Workflow refactor

.github/actions/build-test-scan-push/action.yaml

@@ -0,0 +1,142 @@
+name: 'Build/Test/Scan/Push Image'
+inputs:
+  context:
+    description: Path to the directory of the Dockerfile
+    required: true
+    type: string
+  os:
+    description: Target OS to build, the same as the extension of the Dockerfile
+    default: ubuntu2204
+    type: string
+  product:
+    description: Product being built
+    type: string
+  build-args:
+    description: JSON list of build args for the built image
+    required: true
+    type: string
+  image-tags:
+    description: List of tags for the built image
+    required: true
+    type: string
+  test-image:
+    description: Flag to test image once built
+    default: true
+    type: boolean
+  snyk-token:
+    description: Username for authentication with Snyk for scanning images
+    type: string
+  snyk-org-id:
+    description: Snyk Organization ID to publish scans to
+    type: string
+  push-image:
+    description: Flag to push image once built
+    default: false
+    type: boolean
+  ghcr-token:
+    description: Username for authentication with GHCR.io
+    required: true
+    type: string
+  dockerhub-username:
+    description: Username for authentication with DockerHub
+    required: true
+    type: string
+  dockerhub-token:
+    description: Username for authentication with DockerHub
+    required: true
+    type: string
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v2
+
+    - name: Free Disk space
+      shell: bash
+      run: |
+        sudo rm -rf /usr/local/lib/android  # will release about 10 GB
+        sudo rm -rf /usr/share/dotnet # will release about 20GB
+
+    - name: Login to ghcr.io
+      uses: docker/login-action@v2
+      with:
+        registry: ghcr.io
+        username: ${{ github.actor }}
+        password: ${{ inputs.ghcr-token }}
+
+    - name: Login to Docker Hub
+      uses: docker/login-action@v2
+      with:
+        username: ${{ inputs.dockerhub-username }}
+        password: ${{ inputs.dockerhub-token }}
+
+    - name: Build
+      id: image-build
+      uses: docker/build-push-action@v4
+      with:
+        load: true
+        context: ${{ inputs.context }}
+        file: ${{ inputs.context }}/Dockerfile.${{ inputs.os }}
+        cache-from: type=gha
+        cache-to: type=gha
+        build-args: |
+          ${{ inputs.build-args }}
+        tags: ${{ inputs.image-tags }}
+
+    - name: Get first tag
+      shell: bash
+      id: first-tag
+      run: |
+        IMG_TAGS="${{ inputs.image-tags }}"
+        FIRST_TAG=$(cut -d "," -f 1 <<< "${IMG_TAGS//$'\n'/}")
+        echo "$FIRST_TAG"
+        echo "FIRST_TAG=$FIRST_TAG" >> $GITHUB_OUTPUT
+
+    - name: Test - ${{ inputs.test-image }}
+      shell: bash
+      run: |
+        if [[ "${{ inputs.test-image }}" == "true" ]]; then
+          echo "${{ inputs.build-args }}" > ${{ inputs.context }}/.env
+          echo "OS=${{ inputs.os }}" >> ${{ inputs.context }}/.env
+          cat ${{ inputs.context }}/.env
+          IMAGE_NAME=${{ steps.first-tag.outputs.FIRST_TAG }} docker-compose -f ${{ inputs.context }}/docker-compose.test.yml run sut
+        fi
+
+    - name: Evaluate Snyk command
+      id: eval-snyk-command
+      shell: bash
+      run: |
+        if [[ "${{ github.ref }}" == "refs/heads/main" ]]; then
+          SNYK_COMMAND="monitor"
+        else
+          SNYK_COMMAND="test"
+        fi
+        echo "SNYK_COMMAND=$SNYK_COMMAND" >> $GITHUB_OUTPUT     
+
+    - name: Run Snyk ${{ steps.eval-snyk-command.SNYK_COMMAND }}
+      continue-on-error: true
+      uses: snyk/actions/docker@master
+      env:
+        SNYK_TOKEN: ${{ inputs.snyk-token }}
+      with:
+        image: ${{ steps.first-tag.FIRST_TAG }}
+        args: |
+          --file=${{ inputs.context }}/Dockerfile.${{ inputs.os }} \
+          --org=${{ inputs.snyk-org-id }} \
+          --project-name=${{ steps.first-tag.FIRST_TAG }} \
+          --tags=product=${{ inputs.product }},os=${{ inputs.os }} \
+          --exclude-base-image-vulns \
+          --app-vulns
+        command: ${{ steps.eval-snyk-command.SNYK_COMMAND }}
+
+    - name: Push - ${{ inputs.push-image }}
+      uses: docker/build-push-action@v4
+      with:
+        push: ${{ inputs.push-image }}
+        context: ${{ inputs.context }}
+        file: ${{ inputs.context }}/Dockerfile.${{ inputs.os }}
+        cache-from: type=gha
+        cache-to: type=gha
+        build-args: ${{ inputs.build-args }}
+        tags: ${{ inputs.image-tags }}

