Skip to content

Commit f003c47

Browse files
ddelnanoddelnano
committed
Drop GCS release path; push images and helm charts to GHCR
Signed-off-by: Dom Del Nano <ddelnano@gmail.com>
1 parent 7b63f25 commit f003c47

10 files changed

Lines changed: 55 additions & 111 deletions

‎.github/workflows/cli_release.yaml‎

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ jobs:
1717
name: Build Release
1818
runs-on: oracle-16cpu-64gb-x86-64
1919
needs: get-dev-image
20+
permissions:
21+
contents: read
22+
packages: write
2023
container:
2124
image: ${{ needs.get-dev-image.outputs.image-with-tag }}
2225
env:
@@ -42,38 +45,36 @@ jobs:
4245
BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
4346
run: |
4447
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
45-
- id: gcloud-creds
46-
uses: ./.github/actions/gcloud_creds
48+
- name: Login to GHCR
49+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
4750
with:
48-
SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
51+
registry: ghcr.io
52+
username: ${{ github.actor }}
53+
password: ${{ github.token }}
4954
- name: Build & Push Artifacts
5055
env:
5156
REF: ${{ github.event.ref }}
5257
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
5358
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
5459
BUILD_NUMBER: ${{ github.run_attempt }}
5560
JOB_NAME: ${{ github.job }}
56-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
5761
GH_REPO: ${{ github.repository }}
62+
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'ghcr.io/pixie-io' }}
5863
shell: bash
5964
run: |
6065
export TAG_NAME="${REF#*/tags/}"
6166
mkdir -p "artifacts/"
6267
export ARTIFACTS_DIR="$(realpath artifacts/)"
6368
./ci/save_version_info.sh
6469
./ci/cli_build_release.sh
70+
# Despite the name, linux-artifacts also contains the unsigned darwin
71+
# binaries (cli_darwin_{amd64,arm64}_unsigned). sign-release downloads
72+
# this artifact to feed cli_merge_sign.sh.
6573
- name: Upload Github Artifacts
6674
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
6775
with:
6876
name: linux-artifacts
6977
path: artifacts/
70-
- name: Update GCS Manifest
71-
env:
72-
ARTIFACT_MANIFEST_BUCKET: "pixie-dev-public"
73-
# Use the old style versions file instead of the new updates for the gcs manifest.
74-
MANIFEST_UPDATES: ""
75-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
76-
run: ./ci/update_artifact_manifest.sh
7778
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7879
with:
7980
name: artifact-upload-log
@@ -88,6 +89,10 @@ jobs:
8889
fetch-depth: 0
8990
- name: Add pwd to git safe dir
9091
run: git config --global --add safe.directory `pwd`
92+
- uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
93+
with:
94+
name: linux-artifacts
95+
path: artifacts/
9196
- name: Install gon
9297
run: brew install Bearer/tap/gon
9398
- name: Sign CLI release
@@ -102,7 +107,6 @@ jobs:
102107
export CERT_PATH="pixie.cert"
103108
echo -n "$CERT_BASE64" | base64 --decode -o "$CERT_PATH"
104109
export TAG_NAME="${REF#*/tags/}"
105-
mkdir -p "artifacts/"
106110
export ARTIFACTS_DIR="$(pwd)/artifacts"
107111
./ci/cli_merge_sign.sh
108112
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
@@ -132,19 +136,15 @@ jobs:
132136
BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
133137
run: |
134138
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
135-
- id: gcloud-creds
136-
uses: ./.github/actions/gcloud_creds
137-
with:
138-
SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
139139
- name: Add pwd to git safe dir
140140
run: |
141141
git config --global --add safe.directory `pwd`
142142
- name: Upload signed CLI
143143
env:
144144
REF: ${{ github.event.ref }}
145145
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
146-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
147146
ARTIFACT_UPLOAD_LOG: "artifact_uploads.json"
147+
GH_REPO: ${{ github.repository }}
148148
shell: bash
149149
run: |
150150
export TAG_NAME="${REF#*/tags/}"

