Skip to content

Commit 4c388d0

Browse files
miker985miker985
authored
Merge pull request #3 from UWIT-IAM/modernize-before-arrest_netid
Modernize before arrest netid
2 parents 67a228b + e8c06dc commit 4c388d0

File tree

4 files changed

+57
-58
lines changed

4 files changed

+57
-58
lines changed

‎.github/pull_request_template.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
**Change Description:** {{ FILL THIS IN }}
22

3-
**Closes Jira(s)**: {{ FILL THIS IN }}
3+
**Closes Issue(s)**: {{ FILL THIS IN }}
44

55
## Pull Request checklist
66

‎.github/scripts/gcr-login.sh

-7
This file was deleted.

‎.github/workflows/pull-request.template.yml

+26-15
Original file line numberDiff line numberDiff line change
@@ -20,15 +20,12 @@ jobs:
2020
outputs:
2121
new-version: ${{ steps.update-version.outputs.new-version }}
2222
steps:
23-
- name: Python Poetry Action
24-
uses: abatilo/[email protected]
25-
2623
- uses: uwit-iam/actions/[email protected]
2724
id: guidance
2825
with:
2926
github-token: ${{ secrets.GITHUB_TOKEN }}
3027

31-
- uses: uwit-iam/actions/update-pr-branch-version@0.1
28+
- uses: uwit-iam/actions/update-pr-branch-version@main
3229
with:
3330
github-token: ${{ env.GITHUB_TOKEN }}
3431
version-guidance: ${{ steps.guidance.outputs.guidance }}
@@ -44,28 +41,41 @@ jobs:
4441
runs-on: ubuntu-latest
4542
env:
4643
APP_VERSION: ${{ needs.update-pr-branch-version.outputs.new-version }}
47-
pr_tag: pull-request-${{ github.event.pull_request.number }}
44+
pr_tag: pull-request-${{ github.event.pull_request.number }} # e.g., "pull-request-15"
4845
steps:
4946
- uses: actions/checkout@v4
5047
with:
5148
ref: ${{ github.event.pull_request.head.ref }}
5249

53-
- uses: abatilo/[email protected]
54-
- run: |
50+
- name: Set up environment
51+
id: configure
52+
run: |
5553
sudo apt-get -y install jq
54+
pip install poetry
5655
poetry install
57-
id: configure
58-
name: Set up environment
5956
60-
- uses: UWIT-IAM/actions/[email protected]
57+
- name: Auth to Google Cloud
58+
# important! this 'auth' is referenced as `steps.auth` on the next job
59+
id: auth
60+
# https://github.com/google-github-actions/auth#authenticating-via-service-account-key-json-1
61+
uses: 'google-github-actions/auth@v1'
6162
with:
62-
gcloud-token: ${{ secrets.GCR_TOKEN }}
63+
credentials_json: '${{ secrets.MCI_GCLOUD_AUTH_JSON }}'
64+
token_format: 'access_token'
65+
66+
- name: Auth to Google Artifact Registry
67+
# https://github.com/google-github-actions/auth#authenticating-to-container-registry-and-artifact-registry
68+
# requires role: roles/iam.serviceAccountTokenCreator
69+
run: |-
70+
echo '${{ steps.auth.outputs.access_token }}' | docker login -u oauth2accesstoken --password-stdin https://us-docker.pkg.dev
6371
6472
- run: |
65-
./scripts/build.sh \
66-
-t pull-request-${{ env.PR_TAG }} --cache
73+
# this will tag the image with e.g., "pull-request-15"
74+
# NOTE that this produces tags for ${template:app_name}.dependencies, ${template:app_name}.app, ${template:app_name}.tests (but not "${template:app_name}")
75+
./scripts/build.sh -t "${{ env.pr_tag }}" --cache
6776
68-
- run: docker push gcr.io/uwit-mci-iam/${template:app_name}:${{ env.pr_tag }}
77+
# TODO: this container image URI should be dynamically generated from e..g, fingerprints.yaml
78+
- run: docker push us-docker.pkg.dev/uwit-mci-iam/containers/${template:app_name}.app:${{ env.pr_tag }}
6979

7080
- name: Run validation checks and tests
7181
run: |
@@ -76,7 +86,8 @@ jobs:
7686

