Skip to content

Commit b594777

Browse files
edeatiedeati
authored
Merge pull request #5 from aehrc/update-charts
Major charts refactor
2 parents 0c8c85e + 37e387f commit b594777

182 files changed

Lines changed: 20595 additions & 276 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/integration-tests.yml‎

Lines changed: 457 additions & 0 deletions
Large diffs are not rendered by default.

‎.github/workflows/release-please.yml‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
name: Release Please
2+
3+
# Release Please maintains one open "release PR" per chart. Merging a chart's PR stamps its
4+
# changelog, bumps its Chart.yaml, tags `<chart>-vX.Y.Z` and creates the GitHub Release — then the
5+
# publish job below packages that one chart and pushes it to the Helm repo index and GHCR.
6+
#
7+
# Per-chart releases fall out of `packages` in release-please-config.json: Release Please decides
8+
# what to bump from the FILE PATHS a commit touches, not from the commit scope. A commit touching
9+
# only charts/ontoserver-indexer opens a release PR for the indexer alone. `separate-pull-requests`
10+
# keeps them independent so one chart can be released without dragging the others along.
11+
on:
12+
push:
13+
branches: [master]
14+
workflow_dispatch:
15+
16+
permissions:
17+
contents: write
18+
pull-requests: write
19+
20+
# Shares a group with the tag-triggered release.yml: both rewrite index.yaml on gh-pages, and two
21+
# concurrent runs would clobber each other's entry.
22+
concurrency:
23+
group: release-charts
24+
cancel-in-progress: false
25+
26+
jobs:
27+
release-please:
28+
name: Maintain release PRs
29+
runs-on: ubuntu-latest
30+
outputs:
31+
# `paths_released` is a JSON array of the package paths released by this run — the switch the
32+
# publish job fans out over.
33+
paths_released: ${{ steps.release.outputs.paths_released }}
34+
steps:
35+
- uses: googleapis/release-please-action@v4
36+
id: release
37+
with:
38+
config-file: release-please-config.json
39+
manifest-file: .release-please-manifest.json
40+
41+
publish:
42+
name: Publish ${{ matrix.path }}
43+
needs: release-please
44+
if: needs.release-please.outputs.paths_released != '[]' && needs.release-please.outputs.paths_released != ''
45+
runs-on: ubuntu-latest
46+
strategy:
47+
# Serial on purpose: every chart's publish rewrites the same gh-pages index.yaml.
48+
max-parallel: 1
49+
matrix:
50+
path: ${{ fromJson(needs.release-please.outputs.paths_released) }}
51+
permissions:
52+
contents: write
53+
packages: write
54+
steps:
55+
- uses: actions/checkout@v5
56+
with:
57+
fetch-depth: 0
58+
59+
# Publishing happens here rather than in the tag-triggered release.yml because a tag created
60+
# with GITHUB_TOKEN does NOT trigger other workflows. release.yml would simply never run for a
61+
# Release Please tag, and the chart would be tagged and released on GitHub but never appear in
62+
# the Helm repo index or GHCR — a silent half-release.
63+
- name: Resolve chart and version
64+
id: chart
65+
env:
66+
PKG_PATH: ${{ matrix.path }}
67+
run: |
68+
set -euo pipefail
69+
chart="$(basename "$PKG_PATH")"
70+
version="$(python3 -c "import json,sys; print(json.load(open('.release-please-manifest.json'))['$PKG_PATH'])")"
71+
echo "chart=$chart" >> "$GITHUB_OUTPUT"
72+
echo "version=$version" >> "$GITHUB_OUTPUT"
73+
echo "tag=${chart}-v${version}" >> "$GITHUB_OUTPUT"
74+
echo "Publishing $chart $version"
75+
76+
# Same gate as release.yml: never publish a chart whose commit did not pass the suites. Here
77+
