Skip to content

Commit 92a50b7

Browse files
BrianMMcClainBrianMMcClain
committed
Initial commit
1 parent 9c7a455 commit 92a50b7

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

67 files changed

+8215
-0
lines changed

‎.github/scripts/bump_and_create_tag.sh

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#! /usr/bin/env bash
2+
# Copyright (c) HashiCorp, Inc.
3+
# SPDX-License-Identifier: MPL-2.0
4+
5+
set -eEuo pipefail
6+
7+
git fetch --prune --prune-tags
8+
9+
# Default tag if no tags exist
10+
TAG="1.0.0"
11+
12+
echo "Checking if tags exists . . ."
13+
tags=$(git tag)
14+
if [ ! -z "$tags" ]; then
15+
# Tag exists, bump minor semver
16+
OLD_TAG=`git tag --sort=v:refname | tail -1`
17+
echo "Existing tag $OLD_TAG found"
18+
TAG=`echo $OLD_TAG | awk 'BEGIN{FS="."; OFS="."} { print $1, ($2+1), $3 }'`
19+
fi
20+
21+
echo "Creating tag $TAG . . ."
22+
git config --local user.name "github-actions[bot]"
23+
git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
24+
git tag -a $TAG -m "Create tag $TAG"
25+
git push origin $TAG

‎.github/scripts/check_files_changed.sh

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#! /usr/bin/env bash
2+
3+
set -eEuo pipefail
4+
5+
PATHS="$1"
6+
EVENT="$2"
7+
HEAD_SHA="$3"
8+
COMMIT_SHA="$4"
9+
10+
if [ $EVENT = "pull_request" ]; then
11+
# Pull requests compares to the base commit of the compared branch
12+
CHANGED_FILES=$(git diff --name-only $HEAD_SHA $COMMIT_SHA)
13+
else
14+
# A commit to main compares one commit back
15+
CHANGED_FILES=$(git diff --name-only HEAD^ HEAD)
16+
fi
17+
18+
# Check if any changed files match our paths
19+
FILES_CHANGED=false
20+
for path in $PATHS; do
21+
if echo "$CHANGED_FILES" | grep -q "^${path}"; then
22+
FILES_CHANGED=true
23+
break
24+
fi
25+
done
26+
27+
echo "changed=$FILES_CHANGED" >> $GITHUB_OUTPUT

‎.github/scripts/create_channel_version.sh

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
#! /usr/bin/env bash
2+
# Copyright (c) HashiCorp, Inc.
3+
# SPDX-License-Identifier: MPL-2.0
4+
5+
6+
set -eEuo pipefail
7+
8+
usage() {
9+
cat <<EOF
10+
This script is a helper for setting a channel version in HCP Packer
11+
Usage:
12+
$(basename "$0") <bucket_slug> <sha> <channel_name>
13+
---
14+
Requires the following environment variables to be set:
15+
- HCP_CLIENT_ID
16+
- HCP_CLIENT_SECRET
17+
- HCP_ORGANIZATION_ID
18+
- HCP_PROJECT_ID
19+
EOF
20+
exit 1
21+
}
22+
23+
echo
24+
25+
# Entry point
26+
test "$#" -eq 3 || usage
27+
28+
bucket_slug="$1"
29+
github_sha="$2"
30+
channel_name="$3"
31+
auth_url="${HCP_AUTH_URL:-https://auth.hashicorp.com}"
32+
api_host="${HCP_API_HOST:-https://api.cloud.hashicorp.com}"
33+
base_url="$api_host/packer/2023-01-01/organizations/$HCP_ORGANIZATION_ID/projects/$HCP_PROJECT_ID"
34+
35+
# Authenticate
36+
echo "Authenticating . . ."
37+
response=$(curl --request POST --silent \
38+
--url "$auth_url/oauth/token" \
39+
--data grant_type=client_credentials \
40+
--data client_id="$HCP_CLIENT_ID" \
41+
--data client_secret="$HCP_CLIENT_SECRET" \
42+
--data audience="https://api.hashicorp.cloud")
43+
api_error=$(echo "$response" | jq -r '.error')
44+
if [ "$api_error" != null ]; then
45+
echo "Failed to get access token: $api_error"
46+
exit 1
47+
fi
48+
bearer=$(echo "$response" | jq -r '.access_token')
49+
50+
# Get the fingerprint of the build from this commit
51+
echo "Getting latest build fingerprint . . ."
52+
response=$(curl --request GET --silent \
53+
--url "$base_url/buckets/$bucket_slug/versions" \
54+
--header "authorization: Bearer $bearer")
55+
56+
version_fingerprint=$( echo "$response" | jq -r ".versions[] | select(.builds[].metadata.vcs.details.commit == \"${github_sha}\") | .fingerprint")
57+
58+
echo "Attempting to assign version ${version_fingerprint} in bucket ${bucket_slug} to channel ${channel_name}"
59+
60+
# Get or create channel
61+
echo "Getting channel ${channel_name}"
62+
response=$(curl --request GET --silent \
63+
--url "$base_url/buckets/$bucket_slug/channels/$channel_name" \
64+
--header "authorization: Bearer $bearer")
65+
api_error=$(echo "$response" | jq -r '.message')
66+
if [ "$api_error" != null ]; then
67+
echo "Channel ${channel_name} like doesn't exist, creating new channel"
68+
# Channel likely doesn't exist, create it
69+
api_error=$(curl --request POST --silent \
70+
--url "$base_url/buckets/$bucket_slug/channels" \
71+
--data-raw '{"name":"'"$channel_name"'"}' \
72+
--header "authorization: Bearer $bearer" | jq -r '.error')
73+
if [ "$api_error" != null ]; then
74+
echo "Error creating channel: $api_error"
75+
exit 1
76+
fi
77+
fi
78+
79+
# Update channel to point to version
80+
echo "Updating channel ${channel_name} to version fingerprint ${version_fingerprint}"
81+
api_error=$(curl --request PATCH --silent \
82+
--url "$base_url/buckets/$bucket_slug/channels/$channel_name" \
83+
--data-raw '{"version_fingerprint": "'$version_fingerprint'", "update_mask": "versionFingerprint"}' \
84+
--header "authorization: Bearer $bearer" | jq -r '.message')
85+
if [ "$api_error" != null ]; then
86+
echo "Error updating channel: $api_error"
87+
exit 1
88+
fi

