Merge branch 'main' of https://github.com/canonical/oci-factory into …

…ROCKS-1452/oci-factory-refactor-build-rock-to-be-externally-reusable

.github/base_digests/20.04

@@ -1 +1 @@
-public.ecr.aws/ubuntu/ubuntu:focal@sha256:f80053be8041fea27b329b31c96e8177cd3922ef748a246dc55f651fefdee537
+public.ecr.aws/ubuntu/ubuntu:focal@sha256:036c51fb190af9d3ec7fbd654c2669d5a3da3549aa0e3408b40ba6fb6eb16dfc

.github/base_digests/22.04

@@ -1,2 +1,2 @@
-public.ecr.aws/ubuntu/ubuntu:jammy@sha256:606a9e0ca22a44f8956dcb463ab4daba5d50c100ea8075d3c24a2bddd161d320
+public.ecr.aws/ubuntu/ubuntu:jammy@sha256:1582c29f34a48752e406f1a261fe9545fad895da3f6bb4be55bc82485557564e
 

.github/base_digests/24.04

@@ -0,0 +1,2 @@
+public.ecr.aws/ubuntu/ubuntu:noble@sha256:5b2fc4131b3c134a019c3ea815811de70e6ad9ee1626f59bf302558a95b436e5
+

.github/workflows/Build-Rock.yaml

@@ -50,21 +50,43 @@ jobs:
       runner-build-matrix: ${{ steps.configure.outputs.runner-build-matrix }}
       lpci-build-matrix: ${{ steps.configure.outputs.lpci-build-matrix }}
     steps:
-      # Job Setup
+      # Checkout the OCI Factory repo for the actor validation
       - uses: actions/checkout@v4
-        with:
-          repository: ${{ env.OCI_FACTORY_REPO }}
-          ref: ${{ env.OCI_FACTORY_BRANCH }}
-          fetch-depth: 1
+        if: ${{ github.repository == 'canonical/oci-factory'  && !github.event.pull_request.head.repo.fork }}
 
       - name: Validate access to triggered image
         uses: ./.github/actions/validate-actor
-        if: ${{ github.repository == 'canonical/oci-factory' }}
+        if: ${{ github.repository == 'canonical/oci-factory' && !github.event.pull_request.head.repo.fork }}
         with:
           admin-only: true
           image-path: ${{ inputs.oci-factory-path }}
           github-token: ${{ secrets.ROCKSBOT_TOKEN }}
 
+      # We clear the working directory to make space for the rock repo
+      - run: rm -rf ./*
+        if: ${{ github.repository == 'canonical/oci-factory' && !github.event.pull_request.head.repo.fork }}
+
+      - name: Clone GitHub image repository
+        uses: actions/checkout@v4
+        id: clone-image-repo
+        continue-on-error: true
+        with:
+          repository: ${{ env.OCI_FACTORY_REPO }}
+          ref: ${{ env.OCI_FACTORY_BRANCH }}
+          fetch-depth: 1
+
+      - run: git checkout ${{ inputs.rock-repo-commit }}
+
+      - run: sudo snap install yq --channel=v4/stable
+      - name: Validate image naming and base
+        working-directory: ${{ inputs.rockfile-directory }}
+        run: |
+          rock_name=`cat rockcraft.y*ml | yq -r .name`
+          if [[ "${{ inputs.oci-factory-path }}" != *"${rock_name}"* ]]
+          then
+            echo "ERROR: the rock's name '${rock_name}' must match the OCI folder name!"
+            exit 1
+          fi
       - uses: actions/setup-python@v5
         with:
           python-version: "3.x"

.github/workflows/Image.yaml

@@ -96,7 +96,7 @@ jobs:
 
       - name: Validate access to triggered image
         uses: ./.github/actions/validate-actor
-        if: ${{ github.repository == 'canonical/oci-factory' }}
+        if: ${{ github.repository == 'canonical/oci-factory' && !github.event.pull_request.head.repo.fork }}
         with:
           admin-only: true
           image-path: ${{ steps.validate-image.outputs.img-path }}

