Skip to content

Commit 2b6fd8a

Browse files
Glitchy-SheepGlitchy-Sheep
authored
[deckhouse-cli] Revert "Bump stronghold to v1.18.6" and guard CI (#433)
Signed-off-by: Roman Berezkin <roman.berezkin@flant.com>
1 parent 0df7573 commit 2b6fd8a

7 files changed

Lines changed: 438 additions & 433 deletions

File tree

‎.github/scripts/trdl-build-check.sh‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Reproduce the trdl server release build from trdl.yaml, without a tag.
4+
#
5+
# The trdl server builds a release by generating a Dockerfile
6+
# (werf/trdl: server/pkg/docker/dockerfile.go):
7+
#
8+
# FROM <dockerImage> AS builder
9+
# COPY . /git
10+
# WORKDIR /git
11+
# RUN mkdir -p /result
12+
# RUN --mount=type=secret,... <commands joined with &&>
13+
# FROM scratch
14+
# COPY --from=builder /result /result/
15+
#
16+
# This script generates the same Dockerfile and runs `docker build`
17+
# with the same secret ids the server mounts. If this build passes,
18+
# the release build for a future tag passes too.
19+
#
20+
# Usage:
21+
# trdl-build-check.sh [--dry-run] [tag]
22+
#
23+
# --dry-run print the generated Dockerfile and exit (no secrets needed)
24+
# tag synthetic release tag, default v0.0.0-trdl-check
25+
#
26+
# Required env (unless --dry-run):
27+
# SOURCE_REPO_SSH_KEY SSH private key for the private repo (plain text)
28+
# DECKHOUSE_PRIVATE_REPO hostname of the private repo
29+
30+
set -euo pipefail
31+
32+
dry_run=0
33+
if [ "${1:-}" = "--dry-run" ]; then
34+
dry_run=1
35+
shift
36+
fi
37+
tag="${1:-v0.0.0-trdl-check}"
38+
39+
cd "$(dirname "$0")/../.."
40+
41+
# trdl.yaml is flat: a scalar dockerImage and a plain list of commands.
42+
# Keep it that way - this parser does not understand anything else.
43+
image="$(awk '$1 == "dockerImage:" {print $2; exit}' trdl.yaml)"
44+
commands="$(grep '^ - ' trdl.yaml \
45+
| sed -e 's/^ - //' -e "s/{{ \.Tag }}/${tag}/g" \
46+
| awk 'NR > 1 {printf " && "} {printf "%s", $0} END {print ""}')"
47+
48+
if [ -z "$image" ] || [ -z "$commands" ]; then
49+
echo "failed to parse dockerImage/commands from trdl.yaml" >&2
50+
exit 1
51+
fi
52+
53+
workdir="$(mktemp -d)"
54+
trap 'rm -rf "$workdir"' EXIT
55+
56+
cat > "$workdir/Dockerfile" <<EOF
57+
FROM ${image} AS builder
58+
COPY . /git
59+
WORKDIR /git
60+
RUN mkdir -p /result
61+
RUN --mount=type=secret,id=deckhouse-private-repo --mount=type=secret,id=stronghold-ssh ${commands}
62+
FROM scratch
63+
COPY --from=builder /result /result/
64+
EOF
65+
66+
if [ "$dry_run" = 1 ]; then
67+
cat "$workdir/Dockerfile"
68+
exit 0
69+
fi
70+
71+
: "${SOURCE_REPO_SSH_KEY:?SOURCE_REPO_SSH_KEY is required}"
72+
: "${DECKHOUSE_PRIVATE_REPO:?DECKHOUSE_PRIVATE_REPO is required}"
73+
74+
# The build reads the key as base64 (see trdl.yaml) and ssh-add needs
75+
# a trailing newline in the decoded key.
76+
umask 077
77+
printf '%s\n' "$SOURCE_REPO_SSH_KEY" | base64 > "$workdir/stronghold-ssh"
78+
printf '%s' "$DECKHOUSE_PRIVATE_REPO" > "$workdir/deckhouse-private-repo"
79+
80+
DOCKER_BUILDKIT=1 docker build \
81+
--platform linux/amd64 \
82+
--file "$workdir/Dockerfile" \
83+
--secret "id=stronghold-ssh,src=$workdir/stronghold-ssh" \
84+
--secret "id=deckhouse-private-repo,src=$workdir/deckhouse-private-repo" \
85+
--output "type=local,dest=$workdir/out" \
86+
--progress plain \
87+
.
88+
89+
echo
90+
echo "Artifacts built for ${tag}:"
91+
ls -lR "$workdir/out/result"
92+
test -n "$(ls -A "$workdir/out/result")"

