ci: add performance script to PR jobs #2537
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Node Build | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '0 21 * * *' | |
| pull_request: | |
| branches: | |
| - '**' | |
| push: | |
| branches: | |
| - main | |
| - release/v* | |
| jobs: | |
| prerequisite: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/workflows/rafiki/env-setup | |
| - run: pnpm checks | |
| backend: | |
| runs-on: ubuntu-latest | |
| needs: prerequisite | |
| timeout-minutes: 25 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/workflows/rafiki/env-setup | |
| - run: pnpm --filter backend build:deps | |
| - run: NODE_OPTIONS="--max-old-space-size=4096" pnpm --filter backend test:ci | |
| - name: AsyncAPI extension | |
| run: | | |
| echo "{\"extends\":[\"spectral:oas\",\"spectral:asyncapi\"]}" >> .spectral.json | |
| - name: Validate Open API specs | |
| run: | | |
| npx @stoplight/spectral-cli lint ./packages/backend/src/openapi/specs/*.yaml | |
| frontend: | |
| runs-on: ubuntu-latest | |
| needs: prerequisite | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/workflows/rafiki/env-setup | |
| - run: pnpm --filter frontend typecheck | |
| - run: pnpm --filter frontend build | |
| auth: | |
| runs-on: ubuntu-latest | |
| needs: prerequisite | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/workflows/rafiki/env-setup | |
| - run: pnpm --filter auth build:deps | |
| - run: pnpm --filter auth test | |
| - name: AsyncAPI extension | |
| run: | | |
| echo "{\"extends\":[\"spectral:oas\",\"spectral:asyncapi\"]}" >> .spectral.json | |
| - name: Validate Open API specs | |
| run: | | |
| npx @stoplight/spectral-cli lint ./packages/auth/src/openapi/specs/*.yaml | |
| token-introspection: | |
| runs-on: ubuntu-latest | |
| needs: prerequisite | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/workflows/rafiki/env-setup | |
| - run: pnpm --filter token-introspection test | |
| - name: AsyncAPI extension | |
| run: | | |
| echo "{\"extends\":[\"spectral:oas\",\"spectral:asyncapi\"]}" >> .spectral.json | |
| - name: Validate Open API specs | |
| run: | | |
| npx @stoplight/spectral-cli lint ./packages/token-introspection/src/openapi/specs/*.yaml | |
| mock-account-servicing-entity: | |
| runs-on: ubuntu-latest | |
| needs: prerequisite | |
| timeout-minutes: 5 | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/workflows/rafiki/env-setup | |
| - run: pnpm --filter mock-account-servicing-entity build | |
| - run: pnpm --filter mock-account-servicing-entity typecheck | |
| graphql: | |
| runs-on: ubuntu-latest | |
| needs: prerequisite | |
| strategy: | |
| matrix: | |
| package: [auth, backend] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/workflows/rafiki/env-setup | |
| - name: generate ${{ matrix.package }} graphql | |
| run: pnpm --filter ${{ matrix.package }} generate | |
| - name: verify changed files | |
| uses: tj-actions/verify-changed-files@v19 | |
| id: verify-changed-files | |
| with: | |
| files: | | |
| **/generated/graphql.* | |
| - name: fail if GraphQL was generated | |
| if: steps.verify-changed-files.outputs.files_changed == 'true' | |
| run: exit 1 | |
| codeql-analyze: | |
| runs-on: ubuntu-latest | |
| needs: prerequisite | |
| timeout-minutes: 5 | |
| permissions: | |
| actions: read | |
| contents: read | |
| security-events: write | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| language: [ 'javascript' ] | |
| config: | |
| - './.github/codeql/source.yml' | |
| - './.github/codeql/tests.yml' | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/workflows/rafiki/env-setup | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: ${{ matrix.language }} | |
| config-file: ${{ matrix.config }} | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| integration-test: | |
| runs-on: ubuntu-22.04 | |
| needs: prerequisite | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup environment | |
