Commit Graph

27 Commits

Author SHA1 Message Date
naveensrinivasan
9cacc18c95 Set permissions for GitHub actions
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

https://docs.github.com/en/actions/using-jobs/assigning-permissions-to-jobs

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
2022-03-30 20:36:23 +00:00
Chris Evich
f6963cea13 Cirrus: Build multi-arch images + manifests
Github-actions for large/complex tasks is hard to read and maintain.
Reimplement the multi-arch image build workflow into a set of bash
scripts that use all native contrainer-org tooling.  This requires
a special VM image setup with emulation to build foreign architectures.
It also requires renaming the `helloimage` directory, because the build
script uses the directory name in the image FQIN.

Signed-off-by: Chris Evich <cevich@redhat.com>
2022-03-28 16:56:28 -04:00
naveensrinivasan
1821eb3837 Pin actions to a full length commit SHA
- Pinned actions by SHA https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
- Included permissions for the action. https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions

>Pin actions to a full length commit SHA

>Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

Also dependabot supports upgrades based on SHA.

Signed-off-by: naveensrinivasan <172697+naveensrinivasan@users.noreply.github.com>
2022-03-28 19:00:16 +00:00
Paul Holzinger
525bdc3771 github: label issues based on os
We get a lot of issues for podman-remote on macos. Since the fact that
this is a remote client is often overlooked by us lets add windows, macos
and remote label automatically based on a regex which should match the
output of podman version.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
2022-01-27 17:51:35 +01:00
Chris Evich
6df245c6ec Github-workflow: Fix YAML syntax
The `body` string value must be quoted because it contains a colon.

Also fix an incorrect URL substitution reference in error-notice e-mail
body text.

(In my defense...testing this workflow is basically impractical without
merging it)

Signed-off-by: Chris Evich <cevich@redhat.com>
2022-01-25 12:39:17 -05:00
Chris Evich
29e89da1a2 Github workflow: Send e-mail on job error
This job is designed to be silent when Cirrus-cron executions pass.
Unless specifically instructed, the workflow itself will also remain
silent if there's an error.  Fix this by catching workflow errors and
sending a notification e-mail containing a link to the failed run.  This
also requires listing the recipient addresses directly in the workflow.
Otherwise (as previouslly implemented) the value would not be retrieved
if/when any previous step raised an error.

**Note**: Due to the way this workflow is implemented, there is no way
easy way to test it other than directly on the `main` repo. branch.

Signed-off-by: Chris Evich <cevich@redhat.com>
2022-01-24 15:41:50 -05:00
Chris Evich
32b5892164 Multi-arch image build: Daily version-tag push
This mirrors changes from
https://github.com/containers/buildah/pull/3381

Signed-off-by: Chris Evich <cevich@redhat.com>
2021-07-27 14:15:25 -04:00
Chris Evich
e64545004e [CI:DOCS] Multi-arch image workflow: Make steps generic
This duplicates the change from
https://github.com/containers/skopeo/pull/1379

Since this workflow is duplicated across three repositories, maintaining
changes becomes onerous if the item contents vary between
implementations in any way. Improve this situation by encoding the
repository-specific details into env. vars. then referencing those vars
throughout. This way, a meaningful diff can be worked with to compare
the contents across repositories.

Also included are abstractions for the specific command used to obtain
the project version, and needed details for filtering the output. Both
of these vary across the Buildah, Skopeo, and Podman repos.

NOTE: This change requires the names of two github action secrets
to be updated: PODMAN_QUAY_USERNAME -> REPONAME_QUAY_USERNAME
(and *PASSWORD).

Signed-off-by: Chris Evich <cevich@redhat.com>
2021-07-20 09:43:58 -04:00
Chris Evich
fe044d51ea Fix cirrus-cron failure notification GH workflow
The master->main rename broke this.  Also update the runtime along with
a comment w/ link to the actual job definitions.

Signed-off-by: Chris Evich <cevich@redhat.com>
2021-07-12 10:39:34 -04:00
Chris Evich
6b230bc924 Fix multi-arch image build clone:failure
A suspected recent change in docker (in github-actions Ubuntu
environment) results in a error:

```
cannot clone: Operation not permitted
Error: cannot re-exec process
```

Fix this by using podman to execute the container instead of docker.

Signed-off-by: Chris Evich <cevich@redhat.com>
2021-06-16 16:44:42 -04:00
Chris Evich
3c82059c3d Sync. workflow across skopeo, buildah, and podman
Besides adding ***BIG FAT WARNING*** this commit updates the
containers-repo. logic to only (and properly) handle the `stable` image
(both version and `latest` tags).  This change was already discussed at
length with @TomSweeneyRedHat.

Signed-off-by: Chris Evich <cevich@redhat.com>
2021-05-21 14:39:01 -04:00
Stuart Shelton
60eb4e74d1 Use more recent stale release...
… as currently with `v1`, `remove-stale-when-updated` is set but isn't causing labels to be updated when comments are added.

Signed-off-by: Stuart Shelton <stuart@shelton.me>
2021-05-16 19:02:18 +01:00
Chris Evich
9db9fa2a08 Fix variable reference typo. in multi-arch image action
Bug introduced by #10150

Also, in case of failure of one matrix-leg, do not terminate execution
of all others.  There are many reasons why an item could fail (i.e.
temporary networking problem).  Since the job runs periodically,
we can simply allow the subsequent run to cover for any missed images
pushes due to sporadic job failures.

