Skip to content

Commit 540ed2f

Browse files
sean-breensean-breen
authored
[CI/CD] Release Updater (#1397)
* add write permission * add write permission * write to release branch in Azure * list releases * add new oses * [skip ci] add freebsd packages to uris if requested version is v2.x * [skip ci] remove comment * update handling of FreeBSD pakcages for v2 releases * update regex * recreate tarball for upload to Azure * upload tarball with other packages to Azure * fix upload of tarball * [skip ci] Add azure path when uloading tarball * [skip ci] fix tarball structure * [skip ci] Tidy up paths in log, try simplify the configuration * [skip ci] add missing commands * [skip ci] remove azure upload and cleanup action inputs format * [skip ci] fix typo, use secret for artifactory url * [skip ci] set upload default to false * [skip ci] tidy defaults and descriptions * [skip ci] update descriptions with examples * [skip ci] add warning to not squash commits when merging releases * [skip-ci] suppress gpg key output in make target * Remove job, deps already installed in previous step * fix deb package formact for github assets * [skip ci] sort list when displaying packages * fix paths for FreeBSD pkgs when version 2.x * re-enable workflow
1 parent db165d2 commit 540ed2f

File tree

5 files changed

+234
-108
lines changed

5 files changed

+234
-108
lines changed

‎.github/workflows/assertion.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ jobs:
1919
id-token: write
2020
contents: read
2121
env:
22-
GOPROXY: "https://${{ secrets.ARTIFACTORY_USER }}:${{ secrets.ARTIFACTORY_TOKEN }}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-local-approved-dependency"
22+
GOPROXY: "https://${{ secrets.ARTIFACTORY_USER }}:${{ secrets.ARTIFACTORY_TOKEN }}@${{ secrets.ARTIFACTORY_URL_PROD }}"
2323
outputs:
2424
agent_binary: ${{ steps.check_binary.outputs.agent_binary }}
2525
goversionm: ${{ steps.godeps.outputs.goversionm }}

‎.github/workflows/release-branch.yml‎

Lines changed: 27 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -3,53 +3,51 @@ name: Release Agent
33
on:
44
workflow_dispatch:
55
inputs:
6-
githubRelease:
7-
description: 'Setup release in github'
8-
type: boolean
9-
default: false
106
packageVersion:
11-
description: 'Package version number'
12-
default: "3.0.0"
7+
required: true
8+
description: 'Package version number (3.x.x)'
9+
default: ""
1310
type: string
1411
packageBuildNo:
15-
description: 'Package Build number'
12+
required: true
13+
description: 'Package build number'
1614
default: "1"
1715
type: string
18-
uploadAzure:
19-
description: 'Publish packages Azure storage'
20-
default: true
21-
type: boolean
22-
publishPackages:
23-
description: 'Publish packages to nginx repo'
24-
default: true
25-
type: boolean
16+
releaseBranch:
17+
description: 'Release branch to build from (release-3.x.x)'
18+
required: true
19+
type: string
2620
tagRelease:
27-
description: 'Add tag to release branch'
21+
description: 'Add tag for release (v3.x.x)'
2822
default: false
2923
type: boolean
24+
githubRelease:
25+
description: 'Draft release (v3.x.x) on GitHub'
26+
type: boolean
27+
default: false
3028
createPullRequest:
31-
description: 'Create pull request back into main'
29+
description: 'Create pull request into main (required if release branch has diverged from main)'
30+
default: false
31+
type: boolean
32+
publishPackages:
33+
description: 'Publish packages to nginx repo'
3234
default: false
3335
type: boolean
34-
releaseBranch:
35-
description: 'Release branch to build & publish from'
36-
required: true
37-
type: string
3836
uploadUrl:
3937
description: 'Location to publish packages to'
4038
required: false
4139
default: "https://up-ap.nginx.com"
4240

4341
env:
4442
NFPM_VERSION: 'v2.35.3'
45-
GOPROXY: "https://${{ secrets.ARTIFACTORY_USER }}:${{ secrets.ARTIFACTORY_TOKEN }}@azr.artifactory.f5net.com/artifactory/api/go/f5-nginx-go-local-approved-dependency"
43+
GOPROXY: "https://${{ secrets.ARTIFACTORY_USER }}:${{ secrets.ARTIFACTORY_TOKEN }}@${{ secrets.ARTIFACTORY_URL_PROD }}"
4644

