From c32835df2e4ebfc89b30bd6dc4d948526fd66683 Mon Sep 17 00:00:00 2001 From: fbrodrigorezino Date: Thu, 3 Apr 2025 13:20:47 -0300 Subject: [PATCH] Add base files from github actions --- .github/workflows/main.yaml | 86 +++++++++++++++++++++++++++++++++++++ .github/workflows/pr.yaml | 81 ++++++++++++++++++++++++++++++++++ .gitignore | 1 + scripts/vars.sh | 43 +++++++++++++++---- 4 files changed, 203 insertions(+), 8 deletions(-) create mode 100644 .github/workflows/main.yaml create mode 100644 .github/workflows/pr.yaml diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml new file mode 100644 index 0000000..2dcc827 --- /dev/null +++ b/.github/workflows/main.yaml @@ -0,0 +1,86 @@ +name: Deploy on Main + +on: + push: + branches: + - main + +env: + TRIVY_VERSION: "0.59.1" + OS_VERSION: debian12 + DEBIAN_NAME: bookworm + CI_SERVER: "yes" + INTERMEDIATE_REGISTRY_BASE: "ghcr.io/${{ github.repository }}" + GOOGLE_DISTROLESS_BASE_IMAGE: "gcr.io/distroless/cc-debian12" + +jobs: + build-and-publish: + runs-on: ubuntu-latest + strategy: + matrix: + include: + - PYTHON_VERSION: "3.11.11" + PYTHON_MINOR: "3.11" + - PYTHON_VERSION: "3.12.9" + PYTHON_MINOR: "3.12" + env: + CI_PIPELINE_ID: ${{ github.run_id }} + TEST_IMAGE_BASE: "ghcr.io/${{ github.repository }}/python-distroless-tests" + PYTHON_INTERMEDIATE_BUILDER_IMAGE: "ghcr.io/${{ github.repository }}/python-builder:${{ matrix.PYTHON_MINOR }}-debian12" + PYTHON_INTERMEDIATE_BUILDER_IMAGE_FULL: "ghcr.io/${{ github.repository }}/python-builder:${{ matrix.PYTHON_VERSION }}-debian12" + PYTHON_INTERMEDIATE_DISTROLESS_IMAGE: "ghcr.io/${{ github.repository }}/python-distroless:${{ matrix.PYTHON_MINOR }}-debian12" + PYTHON_INTERMEDIATE_DISTROLESS_IMAGE_FULL: "ghcr.io/${{ github.repository }}/python-distroless:${{ matrix.PYTHON_VERSION }}-debian12" + PYTHON_FINAL_BUILDER_IMAGE: "ghcr.io/${{ github.repository }}/python-builder:${{ matrix.PYTHON_MINOR }}-debian12" + PYTHON_FINAL_BUILDER_IMAGE_FULL: "ghcr.io/${{ github.repository }}/python-builder:${{ matrix.PYTHON_VERSION }}-debian12" + PYTHON_FINAL_DISTROLESS_IMAGE: "ghcr.io/${{ github.repository }}/python-distroless:${{ matrix.PYTHON_MINOR }}-debian12" + PYTHON_FINAL_DISTROLESS_IMAGE_FULL: "ghcr.io/${{ github.repository }}/python-distroless:${{ matrix.PYTHON_VERSION }}-debian12" + CI_COMMIT_BRANCH: "main" + steps: + - uses: actions/checkout@v3 + + - name: Set Python Env Vars + run: | + echo "PYTHON_VERSION=${{ matrix.PYTHON_VERSION }}" >> $GITHUB_ENV + echo "PYTHON_MINOR=${{ matrix.PYTHON_MINOR }}" >> $GITHUB_ENV + + - name: Set up Docker + uses: docker/setup-buildx-action@v2 + + - name: Docker Login + uses: docker/login-action@v2 + with: + username: ${{ secrets.DOCKER_USERNAME }} + password: ${{ secrets.DOCKER_PASSWORD }} + + - name: GitHub Registry Login + uses: docker/login-action@v2 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Build Builder + run: ./scripts/build-builder.sh + + - name: Build Distroless + run: ./scripts/build-distroless.sh + + - name: Run Tests + run: | + ./scripts/tests.sh --target version + ./scripts/tests.sh --target version --debug + ./scripts/tests.sh --target hello-world + ./scripts/tests.sh --target hello-world --debug + ./scripts/tests.sh --target gunicorn + ./scripts/tests.sh --target fastapi + ./scripts/tests.sh --target pandas + ./scripts/tests.sh --target google-cloud + ./scripts/tests.sh --target kubernetes + + - name: Security Scan + run: ./scripts/scan.sh + + - name: Publish Images + run: | + ./scripts/build-builder.sh --publish + ./scripts/build-distroless.sh --publish diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml new file mode 100644 index 0000000..6f6a2fb --- /dev/null +++ b/.github/workflows/pr.yaml @@ -0,0 +1,81 @@ +name: Pull Request Checks + +on: + pull_request: + branches: + - main + +env: + TRIVY_VERSION: "0.59.1" + OS_VERSION: debian12 + DEBIAN_NAME: bookworm + CI_SERVER: "yes" + INTERMEDIATE_REGISTRY_BASE: "docker.io/${{ secrets.DOCKER_USERNAME }}" + GOOGLE_DISTROLESS_BASE_IMAGE: "gcr.io/distroless/cc-debian12" + +jobs: + test-matrix: + runs-on: ubuntu-latest + strategy: + matrix: + include: + - PYTHON_VERSION: "3.11.11" + PYTHON_MINOR: "3.11" + - PYTHON_VERSION: "3.12.9" + PYTHON_MINOR: "3.12" + env: + CI_PIPELINE_ID: ${{ github.run_id }} + TEST_IMAGE_BASE: "docker.io/${{ secrets.DOCKER_USERNAME }}/python-distroless-tests" + PYTHON_INTERMEDIATE_BUILDER_IMAGE: "docker.io/${{ secrets.DOCKER_USERNAME }}/python-builder:${{ matrix.PYTHON_MINOR }}-debian12" + PYTHON_INTERMEDIATE_BUILDER_IMAGE_FULL: "docker.io/${{ secrets.DOCKER_USERNAME }}/python-builder:${{ matrix.PYTHON_VERSION }}-debian12" + PYTHON_INTERMEDIATE_DISTROLESS_IMAGE: "docker.io/${{ secrets.DOCKER_USERNAME }}/python-distroless:${{ matrix.PYTHON_MINOR }}-debian12" + PYTHON_INTERMEDIATE_DISTROLESS_IMAGE_FULL: "docker.io/${{ secrets.DOCKER_USERNAME }}/python-distroless:${{ matrix.PYTHON_VERSION }}-debian12" + PYTHON_FINAL_BUILDER_IMAGE: "docker.io/${{ secrets.DOCKER_USERNAME }}/python-builder:${{ matrix.PYTHON_MINOR }}-debian12" + PYTHON_FINAL_BUILDER_IMAGE_FULL: "docker.io/${{ secrets.DOCKER_USERNAME }}/python-builder:${{ matrix.PYTHON_VERSION }}-debian12" + PYTHON_FINAL_DISTROLESS_IMAGE: "docker.io/${{ secrets.DOCKER_USERNAME }}/python-distroless:${{ matrix.PYTHON_MINOR }}-debian12" + PYTHON_FINAL_DISTROLESS_IMAGE_FULL: "docker.io/${{ secrets.DOCKER_USERNAME }}/python-distroless:${{ matrix.PYTHON_VERSION }}-debian12" + CI_COMMIT_BRANCH: "PR" + steps: + - uses: actions/checkout@v3 + + - name: Set Python Env Vars + run: | + echo "PYTHON_VERSION=${{ matrix.PYTHON_VERSION }}" >> $GITHUB_ENV + echo "PYTHON_MINOR=${{ matrix.PYTHON_MINOR }}" >> $GITHUB_ENV + + - name: Set up Docker + uses: docker/setup-buildx-action@v2 + + - name: Docker Hub Login + uses: docker/login-action@v2 + with: + registry: docker.io + username: ${{ secrets.DOCKER_USERNAME }} + password: ${{ secrets.DOCKER_PASSWORD }} + + - name: Build Builder + run: ./scripts/build-builder.sh + + - name: Build Distroless + run: ./scripts/build-distroless.sh + + - name: Basic Tests + run: | + ./scripts/tests.sh --target version + ./scripts/tests.sh --target version --debug + ./scripts/tests.sh --target hello-world + ./scripts/tests.sh --target hello-world --debug + + - name: HTTP Tests + run: | + ./scripts/tests.sh --target gunicorn + ./scripts/tests.sh --target fastapi + + - name: Advanced Tests + run: | + ./scripts/tests.sh --target pandas + ./scripts/tests.sh --target google-cloud + ./scripts/tests.sh --target kubernetes + + - name: Security Scan + run: ./scripts/scan.sh \ No newline at end of file diff --git a/.gitignore b/.gitignore index 93c700e..a44f633 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,3 @@ .vscode/ .idea/ +.DS_Store diff --git a/scripts/vars.sh b/scripts/vars.sh index 34e103d..fbfa885 100755 --- a/scripts/vars.sh +++ b/scripts/vars.sh @@ -20,10 +20,15 @@ if [[ -z ${DEBIAN_NAME:-} ]]; then exit 1 fi -INTERMEDIATE_REGISTRY_BASE="al3xos" +# Define the registry base variable +DEFAULT_REGISTRY_BASE="rodrigorezino213" +REGISTRY_BASE="${REGISTRY_BASE:-$DEFAULT_REGISTRY_BASE}" + + +INTERMEDIATE_REGISTRY_BASE="$REGISTRY_BASE" RC="" if [[ ${CI_SERVER:-} == "yes" ]]; then - INTERMEDIATE_REGISTRY_BASE="registry.gitlab.com/al3xos/distroless-python" + INTERMEDIATE_REGISTRY_BASE="$REGISTRY_BASE/distroless-python" if [[ $CI_COMMIT_BRANCH != "main" ]]; then RC="-rc" fi @@ -36,7 +41,7 @@ GOOGLE_DISTROLESS_BASE_IMAGE=gcr.io/distroless/cc-${OS_VERSION} # Cut patch version from semver Python version for streamlined image tags: 3.12.0 -> 3.12 PYTHON_MINOR=$(echo $PYTHON_VERSION | sed -e "s#^\([0-9]*\)\.\([0-9]*\)\.\([0-9]*\)#\1.\2#") -TEST_IMAGE_BASE=registry.gitlab.com/al3xos/distroless-python/python-distroless-tests${RC} +TEST_IMAGE_BASE=$REGISTRY_BASE/distroless-python/python-distroless-tests${RC} if [[ ${CI_SERVER:-} == "yes" ]]; then if [[ $CI_COMMIT_BRANCH != "main" ]]; then @@ -50,10 +55,10 @@ PYTHON_INTERMEDIATE_BUILDER_IMAGE_FULL=${INTERMEDIATE_REGISTRY_BASE}/python-buil