Signed-off-by: Chris Evich <cevich@redhat.com>
2021-05-03 10:56:34 -04:00
Chris Evich
00f2f7d14e Fix multi-arch image workflow typo
Signed-off-by: Chris Evich <cevich@redhat.com>
2021-04-30 13:50:41 -04:00
Chris Evich
21bef6db6e Update container image docs + fix unstable execution
Update the order of image documentation to be from most to least stable.
Similarly, avoid depending on execution of upstream podman, when
building/pushing.  It's easily possible for this build to function but
execution to fail due to some partially implemented feature.

Also, ensure images tagged `latest` are pushed for every matrix
item.  For 'upstream' and 'testing', this replaces use of the
'master' tag.

Lastly, update workflow comments and split the 'podman' and 'containers'
FQIN steps and outputs to improve readability.

Signed-off-by: Chris Evich <cevich@redhat.com>
2021-04-29 11:23:59 -04:00
Chris Evich
17c82caac4 Fix logic for pushing stable multi-arch images
The intention is to only push an image if there is ***NOT*** an existing
tag.  The original logic for this condition was inverted.

Also, improve radability of the `{container,podman}_push=true`
statements.

Signed-off-by: Chris Evich <cevich@redhat.com>
2021-04-26 14:12:42 -04:00
Chris Evich
1e98a95a0e Several multi-arch image build/push fixes
* Fix not setting `$VERSION` before reference
* Reduce need for "syntax-hilighting workaround` comment.
  Simplify context-expressions -> simple env. var. referenmces
* Fix pushing quay.io/containers/podman:master twice
  ('upstream' and 'testing' matrix items)
* Throw error on unknown/unsupported matrix items
* Improve readability of setting multi-line `$LABELS` value.

Signed-off-by: Chris Evich <cevich@redhat.com>
2021-04-23 13:35:10 -04:00
Chris Evich
3c5bb7bf0f Add github-action workflow to build/push multi-arch
This borrows very heavily from the work done for buildah by @barthy1 -
Yulia Gaponenko <yulia.gaponenko1@de.ibm.com>.  Some changes to code and
comments made for clarity and specificity.

Signed-off-by: Chris Evich <cevich@redhat.com>
2021-04-22 16:20:59 -04:00
Chris Evich
6c75419a8f Cirrus: Send cirrus-cron report e-mail to list.
This mailing-list was established to allow people to sub/unsub from
automated notifications.  Add it to the list of destinations picked up
by the Github Actions workflow
`.github/workflows/check_cirrus_cron.yml`.

Signed-off-by: Chris Evich <cevich@redhat.com>
2021-02-08 12:11:16 -05:00
Chris Evich
887f88c490 Github-Actions: Send e-mail on Cirrus cron failure
This repository has a number of automaticly triggered branch-level
testing enabled.  However, other than remembering to go look at a
specific WebUI, there is no way for anybody to notice if/when these jobs
fail.

This commit introduces a github-action workflow which runs periodically,
checking for failed cron-triggered Cirrus-CI jobs.  When it finds any, it
formats a simple report for e-mail delivery.  The list of destination
addresses is configurable at any time by merging changes to a
simple CSV file.

Signed-off-by: Chris Evich <cevich@redhat.com>
2020-11-18 15:34:01 -05:00
Ed Santiago
e187423d2a Yet another iteration on PR title plugin
PR #8147 made things worse: it's not valid YAML. This at
least is valid YAML. I have no idea if it yields the
desired result, and we won't even know until it gets
merged, but at least it won't cause fatal syntax errors.

Signed-off-by: Ed Santiago <santiago@redhat.com>
2020-10-26 13:44:59 -06:00
Valentin Rothberg
153531d435 pr update action: fix errors on master branch
The action fails on the master branch as the regex does not match.
The error in this scenario is unfortunate and not of much value as
we do not want to change PR titles on the master branch.

To fix it, entirely disable the action on the master branch which
in restrospective may be a better approach as we do not fire off the
action.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2020-10-26 13:09:20 +01:00
Valentin Rothberg
b26a1085cd add GitHub action to add non-main branch to PR title
Add a GitHub action to add the name of the target branch as prefix to
the title of a pull request.  It is easy to miss the target of a given
pull request which has already caused issues of commits going into
non-main branches without intention.

We have already used this action on the `v2.0.5-rhel` branch with
limited success.  Fortunately, the upstream implemented our feature
request to support adding the _target_ branch name (rather than the
source) to the PR title, which is what we need.

Any non-main branch from this commit forward will now be clearly marked.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2020-10-25 11:34:37 +01:00
Valentin Rothberg
1921a82a91 update stale bot
Update the GitHub action to mark issues and PRs as stale.  There are a
couple of useful features, most importantly, the bot will remove the
stale label from issues as soon as there's either an activity or a
comment.

This reduces some manual overhead: the stale bot will only drop a
comment on issues and PRs that are not marked as stale.  Hence, as we
appreciated the reminders, we had to manually remove the label which
should now turn into campfire tales.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2020-09-22 11:16:40 +02:00
Valentin Rothberg
8094ee89ba github stale workflow: rephrase and bump close time
Rephrase the stale message to be friendlier and bump the closing time to
365 days.  The docs of the stale workflow do not indicate whether we can
not close, so a limit of 365 days seems fair.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2020-01-07 11:04:37 +01:00
Valentin Rothberg
7835b863f2 stale action: add exempt-issue-label
Without the label, issues would be closed regardless of the
"do-not-close" label.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2019-10-30 09:51:40 +01:00
Valentin Rothberg
52e5c4b460 GitHub stale action
Add a GitHub action to mark issues and PRs as stale and
to eventually close them after a grace period.

Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
2019-10-28 20:35:34 +01:00