‎.github/workflows/cloud_release.yaml‎

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ jobs:
1717
name: Build Release
1818
runs-on: oracle-16cpu-64gb-x86-64
1919
needs: get-dev-image
20+
permissions:
21+
contents: read
22+
packages: write
2023
container:
2124
image: ${{ needs.get-dev-image.outputs.image-with-tag }}
2225
steps:
@@ -30,15 +33,17 @@ jobs:
3033
with:
3134
download_toplevel: 'true'
3235
BB_API_KEY: ${{ secrets.BB_IO_API_KEY }}
33-
- id: gcloud-creds
34-
uses: ./.github/actions/gcloud_creds
35-
with:
36-
SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
3736
- name: Import GPG key
3837
env:
3938
BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
4039
run: |
4140
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
41+
- name: Login to GHCR
42+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
43+
with:
44+
registry: ghcr.io
45+
username: ${{ github.actor }}
46+
password: ${{ github.token }}
4247
- name: Build & Push Artifacts
4348
env:
4449
REF: ${{ github.event.ref }}
@@ -47,9 +52,8 @@ jobs:
4752
GH_API_KEY: ${{ secrets.GITHUB_TOKEN }}
4853
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
4954
COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
50-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
5155
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
52-
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'gcr.io/pixie-oss/pixie-prod' }}
56+
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'ghcr.io/pixie-io' }}
5357
GH_REPO: ${{ github.repository }}
5458
shell: bash
5559
run: |

‎.github/workflows/operator_release.yaml‎

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ jobs:
1717
name: Build Release
1818
runs-on: oracle-16cpu-64gb-x86-64
1919
needs: get-dev-image
20+
permissions:
21+
contents: read
22+
packages: write
2023
container:
2124
image: ${{ needs.get-dev-image.outputs.image-with-tag }}
2225
env:
@@ -33,26 +36,27 @@ jobs:
3336
with:
3437
download_toplevel: 'true'
3538
BB_API_KEY: ${{ secrets.BB_IO_API_KEY }}
36-
- id: gcloud-creds
37-
uses: ./.github/actions/gcloud_creds
38-
with:
39-
SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
4039
- name: Import GPG key
4140
env:
4241
BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
4342
run: |
4443
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
44+
- name: Login to GHCR
45+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
46+
with:
47+
registry: ghcr.io
48+
username: ${{ github.actor }}
49+
password: ${{ github.token }}
4550
- name: Build & Push Artifacts
4651
env:
4752
REF: ${{ github.event.ref }}
4853
BUILD_NUMBER: ${{ github.run_attempt }}
4954
JOB_NAME: ${{ github.job }}
5055
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
5156
COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
52-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
5357
GH_REPO: ${{ github.repository }}
5458
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
55-
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'gcr.io/pixie-oss/pixie-prod' }}
59+
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'ghcr.io/pixie-io' }}
5660
shell: bash
5761
run: |
5862
export TAG_NAME="${REF#*/tags/}"
@@ -61,13 +65,6 @@ jobs:
6165
mkdir -p "${ARTIFACTS_DIR}"
6266
./ci/save_version_info.sh
6367
./ci/operator_build_release.sh
64-
- name: Update GCS Manifest
65-
env:
66-
ARTIFACT_MANIFEST_BUCKET: "pixie-dev-public"
67-
# Use the old style versions file instead of the new updates for the gcs manifest.
68-
MANIFEST_UPDATES: ""
69-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
70-
run: ./ci/update_artifact_manifest.sh
7168
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7269
with:
7370
name: manifest-updates

