ${{ secrets.HARBOR_ROBOT_SDP_CHARTS_GITHUB_ACTION_BUILD_SECRET }}
chart-repository: sdp-charts
chart-directory: deploy/helm/${{ env.OPERATOR_NAME }}
chart-version: ${{ needs.build-container-image.outputs.operator-version }}
app-version: ${{ needs.build-container-image.outputs.operator-version }}

openshift-preflight-check:
name: Run OpenShift Preflight Check for ${{ needs.build-container-image.outputs.operator-version }}-${{ matrix.arch }}
needs:
- build-container-image
- publish-index-manifest
strategy:
fail-fast: false
matrix:
arch:
- amd64
- arm64
runs-on: ubuntu-latest
steps:
- name: Run OpenShift Preflight Check
uses: stackabletech/actions/run-openshift-preflight@29bea1b451c0c2e994bd495969286f95bf49ed6a # TODO: Use released action
with:
image-index-uri: oci.stackable.tech/sdp/${{ env.OPERATOR_NAME }}:${{ needs.build-container-image.outputs.operator-version }}
image-architecture: ${{ matrix.arch }}

notify:
name: Failure Notification
needs:
- build-container-image
- publish-index-manifest
- publish-helm-chart
runs-on: ubuntu-latest
if: failure() || github.run_attempt > 1
steps:
- name: Checkout Repository
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
with:
persist-credentials: false

- name: Send Notification
uses: stackabletech/actions/send-slack-notification@29bea1b451c0c2e994bd495969286f95bf49ed6a # TODO: Use released action
with:
publish-helm-chart-result: ${{ needs.publish-helm-chart.result }}
publish-manifests-result: ${{ needs.publish-index-manifest.result }}
build-result: ${{ needs.build-container-image.result }}
slack-token: ${{ secrets.SLACK_CONTAINER_IMAGE_TOKEN }}
channel-id: C07UG6JH44F # notifications-container-images
type: container-image-build
Loading
Loading