.github/workflows/build-content.yaml

@@ -5,9 +5,8 @@ on:
       - dev
   pull_request:
 
-name: build/push RStudio Content Images
+name: Content Images - Build, Test, Scan, and Push
 jobs:
-
   matrix:
     runs-on: ubuntu-latest
     outputs:
@@ -22,7 +21,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     needs: matrix
-    name: r${{ matrix.config.r }} py${{ matrix.config.py }} ${{ matrix.config.os }} ${{ github.ref }}
+    name: content-base-${{ matrix.config.os }}-r${{ matrix.config.r }}-py${{ matrix.config.py }}--${{ github.ref }}
 
     strategy:
       fail-fast: false
@@ -33,96 +32,32 @@ jobs:
       - name: Check Out Repo
         uses: actions/checkout@v3
 
-      - name: Set up Docker Buildx
-        id: buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Cache Docker layers
-        uses: actions/cache@v3
-        with:
-          path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-buildx-${{ github.sha }}
-          restore-keys: |
-            ${{ runner.os }}-buildx-
-
-      - name: Build and Push
-        id: docker_build
-        uses: docker/build-push-action@v3
+      - name: Build/Test/Scan/Push content base image
+        uses: ./.github/actions/build-test-scan-push
         with:
           context: ./content/base
-          file: ./content/base/Dockerfile.${{ matrix.config.os }}
-          builder: ${{ steps.buildx.outputs.name }}
-          tags: |
-            rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }}
-            ghcr.io/rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }}
-            rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os_alt }}
+          os: ${{ matrix.config.os }}
+          product: content-base
+          image-tags: |
+            rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }},
+            ghcr.io/rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }},
+            rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os_alt }},
             ghcr.io/rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os_alt }}
-          cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: type=local,dest=/tmp/.buildx-cache
-          load: true
-          push: false
           build-args: |
             R_VERSION=${{ matrix.config.r }}
             PYTHON_VERSION=${{ matrix.config.py }}
-
-      - name: Image digest
-        run: echo ${{ steps.docker_build.outputs.digest }}
-
-      - name: Show image size
-        run: |
-          docker image ls
-
-      - name: Run Snyk to check Docker image for vulnerabilities (main)
-        if: ${{ github.ref == 'refs/heads/main' }}
-        continue-on-error: true
-        uses: snyk/actions/docker@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          image: rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }}
-          args: --file=./content/base/Dockerfile.${{ matrix.config.os }} --org=${{ secrets.SNYK_ORG_ID }} --project-name=rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }} --tags=product=content-base,os=${{ matrix.config.os }} --app-vulns --exclude-base-image-vulns
-          command: monitor
-
-      - name: Run Snyk to check Docker image for vulnerabilities (branch)
-        if: ${{ github.ref != 'refs/heads/main' }}
-        continue-on-error: true
-        uses: snyk/actions/docker@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          image: rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }}
-          args: --file=./content/base/Dockerfile.${{ matrix.config.os }} --org=${{ secrets.SNYK_ORG_ID }} --project-name=rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }} --tags=product=content-base,os=${{ matrix.config.os }} --app-vulns --exclude-base-image-vulns
-          command: test
-
-      - name: Login to Docker Hub
-        if: ${{ github.ref == 'refs/heads/main' }}
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
-
-      - name: Login to ghcr.io
-        if: ${{ github.ref == 'refs/heads/main' }}
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.BUILD_PAT }}
-
-      - name: Push image(s)
-        if: ${{ github.ref == 'refs/heads/main' }}
-        run: |
-          docker push rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }}
-          docker push ghcr.io/rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }}
-          docker push rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os_alt }}
-          docker push ghcr.io/rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os_alt }}
-
-
+          test-image: false
+          push-image: ${{ github.ref == 'refs/heads/main' }}
+          snyk-token: ${{ secrets.SNYK_TOKEN }}
+          snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
+          ghcr-token: ${{ secrets.BUILD_PAT }}
+          dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
 
