-
Notifications
You must be signed in to change notification settings - Fork 125
GRIF-716.2: Add workflow_dispatch for promoting bricks stable tag #2081
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,96 @@ | ||
| name: "LCM: Retag stable image to major version" | ||
| run-name: "Retag stable lcm-bricks ${{ inputs.tag }} → M<major>-<cluster>" | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [MODERATE] dry-run defaults to With Consider defaulting to default: true
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. sure, why not |
||
|
|
||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| tag: | ||
| description: 'Stable image tag to retag (e.g. 3.7.106)' | ||
| required: true | ||
| type: string | ||
| dry-run: | ||
| description: 'Dry-run only — print crane commands without executing' | ||
| required: true | ||
| default: true | ||
| type: boolean | ||
|
|
||
| concurrency: | ||
| group: ${{ github.workflow }} | ||
| cancel-in-progress: false | ||
|
|
||
| jobs: | ||
| retag-stable: | ||
| name: Retag stable/${{ inputs.tag }} to major version | ||
| runs-on: | ||
| group: infra1-runners-arc | ||
| labels: runners-small | ||
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| env: | ||
| INFRA_REPO_URL: ${{ secrets.ECR_URL }} | ||
| images: "lcm-bricks lcm-bricks-nextversion" | ||
| clusters: "na1 ca2 perf1 bom1 syd1 na3 eu1 fra1" | ||
| steps: | ||
| - name: Get required Vault secrets | ||
| uses: hashicorp/vault-action@v3 | ||
| with: | ||
| url: ${{ secrets.VAULT_ADDRESS }} | ||
| method: jwt | ||
| path: jwt/github | ||
| role: ecr-push | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [CRITICAL — still not fixed] Wrong Vault role/path for The Vault credentials are still the staging-tier ones: role: ecr-push
secrets: secret/data/v3/int/ecr/infra1-user-ecr-rwThis workflow writes to role: ecr-ii-push
secrets: secret/data/v2/data-special/infra1-user-ecr-rwSee |
||
| secrets: | | ||
| secret/data/v3/int/ecr/infra1-user-ecr-rw aws_ecr_access_key | AWS_ACCESS_KEY ; | ||
| secret/data/v3/int/ecr/infra1-user-ecr-rw aws_ecr_secret_key | AWS_SECRET_KEY ; | ||
|
|
||
| - name: Configure AWS credentials | ||
| uses: aws-actions/configure-aws-credentials@v4 | ||
| with: | ||
| aws-access-key-id: ${{ env.AWS_ACCESS_KEY }} | ||
| aws-secret-access-key: ${{ env.AWS_SECRET_KEY }} | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [MODERATE] Hardcoded
With Consider skipping images whose source tag is absent rather than hard-failing: if crane manifest "${src}" > /dev/null 2>&1; then
crane tag "${src}" "${major_tag}"
else
echo "[warn] ${src} not found, skipping"
fi
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Considering that this action is a manual triggered actually when a PR is merged - meaning CI has to have passed and consequently all the builds were successfully. I don't see an issue here |
||
| aws-region: us-east-1 | ||
|
|
||
| - name: Login to Amazon ECR | ||
| uses: aws-actions/amazon-ecr-login@v2 | ||
| with: | ||
| mask-password: 'true' | ||
|
|
||
| - name: Retag images | ||
| env: | ||
| TAG: ${{ inputs.tag }} | ||
| DRY_RUN: ${{ inputs.dry-run }} | ||
| run: | | ||
| set -euo pipefail | ||
| major=$(echo "$TAG" | cut -d. -f1) | ||
| images=( ${{ env.images }} ) | ||
| clusters=( ${{ env.clusters }} ) | ||
| for image in "${images[@]}"; do | ||
| src="${INFRA_REPO_URL}/stable/${image}:${TAG}" | ||
| for cluster in "${clusters[@]}"; do | ||
| major_tag="M${major}-${cluster}" | ||
| if [ "${DRY_RUN}" == 'true' ]; then | ||
| echo "[dry-run] crane tag ${src} ${major_tag}" | ||
| else | ||
| crane tag "${src}" "${major_tag}" | ||
| echo "Tagged ${image}:${TAG} → ${image}:${major_tag}" | ||
| fi | ||
| done | ||
| done | ||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. [CLEANUP] Cluster list and major extraction duplicated between steps
Consider setting these once as job-level env vars, or sharing via
Contributor
Author
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. fixed, worked with the same |
||
|
|
||
| - name: Summary | ||
| env: | ||
| TAG: ${{ inputs.tag }} | ||
| run: | | ||
| set -euo pipefail | ||
| major=$(echo "$TAG" | cut -d. -f1) | ||
| clusters=( ${{ env.clusters }} ) | ||
| { | ||
| echo "## LCM stable retag" | ||
| echo "" | ||
| echo "| | |" | ||
| echo "|---|---|" | ||
| echo "| **Source tag** | \`${TAG}\` |" | ||
| echo "| **Major tag pattern** | \`M${major}-<cluster>\` |" | ||
| echo "| **Clusters** | \`${clusters[*]}\` |" | ||
| echo "| **Dry-run** | \`${{ inputs.dry-run }}\` |" | ||
| } >> "$GITHUB_STEP_SUMMARY" | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[NEW] Instruction stale after
dry-rundefault changed totrueNow that
dry-rundefaults totrue, "leave dry-run unchecked" means the workflow runs in dry-run mode — no images will actually be tagged.GitHub Actions renders
booleaninputs as atrue/falsedropdown, not a checkbox, so "unchecked" is also the wrong UI term.Suggested fix:
The
ghCLI example two lines below already passes-f dry-run=falseexplicitly, so that part is correct.