This is an automated email from the ASF dual-hosted git repository. sciabarracom pushed a commit to branch 0.9.0 in repository https://gitbox.apache.org/repos/asf/openserverless-runtimes.git
commit 5e1caa69027fc200935e0bad1cc4f0895960e5df Author: Michele Sciabarra <[email protected]> AuthorDate: Sat Sep 5 17:00:46 2026 +0200 reworked workflows --- .github/{workflows/test.yaml => cisetup.sh} | 25 +- .github/workflows/{test.yaml => check.yaml} | 27 +- .github/workflows/image.yaml | 432 +++++++--------------------- 3 files changed, 126 insertions(+), 358 deletions(-) diff --git a/.github/workflows/test.yaml b/.github/cisetup.sh old mode 100644 new mode 100755 similarity index 58% copy from .github/workflows/test.yaml copy to .github/cisetup.sh index 88efc02..888699c --- a/.github/workflows/test.yaml +++ b/.github/cisetup.sh @@ -1,3 +1,4 @@ +#!/bin/bash # Licensed to the Apache Software Foundation (ASF) under one # or more contributor license agreements. See the NOTICE file # distributed with this work for additional information @@ -15,26 +16,4 @@ # specific language governing permissions and limitations # under the License. # -name: Test Go Proxy -on: - push: - branches: [main] - pull_request: - branches: [main] - -jobs: - test: - name: Test Go Proxy - runs-on: ubuntu-22.04 - steps: - - name: Checkout recursive - uses: actions/checkout@v2 - - name: License check - uses: apache/skywalking-eyes@main - - name: Set up Go - uses: actions/setup-go@v2 - with: - go-version: 1.23 - - name: Run Go Tests - working-directory: ./openwhisk - run: go test -v \ No newline at end of file +sudo sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin diff --git a/.github/workflows/test.yaml b/.github/workflows/check.yaml similarity index 66% rename from .github/workflows/test.yaml rename to .github/workflows/check.yaml index 88efc02..f4d1355 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/check.yaml @@ -15,26 +15,33 @@ # specific language governing permissions and limitations # under the License. # -name: Test Go Proxy +name: Check on: - push: - branches: [main] pull_request: branches: [main] jobs: - test: - name: Test Go Proxy + check: + name: Check runs-on: ubuntu-22.04 steps: - name: Checkout recursive - uses: actions/checkout@v2 + uses: actions/checkout@v4 + with: + fetch-depth: 0 - name: License check uses: apache/skywalking-eyes@main - name: Set up Go - uses: actions/setup-go@v2 + uses: actions/setup-go@v5 with: go-version: 1.23 - - name: Run Go Tests - working-directory: ./openwhisk - run: go test -v \ No newline at end of file + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + - name: Install Task + run: sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin + - name: Test + run: task test + - name: Tag + run: task tag + - name: Build (no push) + run: task build diff --git a/.github/workflows/image.yaml b/.github/workflows/image.yaml index 79e6e1e..d5307b0 100644 --- a/.github/workflows/image.yaml +++ b/.github/workflows/image.yaml @@ -15,345 +15,127 @@ # specific language governing permissions and limitations # under the License. # + name: Build Images -on: + +on: push: tags: - - '*.*.*.