| uses: ./.github/workflows/rafiki/env-setup | |
| - name: Setup hosts | |
| run: | | |
| echo "127.0.0.1 cloud-nine-wallet-test-backend" | sudo tee -a /etc/hosts | |
| echo "127.0.0.1 cloud-nine-wallet-test-auth" | sudo tee -a /etc/hosts | |
| echo "127.0.0.1 happy-life-bank-test-backend" | sudo tee -a /etc/hosts | |
| echo "127.0.0.1 happy-life-bank-test-auth" | sudo tee -a /etc/hosts | |
| - name: Build dependencies | |
| run: pnpm --filter integration build:deps | |
| - name: Run tests | |
| run: pnpm --filter integration run-tests | |
| # Performance script options | |
| # - use k6 actions for everything. k6 install and k6 run configrued to upload. | |
| # kinda conflicts with how tests are setup to run with run-tests.sh script. | |
| # Would need to rework or duplucate some stuff in ci (setting env vars, ???) | |
| # - just use k6 action to install then run and comment manually in action. | |
| # - probably not ideal because logic to comment may be a bit complicated and lose all the free stuff | |
| # we get from uploading to cloud k6 (history? formatting, etc.). Would probably want to save | |
| # results as json to parse for the comment. | |
| # - combination... just k6 action to install then run manually (with run-tests.sh) and upload | |
| # run to k6 cloud. | |
| # - Might be ok... not sure if we lose anything from running with the k6 action configured to upload | |
| # - enables us to use the run-scripts.sh | |
| # Install k6 via action, run against this native k6 with run-test.sh, no comment | |
| # performance-test: | |
| # runs-on: ubuntu-22.04 | |
| # needs: prerequisite | |
| # timeout-minutes: 5 | |
| # steps: | |
| # - name: Checkout code | |
| # uses: actions/checkout@v4 | |
| # - name: Setup environment | |
| # uses: ./.github/workflows/rafiki/env-setup | |
| # - name: Set up k6 | |
| # uses: grafana/setup-k6-action@v1 | |
| # - name: Setup hosts | |
| # run: | | |
| # echo "127.0.0.1 cloud-nine-wallet-test-backend" | sudo tee -a /etc/hosts | |
| # echo "127.0.0.1 cloud-nine-wallet-test-auth" | sudo tee -a /etc/hosts | |
| # echo "127.0.0.1 happy-life-bank-test-backend" | sudo tee -a /etc/hosts | |
| # echo "127.0.0.1 happy-life-bank-test-auth" | sudo tee -a /etc/hosts | |
| # - name: Build dependencies | |
| # run: pnpm --filter performance build:deps | |
| # - name: Bundle | |
| # run: pnpm --filter performance bundle | |
| # - name: Start test environment | |
| # run: pnpm --filter performance testenv:compose up --wait --build -d | |
| # - name: Start Mock Account Entity Services | |
| # run: nohup pnpm --filter performance start-mases > mases.log 2>&1 & | |
| # - name: Run performance tests | |
| # id: perf_test | |
| # run: pnpm --filter performance run-tests:testenv | |
| # continue-on-error: true # Dont fail here, allows showing logs | |
| # - name: Print MASE logs | |
| # if: always() | |
| # run: cat mases.log | |
| # - name: Fail if performance tests failed | |
| # if: steps.perf_test.outcome == 'failure' | |
| # run: exit 1 | |
| # Install k6 via action, run against this native k6 with run-test.sh, manual comment (log only) | |
| performance-test: | |
| runs-on: ubuntu-22.04 | |
| needs: prerequisite | |
| timeout-minutes: 5 | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup environment | |
| uses: ./.github/workflows/rafiki/env-setup | |
| - name: Set up k6 | |
| uses: grafana/setup-k6-action@v1 | |
| - name: Setup hosts | |
| run: | | |
| echo "127.0.0.1 cloud-nine-wallet-test-backend" | sudo tee -a /etc/hosts | |
| echo "127.0.0.1 cloud-nine-wallet-test-auth" | sudo tee -a /etc/hosts | |
| echo "127.0.0.1 happy-life-bank-test-backend" | sudo tee -a /etc/hosts | |
| echo "127.0.0.1 happy-life-bank-test-auth" | sudo tee -a /etc/hosts | |
| - name: Build dependencies | |
| run: pnpm --filter performance build:deps | |
| - name: Bundle | |
| run: pnpm --filter performance bundle | |
| - name: Start test environment | |
