chore(deps): bump cryptography in / #1938
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build, Tag and Push Container Images to GAR | |
| on: | |
| pull_request: | |
| types: [opened, labeled, unlabeled, synchronize] | |
| push: | |
| branches: | |
| - master | |
| tags: | |
| - '**' | |
| workflow_dispatch: {} | |
| jobs: | |
| # Note: the check job only contains all of the requirements for running the following build workflows. | |
| # This consolidates our build checks into a single place. | |
| check: | |
| if: > | |
| github.event_name == 'workflow_dispatch' || | |
| ( | |
| github.event_name == 'push' && | |
| (github.ref_name == 'master' || startsWith(github.ref, 'refs/tags/')) | |
| ) || | |
| ( | |
| github.event_name == 'pull_request' && | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| ( | |
| contains(github.event.pull_request.labels.*.name, 'preview') || | |
| contains(github.event.pull_request.labels.*.name, 'tokenserver-preview') | |
| ) | |
| ) | |
| runs-on: ubuntu-latest | |
| steps: | |
| - run: echo "Conditions met, proceeding with build jobs" | |
| # Note: we are moving towards renaming all images `syncserver`, the union of sync and tokenserver. | |
| # This presently remains for the time being to simplify deploys by maintaining `image_name: syncstorage-rs`. | |
| # Historical context: <https://github.com/mozilla-services/syncstorage-rs/pull/1306> | |
| build-and-push-syncstorage-rs: | |
| needs: check | |
| permissions: | |
| contents: read | |
| id-token: write | |
| packages: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 | |
| with: | |
| persist-credentials: false | |
| - uses: ./.github/actions/setup-build-and-push | |
| id: setup | |
| with: | |
| workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }} | |
| gcp_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com" | |
| - name: Compute tags | |
| run: | | |
| TAGS=$(cat <<EOF | |
| us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncstorage-rs:${IMAGE_TAG} | |
| ghcr.io/${{ github.repository }}/syncstorage-rs:${IMAGE_TAG} | |
| EOF | |
| ) | |
| if [[ "${PUSH_LATEST}" == "true" ]]; then | |
| TAGS="$TAGS | |
| us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncstorage-rs:latest | |
| ghcr.io/${{ github.repository }}/syncstorage-rs:latest" | |
| fi | |
| echo "IMAGE_TAGS<<EOF" >> "$GITHUB_ENV" | |
| echo "$TAGS" >> "$GITHUB_ENV" | |
| echo "EOF" >> "$GITHUB_ENV" | |
| env: | |
| IMAGE_TAG: ${{ steps.setup.outputs.image_tag }} | |
| PUSH_LATEST: ${{ steps.setup.outputs.push_latest }} | |
| - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: . | |
| push: true | |
| build-args: | | |
| SYNCSTORAGE_DATABASE_BACKEND=spanner | |
| MYSQLCLIENT_PKG=libmysqlclient-dev | |
| tags: ${{ env.IMAGE_TAGS }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| build-and-push-syncserver-postgres: | |
| needs: check | |
| permissions: | |
| contents: read | |
| id-token: write | |
| packages: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 | |
| with: | |
| persist-credentials: false | |
| - uses: ./.github/actions/setup-build-and-push | |
| id: setup | |
| with: | |
| workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }} | |
| gcp_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com" | |
| - name: Compute tags | |
| run: | | |
| TAGS=$(cat <<EOF | |
| us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-postgres:${IMAGE_TAG} | |
| ghcr.io/${{ github.repository }}/syncserver-postgres:${IMAGE_TAG} | |
| EOF | |
| ) | |
| if [[ "${PUSH_LATEST}" == "true" ]]; then | |
| TAGS="$TAGS | |
| us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-postgres:latest | |
| ghcr.io/${{ github.repository }}/syncserver-postgres:latest" | |
| fi | |
| echo "IMAGE_TAGS<<EOF" >> "$GITHUB_ENV" | |