*' - branches-ignore: '*' - #pull_request: - # branches: [main] - -permissions: - contents: write - packages: write + - '*_*' + branches-ignore: + - '*' + workflow_dispatch: + inputs: + runtime: + description: 'Runtimes to build' + type: choice + required: true + default: all + options: + - all + - common + - python + - nodejs + - java + - php + - experimental jobs: - golang: - name: Build Golang + images: + name: Build OpenServerless runtime images runs-on: ubuntu-22.04 - strategy: - max-parallel: 1 - matrix: - version: [v1.21,v1.22,v1.22proxy] + permissions: + contents: write + packages: write steps: - - name: Checkout recursive - uses: actions/checkout@v2 - - name: License check - uses: apache/skywalking-eyes@main - # continue-on-error: true - - name: Assign TAG from pull request - if: ${{ github.event_name == 'pull_request' }} - run: | - echo "IMG_TAG=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV" - - name: Assign TAG from push - if: ${{ github.event_name != 'pull_request' }} - run: | - echo "IMG_TAG=$(git describe --tags --abbrev=0)" >> "$GITHUB_ENV" - - name: Use non ASF docker hub repo - if: ${{ github.repository_owner != 'apache'}} - run: | - echo "BASE_REPO=apache" >> "$GITHUB_ENV" - - name: Use ASF docker hub repo - if: ${{ github.repository_owner == 'apache'}} - run: | - echo "BASE_REPO=apache" >> "$GITHUB_ENV" - - name: Task - run: sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin - - name: Load DockerHub secrets - uses: 1password/load-secrets-action@v2 - with: - # Export loaded secrets as environment variables - export-env: true + - name: Check GHCR_TOKEN is set + if: ${{ github.repository_owner != 'apache' }} env: - OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} - OPS_DOCKERHUB_USER: op://OpenServerless/ops_github_dockerhub/username - OPS_DOCKERHUB_TOKEN: op://OpenServerless/ops_github_dockerhub/password - OPS_BASE_COMMON_IMAGE: op://OpenServerless/ops_github_dockerhub/base_common_image - - name: Registry login - uses: docker/login-action@v3 - with: - #registry: registry.hub.docker.com - username: ${{ env.OPS_DOCKERHUB_USER }} - password: ${{ env.OPS_DOCKERHUB_TOKEN }} - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + GHCR_TOKEN: ${{ secrets.GHCR_TOKEN }} + run: | + if [ -z "$GHCR_TOKEN" ]; then + { + echo "## Missing required secret: GHCR_TOKEN" + echo + echo "This repository publishes multiple images whose names do not" + echo "match the repository (openserverless-runtime-common, -go," + echo "-python, -nodejs, -java, -php). The built-in GITHUB_TOKEN only" + echo "has write access to packages owned by this repository, so it" + echo "cannot push them: the push would fail with" + echo '`denied: permission_denied: write_package`.' + echo + echo "To fix this, create a Personal Access Token and add it as a secret:" + echo + echo "1. Go to https://github.com/settings/tokens"; + echo " -> Generate new token (classic)" + echo "2. Select the **write:packages** scope" + echo "3. Copy the generated token" + echo "4. In this repository go to" + echo " Settings -> Secrets and variables -> Actions -> New repository secret" + echo "5. Name it exactly **GHCR_TOKEN** and paste the token as the value" + echo + echo "Then re-run this workflow." + } >> "$GITHUB_STEP_SUMMARY" + echo "::error title=Missing GHCR_TOKEN::This repository publishes multiple images and needs a PAT with write:packages stored as the secret GHCR_TOKEN. See the job summary for step-by-step instructions." + exit 1 + fi + - name: Checkout + uses: actions/checkout@v7 with: - version: "lab:latest" - driver: cloud - endpoint: "sciabarracom/openserverless-builder" - use: true - - name: Build and push - uses: docker/build-push-action@v5 + submodules: recursive + # full history and tags: "task tag" replaces the existing tags + # and "git describe" needs them to be present + fetch-depth: 0 + - name: License + uses: apache/[email protected] + - name: Set up Go + uses: actions/setup-go@v5 with: - context: ./runtime/go/${{ matrix.version }} - platforms: linux/amd64,linux/arm64 - tags: ${{ env.BASE_REPO }}/openserverless-runtime-go:${{ matrix.version }}-${{ env.IMG_TAG }} - build-args: COMMON=${{ env.OPS_BASE_COMMON_IMAGE }} - # For pull requests, export results to the build cache. - # Otherwise, push to a registry. - outputs: ${{ github.event_name == 'pull_request' && 'type=cacheonly' || 'type=registry,push=true' }} - - python: - name: Build Python - needs: golang - runs-on: ubuntu-22.04 - strategy: - max-parallel: 1 - matrix: - version: [v3.10,v3.11,v3.12,v3.13] - steps: - - name: Checkout recursive - uses: actions/checkout@v2 - - name: License check - uses: apache/skywalking-eyes@main - # continue-on-error: true - - name: Assign TAG from pull request - if: ${{ github.event_name == 'pull_request' }} - run: | - echo "IMG_TAG=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV" - - name: Assign TAG from push - if: ${{ github.event_name != 'pull_request' }} - run: | - echo "IMG_TAG=$(git describe --tags --abbrev=0)" >> "$GITHUB_ENV" - - name: Use non ASF docker hub repo - if: ${{ github.repository_owner != 'apache'}} - run: | - echo "BASE_REPO=apache" >> "$GITHUB_ENV" - - name: Use ASF docker hub repo - if: ${{ github.repository_owner == 'apache'}} - run: | - echo "BASE_REPO=apache" >> "$GITHUB_ENV" - - name: Task - run: sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin - - name: Load DockerHub secrets - uses: 1password/load-secrets-action@v2 - with: - # Export loaded secrets as environment variables - export-env: true - env: - OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} - OPS_DOCKERHUB_USER: op://OpenServerless/ops_github_dockerhub/username - OPS_DOCKERHUB_TOKEN: op://OpenServerless/ops_github_dockerhub/password - OPS_BASE_COMMON_IMAGE: op://OpenServerless/ops_github_dockerhub/base_common_image - - name: Registry login - uses: docker/login-action@v3 - with: - #registry: registry.hub.docker.com - username: ${{ env.OPS_DOCKERHUB_USER }} - password: ${{ env.OPS_DOCKERHUB_TOKEN }} - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - with: - version: "lab:latest" - driver: cloud - endpoint: "sciabarracom/openserverless-builder" - use: true - - name: Build and push - uses: docker/build-push-action@v5 - with: - context: ./runtime/python/${{ matrix.version }} - platforms: linux/amd64,linux/arm64 - tags: ${{ env.BASE_REPO }}/openserverless-runtime-python:${{ matrix.version }}-${{ env.IMG_TAG }} - build-args: COMMON=${{ env.OPS_BASE_COMMON_IMAGE }} - # For pull requests, export results to the build cache. - # Otherwise, push to a registry. - outputs: ${{ github.event_name == 'pull_request' && 'type=cacheonly' || 'type=registry,push=true' }} - - nodejs: - name: Build NodeJs - needs: python - runs-on: ubuntu-22.04 - strategy: - max-parallel: 1 - matrix: - version: [v18,v20,v21] - steps: - - name: Checkout recursive - uses: actions/checkout@v2 - - name: License check - uses: apache/skywalking-eyes@main - # continue-on-error: true - - name: Assign TAG from pull request - if: ${{ github.event_name == 'pull_request' }} - run: | - echo "IMG_TAG=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV" - - name: Assign TAG from push - if: ${{ github.event_name != 'pull_request' }} + go-version: '1.23' + - name: Setup CI + run: bash .github/cisetup.sh + - name: Use ghcr.io repo + if: ${{ github.repository_owner != 'apache' }} run: | - echo "IMG_TAG=$(git describe --tags --abbrev=0)" >> "$GITHUB_ENV" - - name: Use non ASF docker hub repo - if: ${{ github.repository_owner != 'apache'}} + echo "REPO_URL=ghcr.io" >> "$GITHUB_ENV" + echo "REGISTRY_USER=${{ github.actor }}" >> "$GITHUB_ENV" + echo "DOCKERHUB_REGISTRY=ghcr.io" >> "$GITHUB_ENV" + echo "DOCKERHUB_USER=${{ github.repository_owner }}" >> "$GITHUB_ENV" + - name: Use docker.io repo + if: ${{ github.repository_owner == 'apache' }} run: | - echo "BASE_REPO=apache" >> "$GITHUB_ENV" - - name: Use ASF docker hub repo - if: ${{ github.repository_owner == 'apache'}} + echo "REPO_URL=docker.io" >> "$GITHUB_ENV" + echo "REGISTRY_USER=${{ secrets.DOCKERHUB_USER }}" >> "$GITHUB_ENV" + echo "DOCKERHUB_REGISTRY=docker.io" >> "$GITHUB_ENV" + echo "DOCKERHUB_USER=apache" >> "$GITHUB_ENV" + # the Taskfile reads DOCKERHUB_REGISTRY and DOCKERHUB_USER from .env + - name: Create .env run: | - echo "BASE_REPO=apache" >> "$GITHUB_ENV" - - name: Task - run: sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin - - name: Load DockerHub secrets - uses: 1password/load-secrets-action@v2 - with: - # Export loaded secrets as environment variables - export-env: true - env: - OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} - OPS_DOCKERHUB_USER: op://OpenServerless/ops_github_dockerhub/username - OPS_DOCKERHUB_TOKEN: op://OpenServerless/ops_github_dockerhub/password - OPS_BASE_COMMON_IMAGE: op://OpenServerless/ops_github_dockerhub/base_common_image + { + echo "DOCKERHUB_REGISTRY=$DOCKERHUB_REGISTRY" + echo "DOCKERHUB_USER=$DOCKERHUB_USER" + } > .env + cat .env - name: Registry login - uses: docker/login-action@v3 + uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: - #registry: registry.hub.docker.com - username: ${{ env.OPS_DOCKERHUB_USER }} - password: ${{ env.OPS_DOCKERHUB_TOKEN }} - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + registry: ${{ env.REPO_URL }} + username: ${{ env.REGISTRY_USER }} + password: ${{ github.repository_owner == 'apache' && secrets.DOCKERHUB_TOKEN || secrets.GHCR_TOKEN }} + # Manual run: create a new snapshot tag on the current HEAD for the + # selected runtimes. The tag is not pushed, so no second run is started: + # this same run goes on and builds it. + - name: Tag HEAD (manual run) + if: ${{ github.event_name == 'workflow_dispatch' }} + run: | + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + task tag RT="${{ inputs.runtime }}" + - name: Set up QEMU + uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0 with: - version: "lab:latest" - driver: cloud - endpoint: "sciabarracom/openserverless-builder" - use: true + image: tonistiigi/binfmt:qemu-v7.0.0-28 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0 - name: Build and push - uses: docker/build-push-action@v5 - with: - context: ./runtime/nodejs/${{ matrix.version }} - platforms: linux/amd64,linux/arm64 - tags: ${{ env.BASE_REPO }}/openserverless-runtime-nodejs:${{ matrix.version }}-${{ env.IMG_TAG }} - build-args: COMMON=${{ env.OPS_BASE_COMMON_IMAGE }} - # For pull requests, export results to the build cache. - # Otherwise, push to a registry. - outputs: ${{ github.event_name == 'pull_request' && 'type=cacheonly' || 'type=registry,push=true' }} - - php: - name: Build Php - needs: nodejs - runs-on: ubuntu-22.04 - strategy: - max-parallel: 1 - matrix: - version: [v8.0,v8.1,v8.2,v8.3] - steps: - - name: Checkout recursive - uses: actions/checkout@v2 - - name: License check - uses: apache/skywalking-eyes@main - # continue-on-error: true - - name: Assign TAG from pull request - if: ${{ github.event_name == 'pull_request' }} - run: | - echo "IMG_TAG=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV" - - name: Assign TAG from push - if: ${{ github.event_name != 'pull_request' }} - run: | - echo "IMG_TAG=$(git describe --tags --abbrev=0)" >> "$GITHUB_ENV" - - name: Use ASF docker hub repo - if: ${{ github.repository_owner == 'apache'}} - run: | - echo "BASE_REPO=apache" >> "$GITHUB_ENV" - - name: Use non ASF docker hub repo - if: ${{ github.repository_owner != 'apache'}} - run: | - echo "BASE_REPO=apache" >> "$GITHUB_ENV" - - name: Task - run: sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin - - name: Load DockerHub secrets - uses: 1password/load-secrets-action@v2 - with: - # Export loaded secrets as environment variables - export-env: true - env: - OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} - OPS_DOCKERHUB_USER: op://OpenServerless/ops_github_dockerhub/username - OPS_DOCKERHUB_TOKEN: op://OpenServerless/ops_github_dockerhub/password - OPS_BASE_COMMON_IMAGE: op://OpenServerless/ops_github_dockerhub/base_common_image - - name: Registry login - uses: docker/login-action@v3 - with: - #registry: registry.hub.docker.com - username: ${{ env.OPS_DOCKERHUB_USER }} - password: ${{ env.OPS_DOCKERHUB_TOKEN }} - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - with: - version: "lab:latest" - driver: cloud - endpoint: "sciabarracom/openserverless-builder" - use: true - - name: Build and push - uses: docker/build-push-action@v5 - with: - context: ./runtime/php/${{ matrix.version }} - platforms: linux/amd64,linux/arm64 - tags: ${{ env.BASE_REPO }}/openserverless-runtime-php:${{ matrix.version }}-${{ env.IMG_TAG }} - build-args: COMMON=${{ env.OPS_BASE_COMMON_IMAGE }} - # For pull requests, export results to the build cache. - # Otherwise, push to a registry. - outputs: ${{ github.event_name == 'pull_request' && 'type=cacheonly' || 'type=registry,push=true' }} - - java: - name: Build Java - needs: php - runs-on: ubuntu-22.04 - strategy: - max-parallel: 1 - matrix: - version: [v8,v11,v17,v21] - steps: - - name: Checkout recursive - uses: actions/checkout@v2 - - name: License check - uses: apache/skywalking-eyes@main - # continue-on-error: true - - name: Assign TAG from pull request - if: ${{ github.event_name == 'pull_request' }} - run: | - echo "IMG_TAG=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV" - - name: Assign TAG from push - if: ${{ github.event_name != 'pull_request' }} - run: | - echo "IMG_TAG=$(git describe --tags --abbrev=0)" >> "$GITHUB_ENV" - - name: Use ASF docker hub repo - if: ${{ github.repository_owner == 'apache'}} - run: | - echo "BASE_REPO=apache" >> "$GITHUB_ENV" - - name: Use non ASF docker hub repo - if: ${{ github.repository_owner != 'apache'}} - run: | - echo "BASE_REPO=apache" >> "$GITHUB_ENV" - - name: Task - run: sh -c "$(curl --location https://taskfile.dev/install.sh)" -- -d -b /usr/local/bin - - name: Load DockerHub secrets - uses: 1password/load-secrets-action@v2 - with: - # Export loaded secrets as environment variables - export-env: true - env: - OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} - OPS_DOCKERHUB_USER: op://OpenServerless/ops_github_dockerhub/username - OPS_DOCKERHUB_TOKEN: op://OpenServerless/ops_github_dockerhub/password - OPS_BASE_COMMON_IMAGE: op://OpenServerless/ops_github_dockerhub/base_common_image - - name: Registry login - uses: docker/login-action@v3 - with: - #registry: registry.hub.docker.com - username: ${{ env.OPS_DOCKERHUB_USER }} - password: ${{ env.OPS_DOCKERHUB_TOKEN }} - - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 - with: - version: "lab:latest" - driver: cloud - endpoint: "sciabarracom/openserverless-builder" - use: true - - name: Build and push - uses: docker/build-push-action@v5 - with: - context: ./runtime/java/${{ matrix.version }} - platforms: linux/amd64,linux/arm64 - tags: ${{ env.BASE_REPO }}/openserverless-runtime-java:${{ matrix.version }}-${{ env.IMG_TAG }} - build-args: COMMON=${{ env.OPS_BASE_COMMON_IMAGE }} - # For pull requests, export results to the build cache. - # Otherwise, push to a registry. - outputs: ${{ github.event_name == 'pull_request' && 'type=cacheonly' || 'type=registry,push=true' }} \ No newline at end of file + run: task buildx
