diff --git a/.github/workflows/images_build.yml b/.github/workflows/images_build.yml index 6f606f92c..7b997705e 100644 --- a/.github/workflows/images_build.yml +++ b/.github/workflows/images_build.yml @@ -87,7 +87,7 @@ jobs: env: MATRIX_FILE: ${{ env.MATRIX_FILE }} run: | - os_list=$(jq -r '.["os-linux"] | keys | [ .[] | tostring ] | @json' "$MATRIX_FILE") + os_list=$(jq -r '.["os-linux"] | keys | map(select(. != "rhel")) | [ .[] | tostring ] | @json' "$MATRIX_FILE") echo "::group::Operating System List" echo "$os_list" @@ -95,25 +95,12 @@ jobs: echo "list=$os_list" >> $GITHUB_OUTPUT - - name: Prepare Platform list - id: platform_list - env: - MATRIX_FILE: ${{ env.MATRIX_FILE }} - run: | - platform_list=$(jq -r '.["os-linux"] | tostring | @json' "$MATRIX_FILE") - - echo "::group::Platform List" - echo "$platform_list" - echo "::endgroup::" - - echo "list=$platform_list" >> $GITHUB_OUTPUT - - name: Prepare Database engine list id: database env: MATRIX_FILE: ${{ env.MATRIX_FILE }} run: | - database_list=$(jq -r '[.components | values[] ] | sort | unique | del(.. | select ( . == "" ) ) | [ .[] | tostring ] | @json' "$MATRIX_FILE") + database_list=$(jq -r '[.components | values[].base ] | sort | unique | del(.. | select ( . == "" ) ) | @json' "$MATRIX_FILE") echo "::group::Database List" echo "$database_list" @@ -126,7 +113,7 @@ jobs: env: MATRIX_FILE: ${{ env.MATRIX_FILE }} run: | - component_list=$(jq -r '.components | keys | [ .[] | tostring ] | @json' "$MATRIX_FILE") + component_list=$(jq -r '.components | keys | @json' "$MATRIX_FILE") echo "::group::Zabbix Component List" echo "$component_list" @@ -789,7 +776,7 @@ jobs: MATRIX_BUILD: ${{ matrix.build }} MATRIX_FILE: ${{ env.MATRIX_FILE }} run: | - BUILD_BASE=$(jq -r ".components.\"$MATRIX_BUILD\"" "$MATRIX_FILE") + BUILD_BASE=$(jq -r ".components.\"$MATRIX_BUILD\".base" "$MATRIX_FILE") echo "::group::Base Build Image" echo "$BUILD_BASE" diff --git a/.github/workflows/images_build_rhel.yml b/.github/workflows/images_build_rhel.yml index d561bcc31..465fb212b 100644 --- a/.github/workflows/images_build_rhel.yml +++ b/.github/workflows/images_build_rhel.yml @@ -4,7 +4,22 @@ on: release: types: - published + push: + branches: + - '[0-9]+.[0-9]+' + - 'trunk' + paths: + - 'Dockerfiles/*/rhel/*' + - 'build.json' + - '!**/README.md' + - '.github/workflows/images_build_rhel.yml' workflow_dispatch: + inputs: + publish_images: + description: 'Publish images' + required: true + default: false + type: boolean defaults: run: @@ -14,13 +29,14 @@ permissions: contents: read env: - AUTO_PUSH_IMAGES: ${{ contains(fromJSON('["workflow_dispatch"]'), github.event_name) && 'false' || vars.AUTO_PUSH_IMAGES }} + AUTO_PUSH_IMAGES: ${{ contains(fromJSON('["workflow_dispatch", "push"]'), github.event_name) && 'false' || vars.AUTO_PUSH_IMAGES }} LATEST_BRANCH: ${{ github.event.repository.default_branch }} TRUNK_GIT_BRANCH: "refs/heads/trunk" IMAGES_PREFIX: "zabbix-" BASE_BUILD_NAME: "build-base" + MATRIX_FILE: "build.json" DOCKERFILES_DIRECTORY: "Dockerfiles" OIDC_ISSUER: "https://token.actions.githubusercontent.com" @@ -39,10 +55,12 @@ jobs: permissions: contents: read outputs: + platforms: ${{ steps.platform_list.outputs.list }} components: ${{ steps.components.outputs.list }} is_default_branch: ${{ steps.branch_info.outputs.is_default_branch }} current_branch: ${{ steps.branch_info.outputs.current_branch }} sha_short: ${{ steps.branch_info.outputs.sha_short }} + secret_prefix: ${{ steps.branch_info.outputs.secret_prefix }} steps: - name: Block egress traffic uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0 @@ -57,6 +75,42 @@ jobs: with: fetch-depth: 1 + - name: Check ${{ env.MATRIX_FILE }} file + id: build_exists + env: + MATRIX_FILE: ${{ env.MATRIX_FILE }} + run: | + if [[ ! -f "$MATRIX_FILE" ]]; then + echo "::error::File $MATRIX_FILE is missing" + exit 1 + fi + + - name: Prepare Platform list + id: platform_list + env: + MATRIX_FILE: ${{ env.MATRIX_FILE }} + run: | + platform_list=$(jq -r '.