From 427b033f73588648310b346e3eb57f927d0718f7 Mon Sep 17 00:00:00 2001 From: Fran Mulero Date: Fri, 2 Sep 2022 16:21:52 +0200 Subject: [PATCH] [bitnami/*] Containers CI Automated PRs should follow same matrix approach as regular PRs (#4766) * Remove Automated CI workflow Signed-off-by: Fran Mulero * Apply several fixex and improvements Signed-off-by: Fran Mulero * Fix auto-merge label Signed-off-by: Fran Mulero * Move failed automated PRs into Triage column and add auto-merge label only when an Automated PR is approved Signed-off-by: Fran Mulero * Amend workflow, add missing 'steps' Signed-off-by: Fran Mulero * Fix job dependency Signed-off-by: Fran Mulero * Apply suggestions, and remove Automated PRs from initial triage Signed-off-by: Fran Mulero * Apply suggestions Signed-off-by: Fran Mulero * Add condition to 'Send to board' step Signed-off-by: Fran Mulero * Fix and make clearer the conditions Signed-off-by: Fran Mulero * Remove auto-merge label in case of failure Signed-off-by: Fran Mulero Signed-off-by: Fran Mulero --- .github/workflows/ci-automated-pipeline.yaml | 152 ------------------- .github/workflows/ci-pipeline.yaml | 121 +++++++++++++-- .github/workflows/move-closed-issues.yml | 1 - .github/workflows/moving-cards.yml | 2 - 4 files changed, 106 insertions(+), 170 deletions(-) delete mode 100644 .github/workflows/ci-automated-pipeline.yaml diff --git a/.github/workflows/ci-automated-pipeline.yaml b/.github/workflows/ci-automated-pipeline.yaml deleted file mode 100644 index c1ab1f07f36d..000000000000 --- a/.github/workflows/ci-automated-pipeline.yaml +++ /dev/null @@ -1,152 +0,0 @@ -name: '[CI/CD] CI Pipeline for automated PRs' -on: # Triggered only on open PR events done by bitnami-bot on containers folders - pull_request_target: - types: - - opened - branches: - - main - - bitnami:main - paths: - - 'bitnami/**' -env: - CSP_API_URL: https://console.cloud.vmware.com - CSP_API_TOKEN: ${{ secrets.CSP_API_TOKEN }} - VIB_PUBLIC_URL: https://cp.bromelia.vmware.com -jobs: - auto-pr-triage: - runs-on: ubuntu-latest - name: Triage for automated PRs - if: | - contains(github.event.pull_request.title, 'Release') && - github.actor == 'bitnami-bot' - steps: - # Enables auto-merge and adds necessary labels for automated releases' PRs - - id: labeling - name: Label PR - uses: andymckay/labeler@1.0.4 - with: - repo-token: "${{ secrets.GITHUB_TOKEN }}" - add-labels: "verify, auto-merge" - - id: auto-merge - name: Enable auto-merge - run: | - curl --request POST \ - --url https://api.github.com/graphql \ - --header 'authorization: Bearer ${{ secrets.BITNAMI_BOT_TOKEN }}' \ - --data '{ - "query": "mutation { enablePullRequestAutoMerge(input: {pullRequestId: \"${{ github.event.pull_request.node_id }}\", mergeMethod: SQUASH}) { clientMutationId }}" - }' \ - --fail - get-container: - runs-on: ubuntu-latest - name: Get modified containers - needs: auto-pr-triage - outputs: - container: ${{ steps.get-container.outputs.container }} - path: ${{ steps.get-container.outputs.path }} - steps: - - id: get-container - name: Get modified containers - run: | - # Using the Github API to detect the files changed as git merge-base stops working when the branch is behind - # and jitterbit/get-changed-files does not support pull_request_target - URL="https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" - files_changed_data=$(curl -s --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' -X GET -G "$URL") - files_changed="$(echo $files_changed_data | jq -r '.