# the tests run against the release-PR merge commit in parallel with this workflow, so this
78+
# almost always waits a few minutes rather than finding a finished run.
79+
- name: Require successful Unit and Integration test runs
80+
env:
81+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
82+
REPO: ${{ github.repository }}
83+
SHA: ${{ github.sha }}
84+
run: |
85+
set -euo pipefail
86+
query() {
87+
gh api "repos/${REPO}/actions/runs?head_sha=${SHA}&per_page=100" \
88+
--jq "[.workflow_runs[] | select(.name == \"$1\")] | sort_by(.created_at) | last
89+
| if . == null then \"none none\" else \"\(.status) \(.conclusion // \"pending\")\" end"
90+
}
91+
for wf in "Unit Tests" "Integration Tests"; do
92+
status=""; conclusion=""
93+
for attempt in $(seq 1 40); do
94+
read -r status conclusion <<<"$(query "$wf")"
95+
[[ "$status" == "completed" ]] && break
96+
echo "'${wf}' is ${status}; waiting (attempt ${attempt}/40)..."
97+
sleep 30
98+
done
99+
if [[ "$status" != "completed" || "$conclusion" != "success" ]]; then
100+
echo "::error::'${wf}' for ${SHA} is ${status}/${conclusion}. Refusing to publish. Re-run this workflow once the suites are green."
101+
exit 1
102+
fi
103+
echo "'${wf}': success"
104+
done
105+
106+
- name: Install Helm
107+
uses: azure/setup-helm@v5.0.1
108+
with:
109+
version: v3.18.4
110+
111+
- name: Package chart
112+
run: |
113+
set -euo pipefail
114+
helm dependency build "charts/${{ steps.chart.outputs.chart }}"
115+
mkdir -p .cr-release-packages
116+
helm package "charts/${{ steps.chart.outputs.chart }}" -d .cr-release-packages
117+
118+
- name: Attach the package to the GitHub Release
119+
env:
120+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
121+
run: |
122+
gh release upload "${{ steps.chart.outputs.tag }}" \
123+
".cr-release-packages/${{ steps.chart.outputs.chart }}-${{ steps.chart.outputs.version }}.tgz" \
124+
--clobber
125+
126+
- name: Push to GHCR
127+
run: |
128+
echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io \
129+
--username "${{ github.actor }}" --password-stdin
130+
helm push \
131+
".cr-release-packages/${{ steps.chart.outputs.chart }}-${{ steps.chart.outputs.version }}.tgz" \
132+
"oci://ghcr.io/aehrc/${{ steps.chart.outputs.chart }}-helm"
133+
134+
# --merge, not a fresh index: index.yaml carries every previously released chart and version,
135+
# and regenerating it from this one package would delete all of them.
136+
- name: Update the gh-pages Helm repo index
137+
env:
138+
CHART: ${{ steps.chart.outputs.chart }}
139+
VERSION: ${{ steps.chart.outputs.version }}
140+
TAG: ${{ steps.chart.outputs.tag }}
141+
run: |
142+
set -euo pipefail
143+
git config user.name "$GITHUB_ACTOR"
144+
git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
145+
git fetch origin gh-pages
146+
git worktree add gh-pages origin/gh-pages
147+
148+
helm repo index .cr-release-packages \
149+
--url "https://github.com/${{ github.repository }}/releases/download/${TAG}" \
150+
--merge gh-pages/index.yaml
151+
mv .cr-release-packages/index.yaml gh-pages/index.yaml
152+
153+
cp artifacthub-repo.yml gh-pages/artifacthub-repo.yml
154+
if [ -f gh-pages/index.html ]; then
155+
sed -i "s|data-chart=\"${CHART}\">[0-9][0-9.]*<|data-chart=\"${CHART}\">${VERSION}<|g" gh-pages/index.html
156+
fi
157+
158+
cd gh-pages
159+
git add index.yaml artifacthub-repo.yml
160+
[ -f index.html ] && git add index.html
161+
git diff --staged --quiet || git commit -m "Release ${CHART} ${VERSION} [skip ci]"
162+
git push origin HEAD:gh-pages