4745
defaults:
4846
run:
4947
shell: bash
5048

5149
concurrency:
52-
group: ${{ github.ref_name }}-v3-release
50+
group: ${{ github.ref_name }}-release
5351
cancel-in-progress: true
5452

5553
permissions:
@@ -60,10 +58,9 @@ jobs:
6058
name: Set workflow variables
6159
runs-on: ubuntu-22.04
6260
outputs:
61+
tag_release: ${{steps.vars.outputs.tag_release }}
6362
github_release: ${{steps.vars.outputs.github_release }}
64-
upload_azure: ${{steps.vars.outputs.upload_azure }}
6563
publish_packages: ${{steps.vars.outputs.publish_packages }}
66-
tag_release: ${{steps.vars.outputs.tag_release }}
6764
create_pull_request: ${{steps.vars.outputs.create_pull_request }}
6865
steps:
6966
- name: Checkout Repository
@@ -74,10 +71,9 @@ jobs:
7471
- name: Set variables
7572
id: vars
7673
run: |
74+
echo "tag_release=${{ inputs.tagRelease }}" >> $GITHUB_OUTPUT
7775
echo "github_release=${{ inputs.githubRelease }}" >> $GITHUB_OUTPUT
78-
echo "upload_azure=${{ inputs.uploadAzure }}" >> $GITHUB_OUTPUT
7976
echo "publish_packages=${{ inputs.publishPackages }}" >> $GITHUB_OUTPUT
80-
echo "tag_release=${{ inputs.tagRelease }}" >> $GITHUB_OUTPUT
8177
echo "create_pull_request=${{ inputs.createPullRequest }}" >> $GITHUB_OUTPUT
8278
cat $GITHUB_OUTPUT
8379
@@ -193,6 +189,7 @@ jobs:
193189
ref: ${{ inputs.releaseBranch }}
194190

195191
- name: Tag release
192+
if: ${{ needs.vars.outputs.tag_release == 'true' }}
196193
run: |
197194
git config --global user.name 'github-actions'
198195
git config --global user.email '41898282+github-actions[bot]@users.noreply.github.com'
@@ -210,7 +207,7 @@ jobs:
210207
needs: [vars,release-draft,tag-release]
211208
permissions:
212209
id-token: write
213-
contents: write # Needed to update a github release
210+
contents: write # Needed to update a release
214211
steps:
215212
- name: Checkout Repository
216213
uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
@@ -246,12 +243,6 @@ jobs:
246243
echo "$GPG_KEY" | base64 --decode > ${NFPM_SIGNING_KEY_FILE}
247244
make package
248245
249-
- name: Install GPG tools
250-
if: ${{ inputs.publishPackages == true }}
251-
run: |
252-
sudo apt-get update
253-
sudo apt-get install -y gpgv1 monkeysphere
254-
255246
- name: Get Id Token
256247
if: ${{ inputs.publishPackages == true }}
257248
uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
@@ -294,6 +285,7 @@ jobs:
294285
head: '${{ inputs.releaseBranch }}',
295286
base: 'main',
296287
body: [
297-
'This PR is auto-generated by the release workflow.'
288+
'This PR was auto-generated by the release workflow.',
289+
'NOTE: DO NOT squash commits when merging!!',
298290
].join('\n')
299291
});

‎.github/workflows/upload-release-assets.yml‎

Lines changed: 16 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ on:
1212
type: string
1313
default: ""
1414
uploadAzure:
15-
description: 'Publish packages Azure storage'
15+
description: 'Publish packages to Azure blob storage'
1616
type: boolean
1717
default: false
1818
uploadGithub:
@@ -25,7 +25,7 @@ defaults:
2525
shell: bash
2626

