Skip to content
[CI/CD] CI Pipeline

[bitnami/mysql] Release 11.0.0 #31055

Sign in to view logs

[bitnami/mysql] Release 11.0.0

[bitnami/mysql] Release 11.0.0 #31055

Workflow file for this run

.github/workflows/ci-pipeline.yml at 0ff7c8b
# Copyright Broadcom, Inc. All Rights Reserved.
# SPDX-License-Identifier: APACHE-2.0
name: '[CI/CD] CI Pipeline'
on: # rebuild any PRs and main branch changes
pull_request_target:
types:
- opened
- reopened
- synchronize
- labeled
branches:
- main
- bitnami:main
# Remove all permissions by default
permissions: {}
# Avoid concurrency over the same PR
concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
jobs:
get-chart:
runs-on: ubuntu-latest
name: Get modified charts
permissions:
pull-requests: read
outputs:
chart: ${{ steps.get-chart.outputs.chart }}
result: ${{ steps.get-chart.outputs.result }}
values-updated: ${{ steps.get-chart.outputs.values-updated }}
steps:
- id: get-chart
name: Get modified charts
env:
PULL_REQUEST_NUMBER: "${{ github.event.pull_request.number }}"
PULL_REQUEST_URL: "${{ github.event.pull_request.url }}"
GITHUB_TOKEN: "${{ github.token }}"
run: |
# Using the Github API to detect the files changed as git merge-base stops working when the branch is behind
files_changed_data="$(gh api --paginate /repos/${GITHUB_REPOSITORY}/pulls/${PULL_REQUEST_NUMBER}/files)"
files_changed="$(echo "$files_changed_data" | jq -r '.[] | .filename')"
# Adding || true to avoid "Process exited with code 1" errors
charts_dirs_changed="$(echo "$files_changed" | xargs dirname | grep -o "bitnami/[^/]*" | sort | uniq || true)"
# Using grep -c as a better alternative to wc -l when dealing with empty strings."
num_charts_changed="$(echo "$charts_dirs_changed" | grep -c "bitnami" || true)"
num_version_bumps="$(echo "$files_changed_data" | jq -r '[.[] | select(.filename|endswith("Chart.yaml")) | select(.patch|contains("+version")) ] | length' )"
non_readme_files=$(echo "$files_changed" | grep -vc "\.md" || true)
if [[ $(curl -Lks "${PULL_REQUEST_URL}" | jq '.state | index("closed")') != *null* ]]; then
# The PR for which this workflow run was launched is now closed -> SKIP
echo "error=The PR for which this workflow run was launched is now closed. The tests will be skipped." >> $GITHUB_OUTPUT
echo "result=skip" >> $GITHUB_OUTPUT
elif [[ "$non_readme_files" -le "0" ]]; then
# The only changes are .md files -> SKIP
echo "result=skip" >> $GITHUB_OUTPUT
elif [[ "$num_charts_changed" -ne "$num_version_bumps" ]]; then
# Changes done in charts but version not bumped -> ERROR
echo "error=Detected changes in charts without version bump in Chart.yaml. Charts changed: ${num_charts_changed}. Version bumps detected: ${num_version_bumps}" >> $GITHUB_OUTPUT
echo "result=fail" >> $GITHUB_OUTPUT
elif [[ "$num_charts_changed" -eq "1" ]]; then
# Changes done in only one chart -> OK
echo "result=ok" >> $GITHUB_OUTPUT
# Extra output: chart name
chart_name=$(echo "$charts_dirs_changed" | sed "s|bitnami/||g")
echo "chart=${chart_name}" >> $GITHUB_OUTPUT
# Extra output: values-updated
if [[ ${files_changed[@]} =~ "bitnami/${chart_name}/values.yaml" ]]; then
echo "values-updated=true" >> $GITHUB_OUTPUT
fi
elif [[ "$num_charts_changed" -le "0" ]]; then
# Changes done in the bitnami/ folder but not inside a chart subfolder -> SKIP
echo "error=No changes detected in charts. The rest of the tests will be skipped." >> $GITHUB_OUTPUT
echo "result=skip" >> $GITHUB_OUTPUT
else
# Changes done in more than chart -> SKIP
echo "error=Changes detected in more than one chart directory. It is strongly advised to change only one chart in a PR. The rest of the tests will be skipped." >> $GITHUB_OUTPUT