| run: pnpm --filter performance testenv:compose up --wait --build -d | |
| - name: Start Mock Account Entity Services | |
| run: nohup pnpm --filter performance start-mases > mases.log 2>&1 & | |
| - name: Run performance tests | |
| id: perf_test | |
| run: | | |
| pnpm --filter performance run-tests:testenv | tee performance.log | |
| continue-on-error: true # Dont fail here, allows showing logs | |
| - name: Print MASE logs | |
| if: always() | |
| run: cat mases.log | |
| - name: Post/Update Performance Test Logs as PR Comment | |
| if: always() | |
| uses: actions/github-script@v7 | |
| with: | |
| github-token: ${{ secrets.GITHUB_TOKEN }} | |
| script: | | |
| const fs = require('fs'); | |
| const logContent = fs.readFileSync('performance.log', 'utf8'); | |
| const truncatedLog = logContent.length > 65000 ? logContent.slice(-65000) : logContent; // GitHub limits comments to ~65KB | |
| const commentBody = `### Performance Test Results 🚀\n\`\`\`\n${truncatedLog}\n\`\`\``; | |
| const { owner, repo } = context.repo; | |
| const prNumber = context.payload.pull_request?.number; | |
| if (prNumber) { | |
| // Fetch existing comments on the PR | |
| const comments = await github.rest.issues.listComments({ | |
| owner, | |
| repo, | |
| issue_number: prNumber | |
| }); | |
| // Look for an existing comment with the "Performance Test Results" title | |
| const existingComment = comments.data.find(comment => comment.body.includes('### Performance Test Results')); | |
| if (existingComment) { | |
| // If a comment exists, update it | |
| await github.rest.issues.updateComment({ | |
| owner, | |
| repo, | |
| comment_id: existingComment.id, | |
| body: commentBody | |
| }); | |
| } else { | |
| // If no comment exists, create a new one | |
| await github.rest.issues.createComment({ | |
| owner, | |
| repo, | |
| issue_number: prNumber, | |
| body: commentBody | |
| }); | |
| } | |
| } else { | |
| console.log("No PR detected, skipping comment."); | |
| } | |
| - name: Fail if performance tests failed | |
| if: steps.perf_test.outcome == 'failure' | |
| run: exit 1 | |
| # Install k6 via action, run against this native k6 with run-test.sh, manual comment (summary, not logs) | |
| # performance-test: | |
| # runs-on: ubuntu-22.04 | |
| # needs: prerequisite | |
| # timeout-minutes: 5 | |
| # steps: | |
| # - name: Checkout code | |
| # uses: actions/checkout@v4 | |
| # - name: Setup environment | |
| # uses: ./.github/workflows/rafiki/env-setup | |
| # - name: Set up k6 | |
| # uses: grafana/setup-k6-action@v1 | |
| # - name: Setup hosts | |
| # run: | | |
| # echo "127.0.0.1 cloud-nine-wallet-test-backend" | sudo tee -a /etc/hosts | |
| # echo "127.0.0.1 cloud-nine-wallet-test-auth" | sudo tee -a /etc/hosts | |
| # echo "127.0.0.1 happy-life-bank-test-backend" | sudo tee -a /etc/hosts | |
| # echo "127.0.0.1 happy-life-bank-test-auth" | sudo tee -a /etc/hosts | |
| # - name: Build dependencies | |
| # run: pnpm --filter performance build:deps | |
| # - name: Bundle | |
| # run: pnpm --filter performance bundle | |
| # - name: Start test environment | |
| # run: pnpm --filter performance testenv:compose up --wait --build -d | |
| # - name: Start Mock Account Entity Services | |
| # run: nohup pnpm --filter performance start-mases > mases.log 2>&1 & | |
| # - name: Run performance tests | |
| # id: perf_test | |
| # run: | | |
| # pnpm --filter performance run-tests:testenv | tee performance.log | |
| # continue-on-error: true # Don't fail here, allows showing logs | |
| # - name: Print MASE logs | |
| # if: always() | |
| # run: cat mases.log | |
| # - name: Post/Update Performance Test Results as PR Comment | |
| # if: always() | |
| # uses: actions/github-script@v7 | |
| # with: | |
| # github-token: ${{ secrets.GITHUB_TOKEN }} | |
| # script: | | |
| # const fs = require('fs'); | |
| # const summaryPath = './test/performance/k6test-summary.txt'; | |
| # const logPath = './performance.log'; | |
