Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update scripts to initialize with project_name #34

Merged
merged 2 commits into from
Oct 11, 2024
Merged

chore: update scripts to initialize with project_name #34

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2495c48
chore: update scripts to initialize with project_name
migmartri Oct 9, 2024
209b2d6
chore: add index workflowName,project
migmartri Oct 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions .github/workflows/chainloop.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,19 +18,22 @@ on:
workflow_name:
required: false
type: string
project_name:
required: false
type: string
secrets:
api_token:
required: true
signing_key:
required: true
signing_key_password:
required: true

jobs:
chainloop-attestation:
name: Chainloop Attestation Process
runs-on: ubuntu-latest

steps:
- name: Checkout
uses: actions/checkout@v4
Expand Down Expand Up @@ -69,12 +72,12 @@ jobs:
run: |
source <(/usr/local/bin/chainloop/c8l source)
chainloop_attestation_add_from_yaml ${{ inputs.attestation_name }}

- name: Chainloop Attestation Status
run: |
source <(/usr/local/bin/chainloop/c8l source)
chainloop_attestation_status

- name: Validate Collected Artifacts and Record Attestation
if: ${{ success() }}
run: |
Expand All @@ -83,7 +86,7 @@ jobs:
env:
CHAINLOOP_SIGNING_KEY: ${{ secrets.signing_key }}
CHAINLOOP_SIGNING_PASSWORD: ${{ secrets.signing_key_password }}

- name: Generate a summary report
run: |
source <(/usr/local/bin/chainloop/c8l source)
Expand All @@ -95,7 +98,7 @@ jobs:
source <(/usr/local/bin/chainloop/c8l source)
chainloop attestation reset
chainloop_generate_github_summary_on_failure

- name: Mark attestation as cancelled
if: ${{ cancelled() }}
run: |
Expand All @@ -106,3 +109,4 @@ jobs:
CHAINLOOP_TOKEN: ${{ secrets.api_token }}
CHAINLOOP_CONTRACT_REVISION: ${{ inputs.contract_revision }}
CHAINLOOP_WORKFLOW_NAME: ${{ inputs.workflow_name }}
CHAINLOOP_PROJECT_NAME: ${{ inputs.project_name }}
9 changes: 5 additions & 4 deletions .github/workflows/chainloop_github_release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,10 +30,10 @@ on:
jobs:
onboard_workflow:
name: Onboard Chainloop Workflow
uses: chainloop-dev/labs/.github/workflows/chainloop_onboard.yml@4173e015dbd5dc2a8802555c268da63d57bbe576
migmartri marked this conversation as resolved.
Show resolved Hide resolved
uses: chainloop-dev/labs/.github/workflows/chainloop_onboard.yml@main
if: github.event_name == 'release' && github.event.action == 'published'
with:
project: ${{ inputs.workflow_project }}
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure how this ever worked. Did I miss anything cc/ @javirln

project: ${{ inputs.project }}
workflow_name: ${{ inputs.workflow_name }}
# Pass parent workflow secrets to the child workflow
secrets: inherit
Expand All @@ -46,6 +46,7 @@ jobs:
if: github.event_name == 'release' && github.event.action == 'published'
env:
CHAINLOOP_WORKFLOW_NAME: ${{ needs.onboard_workflow.outputs.workflow_name }}
CHAINLOOP_PROJECT_NAME: ${{ needs.onboard_workflow.outputs.project_name }}
CHAINLOOP_TOKEN: ${{ secrets.api_token }}
GH_TOKEN: ${{ github.token }}

Expand All @@ -58,14 +59,14 @@ jobs:

- name: Initialize Attestation
run: |
chainloop attestation init --workflow-name ${CHAINLOOP_WORKFLOW_NAME}
chainloop attestation init --workflow-name ${CHAINLOOP_WORKFLOW_NAME} --project ${CHAINLOOP_PROJECT_NAME}