["os-linux"].rhel | @json' "$MATRIX_FILE") + + echo "::group::Platform List" + echo "$platform_list" + echo "::endgroup::" + + echo "list=$platform_list" >> $GITHUB_OUTPUT + + - name: Prepare Zabbix component list + id: components + env: + MATRIX_FILE: ${{ env.MATRIX_FILE }} + run: | + component_list=$(jq -r '.components |map_values(select(.rhel == true)) | keys | @json' "$MATRIX_FILE") + + echo "::group::Zabbix Component List" + echo "$component_list" + echo "::endgroup::" + + echo "list=$component_list" >> $GITHUB_OUTPUT + - name: Get branch info id: branch_info shell: bash @@ -80,31 +134,16 @@ jobs: echo "::group::Branch data" echo "is_default_branch - $result" echo "current_branch - $github_ref" + echo "secret_prefix=RHEL_${github_ref//.}" echo "sha_short - $sha_short" echo "::endgroup::" echo "is_default_branch=$result" >> $GITHUB_OUTPUT echo "current_branch=$github_ref" >> $GITHUB_OUTPUT + echo "secret_prefix=RHEL_${github_ref//.}" >> $GITHUB_OUTPUT echo "sha_short=$sha_short" >> $GITHUB_OUTPUT - - name: Prepare Zabbix component list - id: components - env: - REDHAT_CERTIFY_CREDENTIALS: ${{ secrets.REDHAT_CERTIFY_CREDENTIALS }} - CURRENT_BRANCH: ${{ steps.branch_info.outputs.current_branch }} - run: | - if [[ -z "$REDHAT_CERTIFY_CREDENTIALS" ]]; then - echo "::error::Missing RedHat Certification details" - exit 1 - fi - component_list=$(jq --raw-output --argjson data "$REDHAT_CERTIFY_CREDENTIALS" -n "\$data.\"$CURRENT_BRANCH\".components | keys | @json") - - echo "::group::Zabbix Component List" - echo "$component_list" - echo "::endgroup::" - - echo "list=$component_list" >> $GITHUB_OUTPUT build_base: timeout-minutes: 30 @@ -114,7 +153,7 @@ jobs: fail-fast: false matrix: build: [build-base] - arch: [X64, ARM64] + arch: ${{ fromJson(needs.init_build.outputs.platforms) }} runs-on: [self-hosted, linux, "${{ matrix.arch }}"] permissions: contents: read @@ -188,7 +227,7 @@ jobs: fail-fast: false matrix: build: [build-mysql, build-sqlite3] - arch: [X64, ARM64] + arch: ${{ fromJson(needs.init_build.outputs.platforms) }} runs-on: [self-hosted, linux, "${{ matrix.arch }}"] permissions: contents: read @@ -278,7 +317,7 @@ jobs: fail-fast: false matrix: build: ${{ fromJson(needs.init_build.outputs.components) }} - arch: [X64, ARM64] + arch: ${{ fromJson(needs.init_build.outputs.platforms) }} runs-on: [self-hosted, linux, "${{ matrix.arch }}"] permissions: contents: read @@ -289,68 +328,31 @@ jobs: with: fetch-depth: 1 - - name: Fix string case - id: lc + - name: Variables formating + id: var_format env: - ARCH: ${{ matrix.arch }} + MATRIX_BUILD: ${{ matrix.build }} run: | - echo "arch=${ARCH,,}" >> $GITHUB_OUTPUT + MATRIX_BUILD=${MATRIX_BUILD^^} + MATRIX_BUILD=${MATRIX_BUILD//-/_} + echo "::group::Result" + echo "matrix_build=${MATRIX_BUILD}" + echo "::endgroup::" + echo "matrix_build=${MATRIX_BUILD}" >> $GITHUB_OUTPUT - name: Detect Build Base Image id: build_base_image env: - REDHAT_CERTIFY_CREDENTIALS: ${{ secrets.REDHAT_CERTIFY_CREDENTIALS }} MATRIX_BUILD: ${{ matrix.build }} - CURRENT_BRANCH: ${{ needs.init_build.outputs.current_branch }} + MATRIX_FILE: ${{ env.MATRIX_FILE }} run: | - BUILD_BASE=$(jq --raw-output --argjson data "$REDHAT_CERTIFY_CREDENTIALS" -n "\$data.\"$CURRENT_BRANCH\".components.\"$MATRIX_BUILD\".build_base") + BUILD_BASE=$(jq -r ".components.\"$MATRIX_BUILD\".base" "$MATRIX_FILE") - echo "::group::Build base image" - echo "build_base=$BUILD_BASE" + echo "::group::Base Build Image" + echo "$BUILD_BASE" echo "::endgroup::" - echo "build_base=$BUILD_BASE" >> $GITHUB_OUTPUT - - - name: Generate image name - id: image_name - env: - REDHAT_CERTIFY_CREDENTIALS: ${{ secrets.REDHAT_CERTIFY_CREDENTIALS }} - MATRIX_BUILD: ${{ matrix.build }} - CURRENT_BRANCH: ${{ needs.init_build.outputs.current_branch }} - run: | - IMAGE_NAME=$(jq --raw-output --argjson data "$REDHAT_CERTIFY_CREDENTIALS" -n "\$data.