echo "result=skip" >> $GITHUB_OUTPUT
fi
# Using actions/github-scripts because using exit 1 in the script above would not provide any output
# Source: https://github.community/t/no-output-on-process-completed-with-exit-code-1/123821/3
- id: show-error
name: Show error
if: ${{ steps.get-chart.outputs.result != 'ok' }}
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
with:
script: |
let message='${{ steps.get-chart.outputs.error }}';
if ('${{ steps.get-chart.outputs.result }}' === 'fail' ) {
core.setFailed(message);
} else {
core.warning(message);
}
update-pr:
runs-on: ubuntu-latest
needs: [get-chart]
name: Automatically update README and CRDs
permissions:
contents: write
outputs:
result: ${{ steps.update-pr.outputs.result }}
if: needs.get-chart.outputs.result == 'ok'
steps:
- name: Checkout bitnami/charts
uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
with:
ref: ${{github.event.pull_request.head.ref}}
repository: ${{github.event.pull_request.head.repo.full_name}}
token: ${{ secrets.BITNAMI_BOT_TOKEN }}
- name: Setup git configuration
run: |
git config user.name "Bitnami Containers"
git config user.email "[email protected]"
- name: Install readme-generator-for-helm
if: needs.get-chart.outputs.values-updated == 'true'
run: npm install -g @bitnami/readme-generator-for-helm
- id: update-readme
name: 'Update README'
if: needs.get-chart.outputs.values-updated == 'true'
env:
CHART: ${{ needs.get-chart.outputs.chart }}
run: |
exit_code=0
echo "Validating README.md for bitnami/${CHART}"
# Validating *.registry parameters
while read line; do
echo "$line" | grep --quiet "\[default: \(REGISTRY_NAME\|\"\"\)\]" || exit_code=$?
done < <(grep "@param\s\+[A-Za-z\.]\+\.registry\s\+" "bitnami/${CHART}/values.yaml")
if [[ $exit_code -ne 0 ]]; then
echo "error=Please ensure all *.registry params include the [default: REGISTRY_NAME] modifier in the chart bitnami/${CHART}/values.yaml file"
exit "$exit_code"
fi
# Validating *.repository parameters
while read line; do
param=$(echo "$line" | awk '{print $3}')
# Checking if it's a image's registry-related param
registry_param=$(echo ${param} | sed 's/\.repository/\.registry/g')
grep --quiet "@param\s\+${registry_param}" "bitnami/${CHART}/values.yaml" && ( echo "$line" | grep --quiet "\[default: \(REPOSITORY_NAME/.*\|\"\"\)\]" || exit_code=$? )
done < <(grep "@param\s\+[A-Za-z\.]\+\.repository\s\+" "bitnami/${CHART}/values.yaml")
if [[ $exit_code -ne 0 ]]; then
echo "error=Please ensure all *.repository params include the [default: REPOSITORY_NAME] modifier the in the chart bitnami/${CHART}/values.yaml file"
exit "$exit_code"
fi
# Validating *.tag parameters
! grep --quiet "@param\s\+[A-Za-z\.]\+\.tag\s\+" "bitnami/${CHART}/values.yaml" || exit_code=$?
if [[ $exit_code -ne 0 ]]; then
echo "error=Please ensure all *.tag params are skipped (@skip) in the bitnami/${CHART}/values.yaml file"
exit "$exit_code"
fi
# Ensuring no unprintable characters are present in values.yaml
! grep --quiet "[^[:print:]]" "bitnami/${CHART}/values.yaml" || exit_code=$?
if [[ $exit_code -ne 0 ]]; then
echo "error=Please ensure there are no unprintable characters in the bitnami/${CHART}/values.yaml file"
exit "$exit_code"
fi
echo "Updating README.md for bitnami/${CHART}"
readme-generator --values "bitnami/${CHART}/values.yaml" --readme "bitnami/${CHART}/README.md" --schema "/tmp/schema.json"
# Commit all changes, if any
if git status -s | grep "bitnami/${CHART}"; then
git add "bitnami/${CHART}" && git commit -m "Update README.md with readme-generator-for-helm" --signoff