‎.github/workflows/release.yaml‎

Lines changed: 20 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@ env:
1212
GOPRIVATE: "flant.internal"
1313
PRIVATE_REPO: "${{secrets.DECKHOUSE_PRIVATE_REPO}}"
1414
GOLANGCI_LINT_VERSION: 'v2.11.4'
15-
GO_IMAGE: registry.deckhouse.io/container-factory@sha256:ce80d4ec2053430e81b1a07492a403c4fb5382a27570984318ea75b87bbe5109
1615

1716
permissions:
1817
contents: write
@@ -40,7 +39,7 @@ jobs:
4039
libssl-dev `# delivery-kit: OpenSSL crypto for signature verification (CGO)` \
4140
libuv1-dev `# delivery-kit: async I/O for libuv-based networking (CGO)` \
4241
libzstd-dev `# delivery-kit: zstd compression support (CGO)` \
43-
file git gcc dnsutils curl
42+
file git gcc dnsutils
4443
# libuv1-dev ships static lib as libuv_a.a; the linker expects libuv.a
4544
ln -fs "$(dpkg -L libuv1-dev | grep -F '/libuv_a.a')" /usr/local/lib/libuv.a
4645
@@ -49,14 +48,11 @@ jobs:
4948
with:
5049
fetch-depth: 0 # To use `git describe --tags`
5150

52-
- name: Install Crane
53-
uses: imjasonh/setup-crane@v0.7
54-
5551
- name: Setup Go
56-
run: |
57-
crane export "$GO_IMAGE" - | tar -x -C / --no-same-owner usr/local/go
58-
echo "/usr/local/go/bin" >> "$GITHUB_PATH"
59-
/usr/local/go/bin/go version
52+
uses: actions/setup-go@v5
53+
with:
54+
go-version: "1.23"
55+
cache: false # Cache download takes longer that a build from scratch
6056

6157
- name: Setup Task
6258
uses: arduino/setup-task@v2
@@ -117,7 +113,7 @@ jobs:
117113
libssl-dev `# delivery-kit: OpenSSL crypto for signature verification (CGO)` \
118114
libuv1-dev `# delivery-kit: async I/O for libuv-based networking (CGO)` \
119115
libzstd-dev `# delivery-kit: zstd compression support (CGO)` \
120-
file git gcc dnsutils curl
116+
file git gcc dnsutils
121117
# libuv1-dev ships static lib as libuv_a.a; the linker expects libuv.a
122118
ln -fs "$(dpkg -L libuv1-dev | grep -F '/libuv_a.a')" /usr/local/lib/libuv.a
123119
@@ -126,14 +122,11 @@ jobs:
126122
with:
127123
fetch-depth: 0 # To use `git describe --tags`
128124

129-
- name: Install Crane
130-
uses: imjasonh/setup-crane@v0.7
131-
132125
- name: Setup Go
133-
run: |
134-
crane export "$GO_IMAGE" - | tar -x -C / --no-same-owner usr/local/go
135-
echo "/usr/local/go/bin" >> "$GITHUB_PATH"
136-
/usr/local/go/bin/go version
126+
uses: actions/setup-go@v5
127+
with:
128+
go-version: "1.23"
129+
cache: false # Cache download takes longer that a build from scratch
137130

