Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add workflow to release webhook in rancher/charts and rancher/rancher #449

Open
wants to merge 8 commits into
base: main
Choose a base branch
from
Open

Add workflow to release webhook in rancher/charts and rancher/rancher #449

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
127f479
Add workflow to release webhook in rancher/charts and rancher/rancher
tomleb Jul 11, 2024
00c013b
Migrate to using Github App
tomleb Sep 20, 2024
a7ce33a
Prepend to release list in charts
tomleb Sep 20, 2024
e9e0ecb
Take v-prefixed version as input
tomleb Oct 4, 2024
0d17e9c
Add doc block to release-message.sh
tomleb Oct 4, 2024
a7c70c3
Ensure prev and new versions are different
tomleb Oct 4, 2024
464e015
Add support for RC to nonRC
tomleb Oct 16, 2024
a7ec374
Add support RC to non-RC in rancher/rancher
tomleb Nov 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
95 changes: 95 additions & 0 deletions .github/workflows/release-charts.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,95 @@
name: Bump webhook in rancher/charts
on:
workflow_dispatch:
inputs:
charts_ref:
description: "Submit PR against the following rancher/charts branch (eg: dev-v2.10)"
required: true
default: "dev-v2.10"
prev_webhook:
description: "Previous Webhook version (eg: 0.5.0-rc.13)"
tomleb marked this conversation as resolved.
Show resolved Hide resolved
required: true
default: ""
new_webhook:
description: "New Webhook version (eg: 0.5.0-rc.14)"
required: true
default: ""

env:
CHARTS_REF: ${{ github.event.inputs.charts_ref }}
PREV_WEBHOOK: ${{ github.event.inputs.prev_webhook }}
NEW_WEBHOOK: ${{ github.event.inputs.new_webhook }}

jobs:
create-charts-pr:
runs-on: ubuntu-latest
permissions:
# Required for vault
id-token: write
steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.inputs.ref }}
path: webhook

- uses: rancher-eio/read-vault-secrets@main
with:
secrets: |
secret/data/github/repo/${{ github.repository }}/github/app-credentials appId | APP_ID ;
secret/data/github/repo/${{ github.repository }}/github/app-credentials privateKey | PRIVATE_KEY

# Fetch github token just for the charts repository
- uses: actions/create-github-app-token@v1
id: app-token
with:
app-id: ${{ env.APP_ID }}
private-key: ${{ env.PRIVATE_KEY }}
repositories: |
charts

- name: Checkout charts repository
uses: actions/checkout@v4
with:
fetch-depth: 0
repository: ${{ github.repository_owner }}/charts
token: ${{ steps.app-token.outputs.token }}
path: charts
# Allow making git push request later on
persist-credentials: true

- name: Configure the committer
run: |
cd charts
user_id=$(gh api "/users/$APP_USER" --jq .id)"
git config --global user.name "$APP_USER"
git config --global user.email "${user_id}+${APP_USER}@users.noreply.github.com>"
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
APP_USER: "${{ steps.app-token.outputs.app-slug }}[bot]"

- name: Install dependencies
run: sudo snap install yq --channel=v4/stable

- name: Run release script
run: |
cd charts
BRANCH="bump-webhook-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
echo "BRANCH=${BRANCH}" >> $GITHUB_ENV
git checkout -b "$BRANCH" "$CHARTS_REF"
./webhook/.github/workflows/scripts/release-against-charts.sh . "$PREV_WEBHOOK" "$NEW_WEBHOOK"

- name: Push and create pull request
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
cd charts
git push origin "$BRANCH"

body=$(../webhook/.github/workflows/scripts/release-message.sh "$PREV_WEBHOOK" "$NEW_WEBHOOK")

gh pr create \
--title "[$CHARTS_REF] Bump rancher-webhook to v$NEW_WEBHOOK" \
--body "$body" \
--repo ${{ github.repository_owner }}/charts \
--head "${{ github.repository_owner }}:$BRANCH" \
--base "$CHARTS_REF"
95 changes: 95 additions & 0 deletions .github/workflows/release-rancher.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,95 @@
name: Bump webhook in rancher/rancher
on:
workflow_dispatch:
inputs:
rancher_ref:
description: "Submit PR against the following rancher/rancher branch (eg: main)"
required: true
default: "main"
prev_webhook:
description: "Previous Webhook version (eg: 0.5.0-rc.13)"
required: true
default: ""
new_webhook:
description: "New Webhook version (eg: 0.5.0-rc.14)"
required: true
default: ""

env:
RANCHER_REF: ${{ github.event.inputs.rancher_ref }}
PREV_WEBHOOK: ${{ github.event.inputs.prev_webhook }}
NEW_WEBHOOK: ${{ github.event.inputs.new_webhook }}

jobs:
create-rancher-pr:
runs-on: ubuntu-latest
permissions:
# Required for vault
id-token: write
steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.inputs.ref }}
path: webhook

- uses: rancher-eio/read-vault-secrets@main
with:
secrets: |
secret/data/github/repo/${{ github.repository }}/github/app-credentials appId | APP_ID ;
secret/data/github/repo/${{ github.repository }}/github/app-credentials privateKey | PRIVATE_KEY