‎.github/workflows/vizier_release.yaml‎

Lines changed: 10 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,9 @@ jobs:
1717
name: Build Release
1818
runs-on: oracle-16cpu-64gb-x86-64
1919
needs: get-dev-image
20+
permissions:
21+
contents: read
22+
packages: write
2023
container:
2124
image: ${{ needs.get-dev-image.outputs.image-with-tag }}
2225
env:
@@ -33,26 +36,27 @@ jobs:
3336
with:
3437
download_toplevel: 'true'
3538
BB_API_KEY: ${{ secrets.BB_IO_API_KEY }}
36-
- id: gcloud-creds
37-
uses: ./.github/actions/gcloud_creds
38-
with:
39-
SERVICE_ACCOUNT_KEY: ${{ secrets.GH_RELEASE_SA_PEM_B64 }}
4039
- name: Import GPG key
4140
env:
4241
BUILDBOT_GPG_KEY_B64: ${{ secrets.BUILDBOT_GPG_KEY_B64 }}
4342
run: |
4443
echo "${BUILDBOT_GPG_KEY_B64}" | base64 --decode | gpg --no-tty --batch --import
44+
- name: Login to GHCR
45+
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
46+
with:
47+
registry: ghcr.io
48+
username: ${{ github.actor }}
49+
password: ${{ github.token }}
4550
- name: Build & Push Artifacts
4651
env:
4752
REF: ${{ github.event.ref }}
4853
BUILD_NUMBER: ${{ github.run_attempt }}
4954
JOB_NAME: ${{ github.job }}
5055
COSIGN_PASSWORD: ${{secrets.COSIGN_PASSWORD}}
5156
COSIGN_PRIVATE_KEY: ${{secrets.COSIGN_PRIVATE_KEY}}
52-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
5357
BUILDBOT_GPG_KEY_ID: ${{ secrets.BUILDBOT_GPG_KEY_ID }}
5458
GH_REPO: ${{ github.repository }}
55-
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'gcr.io/pixie-oss/pixie-prod' }}
59+
IMAGE_REPO: ${{ vars.IMAGE_REPO || 'ghcr.io/pixie-io' }}
5660
shell: bash
5761
run: |
5862
export TAG_NAME="${REF#*/tags/}"
@@ -61,20 +65,6 @@ jobs:
6165
export INDEX_FILE="$(pwd)/index.yaml"
6266
./ci/save_version_info.sh
6367
./ci/vizier_build_release.sh
64-
- name: Build & Export Docs
65-
env:
66-
PXL_DOCS_GCS_PATH: "gs://pixie-dev-public/pxl-docs.json"
67-
run: |
68-
docs="$(mktemp)"
69-
bazel run //src/carnot/docstring:docstring -- --output_json "${docs}"
70-
gsutil cp "${docs}" "${PXL_DOCS_GCS_PATH}"
71-
- name: Update GCS Manifest
72-
env:
73-
ARTIFACT_MANIFEST_BUCKET: "pixie-dev-public"
74-
# Use the old style versions file instead of the new updates for the gcs manifest.
75-
MANIFEST_UPDATES: ""
76-
GOOGLE_APPLICATION_CREDENTIALS: ${{ steps.gcloud-creds.outputs.gcloud-creds }}
77-
run: ./ci/update_artifact_manifest.sh
7868
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
7969
with:
8070
name: manifest-updates

‎ci/artifact_mirrors.yaml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,3 @@
44
- name: gh-releases
55
type: gh-releases
66
url_format: 'https://github.com/${gh_repo}/releases/download/release/${component}/v${version}/${artifact_name}'
7-
- name: pixie-oss-gcs
8-
type: gcs
9-
bucket: pixie-dev-public
10-
path_format: '${component}/${version}/${artifact_name}'
11-
url_format: 'https://storage.googleapis.com/pixie-dev-public/${component}/${version}/${artifact_name}'

‎ci/cli_merge_sign.sh‎

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -33,16 +33,9 @@ security set-key-partition-list -S apple-tool:,apple:,codesign: -s -k "${KEYCHAI
3333
security default-keychain -s "${KEYCHAIN_PATH}"
3434
security find-identity -v
3535