‎.github/workflows/release-varnish-exporter.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Release Varnish Exporter
2+
3+
on:
4+
push:
5+
tags:
6+
- 'varnish-exporter-v*'
7+
8+
env:
9+
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
10+
11+
jobs:
12+
release-varnish-exporter:
13+
name: Build and Push Multi-Arch varnish-exporter
14+
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
17+
packages: write
18+
steps:
19+
- uses: actions/checkout@v5
20+
21+
- name: Set up QEMU
22+
uses: docker/setup-qemu-action@v3
23+
24+
- name: Set up Docker Buildx
25+
uses: docker/setup-buildx-action@v3
26+
27+
- name: Log in to GitHub Container Registry
28+
uses: docker/login-action@v3
29+
with:
30+
registry: ghcr.io
31+
username: ${{ github.actor }}
32+
password: ${{ secrets.GITHUB_TOKEN }}
33+
34+
- name: Extract tag version
35+
id: version
36+
run: echo "tag=${GITHUB_REF#refs/tags/varnish-exporter-v}" >> $GITHUB_OUTPUT
37+
38+
- name: Build and push varnish-exporter
39+
uses: docker/build-push-action@v6
40+
with:
41+
context: docker/varnish-exporter
42+
platforms: linux/amd64,linux/arm64
43+
push: true
44+
tags: |
45+
ghcr.io/aehrc/varnish-exporter:${{ steps.version.outputs.tag }}
46+
ghcr.io/aehrc/varnish-exporter:latest