PYTHON_INTERMEDIATE_DISTROLESS_IMAGE=${INTERMEDIATE_REGISTRY_BASE}/python-distroless:${PYTHON_MINOR}-${OS_VERSION}${RC} PYTHON_INTERMEDIATE_DISTROLESS_IMAGE_FULL=${INTERMEDIATE_REGISTRY_BASE}/python-distroless:${PYTHON_VERSION}-${OS_VERSION}${RC} -PYTHON_FINAL_BUILDER_IMAGE=al3xos/python-builder:${PYTHON_MINOR}-${OS_VERSION}${RC} -PYTHON_FINAL_BUILDER_IMAGE_FULL=al3xos/python-builder:${PYTHON_VERSION}-${OS_VERSION}${RC} -PYTHON_FINAL_DISTROLESS_IMAGE=al3xos/python-distroless:${PYTHON_MINOR}-${OS_VERSION}${RC} -PYTHON_FINAL_DISTROLESS_IMAGE_FULL=al3xos/python-distroless:${PYTHON_VERSION}-${OS_VERSION}${RC} +PYTHON_FINAL_BUILDER_IMAGE=${REGISTRY_BASE}/python-builder:${PYTHON_MINOR}-${OS_VERSION}${RC} +PYTHON_FINAL_BUILDER_IMAGE_FULL=${REGISTRY_BASE}/python-builder:${PYTHON_VERSION}-${OS_VERSION}${RC} +PYTHON_FINAL_DISTROLESS_IMAGE=${REGISTRY_BASE}/python-distroless:${PYTHON_MINOR}-${OS_VERSION}${RC} +PYTHON_FINAL_DISTROLESS_IMAGE_FULL=${REGISTRY_BASE}/python-distroless:${PYTHON_VERSION}-${OS_VERSION}${RC} if [[ $(echo "${@:-}" | grep -c -- '--debug') -gt 0 ]]; then @@ -68,6 +73,28 @@ if [[ -z ${CI_PIPELINE_ID:-} ]]; then CI_PIPELINE_ID=non-ci-$(git rev-parse --short HEAD) fi +# Print the variables for debugging +echo "-> [INFO] PYTHON_VERSION: ${PYTHON_VERSION}" +echo "-> [INFO] OS_VERSION: ${OS_VERSION}" +echo "-> [INFO] PYTHON_MINOR: ${PYTHON_MINOR}" +echo "-> [INFO] PYTHON_INTERMEDIATE_BUILDER_IMAGE: ${PYTHON_INTERMEDIATE_BUILDER_IMAGE}" +echo "-> [INFO] PYTHON_INTERMEDIATE_BUILDER_IMAGE_FULL: ${PYTHON_INTERMEDIATE_BUILDER_IMAGE_FULL}" +echo "-> [INFO] PYTHON_INTERMEDIATE_DISTROLESS_IMAGE: ${PYTHON_INTERMEDIATE_DISTROLESS_IMAGE}" +echo "-> [INFO] PYTHON_INTERMEDIATE_DISTROLESS_IMAGE_FULL: ${PYTHON_INTERMEDIATE_DISTROLESS_IMAGE_FULL}" +echo "-> [INFO] PYTHON_FINAL_BUILDER_IMAGE: ${PYTHON_FINAL_BUILDER_IMAGE}" +echo "-> [INFO] PYTHON_FINAL_BUILDER_IMAGE_FULL: ${PYTHON_FINAL_BUILDER_IMAGE_FULL}" +echo "-> [INFO] PYTHON_FINAL_DISTROLESS_IMAGE: ${PYTHON_FINAL_DISTROLESS_IMAGE}" +echo "-> [INFO] PYTHON_FINAL_DISTROLESS_IMAGE_FULL: ${PYTHON_FINAL_DISTROLESS_IMAGE_FULL}" +echo "-> [INFO] GOOGLE_DISTROLESS_BASE_IMAGE: ${GOOGLE_DISTROLESS_BASE_IMAGE}" +echo "-> [INFO] TEST_IMAGE_BASE: ${TEST_IMAGE_BASE}" +echo "-> [INFO] CI_PIPELINE_ID: ${CI_PIPELINE_ID}" +echo "-> [INFO] INTERMEDIATE_REGISTRY_BASE: ${INTERMEDIATE_REGISTRY_BASE}" +echo "-> [INFO] REGISTRY_BASE: ${REGISTRY_BASE}" +echo "-> [INFO] RC: ${RC}" +echo "-> [INFO] DEBIAN_NAME: ${DEBIAN_NAME}" +echo "-> [INFO] CI_SERVER: ${CI_SERVER}" +echo "-> [INFO] CI_COMMIT_BRANCH: ${CI_COMMIT_BRANCH}" + export PYTHON_VERSION export PYTHON_MINOR export OS_VERSION @@ -81,4 +108,4 @@ export PYTHON_FINAL_DISTROLESS_IMAGE export PYTHON_FINAL_DISTROLESS_IMAGE_FULL export GOOGLE_DISTROLESS_BASE_IMAGE export TEST_IMAGE_BASE -export CI_PIPELINE_ID +export CI_PIPELINE_ID \ No newline at end of file