36-
release_tag=${TAG_NAME##*/v}
37-
bucket="pixie-dev-public"
38-
ARTIFACT_BASE_PATH="https://storage.googleapis.com/${bucket}/cli"
39-
4036
for arch in amd64 arm64
4137
do
42-
url="${ARTIFACT_BASE_PATH}/${release_tag}/cli_darwin_${arch}_unsigned"
43-
rm -f "cli_darwin_${arch}_unsigned"
44-
wget "${url}"
45-
mv "cli_darwin_${arch}_unsigned" "cli_darwin_${arch}"
38+
cp "${artifacts_dir}/cli_darwin_${arch}_unsigned" "cli_darwin_${arch}"
4639
done
4740

4841
# Create a universal binary.

‎ci/cloud_build_release.sh‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -34,12 +34,11 @@ if [[ "${release_tag}" == *"-"* ]]; then
3434
fi
3535

3636
echo "The image tag is: ${release_tag}"
37-
image_repo="${IMAGE_REPO:-gcr.io/pixie-oss/pixie-prod}"
37+
image_repo="${IMAGE_REPO:-ghcr.io/pixie-io}"
3838

3939
bazel run -c opt \
4040
--config=stamp \
4141
--config=x86_64_sysroot \
42-
--action_env=GOOGLE_APPLICATION_CREDENTIALS \
4342
--//k8s:image_repository="${image_repo}" \
4443
--//k8s:image_version="${release_tag}" \
4544
//k8s/cloud:cloud_images_push
@@ -53,17 +52,13 @@ done < <(bazel run -c opt \
5352
--//k8s:image_version="${release_tag}" \
5453
//k8s/cloud:list_image_bundle)
5554

56-
all_licenses_opts=("//tools/licenses:all_licenses" "--action_env=GOOGLE_APPLICATION_CREDENTIALS" "--remote_download_outputs=toplevel")
55+
all_licenses_opts=("//tools/licenses:all_licenses" "--remote_download_outputs=toplevel")
5756
all_licenses_path="$(bazel cquery "${all_licenses_opts[@]}" --output starlark --starlark:expr "target.files.to_list()[0].path" 2> /dev/null)"
5857
bazel build "${all_licenses_opts[@]}"
5958

6059
upload_artifact_to_mirrors "cloud" "${release_tag}" "${all_licenses_path}" "licenses.json"
61-
# The licenses file uses a non-standard path (outside of the "component/version/artifact" convention)
62-
# so for now we'll also copy it to the legacy path.
63-
gsutil cp "${all_licenses_path}" "gs://pixie-dev-public/oss-licenses/${release_tag}.json"
6460
if [[ "${release}" == "true" ]]; then
6561
upload_artifact_to_mirrors "cloud" "latest" "${all_licenses_path}" "licenses.json"
66-
gsutil cp "${all_licenses_path}" "gs://pixie-dev-public/oss-licenses/latest.json"
6762
fi
6863

6964
# Write YAMLs + image paths to a tar file to support easy deployment.

‎ci/operator_build_release.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ bazel run -c opt //src/utils/artifacts/versions_gen:versions_gen -- \
3737
tags=$(git for-each-ref --sort='-*authordate' --format '%(refname:short)' refs/tags \
3838
| grep "release/operator" | grep -v "\-" || true)
3939

40-
image_repo="${IMAGE_REPO:-gcr.io/pixie-oss/pixie-prod}"
40+
image_repo="${IMAGE_REPO:-ghcr.io/pixie-io}"
4141
image_paths=$(bazel cquery //k8s/operator:image_bundle \
4242
--//k8s:image_repository="${image_repo}" \
4343
--//k8s:image_version="${release_tag}" \

‎ci/operator_helm_build_release.sh‎

Lines changed: 3 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,6 @@ tmp_dir="$(mktemp -d)"
3636
index_file="${INDEX_FILE:?}"
3737
gh_repo="${GH_REPO:?}"
3838