‎.github/workflows/build_and_tag.yml

Lines changed: 175 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
name: Build and Tag
2+
3+
on:
4+
push:
5+
branches: [main]
6+
workflow_dispatch:
7+
8+
env:
9+
REGISTRY: ghcr.io
10+
FRONTEND_IMAGE_NAME: terramino-frontend
11+
BACKEND_IMAGE_NAME: terramino-backend
12+
HCP_CLIENT_ID: ${{ secrets.HCP_CLIENT_ID }}
13+
HCP_CLIENT_SECRET: ${{ secrets.HCP_CLIENT_SECRET }}
14+
HCP_PROJECT_ID: ${{ secrets.HCP_PROJECT_ID }}
15+
HCP_ORGANIZATION_ID: ${{ secrets.HCP_ORGANIZATION_ID }}
16+
AWS_REGION: ${{ secrets.AWS_REGION }}
17+
18+
jobs:
19+
check-files-changed:
20+
name : Check changed files
21+
runs-on: ubuntu-latest
22+
23+
outputs:
24+
build-packer: ${{ steps.check-packer.outputs.changed }}
25+
build-container: ${{ steps.check-app.outputs.changed }}
26+
update-terraform: ${{ steps.check-terraform.changed }}
27+
manual-run: ${{ steps.manual-run.manual }}
28+
29+
steps:
30+
- name: Checkout Repository
31+
uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
32+
with:
33+
fetch-depth: 2
34+
35+
- name: Check for Packer changes
36+
id: check-packer
37+
working-directory: .github/scripts
38+
run: ./check_files_changed.sh "shared/** image.pkr.hcl" "${{ github.event_name }}" "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}"
39+
40+
- name: Check for application changes
41+
id: check-app
42+
working-directory: .github/scripts
43+
run: ./check_files_changed.sh "app/**" "${{ github.event_name }}" "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}"
44+
45+
- name: Check for Terraform changes
46+
id: check-terraform
47+
working-directory: .github/scripts
48+
run: ./check_files_changed.sh "*.tf" "${{ github.event_name }}" "${{ github.event.pull_request.base.sha }}" "${{ github.sha }}"
49+
50+
- name: Check for manual run
51+
id: manual-run
52+
#run: echo "manual=${{ github.event_name == 'workflow_dispatch' }}" >> $GITHUB_ENV
53+
run: echo "manual=false" >> $GITHUB_ENV
54+
55+
build-packer:
56+
name: Build AMI
57+
runs-on: ubuntu-latest
58+
needs: check-files-changed
59+
if: ${{ needs.check-files-changed.outputs.build-packer == 'true' || needs.check-files-changed.outputs.manual-run == 'true' }}
60+
steps:
61+
- name: Checkout Repository
62+
uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
63+
64+
- name: Configure AWS Credentials
65+
uses: aws-actions/configure-aws-credentials@8c3f20df09ac63af7b3ae3d7c91f105f857d8497 # v4.0.0
66+
with:
67+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
68+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
69+
aws-region: ${{ secrets.AWS_REGION }}
70+
71+
- name: Setup Packer
72+
uses: hashicorp/setup-packer@main
73+
id: setup-packer
74+
75+
- name: Packer Init
76+
run: packer init .
77+
78+
- name: Packer Build
79+
run: PKR_VAR_region="$AWS_REGION" packer build .
80+
81+
- name: Create and set channel
82+
working-directory: .github/scripts
83+
run: ./create_channel_version.sh nomad-consul-vault ${{ github.sha }} production
84+
85+
build-application:
86+
name: Build Terramino images
87+
runs-on: ubuntu-latest
88+