# Fetch github token just for the rancher repository
- uses: actions/create-github-app-token@v1
id: app-token
with:
app-id: ${{ env.APP_ID }}
private-key: ${{ env.PRIVATE_KEY }}
repositories: |
rancher

- name: Checkout rancher repository
uses: actions/checkout@v4
with:
fetch-depth: 0
repository: ${{ github.repository_owner }}/rancher
token: ${{ steps.app-token.outputs.token }}
path: rancher
# Allow making git push request later on
persist-credentials: true

- name: Configure the committer
run: |
cd rancher
user_id=$(gh api "/users/$APP_USER" --jq .id)"
git config --global user.name "$APP_USER"
git config --global user.email "${user_id}+${APP_USER}@users.noreply.github.com>"
env:
Comment on lines +63 to +66
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adapted from https://github.com/actions/create-github-app-token, unsure how necessary this is, probably not, but I guess that's probably the "idiomatic" values to put there so why not

GH_TOKEN: ${{ steps.app-token.outputs.token }}
APP_USER: "${{ steps.app-token.outputs.app-slug }}[bot]"

- name: Install dependencies
run: sudo snap install yq --channel=v4/stable

- name: Run release script
run: |
cd rancher
BRANCH="bump-webhook-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
echo "BRANCH=${BRANCH}" >> $GITHUB_ENV
git checkout -b "$BRANCH" "$RANCHER_REF"
./webhook/.github/workflows/scripts/release-against-rancher.sh . "$NEW_WEBHOOK"

- name: Push and create pull request
env:
GH_TOKEN: ${{ steps.app-token.outputs.token }}
run: |
cd rancher
git push origin $BRANCH

body=$(../webhook/.github/workflows/scripts/release-message.sh "$PREV_WEBHOOK" "$NEW_WEBHOOK")

gh pr create \
--title "[$RANCHER_REF] Bump rancher-webhook to v$NEW_WEBHOOK" \
--body "$body" \
--repo ${{ github.repository_owner }}/rancher \
--head "${{ github.repository_owner }}:$BRANCH" \
--base "$RANCHER_REF"
65 changes: 65 additions & 0 deletions .github/workflows/scripts/release-against-charts.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,65 @@
#!/bin/bash
#
# Bumps Webhook version in a locally checked out rancher/charts repository
#
# Usage:
# ./release-against-charts.sh <path to charts repo> <prev webhook release> <new webhook release>
#
# Example:
# ./release-against-charts.sh "${GITHUB_WORKSPACE}" "0.5.0-rc.13" "0.5.0-rc.14"

CHARTS_DIR=$1
PREV_WEBHOOK_VERSION=$2 # e.g. 0.5.2-rc.3
NEW_WEBHOOK_VERSION=$3

usage() {
cat <<EOF
Usage:
$0 <path to charts repo> <prev webhook release> <new webhook release>
EOF
}

if [ -z "$CHARTS_DIR" ] || [ -z "$PREV_WEBHOOK_VERSION" ] || [ -z "$NEW_WEBHOOK_VERSION" ]; then
usage
exit 1
fi

tomleb marked this conversation as resolved.
Show resolved Hide resolved
set -ue

pushd "${CHARTS_DIR}" > /dev/null

# Validate the given webhook version (eg: 0.5.0-rc.13)
if ! grep -q "${PREV_WEBHOOK_VERSION}" ./packages/rancher-webhook/package.yaml; then
echo "Previous Webhook version references do not exist in ./packages/rancher-webhook/. The content of the file is:"
cat ./packages/rancher-webhook/package.yaml
exit 1
fi
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could also avoid requiring the old version of webhook and instead fetch it directly from that same file. I'd be okay with that. This way you'd just need to know the version you want to go to.


# Get the chart version (eg: 104.0.0)
if ! PREV_CHART_VERSION=$(yq '.version' ./packages/rancher-webhook/package.yaml); then
echo "Unable to get chart version from ./packages/rancher-webhook/package.yaml. The content of the file is:"
cat ./packages/rancher-webhook/package.yaml
exit 1
fi
NEW_CHART_VERSION=$PREV_CHART_VERSION

sed -i "s/${PREV_WEBHOOK_VERSION}/${NEW_WEBHOOK_VERSION}/g" ./packages/rancher-webhook/package.yaml

git add packages/rancher-webhook
git commit -m "Bump rancher-webhook to v$NEW_WEBHOOK_VERSION"

PACKAGE=rancher-webhook make charts
git add ./assets/rancher-webhook ./charts/rancher-webhook
git commit -m "make charts"

