[Campaign] Ensure Github workflow runs on docker image used by Production Distribution Build

[peterzhuamazon]

Hi All,

This is coming from the campaign here:

• [Meta] Ensure Github workflow runs on docker image used by Production Distribution Build opensearch-build#3966

Overview

We would like your CI check (specifically plugin build) in GitHub Repo to run on top of the Build Docker Images from production distribution pipeline.

This is to ensure every plugin repo will use the exact docker images we used in Jenkins build, to check their PRs and run tests before merging the code, so that issues can be detected earlier, and environment can be identical across teams.

Solutions

The Build Team has created a simple script to dynamically retrieve the current docker image name/tag, so everyone can easily pull the images for their CI checks.

We have a trial run of the above with k-NN team. The script retrieves the docker image dynamically, save output, and use it as the docker image to pull for the upcoming run:

• Adding get-ci-image-tag dynamic retrival on CI workflows k-NN#1099

Note that GitHub Actions only support LINUX docker container at the time of this writing, so we will add Windows containers later on as well as macOS.

Implementation Notes

We would like you to review above PR and implement similar changes. Note on line 33 of the above k-NN PR, -u and -p parameters needs to assign values accordingly.

• OpenSearch Plugin:

          CI_IMAGE_VERSION=`opensearch-build/docker/ci/get-ci-images.sh -p centos7 -u opensearch -t build | head -1`

• OpenSearch-Dashboards Plugin:

          CI_IMAGE_VERSION=`opensearch-build/docker/ci/get-ci-images.sh -p rockylinux8 -u opensearch-dashboards -t build | head -1`

Note that in the above k-NN PR, despite it being OpenSearch plugin, it still uses rockylinux8, as we initially plan to upgrade to rockylinux. We have since revert back to centos7 to support older versions of systems running k-NN lib. As a result, all OpenSearch plugins still uses centos7 for the time being, and all OpenSearch-Dashboards plugins can go to rockylinux8.

Completion Date

The above should be implemented by Nov. 1, 2023 (2023-11-01) by Plugin Owners to their repository.
And backport the changes to 2.x branch after merging in main branch.

Contacts

Please contact @peterzhuamazon for any questions on this campaign.

cc: @bbarani

Thanks.

[stephen-crawford]

[Triage] Hi @peterzhuamazon, thank you for filing this issue. At this time, the Security repos do not have enough context around the purpose of this change... It seems like this is adding responsibility to the Security repo without context for the change. Could you provide a case for this change and why we should address it on such an aggressive time scale (11/1)?

Thank you.

[peterzhuamazon]

Hi @scrawfor99 I will work with you on this soon.

Thanks.

[peterzhuamazon]

We have a new approach established here.
Please see this sample workflow file from Alerting for example:
https://github.com/opensearch-project/alerting/blob/main/.github/workflows/multi-node-test-workflow.yml

Thanks.

[stephen-crawford]

Hi @peterzhuamazon, thanks for following up. Looking at the workflow you shared, it seems like the idea is to just use the docker image to make things more standardized? Have there been issues around this area?

I am not against the change, just want to make sure we (security) have the context for the root of the change.

[stephen-crawford]

Hi @peterzhuamazon, just following up. Are you still pursuing this campaign? If not, we will close this issue. Thank you.

[peterzhuamazon]

Hi @peterzhuamazon, thanks for following up. Looking at the workflow you shared, it seems like the idea is to just use the docker image to make things more standardized? Have there been issues around this area?

I am not against the change, just want to make sure we (security) have the context for the root of the change.

Yes @scrawfor99 this is for standardizing the github run env to be the same as on Jenkins during prod release build.

[peterzhuamazon]

Due to the complexity of the workflows, we need to work with security team to understand the process before onboarding the docker images.

[stephen-crawford]

Hi @peterzhuamazon, just checking in if there was anything you needed from the Security repos at this time. Thanks

[stephen-crawford]

@reta to follow-up.

[peternied]

@peterzhuamazon This recommendation creates a circular dependency between security and OpenSearch-build repos please publish a GitHub action that can be consumed instead of a file [1]

• [1] Get CI Image Tag should be published as a GitHub action opensearch-build#4296