2727
permissions:
28-
contents: read
28+
contents: write
2929

3030
jobs:
3131
vars:
@@ -63,31 +63,20 @@ jobs:
6363
echo "Checking Packages in ${{inputs.pkgRepo}}/nginx-agent"
6464
echo "${{secrets.PUBTEST_CERT}}" > pubtest.crt
6565
echo "${{secrets.PUBTEST_KEY}}" > pubtest.key
66-
PKG_REPO=${{inputs.pkgRepo}} CERT=pubtest.crt KEY=pubtest.key DL=1 scripts/packages/package-check.sh ${{inputs.pkgVersion}}
67-
for i in $(find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}"); do
68-
if [[ "$i" == *.deb ]]; then
69-
echo "Renaming ${i} to ${i/_/-}"
70-
mv "${i}" "${i/_/-}"
71-
fi
72-
if [[ "$i" == *.apk ]]; then
73-
ver=$(echo "$i" | grep -o -e "v[0-9]*\.[0-9]*")
74-
arch=$(echo "$i" | grep -o -F -e "x86_64" -e "aarch64")
75-
dest="$(dirname "$i")/nginx-agent-${{inputs.pkgVersion}}-$ver-$arch.apk"
76-
echo "Renaming ${i} to ${dest}"
77-
mv "${i}" "${dest}"
78-
fi
79-
done
80-
find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}"
66+
67+
DL=1 PKG_REPO=${{inputs.pkgRepo}} \
68+
CERT=pubtest.crt KEY=pubtest.key \
69+
scripts/packages/package-check.sh ${{inputs.pkgVersion}}
8170

8271
- name: GitHub Upload
83-
continue-on-error: true
8472
if: ${{ needs.vars.outputs.github_release == 'true' }}
8573
env:
8674
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8775
# clobber overwrites existing assets of the same name
8876
run: |
77+
gh release list
8978
gh release upload --clobber v${{ inputs.pkgVersion }} \
90-
$(find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}")
79+
$(find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}" | grep -v "azure")
9180
9281
- name: Azure Login
9382
if: ${{ inputs.uploadAzure == true }}
@@ -100,8 +89,14 @@ jobs:
10089
uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
10190
with:
10291
inlineScript: |
103-
for i in $(find ${{inputs.pkgRepo}}/nginx-agent | grep -e "nginx-agent[_-]${{inputs.pkgVersion}}"); do
104-
dest="nginx-agent/${GITHUB_REF##*/}/${i##*/}"
92+
echo "Uploading tarball... nginx-agent/release-${{ inputs.pkgVersion }}/nginx-agent.tar.gz"
93+
az storage blob upload --auth-mode=login -f "${{ inputs.pkgRepo }}/nginx-agent/nginx-agent.tar.gz" \
94+
-c ${{ secrets.AZURE_CONTAINER_NAME }} \
95+
--account-name ${{ secrets.AZURE_ACCOUNT_NAME }} --overwrite -n nginx-agent/release-${{ inputs.pkgVersion }}/nginx-agent.tar.gz
96+
97+
echo "Uploading packages..."
98+
for i in $(find ${{ inputs.pkgRepo }}/nginx-agent | grep -e "nginx-agent[_-]${{ inputs.pkgVersion }}"); do
99+
dest="nginx-agent/release-${{ inputs.pkgVersion }}/${i##*/}"
105100
echo "Uploading ${i} to ${dest}"
106101
az storage blob upload --auth-mode=login -f "$i" -c ${{ secrets.AZURE_CONTAINER_NAME }} \
107102
--account-name ${{ secrets.AZURE_ACCOUNT_NAME }} --overwrite -n ${dest}

‎Makefile.packaging‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ $(PACKAGES_DIR):
3535
@mkdir -p $(PACKAGES_DIR)/deb && mkdir -p $(PACKAGES_DIR)/rpm && mkdir -p $(PACKAGES_DIR)/apk
3636

3737
.PHONY: package
38-
package: $(PACKAGES_DIR) #### Create final packages for all supported distros
38+
package: gpg-key $(PACKAGES_DIR) #### Create final packages for all supported distros
3939

4040
# Build binaries for all supported architectures
4141
@for arch in $(DEB_ARCHS); do \
@@ -145,7 +145,12 @@ package: $(PACKAGES_DIR) #### Create final packages for all supported distros
145145

146146
.PHONY: gpg-key
147147
gpg-key: ## Generate GPG public key
148-
$$(gpg --import $(NFPM_SIGNING_KEY_FILE)); \
148+
@if [ -z "$(NFPM_SIGNING_KEY_FILE)" ]; then \
149+
echo "NFPM_SIGNING_KEY_FILE is not set. Exiting..."; \
150+
exit 1; \
151+
fi
152+
@echo "Generating GPG public key for package signing...";
153+
@$$(gpg --import $(NFPM_SIGNING_KEY_FILE)); \
149154
keyid=$$(gpg --list-keys NGINX | egrep -A1 "^pub" | egrep -v "^pub" | tr -d '[:space:]'); \
150155
if [ -z "$$keyid" ]; then echo "Error: GPG key not found."; exit 1; fi; \
151156
# Check if the key is expired \

0 commit comments

Comments
 (0)