.github/workflows/Tests.yaml

@@ -72,7 +72,7 @@ jobs:
     - uses: actions/checkout@v4 
     - name: Validate access to triggered image
       uses: ./.github/actions/validate-actor
-      if: ${{ github.repository == 'canonical/oci-factory' }}
+      if: ${{ github.repository == 'canonical/oci-factory' && !github.event.pull_request.head.repo.fork }}
       with:
         admin-only: true
         image-path: ${{ inputs.oci-image-path }}

.github/workflows/Vulnerability-Scan.yaml

@@ -46,7 +46,7 @@ jobs:
 
       - name: Validate access to triggered image
         uses: ./.github/actions/validate-actor
-        if: ${{ github.repository == 'canonical/oci-factory' }}
+        if: ${{ github.repository == 'canonical/oci-factory' && !github.event.pull_request.head.repo.fork }}
         with:
           admin-only: true
           image-path: ${{ inputs.oci-image-path }}
@@ -268,6 +268,6 @@ jobs:
           fi
 
       - name: Close issue
-        if: ${{ steps.issue-exists.outputs.issue-exists == 'true' && steps.create-markdown.outputs.vulnerability-exists == 'false' }}
+        if: ${{ needs.test-vulnerabilities.result == 'success' && steps.issue-exists.outputs.issue-exists == 'true' && steps.create-markdown.outputs.vulnerability-exists == 'false' }}
         run: |
           gh issue close ${{ steps.issue-exists.outputs.issue-number }} --repo ${{ steps.get-image-repo.outputs.img-repo }}

oci/alertmanager/_releases.json

@@ -1,107 +1,107 @@
 {
     "0.25.0-22.04": {
         "stable": {
-            "target": "53"
+            "target": "59"
         },
         "candidate": {
-            "target": "53"
+            "target": "59"
         },
         "beta": {
-            "target": "53"
+            "target": "59"
         },
         "edge": {
-            "target": "53"
+            "target": "59"
         },
         "end-of-life": "2025-03-13T00:00:00Z"
     },
     "0.25-22.04": {
         "stable": {
-            "target": "53"
+            "target": "59"
         },
         "candidate": {
-            "target": "53"
+            "target": "59"
         },
         "beta": {
-            "target": "53"
+            "target": "59"
         },
         "edge": {
-            "target": "53"
+            "target": "59"
         },
         "end-of-life": "2025-03-13T00:00:00Z"
     },
     "0-22.04": {
         "stable": {
-            "target": "55"
+            "target": "61"
         },
         "candidate": {
-            "target": "55"
+            "target": "61"
         },
         "beta": {
-            "target": "55"
+            "target": "61"
         },
         "edge": {
-            "target": "55"
+            "target": "61"
         },
         "end-of-life": "2025-03-13T00:00:00Z"
     },
     "0.26.0-22.04": {
         "stable": {
-            "target": "54"
+            "target": "60"
         },
         "candidate": {
-            "target": "54"
+            "target": "60"
         },
         "beta": {
-            "target": "54"
+            "target": "60"
         },
         "edge": {
-            "target": "54"
+            "target": "60"
         },
         "end-of-life": "2025-03-13T00:00:00Z"
     },
     "0.26-22.04": {
         "stable": {
-            "target": "54"
+            "target": "60"
         },
         "candidate": {
-            "target": "54"
+            "target": "60"
         },
         "beta": {
-            "target": "54"
+            "target": "60"
         },
         "edge": {
-            "target": "54"
+            "target": "60"
         },
         "end-of-life": "2025-03-13T00:00:00Z"
     },
     "0.27.0-22.04": {
         "end-of-life": "2025-03-13T00:00:00Z",
         "stable": {
-            "target": "55"
+            "target": "61"
         },
         "candidate": {
-            "target": "55"
+            "target": "61"
         },
         "beta": {
-            "target": "55"
+            "target": "61"
         },
         "edge": {
-            "target": "55"
+            "target": "61"
         }
     },
     "0.27-22.04": {
         "end-of-life": "2025-03-13T00:00:00Z",
         "stable": {
-            "target": "55"
+            "target": "61"
         },
         "candidate": {
-            "target": "55"
+            "target": "61"
         },
         "beta": {
-            "target": "55"
+            "target": "61"
         },
         "edge": {
-            "target": "55"
+            "target": "61"
         }
     }
 }