138131
- name: Setup Task
139132
uses: arduino/setup-task@v2
@@ -190,7 +183,7 @@ jobs:
190183
libssl-dev `# delivery-kit: OpenSSL crypto for signature verification (CGO)` \
191184
libuv1-dev `# delivery-kit: async I/O for libuv-based networking (CGO)` \
192185
libzstd-dev `# delivery-kit: zstd compression support (CGO)` \
193-
file git gcc dnsutils curl
186+
file git gcc dnsutils
194187
# libuv1-dev ships static lib as libuv_a.a; the linker expects libuv.a
195188
ln -fs "$(dpkg -L libuv1-dev | grep -F '/libuv_a.a')" /usr/local/lib/libuv.a
196189
@@ -199,14 +192,11 @@ jobs:
199192
with:
200193
fetch-depth: 0 # To use `git describe --tags`
201194

202-
- name: Install Crane
203-
uses: imjasonh/setup-crane@v0.7
204-
205195
- name: Setup Go
206-
run: |
207-
crane export "$GO_IMAGE" - | tar -x -C / --no-same-owner usr/local/go
208-
echo "/usr/local/go/bin" >> "$GITHUB_PATH"
209-
/usr/local/go/bin/go version
196+
uses: actions/setup-go@v5
197+
with:
198+
go-version: "1.23"
199+
cache: false # Cache download takes longer that a build from scratch
210200

211201
- name: Setup GolangCI-Lint
212202
uses: golangci/golangci-lint-action@v9
@@ -268,7 +258,7 @@ jobs:
268258
libssl-dev `# delivery-kit: OpenSSL crypto for signature verification (CGO)` \
269259
libuv1-dev `# delivery-kit: async I/O for libuv-based networking (CGO)` \
270260
libzstd-dev `# delivery-kit: zstd compression support (CGO)` \
271-
file git gcc dnsutils curl
261+
file git gcc dnsutils
272262
# libuv1-dev ships static lib as libuv_a.a; the linker expects libuv.a
273263
ln -fs "$(dpkg -L libuv1-dev | grep -F '/libuv_a.a')" /usr/local/lib/libuv.a
274264
@@ -277,14 +267,11 @@ jobs:
277267
with:
278268
fetch-depth: 0 # To use `git describe --tags`
279269

280-
- name: Install Crane
281-
uses: imjasonh/setup-crane@v0.7
282-
283270
- name: Setup Go
284-
run: |
285-
crane export "$GO_IMAGE" - | tar -x -C / --no-same-owner usr/local/go
286-
echo "/usr/local/go/bin" >> "$GITHUB_PATH"
287-
/usr/local/go/bin/go version
271+
uses: actions/setup-go@v5
272+
with:
273+
go-version: "1.23"
274+
cache: false # Cache download takes longer that a build from scratch
288275

289276
- name: Setup Task
290277
uses: arduino/setup-task@v2

‎.github/workflows/trdl-build-check.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: trdl-build-check
2+
3+
on:
4+
pull_request:
5+
paths:
6+
- trdl.yaml
7+
- go.mod
8+
- go.sum
9+
- Taskfile.yml
10+
- .github/workflows/trdl-build-check.yml
11+
- .github/scripts/trdl-build-check.sh
12+
schedule:
13+
- cron: "0 7 * * 1"
14+
workflow_dispatch:
15+
16+
defaults:
17+
run:
18+
shell: bash
19+
20+
jobs:
21+
build:
22+
name: Reproduce trdl release build
23+
# Secrets are not available to PRs from forks.
24+
if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
25+
runs-on: [self-hosted, regular]
26+
steps:
27+
- name: Checkout
28+
uses: actions/checkout@v4
29+
30+
- name: Reproduce trdl build
31+
env:
32+
SOURCE_REPO_SSH_KEY: ${{ secrets.SOURCE_REPO_SSH_KEY }}
33+
DECKHOUSE_PRIVATE_REPO: ${{ secrets.DECKHOUSE_PRIVATE_REPO }}
34+
run: .github/scripts/trdl-build-check.sh