needs: check-files-changed
89+
if: ${{ needs.check-files-changed.outputs.build-container == 'true' || needs.check-files-changed.outputs.manual-run == 'true' }}
90+
91+
permissions:
92+
contents: write
93+
packages: write
94+
95+
steps:
96+
- name: Set Timestamp
97+
id: timestamp
98+
run: echo "TIMESTAMP=$(date +%s)" >> $GITHUB_ENV
99+
100+
- name: Set repository name
101+
id: set-repo
102+
run: echo "REPO=${GITHUB_REPOSITORY@L}" >> "${GITHUB_ENV}"
103+
104+
- name: Checkout repo
105+
uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
106+
107+
- name: Log in to GHCR
108+
uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
109+
with:
110+
registry: ${{ env.REGISTRY }}
111+
username: ${{ github.actor }}
112+
password: ${{ secrets.GITHUB_TOKEN }}
113+
114+
# Frontend image build and push
115+
- name: Build and push frontend image
116+
id: frontend-push
117+
uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
118+
with:
119+
context: app/
120+
file: app/Dockerfile.frontend
121+
push: true
122+
tags: ${{ env.REGISTRY }}/${{ env.REPO }}/${{ env.FRONTEND_IMAGE_NAME }}:${{ env.TIMESTAMP }}
123+
124+
- id: get-frontend-build-name
125+
name: Save frontend image path to file
126+
env:
127+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
128+
run: |
129+
imageName=${{ fromJSON(steps.frontend-push.outputs.metadata)['image.name'] }}
130+
echo "$imageName" > latest-frontend.version
131+
132+
# Backend image build and push
133+
- name: Build and push backend image
134+
id: backend-push
135+
uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
136+
with:
137+
context: app/
138+
file: app/Dockerfile.backend
139+
push: true
140+
tags: ${{ env.REGISTRY }}/${{ env.REPO }}/${{ env.BACKEND_IMAGE_NAME }}:${{ env.TIMESTAMP }}
141+
142+
- id: get-backend-build-name
143+
name: Save backend image path to file
144+
run: |
145+
imageName=${{ fromJSON(steps.backend-push.outputs.metadata)['image.name'] }}
146+
echo "$imageName" > latest-backend.version
147+
148+
- name: Commit image files to repo
149+
env:
150+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
151+
run: |
152+
git config user.name "github-actions"
153+
git config user.email "github-actions[bot]@users.noreply.github.com"
154+
git add latest-frontend.version latest-backend.version
155+
git commit -m "Updated frontend and backend image URIs."
156+
git push
157+
158+
tag-release:
159+
name: Create tag
160+
runs-on: ubuntu-latest
161+
needs: [check-files-changed, build-packer, build-application]
162+
if: ${{ always() && (needs.build-packer.result == 'success' || needs.build-application.result == 'success' || needs.check-files-changed.outputs.update-terraform == 'true' || needs.check-files-changed.outputs.manual-run == 'true' ) }}
163+
164+
permissions:
165+
contents: write
166+
packages: write
167+
168+
steps:
169+
- name: Checkout Repository
170+
uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4.0.0
171+
172+
- name: Bump version and create tag
173+
working-directory: .github/scripts
174+
run: ./bump_and_create_tag.sh
175+

0 commit comments

Comments
 (0)