‎.github/workflows/release.yml‎

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
name: Release
2+
3+
on:
4+
push:
5+
tags:
6+
- 'ontoserver-v*'
7+
- 'ontoserver-extras-v*'
8+
- 'ontoserver-indexer-v*'
9+
10+
permissions:
11+
contents: write
12+
pages: write
13+
packages: write
14+
15+
# Serialise releases. Every run rewrites index.yaml on the gh-pages branch, so two tags pushed
16+
# close together race: both clone the same index.yaml, each adds only its own chart, and whichever
17+
# pushes second either fails or drops the other's entry — leaving a published release that the Helm
18+
# repo index does not list. Not cancel-in-progress: a half-finished release must be allowed to
19+
# finish, since the tag and the GitHub Release are already created by then.
20+
concurrency:
21+
group: release-charts
22+
cancel-in-progress: false
23+
24+
env:
25+
FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
26+
27+
jobs:
28+
# The test workflows trigger on `branches: ['**']`, which excludes tags — so without this gate a
29+
# tag publishes whatever the tagged commit happens to be, tested or not. Rather than re-run the
30+
# suites here (the integration matrix is expensive and would double every release), check that
31+
# the runs for this exact commit already succeeded. They normally have: the tag points at a
32+
# commit that was pushed to a branch first, which is what triggered them.
33+
verify-tests:
34+
name: Verify tests passed for this commit
35+
runs-on: ubuntu-latest
36+
permissions:
37+
actions: read
38+
contents: read
39+
steps:
40+
- name: Require successful Unit and Integration test runs
41+
env:
42+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
43+
REPO: ${{ github.repository }}
44+
SHA: ${{ github.sha }}
45+
run: |
46+
set -euo pipefail
47+
# Status and conclusion are extracted inside a single `gh api --jq` call rather than by
48+
# piping the run object into jq. The object embeds the commit message, and a multi-line
49+
# message contains raw control characters that make a second jq parse fail.
50+
query() {
51+
gh api "repos/${REPO}/actions/runs?head_sha=${SHA}&per_page=100" \
52+
--jq "[.workflow_runs[] | select(.name == \"$1\")] | sort_by(.created_at) | last
53+
| if . == null then \"none none\" else \"\(.status) \(.conclusion // \"pending\")\" end"
54+
}
55+
# A run triggered by the branch push may still be in flight when the tag lands moments
56+
# later, so poll rather than failing on a race. 20 x 30s = 10 minutes, which comfortably
57+
# covers the unit suite; a slower integration run is reported as still running and the
58+
# release can be retried by re-running this workflow.
59+
for wf in "Unit Tests" "Integration Tests"; do
60+
status=""; conclusion=""
61+
for attempt in $(seq 1 20); do
62+
read -r status conclusion <<<"$(query "$wf")"
63+
if [[ "$status" == "none" ]]; then
64+
echo "::error::No '${wf}' run found for commit ${SHA}. The test workflows trigger on branch pushes only, so this commit was never tested. Push it to a branch before tagging."
65+
exit 1
66+
fi
67+
[[ "$status" == "completed" ]] && break
68+
echo "'${wf}' is ${status}; waiting (attempt ${attempt}/20)..."
69+
sleep 30
70+
done
71+
if [[ "$status" != "completed" ]]; then
72+
echo "::error::'${wf}' for commit ${SHA} did not finish in time (still ${status}). Re-run this release workflow once it completes."
73+
exit 1
74+
fi
75+
if [[ "$conclusion" != "success" ]]; then
76+
echo "::error::'${wf}' for commit ${SHA} concluded '${conclusion}', not success. Refusing to publish an untested chart."
77+
exit 1
78+
fi
79+
echo "'${wf}': success"
80+
done
81+
82+
release-charts:
83+
name: Release Helm Charts
84+
needs: verify-tests
85+
runs-on: ubuntu-latest
86+
permissions:
87+
contents: write
88+
pages: write
89+
steps:
90+
- uses: actions/checkout@v5
91+
with:
92+
fetch-depth: 0
93+
94+
- name: Configure Git
95+
run: |
96+
git config user.name "$GITHUB_ACTOR"
97+
git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
98+
99+
- name: Install Helm
100+
uses: azure/setup-helm@v5.0.1
101+
with:
102+
version: v3.18.4
103+
104+
- name: Run chart-releaser
105+
uses: helm/chart-releaser-action@v1.6.0
106+
with:
107+
charts_dir: charts
108+
skip_existing: true
109+
env:
110+
CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
111+
112+
- name: Publish artifacthub-repo.yml to gh-pages
113+
run: |
114+
tag="${GITHUB_REF#refs/tags/}"
115+
chart="${tag%-v*}"
116+
version="${tag#*-v}"
117+
118+
git fetch origin gh-pages
119+
git checkout gh-pages
120+
git checkout ${{ github.sha }} -- artifacthub-repo.yml
121+
git add artifacthub-repo.yml
122+
123+
sed -i "s|data-chart=\"${chart}\">[0-9][0-9.]*<|data-chart=\"${chart}\">${version}<|g" index.html
124+
git add index.html
125+
126+
git diff --staged --quiet || git commit -m "Release ${chart} ${version} [skip ci]"
127+
git push origin gh-pages
128+
129+
push-charts-oci:
130+
name: Push Helm Charts to OCI
131+
runs-on: ubuntu-latest
132+
needs: release-charts
133+
permissions:
134+
contents: read
135+
packages: write
136+
steps:
137+
- uses: actions/checkout@v5
138+
139+
- name: Extract chart name and version from tag
140+
id: chart
141+
run: |
142+
tag="${GITHUB_REF#refs/tags/}"
143+
echo "chart=${tag%-v*}" >> $GITHUB_OUTPUT
144+
echo "version=${tag#*-v}" >> $GITHUB_OUTPUT
145+
146+
- name: Install Helm
147+
uses: azure/setup-helm@v5.0.1
148+
with:
149+
version: v3.18.4
150+
151+
- name: Log in to GitHub Container Registry
152+
run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io --username ${{ github.actor }} --password-stdin
153+
154+
- name: Package and push chart
155+
run: |
156+
chart="${{ steps.chart.outputs.chart }}"
157+
helm dependency build charts/$chart
158+
helm package charts/$chart -d charts-pkg
159+
helm push charts-pkg/$chart-*.tgz oci://ghcr.io/aehrc/$chart-helm

0 commit comments

Comments
 (0)