From ac8e7e58fdbae46eeac217a68131362f6dfa347a Mon Sep 17 00:00:00 2001 From: Mike Surowiec Date: Thu, 10 Feb 2022 14:14:40 -0600 Subject: [PATCH] Public Repo Azure Preview Environments (#25206) * add public deploy workflow, update destroy to work on pull_request_target Co-authored-by: Peter Bengtsson --- .dockerignore | 2 + .../workflows/azure-preview-env-deploy.yml | 62 ++++++++++++++----- .../workflows/azure-preview-env-destroy.yml | 7 ++- .../workflows/main-preview-docker-cache.yml | 4 +- .gitignore | 4 ++ Dockerfile | 2 +- 6 files changed, 60 insertions(+), 21 deletions(-) diff --git a/.dockerignore b/.dockerignore index bf645012d036..aa9b89a06425 100644 --- a/.dockerignore +++ b/.dockerignore @@ -10,3 +10,5 @@ tests/ lib/rest/static/dereferenced # Folder is cloned during the preview + prod workflows, the assets are merged into other locations for use before the build docs-early-access/ +# During the preview deploy untrusted user code may be cloned into this directory +user-code/ diff --git a/.github/workflows/azure-preview-env-deploy.yml b/.github/workflows/azure-preview-env-deploy.yml index a102730e06f0..7893e80df32b 100644 --- a/.github/workflows/azure-preview-env-deploy.yml +++ b/.github/workflows/azure-preview-env-deploy.yml @@ -1,12 +1,13 @@ name: Azure - Deploy Preview Environment -# **What it does**: Build and deploy to an Azure preview environment -# **Why we have it**: It's our preview environment deploy mechanism, only applicable to docs-internal +# **What it does**: Build and deploy an Azure preview environment for this PR +# **Why we have it**: It's our preview environment deploy mechanism, to docs-internal and docs public repo # **Who does it impact**: All contributors. -# This whole workflow is only guaranteed to be secure in the *private -# repo* and because we repo-sync these files over the to the public one, -# IT'S IMPORTANT THAT THIS WORKFLOW IS ONLY ENABLED IN docs-internal! +# !!! +# ! This worflow has access to secrets, runs in the public repository, and clones untrusted user code. +# ! Modify with extreme caution +# !!! on: # The advantage of 'pull_request' over 'pull_request_target' is that we @@ -15,13 +16,17 @@ on: # From a security point of view, its arguably safer this way because # unlike 'pull_request_target', these only have secrets if the pull # request creator has permission to access secrets. - pull_request: + pull_request_target: workflow_dispatch: inputs: PR_NUMBER: description: 'PR Number' type: string required: true + COMMIT_REF: + description: 'The commit SHA to build' + type: string + required: true permissions: contents: read @@ -34,7 +39,6 @@ concurrency: jobs: build-and-deploy-azure-preview: - if: ${{ github.repository == 'github/docs-internal' }} name: Build and deploy Azure preview environment runs-on: ubuntu-latest timeout-minutes: 15 @@ -47,7 +51,11 @@ jobs: url: ${{ env.APP_URL }} env: PR_NUMBER: ${{ github.event.number || github.event.inputs.PR_NUMBER }} - ENABLE_EARLY_ACCESS: ${{ github.repository == 'github/docs-internal' }} + COMMIT_REF: ${{ github.event.pull_request.head.sha || github.event.inputs.COMMIT_REF }} + BRANCH_NAME: ${{ github.head_ref || github.ref_name }} + IS_INTERNAL_BUILD: ${{ github.repository == 'github/docs-internal' }} + # This may also run in forked repositories, not just 'github/docs' + IS_PUBLIC_BUILD: ${{ github.repository != 'github/docs-internal' }} steps: - name: 'Az CLI login' @@ -65,10 +73,19 @@ jobs: - name: Set up Docker Buildx uses: docker/setup-buildx-action@94ab11c41e45d028884a99163086648e898eed25 - - name: Check out repo + - if: ${{ env.IS_PUBLIC_BUILD }} + name: Check out main branch + uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 + with: + ref: 'main' + persist-credentials: 'false' + lfs: 'true' + + - if: ${{ env.IS_INTERNAL_BUILD }} + name: Check out PR code uses: actions/checkout@1e204e9a9253d643386038d443f96446fa156a97 with: - ref: ${{ github.event.pull_request.head.sha }} + ref: ${{ env.COMMIT_REF }} # To prevent issues with cloning early access content later persist-credentials: 'false' lfs: 'true' @@ -84,14 +101,14 @@ jobs: - name: 'Set env vars' run: | # Image tag is unique to each workflow run so that it always triggers a new deployment - echo "DOCKER_IMAGE=${{ secrets.NONPROD_REGISTRY_SERVER }}/${IMAGE_REPO}:${{ github.event.pull_request.head.sha }}-${{ github.run_number }}-${{ github.run_attempt }}" >> $GITHUB_ENV + echo "DOCKER_IMAGE=${{ secrets.NONPROD_REGISTRY_SERVER }}/${IMAGE_REPO}:${{ env.COMMIT_REF }}-${{ github.run_number }}-${{ github.run_attempt }}" >> $GITHUB_ENV - - if: ${{ env.ENABLE_EARLY_ACCESS }} + - if: ${{ env.IS_INTERNAL_BUILD }} name: Determine which docs-early-access branch to clone id: 'check-early-access' uses: actions/github-script@2b34a689ec86a68d8ab9478298f91d5401337b7d env: - BRANCH_NAME: ${{ github.head_ref || github.ref_name }} + BRANCH_NAME: ${{ env.BRANCH_NAME }} with: github-token: ${{ secrets.DOCUBOT_REPO_PAT }} result-encoding: string @@ -116,7 +133,7 @@ jobs: return 'main' } - - if: ${{ env.ENABLE_EARLY_ACCESS }} + - if: ${{ env.IS_INTERNAL_BUILD }} name: Clone docs-early-access uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 with: @@ -125,10 +142,25 @@ jobs: path: docs-early-access ref: ${{ steps.check-early-access.outputs.result }} - - if: ${{ env.ENABLE_EARLY_ACCESS }} + - if: ${{ env.IS_INTERNAL_BUILD }} name: Merge docs-early-access repo's folders run: .github/actions-scripts/merge-early-access.sh + - if: ${{ env.IS_PUBLIC_BUILD }} + name: Check out user code to temp directory + uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579 + with: + path: ./user-code + ref: ${{ env.COMMIT_REF }} + + # Move acceptable user changes into our main branch checkout + - if: ${{ env.IS_PUBLIC_BUILD }} + name: Move acceptable user changes + run: | + rsync -rptovR ./user-code/content/./**/*.md ./content + rsync -rptovR ./user-code/assets/./**/*.png ./assets + rsync -rptovR ./user-code/data/./**/*.{yml,md} ./data + # In addition to making the final image smaller, we also save time by not sending unnecessary files to the docker build context - name: 'Prune for preview env' run: .github/actions-scripts/prune-for-preview-env.sh diff --git a/.github/workflows/azure-preview-env-destroy.yml b/.github/workflows/azure-preview-env-destroy.yml index f26a4be14d70..94463d846fbf 100644 --- a/.github/workflows/azure-preview-env-destroy.yml +++ b/.github/workflows/azure-preview-env-destroy.yml @@ -5,7 +5,7 @@ name: Azure - Destroy Preview Env # **Who does it impact**: All contributors. on: - pull_request: + pull_request_target: types: - closed - locked @@ -16,10 +16,12 @@ on: type: string required: true +permissions: + contents: read + jobs: destory-azure-preview-env: name: Destroy - if: ${{ github.repository == 'github/docs-internal' }} runs-on: ubuntu-latest timeout-minutes: 5 env: @@ -59,5 +61,6 @@ jobs: # Remove all GitHub deployments from this environment and remove the environment - uses: strumwolf/delete-deployment-environment@45c821e46baa405e25410700fe2e9643929706a0 with: + # The token provided by the workflow does not have the permissions to delete created environments token: ${{ secrets.DOCUBOT_REPO_PAT }} environment: preview-env-${{ env.PR_NUMBER }} diff --git a/.github/workflows/main-preview-docker-cache.yml b/.github/workflows/main-preview-docker-cache.yml index 92bebd90cca5..a42239c1f1f8 100644 --- a/.github/workflows/main-preview-docker-cache.yml +++ b/.github/workflows/main-preview-docker-cache.yml @@ -24,8 +24,6 @@ jobs: timeout-minutes: 15 env: ENABLE_EARLY_ACCESS: ${{ github.repository == 'github/docs-internal' }} - NONPROD_REGISTRY_USERNAME: ghdocs - NONPROD_REGISTRY_NAME: ghdocs DOCKER_IMAGE_CACHE_REF: ${{ secrets.NONPROD_REGISTRY_SERVER }}/${{ github.repository }}:main-preview steps: @@ -38,7 +36,7 @@ jobs: uses: azure/docker-login@81744f9799e7eaa418697cb168452a2882ae844a with: login-server: ${{ secrets.NONPROD_REGISTRY_SERVER }} - username: ${{ env.NONPROD_REGISTRY_USERNAME }} + username: ${{ secrets.NONPROD_REGISTRY_USERNAME }} password: ${{ secrets.NONPROD_REGISTRY_PASSWORD }} - name: Set up Docker Buildx diff --git a/.gitignore b/.gitignore index 510858060fe1..f017bafe2ffc 100644 --- a/.gitignore +++ b/.gitignore @@ -17,3 +17,7 @@ blc_output.log blc_output_internal.log broken_links.md lib/redirects/.redirects-cache_*.json + +# During the preview deploy untrusted user code may be cloned into this directory +# We ignore it from git to keep things deterministic +user-code/ diff --git a/Dockerfile b/Dockerfile index 912301bc55cb..985bde3af750 100644 --- a/Dockerfile +++ b/Dockerfile @@ -23,7 +23,7 @@ FROM base as all_deps COPY --chown=node:node package.json package-lock.json ./ -RUN npm ci --no-optional +RUN npm ci --no-optional --registry https://registry.npmjs.org/ # For Next.js v12+ # This the appropriate necessary extra for node:16-alpine