| # let summaryContent = ''; | |
| # let logContent = ''; | |
| # // Read the k6 summary file | |
| # if (fs.existsSync(summaryPath)) { | |
| # summaryContent = fs.readFileSync(summaryPath, 'utf8'); | |
| # } else { | |
| # summaryContent = 'Performance test summary not found.'; | |
| # } | |
| # // Read the full logs | |
| # if (fs.existsSync(logPath)) { | |
| # logContent = fs.readFileSync(logPath, 'utf8'); | |
| # } else { | |
| # logContent = 'Performance log not found.'; | |
| # } | |
| # // GitHub comment size limit handling (truncate logs if necessary) | |
| # const maxLogSize = 60000; // 60KB limit | |
| # const truncatedLogs = logContent.length > maxLogSize ? `...(truncated)...\n${logContent.slice(-maxLogSize)}` : logContent; | |
| # const commentBody = ` | |
| # ### 🚀 Performance Test Results | |
| # ${summaryContent} | |
| # <details> | |
| # <summary>📜 Performance Logs</summary> | |
| # \`\`\` | |
| # ${truncatedLogs} | |
| # \`\`\` | |
| # </details> | |
| # `; | |
| # const { owner, repo } = context.repo; | |
| # const prNumber = context.payload.pull_request?.number; | |
| # if (prNumber) { | |
| # // Fetch existing comments on the PR | |
| # const comments = await github.rest.issues.listComments({ | |
| # owner, | |
| # repo, | |
| # issue_number: prNumber | |
| # }); | |
| # // Look for an existing comment with the "Performance Test Results" title | |
| # const existingComment = comments.data.find(comment => comment.body.includes('🚀 Performance Test Results')); | |
| # if (existingComment) { | |
| # // If a comment exists, update it | |
| # await github.rest.issues.updateComment({ | |
| # owner, | |
| # repo, | |
| # comment_id: existingComment.id, | |
| # body: commentBody | |
| # }); | |
| # } else { | |
| # // If no comment exists, create a new one | |
| # await github.rest.issues.createComment({ | |
| # owner, | |
| # repo, | |
| # issue_number: prNumber, | |
| # body: commentBody | |
| # }); | |
| # } | |
| # } else { | |
| # console.log("No PR detected, skipping comment."); | |
| # } | |
| # - name: Fail if performance tests failed | |
| # if: steps.perf_test.outcome == 'failure' | |
| # run: exit 1 | |
| node-build: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| needs: [auth, backend, frontend, token-introspection, mock-account-servicing-entity, graphql, codeql-analyze, integration-test] | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/workflows/rafiki/env-setup | |
| - run: pnpm build | |
| version-generator: | |
| runs-on: ubuntu-latest | |
| outputs: | |
| version: ${{ steps.version-generator.outputs.NEW_VERSION }} | |
| tagPushed: ${{ steps.version-generator.outputs.SHOULD_PUSH_TAG }} | |
| dockerPush: ${{ steps.version-generator.outputs.PUSH_DOCKER_IMAGE }} | |
| generateRelease: ${{ steps.version-generator.outputs.GENERATE_RELEASE }} | |
| steps: | |
| - uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| fetch-tags: true | |
| - name: Configure git | |
| run: | | |
| git config --global user.name "github-actions[bot]" | |
| git config --global user.email "github-actions[bot]@users.noreply.github.com" | |
| - id: version-generator | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| SHOULD_PUSH_TAG=false | |
| PUSH_DOCKER_IMAGE=false | |
| GENERATE_RELEASE=false | |
| if [ "${{ github.event_name == 'schedule' }}" = true ]; then | |
| PUSH_DOCKER_IMAGE=true | |
| NEW_VERSION="nightly" | |
| elif [ "${{ github.event_name == 'workflow_dispatch' }}" = true ]; then | |
| NEW_VERSION="manual" | |
| elif [ "${{ startsWith(github.ref_name, 'release/v')}}" = true ]; then | |
| PUSH_DOCKER_IMAGE=true | |
| SHOULD_PUSH_TAG=true | |
| GENERATE_RELEASE=true | |
| VERSION_PREFIX=$(echo "${{ github.ref_name }}" | sed 's|release/||') | |
| read major minor patch pre_release <<< $(echo "$VERSION_PREFIX" | awk -F'[.v-]' '{print $2, $3, $4, $5}') | |
| version_search="v$major.$minor.*" | |
| if [ -n "$pre_release" ]; then | |
| version_search="$version_search-$pre_release" | |
