NRP k8s demo: allow local authentication only #573
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # DSpace Docker image build for hub.docker.com | |
| name: Docker images | |
| # Run this Build for all pushes to 'main' or maintenance branches, or tagged releases. | |
| # Also run for PRs to ensure PR doesn't break Docker build process | |
| # NOTE: uses "reusable-docker-build.yml" in DSpace/DSpace to actually build each of the Docker images | |
| # https://github.com/DSpace/DSpace/blob/dspace-7_x/.github/workflows/reusable-docker-build.yml | |
| # | |
| on: | |
| push: | |
| branches: | |
| - clarin-v7 | |
| - customer/* | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read # to fetch code (actions/checkout) | |
| packages: write # to write images to GitHub Container Registry (GHCR) | |
| jobs: | |
| ############################################################# | |
| # Build/Push the 'dspace/dspace-angular' image | |
| ############################################################# | |
| dspace-angular: | |
| # Ensure this job never runs on forked repos. It's only executed for 'dspace/dspace-angular' | |
| if: github.repository == 'ufal/dspace-angular' | |
| # Use the reusable-docker-build.yml script from DSpace/DSpace repo to build our Docker image | |
| uses: ufal/clarin-dspace/.github/workflows/reusable-docker-build.yml@clarin-v7 | |
| with: | |
| build_id: dspace-angular-dev | |
| image_name: ufal/dspace-angular | |
| dockerfile_path: ./Dockerfile | |
| tags_flavor: suffix=-dev | |
| # As this is a "dev" image, its tags are all suffixed with "-dev". Otherwise, it uses the same | |
| # tagging logic as the primary 'dspace/dspace-angular' image above. | |
| run_python_version_script: true | |
| python_version_script_dest: src/static-files/VERSION_D.html | |
| secrets: | |
| DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }} | |
| DOCKER_ACCESS_TOKEN: ${{ secrets.DOCKER_ACCESS_TOKEN }} | |
| ############################################################# | |
| # Build/Push the 'ufal/dspace-angular' image ('-dist' tag) | |
| ############################################################# | |
| dspace-angular-dist: | |
| # Ensure this job never runs on forked repos. It's only executed for 'ufal/dspace-angular' | |
| if: github.repository == 'ufal/dspace-angular' | |
| # Use the reusable-docker-build.yml script from DSpace/DSpace repo to build our Docker image | |
| uses: ufal/clarin-dspace/.github/workflows/reusable-docker-build.yml@clarin-v7 | |
| with: | |
| build_id: dspace-angular | |
| image_name: ufal/dspace-angular | |
| dockerfile_path: ./Dockerfile.dist | |
| run_python_version_script: true | |
| python_version_script_dest: src/static-files/VERSION_D.html | |
| secrets: | |
| DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }} | |
| DOCKER_ACCESS_TOKEN: ${{ secrets.DOCKER_ACCESS_TOKEN }} | |
| # Enable redeploy of sandbox & demo if the branch for this image matches the deployment branch of | |
| # these sites as specified in reusable-docker-build.xml | |
| REDEPLOY_SANDBOX_URL: ${{ secrets.REDEPLOY_SANDBOX_URL }} | |
| REDEPLOY_DEMO_URL: ${{ secrets.REDEPLOY_DEMO_URL }} | |
| ########################################################################### | |
| # Notify ufal/dspace-k8s of a new build, for the ok-dspace test environment | |
| ########################################################################### | |
| # Replaces the old commented-out deploy stub, which targeted the dataquest | |
| # docker-compose instances (dev-5/dev-8) we no longer have access to. | |
| # | |
| # Runs only for pushes to `clarin-v7` - currently the default branch, named | |
| # explicitly here because that is exactly what the guard below matches - and | |
| # only after the image this environment consumes has actually been pushed. | |
| # | |
| # This job records a new version; it does not deploy. It sends a | |
| # repository_dispatch to ufal/dspace-k8s, which pins the tag to git, and a | |
| # reconciler inside that cluster applies it. No deployment step and no cluster | |
| # credential exists in this repository, or anywhere in GitHub. | |
| deploy-ok-dspace: | |
| if: github.repository == 'ufal/dspace-angular' && github.event_name == 'push' && github.ref_name == 'clarin-v7' | |
| # dspace-angular-dist, NOT dspace-angular: the latter builds the '-dev' | |
| # suffixed image, while the overlay runs the unsuffixed dist image. | |
| needs: [dspace-angular-dist] | |
| runs-on: ubuntu-latest | |
| # This job authenticates with a PAT and never uses GITHUB_TOKEN, so it needs | |
| # none of the workflow-level permissions at all. | |
| permissions: {} | |
| steps: | |
| # One POST, hand-rolled with the `gh` and `jq` that ubuntu-latest already | |
| # ships, rather than a third-party dispatch action: a single API call is | |
| # not worth a supply-chain dependency that runs with the PAT in its | |
| # environment. | |
| - name: Notify ufal/dspace-k8s | |
| env: | |
| # Fine-grained PAT, scoped to ufal/dspace-k8s only, Contents: write | |
| # (what POST /repos/{owner}/{repo}/dispatches requires). | |
| GH_TOKEN: ${{ secrets.OK_DSPACE_DEPLOY_TOKEN }} | |
| SHA: ${{ github.sha }} | |
| run: | | |
| set -euo pipefail | |
| # jq builds the payload from an --arg, so the value is a JSON string | |
| # by construction rather than by careful quoting. | |
| jq -n --arg sha "${SHA}" \ | |
| '{event_type: "deploy-ok-dspace", | |
| client_payload: {component: "frontend", sha: $sha}}' \ | |
| | gh api -X POST repos/ufal/dspace-k8s/dispatches --input - |