fi
- id: update-crds
name: 'Update CRDs'
# To avoid malicious executions, only PRs performed by the bitnami-bot will perform the CRDs update
if: github.event.pull_request.user.login == 'bitnami-bot'
env:
CHART: ${{ needs.get-chart.outputs.chart }}
run: |
# Updating CRDs stored at 'bitnami/$CHART/crds' and 'bitnami/$CHART/templates/crds'
mapfile -t crd_files < <(find "bitnami/${CHART}/crds" "bitnami/${CHART}/templates/crds" -name "*.yaml" -o -name "*.yml" 2>/dev/null || true)
for file in "${crd_files[@]}"; do
# Automatically update CRDs that use the '# Source' header
source_url_tpl="$(head -n 1 $file | grep -E "^# ?Source: ?" | sed -E 's|^# ?Source: ?||' || true)"
if [[ -n "$source_url_tpl" ]]; then
# Validate the second line of the CRD file includes the version of the CRD
crd_version="$(head -n 2 $file | tail -n 1 | grep -E "^# ?Version: ?" | sed -E 's|^# ?Version: ?||' || true)"
if [[ -z "$crd_version" ]]; then
echo "error=CRD file '${file}' does not include the '#Version: <version> header'"
exit 1
fi
# Additional headers may be used for extra features
# Conditional - Adds a conditional {{if}}/{{end}} to the downloaded upstream CRD
# VersionOf - Name of a subcomponent, its version will be used for CRD tracking instead of the main component version
# UseKustomize - If set to true, uses Kustomize to render the CRDs
# RequiresFilter - If set to true, uses yq to filter resources having 'kind: CustomResourceDefinition', useful when using 'install.yaml' file as upstream source
continue=true
line_n=2
extra_headers=""
CONDITIONAL=""
SUBCOMPONENT=""
USE_KUSTOMIZE=""
REQUIRES_FILTER=""
while [ "$continue" = true ]; do
line_n=$((line_n+1))
line="$(head -n $line_n $file | tail -n 1)"
if [[ $line =~ ^#\ ?[a-zA-Z]+:\ ? ]]; then
if [[ $line =~ ^#\ ?Conditional:\ ? ]]; then
CONDITIONAL="$(echo $line | sed -E 's|^# ?Conditional: ?||')"
CONDITIONAL="{{- if ${CONDITIONAL} }}\n"
elif [[ $line =~ ^#\ ?VersionOf:\ ? ]]; then
SUBCOMPONENT="$(echo $line | sed -E 's|^# ?VersionOf: ?||')"
elif [[ $line =~ ^#\ ?UseKustomize:\ ? ]]; then
USE_KUSTOMIZE="$(echo $line | sed -E 's|^# ?UseKustomize: ?||' || true)"
elif [[ $line =~ ^#\ ?RequiresFilter:\ ? ]]; then
REQUIRES_FILTER="$(echo $line | sed -E 's|^# ?RequiresFilter: ?||' || true)"
else
echo "error=Header ${line} not recognized'"
exit 1
fi
extra_headers="${extra_headers}${line}\n"
else
continue=false
fi
done
# Obtain the version of the subcomponent if provided, otherwise use the main component version
if [[ -n "$SUBCOMPONENT" ]]; then
APP_VERSION="$(cat bitnami/${CHART}/Chart.yaml | grep -E "image: \S+${SUBCOMPONENT}:" | sed -E "s|.*${SUBCOMPONENT}:([0-9\.]+)-.*|\1|")"
else
APP_VERSION="$(yq e '.appVersion' bitnami/${CHART}/Chart.yaml)"
fi
# Replace version placeholder, if present
source_url=$(echo "$source_url_tpl" | sed "s/{version}/${APP_VERSION}/")
# If the application version is newer, automatically update the CRD file
if [[ "$APP_VERSION" != "$crd_version" || "$skip_version" = true ]]; then
if [[ "$USE_KUSTOMIZE" = "true" ]]; then
kubectl kustomize "$source_url" > $file
else
curl -Lks --fail -o $file "$source_url"
fi
if [[ "$REQUIRES_FILTER" = "true" ]]; then
yq -i e '. | select(.kind == "CustomResourceDefinition") | ... head_comment=""' $file
fi
sed -i "1s|^|# Source: ${source_url_tpl}\n# Version: ${APP_VERSION}\n${extra_headers}${CONDITIONAL}|" $file
if [[ -n "$CONDITIONAL" ]]; then
echo -E "{{- end }}" >> $file
fi
echo "info=CRD file '${file}' automatically updated using source '$source_url'"
fi
else
echo "info=CRD file '$file' does not contain the '#Source' header. Skipping..."