| echo "$TAGS" >> "$GITHUB_ENV" | |
| echo "EOF" >> "$GITHUB_ENV" | |
| env: | |
| IMAGE_TAG: ${{ steps.setup.outputs.image_tag }} | |
| PUSH_LATEST: ${{ steps.setup.outputs.push_latest }} | |
| - name: Build and push to prod GAR and ghcr | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: . | |
| push: true | |
| build-args: | | |
| SYNCSTORAGE_DATABASE_BACKEND=postgres | |
| TOKENSERVER_DATABASE_BACKEND=postgres | |
| tags: ${{ env.IMAGE_TAGS }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| - name: GCP auth (enterprise) | |
| id: gcp_auth_ent | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 | |
| with: | |
| workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-fx-enterprise-prod.iam.gserviceaccount.com" | |
| token_format: access_token | |
| - name: Log in to enterprise GAR | |
| uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2 | |
| with: | |
| registry: us-docker.pkg.dev | |
| username: oauth2accesstoken | |
| password: ${{ steps.gcp_auth_ent.outputs.access_token }} | |
| - name: Compute enterprise tags | |
| run: | | |
| TAGS="us-docker.pkg.dev/moz-fx-fx-enterprise-prod/fx-enterprise-private/syncserver-postgres:${IMAGE_TAG}" | |
| if [[ "${PUSH_LATEST}" == "true" ]]; then | |
| TAGS="$TAGS | |
| us-docker.pkg.dev/moz-fx-fx-enterprise-prod/fx-enterprise-private/syncserver-postgres:latest" | |
| fi | |
| echo "IMAGE_TAGS<<EOF" >> "$GITHUB_ENV" | |
| echo "$TAGS" >> "$GITHUB_ENV" | |
| echo "EOF" >> "$GITHUB_ENV" | |
| env: | |
| IMAGE_TAG: ${{ steps.setup.outputs.image_tag }} | |
| PUSH_LATEST: ${{ steps.setup.outputs.push_latest }} | |
| - name: Build and push to enterprise GAR | |
| uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: . | |
| push: true | |
| build-args: | | |
| SYNCSTORAGE_DATABASE_BACKEND=postgres | |
| TOKENSERVER_DATABASE_BACKEND=postgres | |
| tags: ${{ env.IMAGE_TAGS }} | |
| cache-from: type=gha | |
| build-and-push-syncserver-mysql: | |
| needs: check | |
| permissions: | |
| contents: read | |
| id-token: write | |
| packages: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 | |
| with: | |
| persist-credentials: false | |
| - uses: ./.github/actions/setup-build-and-push | |
| id: setup | |
| with: | |
| workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }} | |
| gcp_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com" | |
| - name: Compute tags | |
| run: | | |
| TAGS=$(cat <<EOF | |
| us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-mysql:${IMAGE_TAG} | |
| ghcr.io/${{ github.repository }}/syncserver-mysql:${IMAGE_TAG} | |
| EOF | |
| ) | |
| if [[ "${PUSH_LATEST}" == "true" ]]; then | |
| TAGS="$TAGS | |
| us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-mysql:latest | |
| ghcr.io/${{ github.repository }}/syncserver-mysql:latest" | |
| fi | |
| echo "IMAGE_TAGS<<EOF" >> "$GITHUB_ENV" | |
| echo "$TAGS" >> "$GITHUB_ENV" | |
| echo "EOF" >> "$GITHUB_ENV" | |
| env: | |
| IMAGE_TAG: ${{ steps.setup.outputs.image_tag }} | |
| PUSH_LATEST: ${{ steps.setup.outputs.push_latest }} | |
| - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: . | |
| push: true | |
| build-args: | | |
| SYNCSTORAGE_DATABASE_BACKEND=mysql | |
| TOKENSERVER_DATABASE_BACKEND=mysql | |
| tags: ${{ env.IMAGE_TAGS }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| # Payload-link Dataflow flex template (Java). GAR-only -- this image | |
| # is consumed by webservices-infra to launch the Dataflow job; we do | |
| # not mirror it to GHCR. | |
| build-and-push-syncserver-payload-link-dataflow: | |
| needs: check | |
| outputs: | |
| image_tag: ${{ steps.setup.outputs.image_tag }} | |
| permissions: | |
| contents: read | |
| id-token: write | |
| packages: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 | |
| with: | |