| fi | |
| echo "VERSION_SEARCH: $version_search" | |
| VERSION_PREFIX=$(git tag -l $version_search --sort=-taggerdate | head -n 1) | |
| if [ -n "$VERSION_PREFIX" ]; then | |
| read major minor patch pre_release <<< $(echo "$VERSION_PREFIX" | awk -F'[.v-]' '{print $2, $3, $4, $5}') | |
| patch=$((patch + 1)) | |
| fi | |
| NEW_VERSION="v${major}.${minor}.${patch}" | |
| if [ -n "$pre_release" ]; then | |
| NEW_VERSION="$NEW_VERSION-${pre_release}" | |
| fi | |
| else | |
| NEW_VERSION=$(echo "${{ github.ref_name }}" | sed 's/[^a-zA-Z0-9_.-]/_/g') | |
| if [[ ! "$NEW_VERSION" =~ ^[a-zA-Z0-9] ]]; then | |
| NEW_VERSION="tag_$NEW_VERSION" | |
| fi | |
| fi | |
| echo "NEW_VERSION=$NEW_VERSION" >> $GITHUB_OUTPUT | |
| echo "New version will be: $NEW_VERSION" | |
| echo "SHOULD_PUSH_TAG=$SHOULD_PUSH_TAG" >> $GITHUB_OUTPUT | |
| echo "Will tag be pushed? $SHOULD_PUSH_TAG" | |
| echo "PUSH_DOCKER_IMAGE=$PUSH_DOCKER_IMAGE" >> $GITHUB_OUTPUT | |
| echo "Will docker image be pushed? $PUSH_DOCKER_IMAGE" | |
| echo "GENERATE_RELEASE=$GENERATE_RELEASE" >> $GITHUB_OUTPUT | |
| echo "Will generate release noted? $GENERATE_RELEASE" | |
| if [ "$SHOULD_PUSH_TAG" = true ]; then | |
| git tag -fa $NEW_VERSION -m "$NEW_VERSION" | |
| git push -f origin $NEW_VERSION | |
| fi | |
| docker-build: | |
| runs-on: ubuntu-latest | |
| needs: version-generator | |
| timeout-minutes: 10 | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| strategy: | |
| matrix: | |
| platform: | |
| - arch: linux/amd64 | |
| name: amd64 | |
| - arch: linux/arm64 | |
| name: arm64 | |
| package: | |
| - auth | |
| - backend | |
| - frontend | |
| steps: | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Build | |
| uses: docker/build-push-action@v5 | |
| with: | |
| push: false | |
| platforms: ${{ matrix.platform.arch }} | |
| file: packages/${{ matrix.package }}/Dockerfile.prod | |
| tags: ghcr.io/${{ github.repository_owner }}/rafiki-${{ matrix.package }}-${{ matrix.platform.name }}:${{ needs.version-generator.outputs.version }} | |
| outputs: type=docker,dest=/tmp/${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }}.tar | |
| - name: Save docker image to cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: /tmp/${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }}.tar | |
| key: ${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }} | |
| docker-grype: | |
| name: Docker Grype Scan | |
| needs: [version-generator, docker-build] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| strategy: | |
| matrix: | |
| platform: | |
| - arch: linux/amd64 | |
| name: amd64 | |
| - arch: linux/arm64 | |
| name: arm64 | |
| package: | |
| - auth | |
| - backend | |
| - frontend | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Fetch docker image from cache | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: /tmp/${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }}.tar | |
| key: ${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }} | |
| fail-on-cache-miss: true | |
| - name: Docker list | |
| run: | | |
| docker images | |
| - name: Scan docker image | |
| uses: anchore/scan-action@v3 | |
| with: | |
| image: /tmp/${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }}.tar | |
| fail-build: true | |
| only-fixed: true | |
| severity-cutoff: high | |
| output-format: table | |
| docker-trivy: | |
| name: Docker Trivy Scan | |
| needs: [version-generator, docker-build] | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 5 | |
| strategy: | |
| matrix: | |
| platform: | |
| - arch: linux/amd64 | |
| name: amd64 | |
| - arch: linux/arm64 | |
| name: arm64 | |
| package: | |
| - auth | |
| - backend | |
| - frontend | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - name: Fetch docker image from cache | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: /tmp/${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }}.tar | |
| key: ${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }} | |