- name: Attest all assets
run: |
# gh release download raises an error if there are not assets on the release
# that makes the workflow fail, so we use `|| true` to avoid that
gh release download ${{github.ref_name}} -D /tmp/github-release || true

for entry in $(ls /tmp/github-release); do
chainloop attestation add --value "/tmp/github-release/$entry"
done
Expand Down
8 changes: 6 additions & 2 deletions .github/workflows/chainloop_init.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,9 @@ on:
workflow_name:
required: false
type: string
project_name:
required: false
type: string
secrets:
api_token:
required: true
Expand All @@ -23,7 +26,7 @@ jobs:
chainloop-init:
name: Chainloop Install & Attestation Init
runs-on: ubuntu-latest

steps:
- name: Checkout repository
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
Expand All @@ -48,10 +51,11 @@ jobs:
id: cache-chainloop
with:
path: .c8l_cache
key: c8l-cache-${{ runner.os }}-${{ github.run_id }}
key: c8l-cache-${{ runner.os }}-${{ github.run_id }}

env:
CHAINLOOP_VERSION: ${{ inputs.chainloop_version }}
CHAINLOOP_TOKEN: ${{ secrets.api_token }}
CHAINLOOP_CONTRACT_REVISION: ${{ inputs.contract_revision }}
CHAINLOOP_WORKFLOW_NAME: ${{ inputs.workflow_name }}
CHAINLOOP_PROJECT_NAME: ${{ inputs.project_name }}
18 changes: 12 additions & 6 deletions .github/workflows/chainloop_onboard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,17 @@ on:
workflow_name:
description: The discovered or created Chainloop workflow
value: ${{ jobs.chainloop_onboard.outputs.workflow_name }}
project_name:
description: The discovered or created Chainloop project name
value: ${{ jobs.chainloop_onboard.outputs.project_name }}

jobs:
chainloop_onboard:
name: Automatic Chainloop onboarding flow from Github Actions
runs-on: ubuntu-latest
outputs:
workflow_name: ${{ steps.set_workflow_name.outputs.workflow_name }}
project_name: ${{ steps.set_workflow_name.outputs.project_name }}

steps:
- name: Install Chainloop
Expand All @@ -40,14 +44,16 @@ jobs:
workflow_name=$(basename "$PARENT_WORKFLOW" | sed 's/\..*$//g; s/[[:space:]]/-/g; s/_/-/g' | tr '[:upper:]' '[:lower:]')
fi
echo "workflow_name=$workflow_name" >> $GITHUB_OUTPUT
project=${{ inputs.project }}
if [[ "$project" = "" ]]; then
project=$(echo -n ${{github.repositoryUrl}} | rev | cut -d'/' -f1 | rev | sed 's/.git$//g')
fi
echo "project_name=$project" >> $GITHUB_OUTPUT

- name: Discover and create workflow
env:
WORKFLOW_NAME: ${{ steps.set_workflow_name.outputs.workflow_name }}
PROJECT_NAME: ${{ steps.set_workflow_name.outputs.project_name }}
run: |
echo "Creating '$WORKFLOW_NAME' chainloop workflow"
project=${{ inputs.project }}
if [[ "$project" = "" ]]; then
project=$(echo -n ${{github.repositoryUrl}} | rev | cut -d'/' -f1 | rev | sed 's/.git$//g')
fi
chainloop --token ${{ secrets.api_token }} wf create --name "$WORKFLOW_NAME" --project "$project" --skip-if-exists
echo "Creating '$PROJECT_NAME' / '$WORKFLOW_NAME' workflow"
chainloop --token ${{ secrets.api_token }} wf create --name "$WORKFLOW_NAME" --project "$PROJECT_NAME" --skip-if-exists
12 changes: 6 additions & 6 deletions .github/workflows/chainloop_push.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ on:
required: false
signing_key_password:
required: false

jobs:
chainloop-attestation:
name: Chainloop Attestation Process
Expand All @@ -33,7 +33,7 @@ jobs:
id: cache-chainloop
with:
path: .c8l_cache
key: c8l-cache-${{ runner.os }}-${{ github.run_id }}
key: c8l-cache-${{ runner.os }}-${{ github.run_id }}