CHART=rancher-webhook VERSION=${PREV_CHART_VERSION}+up${PREV_WEBHOOK_VERSION} make remove
git add ./assets/rancher-webhook ./charts/rancher-webhook ./index.yaml
git commit -m "make remove"
tomleb marked this conversation as resolved.
Show resolved Hide resolved

yq --inplace "del(.rancher-webhook.[] | select(. == \"${PREV_CHART_VERSION}+up${PREV_WEBHOOK_VERSION}\"))" release.yaml
yq --inplace ".rancher-webhook += [\"${NEW_CHART_VERSION}+up${NEW_WEBHOOK_VERSION}\"]" release.yaml

git add release.yaml
git commit -m "Add rancher-webhook ${NEW_CHART_VERSION}+up${NEW_WEBHOOK_VERSION} to release.yaml"

popd > /dev/null
56 changes: 56 additions & 0 deletions .github/workflows/scripts/release-against-rancher.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
#!/bin/bash
#
# Bumps Webhook version in a locally checked out rancher/rancher repository
#
# Usage:
# ./release-against-rancher.sh <path to rancher repo> <new webhook release>
#
# Example:
# ./release-against-charts.sh "${GITHUB_WORKSPACE}" "0.5.0-rc.14"

RANCHER_DIR=$1
NEW_WEBHOOK_VERSION=$2 # e.g. 0.5.2-rc.3

usage() {
cat <<EOF
Usage:
$0 <path to rancher repo> <new webhook release>
EOF
}

if [ -z "$RANCHER_DIR" ] || [ -z "$NEW_WEBHOOK_VERSION" ]; then
usage
exit 1
fi

set -ue

pushd "${RANCHER_DIR}" > /dev/null

# Validate the given webhook version (eg: 0.5.0-rc.13)
if grep -q "${NEW_WEBHOOK_VERSION}" ./build.yaml; then
echo "build.yaml already at version v${NEW_WEBHOOK_VERSION}"
exit 1
fi

# Get the chart version (eg: 104.0.0)
if ! PREV_CHART_VERSION=$(yq -r '.webhookVersion' ./build.yaml | cut -d+ -f1); then
echo "Unable to get chart version from ./build.yaml. The content of the file is:"
cat ./build.yaml
exit 1
fi
NEW_CHART_VERSION=$PREV_CHART_VERSION

yq --inplace ".webhookVersion = \"${NEW_CHART_VERSION}+up${NEW_WEBHOOK_VERSION}\"" ./build.yaml

# Downloads dapper
make .dapper

# DAPPER_MODE=bind will make sure we output everything that changed
DAPPER_MODE=bind ./.dapper go generate ./... || true
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need to go generate everything here or intent was only to call go run ./pkg/codegen/buildconfig/...?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I could extract the commands that go generate runs but I think it's more future proof to use go generate directly. The tradeoff is that this takes longer to run (which also means preventing other jobs to run).

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It also has potential of failing doing the irrelevant work.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll leave as is for now.

DAPPER_MODE=bind ./.dapper rm -rf go
Comment on lines +88 to +90
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there any benefit in using dapper for this? Perpetuating the use of dapper seems suboptimal.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Discussed this on slack but for visibility:

go generate might use a few tools like go and controller-gen. Those tools version are currently only defined in the Dockerfile for dapper in r/r. I want to be able to generate using the right tools, so using dapper for now is convenient because we don't need to care about those tools, no need to keep maintaining and syncing them with r/r, etc.

I don't really have bandwidth for making a change in r/r to allow that (eg: by extracting the versions of tools outside).


git add .
git commit -m "Bump webhook to ${NEW_CHART_VERSION}+up${NEW_WEBHOOK_VERSION}"

popd > /dev/null
47 changes: 47 additions & 0 deletions .github/workflows/scripts/release-message.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
#!/bin/sh

tomleb marked this conversation as resolved.
Show resolved Hide resolved
PREV_WEBHOOK_VERSION=$1 # e.g. 0.5.2-rc.3
NEW_WEBHOOK_VERSION=$2
GITHUB_TRIGGERING_ACTOR=${GITHUB_TRIGGERING_ACTOR:-}

usage() {
cat <<EOF
Usage:
$0 <prev webhook release> <new webhook release>
EOF
}

if [ -z "$PREV_WEBHOOK_VERSION" ] || [ -z "$NEW_WEBHOOK_VERSION" ]; then
usage
exit 1
fi

set -ue

# XXX: That's wasteful but doing it by caching the response in a var was giving
# me unicode error.
url=$(gh release view --repo rancher/webhook --json url "v${NEW_WEBHOOK_VERSION}" --jq '.url')
body=$(gh release view --repo rancher/webhook --json body "v${NEW_WEBHOOK_VERSION}" --jq '.body')

generated_by=""
if [ -n "$GITHUB_TRIGGERING_ACTOR" ]; then
generated_by=$(cat <<EOF
# About this PR

The workflow was triggered by $GITHUB_TRIGGERING_ACTOR.
EOF
)
fi

cat <<EOF
# Release note for [v${NEW_WEBHOOK_VERSION}]($url)

$body

# Useful links

- Commit comparison: https://github.com/rancher/webhook/compare/v${PREV_WEBHOOK_VERSION}...v${NEW_WEBHOOK_VERSION}
- Release v${PREV_WEBHOOK_VERSION}: https://github.com/rancher/webhook/releases/tag/v${PREV_WEBHOOK_VERSION}

$generated_by
EOF
Loading