| fail-on-cache-miss: true | |
| - name: Download Trivy | |
| run: | | |
| curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh -s -- -b /tmp | |
| - name: Scan docker image | |
| run: | | |
| docker images | |
| /tmp/trivy image --db-repository ghcr.io/aquasecurity/trivy-db,public.ecr.aws/aquasecurity/trivy-db --java-db-repository ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db --ignore-unfixed --format table --vuln-type os,library --exit-code 1 --severity HIGH --input /tmp/${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }}.tar | |
| push: | |
| name: Push to registry | |
| needs: [version-generator, docker-grype, docker-trivy, version-generator, node-build] | |
| runs-on: ubuntu-latest | |
| if: needs.version-generator.outputs.dockerPush == 'true' | |
| strategy: | |
| matrix: | |
| platform: | |
| - arch: linux/amd64 | |
| name: amd64 | |
| - arch: linux/arm64 | |
| name: arm64 | |
| package: | |
| - auth | |
| - backend | |
| - frontend | |
| steps: | |
| - name: Fetch docker image from cache | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: /tmp/${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }}.tar | |
| key: ${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }} | |
| fail-on-cache-miss: true | |
| - name: Set up QEMU | |
| uses: docker/setup-qemu-action@v3 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v3 | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Load image into Docker | |
| run: | | |
| docker load --input /tmp/${{ github.sha }}-${{ matrix.package }}-${{ matrix.platform.name }}-${{ needs.version-generator.outputs.version }}.tar | |
| - name: List docker images | |
| run: docker images | |
| - name: Push to registry | |
| run: | | |
| docker push ghcr.io/${{ github.repository_owner }}/rafiki-${{ matrix.package }}-${{ matrix.platform.name }}:${{ needs.version-generator.outputs.version }} | |
| push-manifest: | |
| name: Push multi-arch manifest list | |
| needs: [version-generator, push] | |
| runs-on: ubuntu-latest | |
| if: needs.version-generator.outputs.dockerPush == 'true' | |
| strategy: | |
| matrix: | |
| package: | |
| - auth | |
| - backend | |
| - frontend | |
| steps: | |
| - name: Login to GHCR | |
| uses: docker/login-action@v3 | |
| with: | |
| registry: ghcr.io | |
| username: ${{ github.repository_owner }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Create manifest list | |
| run: | | |
| docker manifest create ghcr.io/${{ github.repository_owner }}/rafiki-${{ matrix.package }}:${{ needs.version-generator.outputs.version }} \ | |
| --amend ghcr.io/${{ github.repository_owner }}/rafiki-${{ matrix.package }}-amd64:${{ needs.version-generator.outputs.version }} \ | |
| --amend ghcr.io/${{ github.repository_owner }}/rafiki-${{ matrix.package }}-arm64:${{ needs.version-generator.outputs.version }} | |
| - name: Push manifest list | |
| run: | | |
| docker manifest push ghcr.io/${{ github.repository_owner }}/rafiki-${{ matrix.package }}:${{ needs.version-generator.outputs.version }} | |
| generate-release: | |
| runs-on: ubuntu-latest | |
| needs: [push-manifest, version-generator] | |
| if: needs.version-generator.outputs.generateRelease == 'true' | |
| steps: | |
| - name: Checkout Code | |
| uses: actions/checkout@v4 | |
| - name: Generate CHANGELOG data | |
| id: changelog | |
| uses: requarks/changelog-action@v1 | |
| with: | |
| token: ${{ github.token }} | |
| tag: ${{ needs.version-generator.outputs.version }} | |
| includeRefIssues: false | |
| - name: Create Release | |
| uses: ncipollo/[email protected] | |
| with: | |
| allowUpdates: true | |
| draft: false | |
| makeLatest: true | |
| prerelease: endsWith(needs.version-generator.outputs.version, '-alpha') | |
| name: ${{ needs.version-generator.outputs.version }} | |
| body: ${{ steps.changelog.outputs.changes }} | |
| tag: ${{ needs.version-generator.outputs.version }} | |
| token: ${{ github.token }} |