- name: Restore Chainloop binaries from cache
run: |
Expand Down Expand Up @@ -64,7 +64,7 @@ jobs:
run: |
source <(/usr/local/bin/chainloop/c8l source)
chainloop_attestation_add_from_yaml ${{ inputs.attestation_name }}

- name: Validate Collected Artifacts and Record Attestation
if: ${{ success() }}
run: |
Expand All @@ -73,7 +73,7 @@ jobs:
env:
CHAINLOOP_SIGNING_KEY: ${{ secrets.signing_key }}
CHAINLOOP_SIGNING_PASSWORD: ${{ secrets.signing_key_password }}

- name: Generate a summary report
run: |
source <(/usr/local/bin/chainloop/c8l source)
Expand All @@ -85,7 +85,7 @@ jobs:
source <(/usr/local/bin/chainloop/c8l source)
chainloop attestation reset --remote-state --attestation-id ${CHAINLOOP_ATTESTATION_ID}
chainloop_generate_github_summary_on_failure

- name: Mark attestation as cancelled
if: ${{ cancelled() }}
run: |
Expand All @@ -95,5 +95,5 @@ jobs:
CHAINLOOP_VERSION: ${{ inputs.chainloop_version }}
CHAINLOOP_TOKEN: ${{ secrets.api_token }}
CHAINLOOP_CONTRACT_REVISION: ${{ inputs.contract_revision }}
# Not sure if this is being used.
CHAINLOOP_WORKFLOW_NAME: ${{ inputs.workflow_name }}

8 changes: 6 additions & 2 deletions tools/c8l
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -674,9 +674,13 @@ chainloop_attestation_init() {
fi
WF_NAME_VALUE=""
if [ -n "${CHAINLOOP_WORKFLOW_NAME}" ]; then
WF_NAME_VALUE="--workflow-name ${CHAINLOOP_WORKFLOW_NAME}"
WF_NAME_VALUE="--workflow ${CHAINLOOP_WORKFLOW_NAME}"
fi
r=$(chainloop attestation init -f --remote-state --output json $CR_VALUE $WF_NAME_VALUE)
PROJECT_NAME_VALUE=""
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@danlishka I might need your help here. I am trying to figure out how the push works.

I think it uses some kind of cache, but I guess that now we will need to update the cache to also take into account the project name, but I am struggling to find that. No rush

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ahh no, the cache is unique within the run, ok.

I am wondering then why we are passing the workflow name here

https://github.com/chainloop-dev/chainloop/blob/f215274ee36f6f0cb7010eadaeafbb60b394265c/.github/workflows/docs_deploy.yml#L96

if [ -n "${CHAINLOOP_PROJECT_NAME}" ]; then
PROJECT_NAME_VALUE="--project ${CHAINLOOP_PROJECT_NAME}"
fi
r=$(chainloop attestation init -f --remote-state --output json $CR_VALUE $WF_NAME_VALUE $PROJECT_NAME_VALUE)
if [ $? -ne 0 ]; then
log_error "Chainloop initialization failed: $r"
return 1
Expand Down
8 changes: 6 additions & 2 deletions tools/src/lib/chainloop.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,9 +93,13 @@ chainloop_attestation_init() {
fi
WF_NAME_VALUE=""
if [ -n "${CHAINLOOP_WORKFLOW_NAME}" ]; then
WF_NAME_VALUE="--workflow-name ${CHAINLOOP_WORKFLOW_NAME}"
WF_NAME_VALUE="--workflow ${CHAINLOOP_WORKFLOW_NAME}"
fi
r=$(chainloop attestation init -f --remote-state --output json $CR_VALUE $WF_NAME_VALUE)
PROJECT_NAME_VALUE=""
if [ -n "${CHAINLOOP_PROJECT_NAME}" ]; then
PROJECT_NAME_VALUE="--project ${CHAINLOOP_PROJECT_NAME}"
fi
r=$(chainloop attestation init -f --remote-state --output json $CR_VALUE $WF_NAME_VALUE $PROJECT_NAME_VALUE)
if [ $? -ne 0 ]; then
log_error "Chainloop initialization failed: $r"
return 1
Expand Down