7787
- uses: mshick/add-pr-comment@v1
7888
env:
79-
image: gcr.io/uwit-mci-iam/${template:app_name}:${{ env.pr_tag }}
89+
# TODO: this container image URI should be dynamically generated from e..g, fingerprints.yaml
90+
image: us-docker.pkg.dev/uwit-mci-iam/containers/${template:app_name}.app:${{ env.pr_tag }}
8091
with:
8192
repo-token: ${{ secrets.GITHUB_TOKEN }}
8293
repo-token-user-login: 'github-actions[bot]'

‎.github/workflows/release-on-push-to-main.yaml

+30-35
Original file line numberDiff line numberDiff line change
@@ -5,67 +5,62 @@ on:
55
- main
66
paths:
77
- pyproject.toml
8+
workflow_dispatch:
9+
810
jobs:
9-
check-publishability:
11+
publish-if-new-version:
1012
if: github.repository != 'UWIT-IAM/example-flask-app'
1113
runs-on: ubuntu-latest
12-
outputs:
13-
publishable: ${{ steps.check.outputs.publish }}
1414
steps:
1515
- uses: actions/checkout@v4
1616
with:
1717
fetch-depth: 2
18-
# note: this may not longer be necessary but the below job was failing April 2023
19-
# and using an explicit token fixed that
20-
token: ${{ secrets.ACTIONS_PAT }}
18+
2119
# Only publish if the version has changed; otherwise, we would be
2220
# re-publishing existing stuff without updating the version, and that
2321
# could cause problems.
24-
- run: |
22+
- name: Check if the change should be published
23+
run: |
2524
set -x
2625
publishable=false
2726
diff=$(git diff HEAD:pyproject.toml HEAD~1:pyproject.toml) || exit 0
2827
echo "$diff" | grep '+version ='
29-
if [[ "$?" == "0" ]]
28+
if [[ "$?" -ne 0 ]]
3029
then
31-
publishable=true
30+
echo 'Not publishable - skipping'
31+
exit 1
3232
fi
33-
echo "::set-output name=publish::${publishable}"
34-
name: Check if the change should be published
35-
id: check
36-
build-and-publish:
37-
needs: [check-publishability]
38-
if: needs.check-publishability.outputs.publishable == 'true'
39-
runs-on: ubuntu-latest
40-
permissions:
41-
packages: write
42-
steps:
43-
- uses: actions/checkout@v4
33+
34+
- uses: actions/setup-python@v4
4435
with:
45-
token: ${{ secrets.ACTIONS_PAT }}
36+
python-version-file: pyproject.toml
4637

4738
- name: Install and configure poetry
4839
run: |
4940
pipx install poetry
5041
poetry config virtualenvs.create false
5142
52-
- name: Install app
43+
- name: Install package
5344
run: poetry install
5445

55-
- run: sudo apt-get -y install jq
46+
- name: Install jq for fingerprinter
47+
run: sudo apt-get -y install jq
48+
49+
- name: Auth to Google Cloud
50+
# important! this 'auth' is referenced as `steps.auth` on the next job
51+
id: auth
52+
# https://github.com/google-github-actions/auth#authenticating-via-service-account-key-json-1
53+
uses: 'google-github-actions/auth@v1'
54+
with:
55+
credentials_json: '${{ secrets.MCI_GCLOUD_AUTH_JSON }}'
56+
token_format: 'access_token'
5657

57-
- name: Log in to the Google container registry
58-
run: ./.github/scripts/gcr-login.sh
59-
env:
60-
# UPDATE: If this repository is not in the UWIT-IAM
61-
# org, you must ensure this secret exists, or update this
62-
# value to use a secret that does exist. The token
63-
# should be base64 encoded, and needs to be created by an
64-
# Aux project administrator.
65-
#
66-
# If you are running inside the UWIT-IAM namespace,
67-
# this is available for all repositories to use.
68-
GITHUB_TOKEN: ${{ secrets.GCR_TOKEN }}
58+
- name: Auth to Google Artifact Registry
59+
# https://github.com/google-github-actions/auth#authenticating-to-container-registry-and-artifact-registry
60+
# requires role: roles/iam.serviceAccountTokenCreator
61+
run: |-
62+
echo '${{ steps.auth.outputs.access_token }}' | docker login -u oauth2accesstoken --password-stdin https://us-docker.pkg.dev
6963
- name: Create and push release image; deploy to dev
7064
run: |
65+
# requires role: roles/artifactregistry.createOnPushWriter
7166
./scripts/build.sh --release $(poetry version -s) --cache --deploy dev

0 commit comments

Comments
 (0)