| persist-credentials: false | |
| - uses: ./.github/actions/setup-build-and-push | |
| id: setup | |
| with: | |
| workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }} | |
| gcp_service_account: "${{ vars.SERVICE_ACCOUNT_NAME || 'artifact-writer' }}@moz-fx-sync-prod.iam.gserviceaccount.com" | |
| - name: Compute tags (GAR only) | |
| run: | | |
| TAGS="us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-payload-link-dataflow:${IMAGE_TAG}" | |
| if [[ "${PUSH_LATEST}" == "true" ]]; then | |
| TAGS="$TAGS | |
| us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-payload-link-dataflow:latest" | |
| fi | |
| echo "IMAGE_TAGS<<EOF" >> "$GITHUB_ENV" | |
| echo "$TAGS" >> "$GITHUB_ENV" | |
| echo "EOF" >> "$GITHUB_ENV" | |
| env: | |
| IMAGE_TAG: ${{ steps.setup.outputs.image_tag }} | |
| PUSH_LATEST: ${{ steps.setup.outputs.push_latest }} | |
| - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7 | |
| with: | |
| context: tools/payload-link-dataflow | |
| file: tools/payload-link-dataflow/Dockerfile | |
| push: true | |
| tags: ${{ env.IMAGE_TAGS }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| # Write the payload-link Dataflow flex-template spec (the container spec | |
| # JSON) into the dev job bucket, pointing at the image published above. | |
| # This spec is what tells the Dataflow job -- provisioned in | |
| # webservices-infra via container_spec_gcs_path -- which container to run | |
| # (STOR-648). Writing it does NOT relaunch a running job; it takes effect | |
| # the next time the job is (re)started. | |
| # | |
| # dev only for now. stage/prod buckets will be added later (likely a | |
| # matrix / GitHub environments), hence the parameterised vars below. | |
| # | |
| # Prerequisites (infra, out of this repo): | |
| # * the deploy SA has roles/storage.objectAdmin on the bucket (the | |
| # Dataflow SA already does, per webservices-infra), and | |
| # * that SA has a roles/iam.workloadIdentityUser binding for this repo's | |
| # WIF principal so Actions can impersonate it. | |
| write-payload-link-dataflow-spec-dev: | |
| needs: build-and-push-syncserver-payload-link-dataflow | |
| if: > | |
| github.event_name == 'workflow_dispatch' || | |
| ( | |
| github.event_name == 'push' && | |
| (github.ref_name == 'master' || startsWith(github.ref, 'refs/tags/')) | |
| ) | |
| permissions: | |
| contents: read | |
| id-token: write | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 | |
| with: | |
| persist-credentials: false | |
| - id: gcp-auth | |
| uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3 | |
| with: | |
| token_format: access_token | |
| workload_identity_provider: ${{ vars.GCPV2_GITHUB_WORKLOAD_IDENTITY_PROVIDER }} | |
| service_account: ${{ vars.PAYLOAD_LINK_DATAFLOW_DEPLOY_SA || 'sync-nonprod-dev-tmpl-pub@moz-fx-sync-nonprod.iam.gserviceaccount.com' }} | |
| - uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 | |
| - name: Write dev flex-template spec | |
| env: | |
| BUCKET: ${{ vars.PAYLOAD_LINK_DATAFLOW_DEV_BUCKET || 'sync-nonprod-dev-payload-link-dataflow' }} | |
| TAG: ${{ needs.build-and-push-syncserver-payload-link-dataflow.outputs.image_tag }} | |
| run: | | |
| IMAGE="us-docker.pkg.dev/moz-fx-sync-prod/sync-prod/syncserver-payload-link-dataflow:${TAG}" | |
| # Stable spec consumed by the webservices-infra Dataflow job, plus a | |
| # tag-versioned copy for reproducible rollback. | |
| for SPEC in \ | |
| "gs://${BUCKET}/templates/syncserver-payload-link-dataflow.json" \ | |
| "gs://${BUCKET}/templates/syncserver-payload-link-dataflow-${TAG}.json"; do | |
| gcloud dataflow flex-template build "${SPEC}" \ | |
| --image "${IMAGE}" \ | |
| --sdk-language JAVA \ | |
| --metadata-file tools/payload-link-dataflow/metadata.json | |
| done |