[] | .filename')" - # Adding || true to avoid "Process exited with code 1" errors - containers_dirs_changed="$(echo "$files_changed" | xargs dirname | grep -o "^bitnami/[^/]*" | sort | uniq || true)" - flavors=($(echo "$files_changed" | xargs dirname | grep -o "^bitnami/[^/]*/[^/]*/[^/]*" | sort | uniq || true)) - container_name=$(echo "$containers_dirs_changed" | sed "s|bitnami/||g") - - if [[ "${#flavors[@]}" -eq "1" ]]; then - # Changes done in only one container -> OK - echo "::set-output name=container::${container_name}" - echo "::set-output name=path::${flavors[0]}" - else - # No changes detected or there are changes done in more than one container -> FAIL. It doesn't make sense in automated PRs. - echo -e "No changes detected or there are changes done in more than one container:\n${containers_dirs_changed}\n. The rest of the tests will be skipped." - exit 1 - fi - vib-verify: - runs-on: ubuntu-latest - needs: get-container - name: Verify - steps: - - uses: actions/checkout@v3 - name: Checkout Repository - with: - # Required to search the latest commit with the tag - fetch-depth: 1 - # labeled events trigger the event with the latest commit in main - ref: ${{ github.event.pull_request.head.ref }} - repository: ${{ github.event.pull_request.head.repo.full_name }} - - id: get-tag - name: Get latest image tag - run: | - # Now EAM commits has the following format "[bitnami/] Release " - tag="$(grep -oE "org.opencontainers.image.ref.name=\".+\"" ${{ needs.get-container.outputs.path }}/Dockerfile | sed -nr "s|org.opencontainers.image.ref.name=\"(.+)\"|\1|p")" - if [[ -z "${tag}" ]]; then - echo "No tag found for: ${{ needs.get-container.outputs.path }}" - exit 1 - else - echo "::set-output name=tag::${tag}" - fi - - uses: vmware-labs/vmware-image-builder-action@main - name: Verify - with: - pipeline: vib-verify.json - env: - # Path with docker resources - VIB_ENV_PATH: ${{ needs.get-container.outputs.path }} - # Container name - VIB_ENV_CONTAINER: ${{ needs.get-container.outputs.container }} - VIB_ENV_TAG: ${{ steps.get-tag.outputs.tag }} - auto-pr-review: - runs-on: ubuntu-latest - needs: vib-verify - name: Reviewal for automated PRs - if: | - always() && - github.actor == 'bitnami-bot' - steps: - # Approves the CI's PR if the 'VIB Verify' job succeeded - # Approved by the 'github-actions' user. A PR can't be approved by its author - - name: Approval - if: ${{ needs.vib-verify.result == 'success' }} - run: | - curl --request POST \ - --url https://api.github.com/repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/reviews \ - --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' \ - --header 'content-type: application/json' \ - --data '{ - "event": "APPROVE" - }' \ - --fail - - name: Manual review required - if: ${{ needs.vib-verify.result != 'success' }} - run: | - curl --request POST \ - --url https://api.github.com/repos/${{ github.repository }}/issues/${{ github.event.pull_request.number }}/comments \ - --header 'authorization: Bearer ${{ secrets.GITHUB_TOKEN }}' \ - --header 'content-type: application/json' \ - --data '{ - "body": "There has been an error during the automated release process. Manual revision is now required." - }' \ - --fail - - name: Assign to a person to work on it - if: ${{ needs.vib-verify.result != 'success' }} - uses: pozil/auto-assign-issue@v1.9.0 - with: - numOfAssignee: 1 - removePreviousAssignees: true - teams: build-maintainers - repo-token: "${{ secrets.BITNAMI_BOT_TOKEN }}" - - name: Move into From Bitnami - uses: peter-evans/create-or-update-project-card@v2 - if: ${{ needs.vib-verify.result != 'success' }} - with: - project-name: Support - column-name: From Bitnami - token: "${{ secrets.GITHUB_TOKEN }}" - # The action by default uses github.event.issue.number but PRs don't have that field - issue-number: ${{ github.event.number }} diff --git a/.github/workflows/ci-pipeline.yaml b/.github/workflows/ci-pipeline.yaml index c98d731728ed..b1d3820f0a3d 100644 --- a/.github/workflows/ci-pipeline.yaml +++ b/.github/workflows/ci-pipeline.yaml @@ -2,25 +2,44 @@ name: '[CI/CD] CI Pipeline' on: # rebuild any PRs and main branch changes pull_request_target: types: - - reopened + - opened - synchronize - labeled branches: - main - bitnami:main +permissions: + issues: write + pull-requests: write env: CSP_API_URL: https://console.cloud.vmware.com CSP_API_TOKEN: ${{ secrets.CSP_API_TOKEN }} VIB_PUBLIC_URL: https://cp.bromelia.vmware.com jobs: + auto-pr-triage: + runs-on: ubuntu-latest + name: Triage for automated PRs + if: | + contains(github.event.pull_request.title, 'Release') && + github.actor == 'bitnami-bot' + steps: + # Enables auto-merge and adds necessary labels for automated releases' PRs + - id: labeling + name: Label PR + uses: andymckay/labeler@1.0.4 + with: + add-labels: "verify, auto-merge" get-containers: runs-on: ubuntu-latest name: Get modified containers if: | github.event.pull_request.state != 'closed' && ( - (github.event.action == 'labeled' && github.event.label.name == 'verify') || - (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'verify')) + (contains(github.event.pull_request.title, 'Release') && github.actor == 'bitnami-bot') || + ( + (github.event.action == 'labeled' && github.event.label.name == 'verify') || + (github.event.action != 'labeled' && contains(github.event.pull_request.labels.*.name, 'verify')) + ) ) outputs: result: ${{ steps.get-containers.outputs.result }} @@ -54,7 +73,7 @@ jobs: runs-on: ubuntu-latest needs: get-containers if: ${{ needs.get-containers.outputs.result == 'ok' && contains(github.event.pull_request.labels.*.name, 'verify') }} - name: Verify container + name: VIB Verify continue-on-error: false strategy: fail-fast: false @@ -75,11 +94,21 @@ jobs: run: | if [[ -d "${{ matrix.container }}" ]]; then name="$(echo "${{ matrix.container }}" | awk -F '/' '{print $2}')" - # Build a tag based on current SHA - tag="$(echo "${{ matrix.container }}" | awk -F '/' -v run_number="${GITHUB_RUN_NUMBER}" '{printf "%s-rc.%s", $3, run_number}')" - echo "::set-output name=tag::${tag}" - echo "::set-output name=name::${name}" - echo "::set-output name=result::ok" + tag="" + if [[ "${{ github.actor }}" == "bitnami-bot" ]]; then + tag="$(grep -oE "org.opencontainers.image.ref.name=\".+\"" ${{ matrix.container }}/Dockerfile | sed -nr "s|org.opencontainers.image.ref.name=\"(.+)\"|\1|p")" + else + # Build a tag based on current RUN number + tag="$(echo "${{ matrix.container }}" | awk -F '/' -v run_number="${GITHUB_RUN_NUMBER}" '{printf "%s-rc.%s", $3, run_number}')" + fi + if [[ -z "${tag}" ]]; then + echo "No tag found for: ${{ matrix.container }}" + exit 1 + else + echo "::set-output name=tag::${tag}" + echo "::set-output name=name::${name}" + echo "::set-output name=result::ok" + fi else # Container folder doesn't exists we are assuming a deprecation echo "::set-output name=result::skip" @@ -95,13 +124,75 @@ jobs: # Container name VIB_ENV_CONTAINER: ${{ steps.get-container-metadata.outputs.name }} VIB_ENV_TAG: ${{ steps.get-container-metadata.outputs.tag }} - verify-all: + verification-summary: # Ensure all containers passed the verification runs-on: ubuntu-latest - name: Verify - needs: vib-verify + name: Verification Summary + needs: + - get-containers + - vib-verify if: ${{ always() }} steps: - - name: Verify - if: ${{ needs.vib-verify.result != 'success' && needs.vib-verify.result != 'skipped'}} - run: exit 1 + - name: Verification Summary + run: | + if [[ "${{ needs.get-containers.result }}" != "success" ]]; then + echo "Verification is required." + echo "If you've just created this PR, don't worry about this message. Bitnami Team has to review it and make the verification possible." + exit 1 + else + if [[ "${{ needs.get-containers.outputs.result }}" == "skip" ]]; then + echo "It seems these changes don't involve any container" + else + if [[ "${{ needs.vib-verify.result }}" != "success" ]]; then + echo "Verification is required" + echo "Please review previous jobs to get more information" + exit 1 + else + echo "Well done! Everything looks good. Please wait for the Bitnami Team review." + fi + fi + fi + auto-pr-review: + runs-on: ubuntu-latest + name: Reviewal for automated PRs + needs: verification-summary + if: | + always() && + contains(github.event.pull_request.title, 'Release') && + github.actor == 'bitnami-bot' + steps: + - name: Enable auto-merge feature + if: ${{ needs.verification-summary.result == 'success' }} + uses: reitermarkus/automerge@v2.1.2 + with: + token: ${{ secrets.BITNAMI_BOT_TOKEN }} + merge-method: squash + pull-request: ${{ github.event.number }} + - name: PR Approval + if: ${{ needs.verification-summary.result == 'success' }} + uses: hmarr/auto-approve-action@v2.4.0 + with: + pull-request-number: ${{ github.event.number }} + - name: Manual review required + if: ${{ needs.verification-summary.result != 'success' }} + uses: peter-evans/create-or-update-comment@v2.0.0 + with: + issue-number: ${{ github.event.number }} + body: | + There has been an error during the automated release process. Manual revision is now required. + Please check the related [action_run#${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more information. + - name: Remove Automerge label + if: ${{ needs.verification-summary.result != 'success' }} + uses: andymckay/labeler@1.0.4 + with: + repo-token: "${{ secrets.GITHUB_TOKEN }}" + remove-labels: auto-merge + - name: Send to the board + if: ${{ needs.verification-summary.result != 'success' }} + uses: peter-evans/create-or-update-project-card@v2 + with: + project-name: Support + # If the author comes from Bitnami, send it to Bitnami. Otherwise, all to Triage + column-name: From Bitnami + token: "${{ secrets.BITNAMI_BOT_TOKEN }}" + issue-number: ${{ github.event.number }} diff --git a/.github/workflows/move-closed-issues.yml b/.github/workflows/move-closed-issues.yml index 73fb8d4c41fb..d7aefa18b2d2 100644 --- a/.github/workflows/move-closed-issues.yml +++ b/.github/workflows/move-closed-issues.yml @@ -19,7 +19,6 @@ concurrency: jobs: send_to_solved: - if: ${{ github.actor != 'bitnami-bot' }} runs-on: ubuntu-latest steps: - name: Repo checkout diff --git a/.github/workflows/moving-cards.yml b/.github/workflows/moving-cards.yml index 9c5f5c875080..ea07bd7c2938 100644 --- a/.github/workflows/moving-cards.yml +++ b/.github/workflows/moving-cards.yml @@ -17,7 +17,6 @@ concurrency: jobs: label-card: - if: ${{ github.actor != 'bitnami-bot' }} runs-on: ubuntu-latest steps: - name: Repo checkout @@ -54,7 +53,6 @@ jobs: add-labels: "solved" remove-labels: "in-progress, on-hold, triage" assign-assignee-if-needed: - if: ${{ github.actor != 'bitnami-bot' && (!contains(github.event.issue.labels.*.name, 'auto-merge')) }} runs-on: ubuntu-latest steps: - name: Repo checkout