ci: add containerized libvirt build workflow (#1130)

* Add libvirt container build workflow * Update release workflow * Update image libvirt base image --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>
edgelesssys · Feb 2, 2023 · f74f589 · f74f589
1 parent 64c4b1f
commit f74f589
Show file tree

Hide file tree

Showing 4 changed files with 60 additions and 116 deletions.
diff --git a/.github/workflows/build-libvirt-image.yml b/.github/workflows/build-libvirt-image.yml
@@ -0,0 +1,35 @@
+name: Build and upload libvirt image
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+      - "release/**"
+    paths:
+      - "cli/internal/libvirt/**"
+      - ".github/workflows/build-libvirt-image.yml"
+
+jobs:
+  build-qemu-metadata-api:
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Check out repository
+        id: checkout
+        uses: actions/checkout@ac593985615ec2ede58e132d2e21d2b1cbd6127c # v3.3.0
+        with:
+          ref: ${{ !github.event.pull_request.head.repo.fork && github.head_ref || '' }}
+
+      - name: Build and upload libvirt container image
+        id: build-and-upload
+        uses: ./.github/actions/build_micro_service
+        with:
+          name: "libvirt"
+          dockerfile: "cli/internal/libvirt/Dockerfile"
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+          cosignPublicKey: ${{ startsWith(github.ref, 'refs/heads/release/v') && secrets.COSIGN_PUBLIC_KEY || secrets.COSIGN_DEV_PUBLIC_KEY }}
+          cosignPrivateKey: ${{ startsWith(github.ref, 'refs/heads/release/v') && secrets.COSIGN_PRIVATE_KEY || secrets.COSIGN_DEV_PRIVATE_KEY }}
+          cosignPassword: ${{ startsWith(github.ref, 'refs/heads/release/v') && secrets.COSIGN_PASSWORD || secrets.COSIGN_DEV_PASSWORD }}
diff --git a/.github/workflows/build-micro-service-manual.yml b/.github/workflows/build-micro-service-manual.yml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -149,19 +149,33 @@ jobs:
           cosignPassword: ${{ startsWith(github.ref, 'refs/heads/release/v') && secrets.COSIGN_PASSWORD || secrets.COSIGN_DEV_PASSWORD }}
 
   micro-services-metadata:
-    name: Build micro services
+    name: Build docker images
+    runs-on: ubuntu-22.04
     needs: [verify-inputs, prepare-release-branch]
-    uses: ./.github/workflows/build-micro-service-manual.yml
     permissions:
       contents: read
       packages: write
-    secrets: inherit
-    with:
-      microService: qemu-metadata-api
-      imageTag: ${{ inputs.version }}
-      version: ${{ needs.verify-inputs.outputs.WITHOUT_V }}
-      ref: ${{ needs.verify-inputs.outputs.RELEASE_BRANCH }}
-      release: true
+    strategy:
+      matrix:
+        appName:
+          [qemu-metadata-api, libvirt]
+        include:
+          - appName: qemu-metadata-api
+            dockerfile: ./hack/qemu-metadata-api/Dockerfile
+          - appName: libvirt
+            dockerfile: ./cli/internal/libvirt/Dockerfile
+    steps:
+      - name: Build docker image
+        uses: ./.github/actions/build_micro_service
+        with:
+          name: ${{ matrix.appName }}
+          pushTag: ${{ inputs.version }}
+          projectVersion: ${{ needs.verify-inputs.outputs.WITHOUT_V }}
+          dockerfile: ${{ matrix.dockerfile }}
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+          cosignPublicKey: ${{ startsWith(github.ref, 'refs/heads/release/v') && secrets.COSIGN_PUBLIC_KEY || secrets.COSIGN_DEV_PUBLIC_KEY }}
+          cosignPrivateKey: ${{ startsWith(github.ref, 'refs/heads/release/v') && secrets.COSIGN_PRIVATE_KEY || secrets.COSIGN_DEV_PRIVATE_KEY }}
+          cosignPassword: ${{ startsWith(github.ref, 'refs/heads/release/v') && secrets.COSIGN_PASSWORD || secrets.COSIGN_DEV_PASSWORD }}
 
   update-versions:
     name: Update container image versions

diff --git a/cli/internal/libvirt/Dockerfile b/cli/internal/libvirt/Dockerfile
@@ -1,4 +1,4 @@
-FROM fedora:37@sha256:99aa8919afd1880064ec915dba44cdc5b52808667717f605750329d55006538a AS deploy
+FROM fedora:37@sha256:3487c98481d1bba7e769cf7bcecd6343c2d383fdd6bed34ec541b6b23ef07664 AS release
 RUN dnf -y update && \
     dnf -y install dnf-plugins-core \
     libvirt-daemon-config-network \
@@ -7,6 +7,7 @@ RUN dnf -y update && \
     swtpm \
     swtpm-tools \
     libvirt-client && \
+    dnf remove -y python-setuptools && \
     dnf clean all
 
 # Prevent cgroup issues on Fedora and configure libvirt