-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
ci(workflow): enable community contributions #1848
Conversation
|
We are also building and pushing images whenenver a PR has been merged into main, check
We can create a workflow that can be run manually by org members, to upload images to ghcr tagged with |
@adamtagscherer raises important concerns and i would also like to add to this. Although we are not pushing PR images to GHCR, we could solve this by creating another (manually triggered) workflow that takes specific PR commit reference and pushes built artifacts for that commit to GHCR. This would allow us to test things, would also unblock community contributions, and it would also address the security concerns. My suggestion is that we add this action in a separate PR after this one is merged (it can be reused similarly to pushes to main). I wrote a small PoC bash script that can import images from a specific GA pipeline run into local docker registry. I have tested it against GA run https://github.com/openclarity/vmclarity/actions/runs/9660640440. You need GitHub CLI to run this. Note that pulling artifacts can take some time. It can be used in case we use docker-only approach for E2E testing on cloud providers. It does not solve directly the second concern regarding CF file (unless it is extended with this script). But the suggestion above #!/usr/bin/env bash
## Defines which image artifacts to download
GH_ACTION_RUN_ID="9660640440"
PLATFORM="arm64"
## Defines how to tag loaded VMClarity images
IMPORTED_IMAGE_REGISTRY="ghcr.io/openclarity"
IMPORTED_IMAGE_TAG="latest"
## Set path to temporary dir where artifacts will be pulled into
mkdir -p /tmp/vmclarity-images
cd /tmp/vmclarity-images
## Download all artifacts using GitHub CLI
gh run download --repo openclarity/vmclarity ${GH_ACTIONS_RUN_ID}
## Load all VMClarity platform-specific images
for image_archive in vmclarity-*-${PLATFORM}/*.tar; do
# load image
image_name=$(basename $image_archive .tar)
image_load_output=$(docker load --input "$image_archive" --quiet)
image_id=${image_load_output#"Loaded image ID: sha256:"} # strip prefix, very hacky due to https://github.com/moby/moby/issues/40188 limitations
# tag image
tagged_image="$IMPORTED_IMAGE_REGISTRY/$image_name:$IMPORTED_IMAGE_TAG"
echo "Tagging image ID=$image_id as $tagged_image"
docker tag $image_id $tagged_image
done
## Cleanup artifacts temporary dir
cd ~
rm -rf /tmp/vmclarity-images |
@ramizpolic I also agree that there should be a way to manually upload to ghcr to further test changes, let's sit together and decide on a solution that works for everyone. We had something like this created by @zsoltkacsandi recently in #1768, I removed it in this PR since essential parts of the workflow has been reworked, and I believe we need to adhere with the changes made on it. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, great work on this @csatib02!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
673fb30
a4d37be
to
673fb30
Compare
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
Signed-off-by: Bence Csati <bcsati@cisco.com>
673fb30
to
ff06d84
Compare
Description
ghcr
uploads on pull requests, and instead uses artifacts.Type of Change
Checklist