   build-pro:
     runs-on: ubuntu-latest
     needs: [ matrix, build ]
-    name: pro r${{ matrix.config.r }} py${{ matrix.config.py }} ${{ matrix.config.os }} ${{ github.ref }}
+    name: content-pro-${{ matrix.config.os }}-r${{ matrix.config.r }}-py${{ matrix.config.py }}--${{ github.ref }}
 
     strategy:
       fail-fast: false
@@ -133,88 +68,26 @@ jobs:
       - name: Check Out Repo
         uses: actions/checkout@v3
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
-
-      - name: Cache Docker layers
-        uses: actions/cache@v3
-        with:
-          path: /tmp/.buildx-cache
-          key: ${{ runner.os }}-buildx-${{ github.sha }}
-          restore-keys: |
-            ${{ runner.os }}-buildx-
-
-      - name: Build and Push
-        id: docker_build
-        uses: docker/build-push-action@v3
+      - name: Build/Test/Scan/Push content pro image
+        uses: ./.github/actions/build-test-scan-push
         with:
           context: ./content/pro
-          file: ./content/pro/Dockerfile.${{ matrix.config.os }}
-          builder: ${{ steps.buildx.outputs.name }}
-          tags: |
+          os: ${{ matrix.config.os }}
+          product: content-pro
+          image-tags: |
             rstudio/content-pro:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }}
             ghcr.io/rstudio/content-pro:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }}
             rstudio/content-pro:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os_alt }}
             ghcr.io/rstudio/content-pro:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os_alt }}
-          cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: type=local,dest=/tmp/.buildx-cache
-          load: true
-          push: false
           build-args: |
             R_VERSION=${{ matrix.config.r }}
             PYTHON_VERSION=${{ matrix.config.py }}
             DRIVERS_VERSION=${{ matrix.config.drivers }}
             BASE_IMAGE=rstudio/content-base:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }}
-
-      - name: Image digest
-        run: echo ${{ steps.docker_build.outputs.digest }}
-
-      - name: Show image size
-        run: |
-          docker image ls
-
-      - name: Run Snyk to check Docker image for vulnerabilities (main)
-        if: ${{ github.ref == 'refs/heads/main' }}
-        continue-on-error: true
-        uses: snyk/actions/docker@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          image: rstudio/content-pro:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }}
-          args: --file=./content/pro/${{ matrix.config.os }}/Dockerfile --org=${{ secrets.SNYK_ORG_ID }} --project-name=rstudio/content-pro:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }} --tags=product=content-pro,os=${{ matrix.config.os }} --app-vulns --exclude-base-image-vulns
-          command: monitor
-
-      - name: Run Snyk to check Docker image for vulnerabilities (branch)
-        if: ${{ github.ref != 'refs/heads/main' }}
-        continue-on-error: true
-        uses: snyk/actions/docker@master
-        env:
-          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-        with:
-          image: rstudio/content-pro:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }}
-          args: --file=./content/pro/${{ matrix.config.os }}/Dockerfile --org=${{ secrets.SNYK_ORG_ID }} --project-name=rstudio/content-pro:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }} --tags=product=content-pro,os=${{ matrix.config.os }} --app-vulns --exclude-base-image-vulns
-          command: test
-
-      - name: Login to Docker Hub
-        if: ${{ github.ref == 'refs/heads/main' }}
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_HUB_USERNAME }}
-          password: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
-
-      - name: Login to ghcr.io
-        if: ${{ github.ref == 'refs/heads/main' }}
-        uses: docker/login-action@v2
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.BUILD_PAT }}
-
-      - name: Push image(s)
-        if: ${{ github.ref == 'refs/heads/main' }}
-        run: |
-          docker push rstudio/content-pro:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }}
-          docker push ghcr.io/rstudio/content-pro:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os }}
-          docker push rstudio/content-pro:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os_alt }}
-          docker push ghcr.io/rstudio/content-pro:r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ matrix.config.os_alt }}
-
+          test-image: false
+          push-image: ${{ github.ref == 'refs/heads/main' }}
+          snyk-token: ${{ secrets.SNYK_TOKEN }}
+          snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
+          ghcr-token: ${{ secrets.BUILD_PAT }}
+          dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}