39-
helm_gcs_bucket="pixie-operator-charts"
40-
if [[ $VERSION == *"-"* ]]; then
41-
helm_gcs_bucket="pixie-operator-charts-dev"
42-
fi
43-
4439
repo_path=$(pwd)
4540
# shellcheck source=ci/artifact_utils.sh
4641
. "${repo_path}/ci/artifact_utils.sh"
@@ -60,37 +55,12 @@ helm_tmpl_checks="$(cat "${repo_path}/k8s/operator/helm/olm_template_checks.tmpl
6055
find "${repo_path}/k8s/operator/helm/templates" -type f -exec sed -i "/HELM_DEPLOY_OLM_PLACEHOLDER/c\\${helm_tmpl_checks}" {} \;
6156
rm "${repo_path}/k8s/operator/helm/olm_template_checks.tmpl"
6257

63-
# Fetch all of the current charts in GCS, because generating the index needs all pre-existing tar versions present.
64-
mkdir -p "${tmp_dir}/${helm_gcs_bucket}"
65-
gsutil rsync "gs://${helm_gcs_bucket}" "${tmp_dir}/${helm_gcs_bucket}"
66-
6758
# Generates tgz for the new release helm3 chart.
68-
helm package "${helm_path}" -d "${tmp_dir}/${helm_gcs_bucket}"
69-
70-
# Create release for Helm2.
71-
mkdir "${helm_path}2"
72-
73-
# Create Chart.yaml for this release for Helm2.
74-
echo "apiVersion: v1
75-
name: pixie-operator-helm2-chart
76-
type: application
77-
version: ${VERSION}" > "${helm_path}2/Chart.yaml"
78-
79-
cp -r "${helm_path}/templates" "${helm_path}2/templates"
80-
cp "${helm_path}/values.yaml" "${helm_path}2/values.yaml"
81-
82-
# Generates tgz for the new release helm3 chart.
83-
helm package "${helm_path}2" -d "${tmp_dir}/${helm_gcs_bucket}"
84-
85-
# Update the index file.
86-
helm repo index "${tmp_dir}/${helm_gcs_bucket}" --url "https://${helm_gcs_bucket}.storage.googleapis.com"
87-
88-
upload_artifact_to_mirrors "operator" "${VERSION}" "${tmp_dir}/${helm_gcs_bucket}/pixie-operator-chart-${VERSION}.tgz" "pixie-operator-chart-${VERSION}.tgz"
59+
helm package "${helm_path}" -d "${tmp_dir}/helm_chart"
8960

90-
# Upload the new index and tar to gcs by syncing. This will help keep the timestamps for pre-existing tars the same.
91-
gsutil rsync "${tmp_dir}/${helm_gcs_bucket}" "gs://${helm_gcs_bucket}"
61+
upload_artifact_to_mirrors "operator" "${VERSION}" "${tmp_dir}/helm_chart/pixie-operator-chart-${VERSION}.tgz" "pixie-operator-chart-${VERSION}.tgz"
9262

93-
# Generate separate index file for GH.
63+
# Generate index file for GH.
9464
mkdir -p "${tmp_dir}/gh_helm_chart"
9565
helm package "${helm_path}" -d "${tmp_dir}/gh_helm_chart"
9666
# Pull index file.

‎ci/vizier_build_release.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ echo "The release tag is: ${release_tag}"
3535
bazel run -c opt //src/utils/artifacts/versions_gen:versions_gen -- \
3636
--repo_path "${repo_path}" --artifact_name vizier --versions_file "${versions_file}"
3737

38-
image_repo="${IMAGE_REPO:-gcr.io/pixie-oss/pixie-prod}"
38+
image_repo="${IMAGE_REPO:-ghcr.io/pixie-io}"
3939

4040
push_all_multiarch_images "//k8s/vizier:vizier_images_push" "//k8s/vizier:list_image_bundle" "${release_tag}" "${image_repo}"
4141

0 commit comments

Comments
 (0)