2023-03-21 09:04:36 -04:00
|
|
|
name: Build and Upload OS image (scheduled)
|
2023-01-23 04:59:17 -05:00
|
|
|
|
|
|
|
on:
|
2023-04-13 11:44:23 -04:00
|
|
|
workflow_dispatch:
|
2023-01-23 04:59:17 -05:00
|
|
|
schedule:
|
2023-04-13 11:44:23 -04:00
|
|
|
- cron: "0 21 * * 2" # At 21:00 on Tuesday.
|
|
|
|
- cron: "10 21 * * 2" # At 21:10 on Tuesday.
|
|
|
|
- cron: "20 21 * * 2" # At 21:20 on Tuesday.
|
|
|
|
- cron: "0 21 * * 4" # At 21:00 on Thursday.
|
|
|
|
- cron: "10 21 * * 4" # At 21:10 on Thursday.
|
|
|
|
- cron: "20 21 * * 4" # At 21:20 on Thursday.
|
2023-01-23 04:59:17 -05:00
|
|
|
|
|
|
|
jobs:
|
|
|
|
stream:
|
|
|
|
runs-on: ubuntu-22.04
|
|
|
|
outputs:
|
|
|
|
stream: ${{ steps.stream.outputs.stream }}
|
|
|
|
steps:
|
|
|
|
- name: Determine stream
|
|
|
|
id: stream
|
|
|
|
run: |
|
2023-04-13 11:44:23 -04:00
|
|
|
if [[ ${{ github.event_name }} == "workflow_dispatch" ]]; then
|
|
|
|
echo "stream=nightly" | tee -a "$GITHUB_OUTPUT"
|
|
|
|
exit 0
|
|
|
|
fi
|
|
|
|
|
2023-01-23 04:59:17 -05:00
|
|
|
case "${{ github.event.schedule }}" in
|
2023-04-28 06:57:11 -04:00
|
|
|
"0 21 * * 4" | "0 21 * * 2")
|
2023-04-14 12:25:53 -04:00
|
|
|
echo "stream=debug" | tee -a "$GITHUB_OUTPUT"
|
2023-01-23 04:59:17 -05:00
|
|
|
;;
|
2023-04-28 06:57:11 -04:00
|
|
|
"10 21 * * 4" | "10 21 * * 2")
|
2023-04-14 12:25:53 -04:00
|
|
|
echo "stream=console" | tee -a "$GITHUB_OUTPUT"
|
2023-01-23 04:59:17 -05:00
|
|
|
;;
|
2023-04-28 06:57:11 -04:00
|
|
|
"20 21 * * 4" | "20 21 * * 2")
|
2023-04-14 12:25:53 -04:00
|
|
|
echo "stream=nightly" | tee -a "$GITHUB_OUTPUT"
|
2023-01-23 04:59:17 -05:00
|
|
|
;;
|
|
|
|
*)
|
|
|
|
echo "::error::Unknown stream for schedule '${{ github.event.schedule }}'"
|
|
|
|
exit 1
|
|
|
|
;;
|
|
|
|
esac
|
|
|
|
|
|
|
|
build-image:
|
|
|
|
needs: stream
|
|
|
|
uses: ./.github/workflows/build-os-image.yml
|
2023-01-30 10:11:27 -05:00
|
|
|
permissions:
|
|
|
|
id-token: write
|
|
|
|
contents: read
|
|
|
|
packages: read
|
2023-01-23 04:59:17 -05:00
|
|
|
secrets: inherit
|
|
|
|
with:
|
|
|
|
stream: ${{ needs.stream.outputs.stream }}
|
2023-04-13 11:44:23 -04:00
|
|
|
ref: ${{ github.head_ref }}
|
|
|
|
|
|
|
|
update-code:
|
|
|
|
# On nightly stream only.
|
|
|
|
if: |
|
|
|
|
github.event_name == 'workflow_dispatch' ||
|
2023-04-28 06:57:11 -04:00
|
|
|
github.event.schedule == '20 21 * * 4' ||
|
2023-04-13 11:44:23 -04:00
|
|
|
github.event.schedule == '20 21 * * 2'
|
|
|
|
needs: build-image
|
|
|
|
runs-on: ubuntu-22.04
|
|
|
|
steps:
|
|
|
|
- name: Checkout
|
2023-12-20 10:10:35 -05:00
|
|
|
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
2023-04-13 11:44:23 -04:00
|
|
|
with:
|
|
|
|
ref: ${{ github.head_ref }}
|
|
|
|
|
|
|
|
- name: Setup Go environment
|
2023-12-21 06:54:39 -05:00
|
|
|
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
|
2023-04-13 11:44:23 -04:00
|
|
|
with:
|
2023-12-08 06:11:31 -05:00
|
|
|
go-version: "1.21.5"
|
2023-06-01 09:16:00 -04:00
|
|
|
cache: false
|
2023-04-13 11:44:23 -04:00
|
|
|
|
|
|
|
- name: Determine version
|
|
|
|
id: version
|
|
|
|
uses: ./.github/actions/pseudo_version
|
|
|
|
|
|
|
|
- name: Update QEMU/MiniConstellation image version
|
2023-05-05 07:13:51 -04:00
|
|
|
run: |
|
|
|
|
defaultVersionReg='defaultImage = \"[^\"]*\"'
|
|
|
|
|
|
|
|
# Ensure regexp matches (otherwise the file was changed or the workflow is broken).
|
2023-05-23 04:49:47 -04:00
|
|
|
grep -E "${defaultVersionReg}" internal/config/image_enterprise.go
|
2023-05-05 07:13:51 -04:00
|
|
|
|
|
|
|
# Update version.
|
|
|
|
newVersion="ref\/${{ steps.version.outputs.branchName }}\/stream\/nightly\/${{ steps.version.outputs.version }}"
|
2023-05-23 04:49:47 -04:00
|
|
|
sed -i "s/${defaultVersionReg}/defaultImage = \"${newVersion}\"/" internal/config/image_enterprise.go
|
2023-04-13 11:44:23 -04:00
|
|
|
|
|
|
|
- name: Build generateMeasurements tool
|
|
|
|
working-directory: internal/attestation/measurements/measurement-generator
|
|
|
|
run: go build -o generate .
|
|
|
|
|
|
|
|
- name: Update hardcoded measurements
|
|
|
|
working-directory: internal/attestation/measurements
|
|
|
|
run: ./measurement-generator/generate
|
|
|
|
|
|
|
|
- name: Cleanup
|
|
|
|
run: rm -f internal/attestation/measurements/measurement-generator/generate
|
|
|
|
|
|
|
|
- name: Create pull request
|
2023-06-20 10:37:01 -04:00
|
|
|
uses: peter-evans/create-pull-request@153407881ec5c347639a548ade7d8ad1d6740e38 # v5.0.2
|
2023-04-13 11:44:23 -04:00
|
|
|
with:
|
|
|
|
branch: "image/automated/update-measurements-${{ github.run_number }}"
|
|
|
|
base: main
|
|
|
|
title: "image: update measurements and image version"
|
|
|
|
body: |
|
|
|
|
:robot: *This is an automated PR.* :robot:
|
|
|
|
|
|
|
|
The PR is triggered as part of the scheduled image build on main.
|
|
|
|
It updates the hardcoded measurements and the image version (for QEMU/MiniConstellation).
|
|
|
|
commit-message: "image: update measurements and image version"
|
|
|
|
committer: edgelessci <edgelessci@users.noreply.github.com>
|
|
|
|
labels: no changelog
|
|
|
|
# We need to push changes using a token, otherwise triggers like on:push and on:pull_request won't work.
|
|
|
|
token: ${{ !github.event.pull_request.head.repo.fork && secrets.CI_COMMIT_PUSH_PR || '' }}
|
2023-11-15 02:48:13 -05:00
|
|
|
|
|
|
|
notify-failure:
|
|
|
|
if: failure()
|
|
|
|
needs: [ "stream", "build-image", "update-code" ]
|
|
|
|
runs-on: ubuntu-22.04
|
|
|
|
steps:
|
|
|
|
- name: Checkout
|
2023-12-20 10:10:35 -05:00
|
|
|
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
2023-11-15 02:48:13 -05:00
|
|
|
with:
|
|
|
|
ref: ${{ github.head_ref }}
|
|
|
|
|
|
|
|
- name: Pick assignee
|
|
|
|
id: pick-assignee
|
|
|
|
continue-on-error: true
|
|
|
|
uses: ./.github/actions/pick_assignee
|
|
|
|
|
|
|
|
- name: Notify failure
|
|
|
|
continue-on-error: true
|
|
|
|
uses: ./.github/actions/notify_teams
|
|
|
|
with:
|
|
|
|
teamsWebhookURI: ${{ secrets.MS_TEAMS_WEBHOOK_URI }}
|
|
|
|
title: "Constellation image build failed"
|
|
|
|
assignee: ${{ steps.pick-assignee.outputs.assignee }}
|