‎Taskfile.yml‎

Lines changed: 4 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -38,10 +38,8 @@ vars:
3838
version="$(go list -m -f '{{"{{"}}.Replace.Version{{"}}"}}' github.com/werf/werf/v2)"
3939
echo "-X 'github.com/werf/werf/v2/pkg/werf.Version=${version}'"
4040
41-
cgoTags: "gost clionly dfrunsecurity dfrunnetwork dfrunmount dfssh containers_image_openpgp osusergo exclude_graphdriver_devicemapper netgo no_devmapper static_build cni"
42-
goTags: "gost clionly dfrunsecurity dfrunnetwork dfrunmount dfssh containers_image_openpgp"
43-
cgoDevTags: "clionly dfrunsecurity dfrunnetwork dfrunmount dfssh containers_image_openpgp osusergo exclude_graphdriver_devicemapper netgo no_devmapper static_build cni"
44-
goDevTags: "clionly dfrunsecurity dfrunnetwork dfrunmount dfssh containers_image_openpgp"
41+
cgoTags: "clionly dfrunsecurity dfrunnetwork dfrunmount dfssh containers_image_openpgp osusergo exclude_graphdriver_devicemapper netgo no_devmapper static_build cni"
42+
goTags: "clionly dfrunsecurity dfrunnetwork dfrunmount dfssh containers_image_openpgp"
4543
testsumFormat: '{{if eq .GITHUB_ACTIONS "true"}}github-actions{{else}}pkgname-and-test-fails{{end}}'
4644

4745
cgoDevLDFlags: "-linkmode external -extldflags=-static -s -w -X 'github.com/deckhouse/deckhouse-cli/internal/version.Version=local-dev' {{ .werfLDFlags }}"
@@ -68,7 +66,7 @@ tasks:
6866
internal: true
6967
cmds:
7068
- go build -o "{{ .outputDir | default (printf "./build/%s-%s" .targetOS .targetArch) }}/bin/d8"
71-
-compiler gc -ldflags="{{ .cgoDevLDFlags }}" -tags="{{ .cgoDevTags }}" {{ .CLI_ARGS }} ./cmd/d8/
69+
-compiler gc -ldflags="{{ .cgoDevLDFlags }}" -tags="{{ .cgoTags }}" {{ .CLI_ARGS }} ./cmd/d8/
7270
env:
7371
CGO_ENABLED: "1"
7472
GOOS: "{{ .targetOS }}"
@@ -88,7 +86,7 @@ tasks:
8886
internal: true
8987
cmds:
9088
- go build -o "{{ .outputDir | default (printf "./build/%s-%s" .targetOS .targetArch) }}/bin/d8{{ if (eq .targetOS "windows") }}.exe{{ end }}"
91-
-ldflags="{{ .goDevLDFlags }}" -tags="{{ .goDevTags }}" {{ .CLI_ARGS }} ./cmd/d8/
89+
-ldflags="{{ .goDevLDFlags }}" -tags="{{ .goTags }}" {{ .CLI_ARGS }} ./cmd/d8/
9290
env:
9391
CGO_ENABLED: "0"
9492
GOOS: "{{ .targetOS }}"
@@ -294,16 +292,6 @@ tasks:
294292
cmds:
295293
- golangci-lint run ./... --build-tags="{{ .goTags }}"
296294

297-
lint:dev:
298-
desc: Run golangci-lint with auto-fix
299-
cmds:
300-
- golangci-lint run ./... --fix --build-tags="{{ .goDevTags }}"
301-
302-
lint:dev:check:
303-
desc: Run golangci-lint without fixes (CI mode)
304-
cmds:
305-
- golangci-lint run ./... --build-tags="{{ .goDevTags }}"
306-
307295
check:kubectl:
308296
desc: Check kubectlVersion matches k8s.io/kubectl in go.mod
309297
cmds:

0 commit comments

Comments
 (0)