fi
done
# Commit all changes, if any
if git status -s | grep "bitnami/${CHART}"; then
git add "bitnami/${CHART}" && git commit -m "Update CRDs automatically" --signoff
fi
- id: update-pr
name: Push changes
run: |
# Push all the new commits, if any
if [[ $(git cherry -v) ]]; then
git push
echo "result=ok" >> $GITHUB_OUTPUT
else
echo "result=skip" >> $GITHUB_OUTPUT
fi
vib-verify:
runs-on: ubuntu-latest
needs: [get-chart, update-pr]
permissions:
contents: read
# Given performance issues of the action feature on GH's side, we need to be very restrictive in the job's triggers:
# -> The 'Get modified charts' job suceededs AND
# -> The 'Update PR' job did not push any new changes AND
# ( ---> The pipeline was triggered due to a label addition and said label was the 'verify' one OR
# ---> the PR already contains the 'verify' label )
if: |
needs.get-chart.outputs.result == 'ok' &&
needs.update-pr.outputs.result == 'skip' &&
(
contains(github.event.pull_request.labels.*.name, 'verify') || (github.event.action == 'labeled' && github.event.label.name == 'verify')
)
name: VIB Verify
steps:
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29
name: Checkout Repository
with:
ref: ${{ github.event.pull_request.head.ref }}
repository: ${{ github.event.pull_request.head.repo.full_name }}
- id: log-chart-info
name: Get chart version and app version
env:
CHART: ${{ needs.get-chart.outputs.chart }}
run: |
# Log chart info
chart_version="$(yq e '.version' bitnami/${CHART}/Chart.yaml)"
app_version="$(yq e '.appVersion' bitnami/${CHART}/Chart.yaml)"
echo "Chart: ${CHART} ChartVersion: ${chart_version} AppVersion: ${app_version}"
- id: get-asset-vib-config
name: Get asset-specific configuration for VIB action
run: |
config_file=".vib/${{ needs.get-chart.outputs.chart }}/vib-action.config"
# Supported configuration customizations and default values
verification_mode="PARALLEL"
if [[ -f $config_file ]]; then
verification_mode="$(cat $config_file | grep 'verification-mode' | cut -d'=' -f2)"
fi
runtime_parameters_file=""
if [[ -f ".vib/${{ needs.get-chart.outputs.chart }}/runtime-parameters.yaml" ]]; then
# The path is relative to the .vib folder
runtime_parameters_file="${{ needs.get-chart.outputs.chart }}/runtime-parameters.yaml"
fi
echo "verification_mode=${verification_mode}" >> $GITHUB_OUTPUT
echo "runtime_parameters_file=${runtime_parameters_file}" >> $GITHUB_OUTPUT
- uses: vmware-labs/vmware-image-builder-action@v0
name: Verify ${{ needs.get-chart.outputs.chart }}
with:
pipeline: ${{ needs.get-chart.outputs.chart }}/vib-verify.json
verification-mode: ${{ steps.get-asset-vib-config.outputs.verification_mode }}
runtime-parameters-file: ${{ steps.get-asset-vib-config.outputs.runtime_parameters_file }}
env:
CSP_API_URL: https://console.cloud.vmware.com
CSP_API_TOKEN: ${{ secrets.CSP_API_TOKEN }}
VIB_PUBLIC_URL: https://cp.bromelia.vmware.com
# Target-Platform used by default
VIB_ENV_TARGET_PLATFORM: ${{ secrets.VIB_ENV_TARGET_PLATFORM }}
# Alternative Target-Platform to be used in case of incompatibilities
VIB_ENV_ALTERNATIVE_TARGET_PLATFORM: ${{ secrets.VIB_ENV_ALTERNATIVE_TARGET_PLATFORM }}
auto-pr-review:
runs-on: ubuntu-latest
needs: vib-verify
name: Reviewal for automated PRs
permissions:
pull-requests: write
# Job to be run only when the triage for automated PRs did as well,
# not taking into account whether 'VIB Verify' succeeded
if: |
always() &&
contains(github.event.pull_request.labels.*.name, 'auto-merge') &&
github.event.pull_request.user.login == 'bitnami-bot'
steps:
# Approve the CI's PR if the 'VIB Verify' job succeeded
# Approved by the 'github-actions' user; a PR can't be approved by its author
- name: PR approval
if: ${{ needs.vib-verify.result == 'success' }}
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
with:
result-encoding: string
retries: 3
script: |
github.rest.pulls.createReview({
owner: context.repo.owner,
repo: context.repo.repo,
pull_number: context.issue.number,
event: 'APPROVE',
});
- name: Merge
id: merge
if: ${{ needs.vib-verify.result == 'success' }}
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
with:
result-encoding: string
retries: 3
github-token: ${{ secrets.BITNAMI_BOT_TOKEN }}
script: |
github.rest.pulls.merge({
pull_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
merge_method: 'squash'
})
# If the CI did not succeed ('VIB Verify' failed or skipped),
# post a comment on the PR and assign a maintainer agent to review it
- name: Manual review required
if: ${{ always() && (needs.vib-verify.result != 'success' || steps.merge.outcome != 'success' ) }}
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea
env:
BODY: |
There has been an error during the automated release process. Manual revision is now required.
Please check the related [action_run#${{ github.run_id }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}) for more information.
with:
retries: 3
# Necessary to trigger support workflows
github-token: ${{ secrets.BITNAMI_BOT_TOKEN }}
script: |
const {BODY} = process.env
github.rest.issues.createComment({
issue_number: context.issue.number,
owner: context.repo.owner,
repo: context.repo.repo,
body: `${BODY}`
})