\"$CURRENT_BRANCH\".components.\"$MATRIX_BUILD\".login") - - echo "::add-mask::$IMAGE_NAME" - echo "image_name=$IMAGE_NAME" >> $GITHUB_OUTPUT - - - name: Generate credentials - id: login_credentials - env: - REDHAT_CERTIFY_CREDENTIALS: ${{ secrets.REDHAT_CERTIFY_CREDENTIALS }} - MATRIX_BUILD: ${{ matrix.build }} - CURRENT_BRANCH: ${{ needs.init_build.outputs.current_branch }} - run: | - IMAGE_NAME=$(jq --raw-output --argjson data "$REDHAT_CERTIFY_CREDENTIALS" -n "\$data.\"$CURRENT_BRANCH\".components.\"$MATRIX_BUILD\".login") - REGISTRY_PASSWORD=$(jq --raw-output --argjson data "$REDHAT_CERTIFY_CREDENTIALS" -n "\$data.\"$CURRENT_BRANCH\".components.\"$MATRIX_BUILD\".secret") - - echo "::add-mask::$IMAGE_NAME" - echo "::add-mask::redhat-isv-containers+$IMAGE_NAME-robot" - echo "::add-mask::$REGISTRY_PASSWORD" - - echo "username=$IMAGE_NAME" >> $GITHUB_OUTPUT - echo "password=$REGISTRY_PASSWORD" >> $GITHUB_OUTPUT - - - name: Log in to Quay.io - uses: redhat-actions/podman-login@9184318aae1ee5034fbfbacc0388acf12669171f # v1.6 - if: ${{ env.AUTO_PUSH_IMAGES == 'true' }} - env: - LOGIN: ${{ steps.login_credentials.outputs.username }} - PASSWORD: ${{ steps.login_credentials.outputs.password }} - with: - username: redhat-isv-containers+${{ env.LOGIN }}-robot - password: ${{ env.PASSWORD }} - registry: ${{ env.REGISTRY }} - auth_file_path: /tmp/.docker_${{ matrix.build }}_${{ matrix.arch }}_${{ needs.init_build.outputs.sha_short }} + echo "build_base=${BUILD_BASE}" >> $GITHUB_OUTPUT - name: Remove smartmontools if: ${{ matrix.build == 'agent2' }} @@ -363,7 +365,7 @@ jobs: id: meta uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1 with: - images: ${{ env.REGISTRY }}/${{ env.REGISTRY_NAMESPACE }}/${{ steps.image_name.outputs.image_name }} + images: ${{ env.REGISTRY }}/${{ env.REGISTRY_NAMESPACE }}/${{ secrets[format('{0}_{1}_PROJECT', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)] }} tags: | type=semver,pattern={{version}} type=sha @@ -372,6 +374,7 @@ jobs: suffix=${{ matrix.arch == 'ARM64' && '-arm64' || '' }},onlatest=true - name: Download SHA256 tag of ${{ steps.build_base_image.outputs.build_base }}:${{ matrix.arch }} + if: ${{ matrix.build != 'snmptraps' }} uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0 with: path: ${{ steps.build_base_image.outputs.build_base }}_${{ matrix.arch }} @@ -379,6 +382,7 @@ jobs: - name: Retrieve ${{ steps.build_base_image.outputs.build_base }}:${{ matrix.arch }} SHA256 tag id: base_build + if: ${{ matrix.build != 'snmptraps' }} env: MATRIX_ARCH: ${{ matrix.arch }} BASE_IMAGE: ${{ steps.build_base_image.outputs.build_base }} @@ -395,7 +399,7 @@ jobs: echo "base_tag=${BASE_TAG}" >> $GITHUB_OUTPUT echo "base_build_image=${BUILD_BASE_IMAGE}" >> $GITHUB_OUTPUT - - name: Build ${{ matrix.build }} + - name: Build image id: build_image uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2.12 with: @@ -409,7 +413,16 @@ jobs: ${{ env.DOCKERFILES_DIRECTORY }}/${{ matrix.build }}/rhel/Dockerfile build-args: BUILD_BASE_IMAGE=${{ steps.base_build.outputs.base_build_image }} - - name: Push to RedHat certification procedure + - name: Log in to Quay.io + uses: redhat-actions/podman-login@9184318aae1ee5034fbfbacc0388acf12669171f # v1.6 + if: ${{ env.AUTO_PUSH_IMAGES == 'true' }} + with: + username: ${{ format('redhat-isv-containers+{0}-robot', secrets[format('{0}_{1}_PROJECT', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)]) }} + password: ${{ secrets[format('{0}_{1}_SECRET', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)] }} + registry: ${{ env.REGISTRY }} + auth_file_path: /tmp/.docker_${{ matrix.build }}_${{ matrix.arch }}_${{ needs.init_build.outputs.sha_short }} + + - name: Push to RedHat certification procedure (1st) id: push_to_registry if: ${{ env.AUTO_PUSH_IMAGES == 'true' }} uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2.7.1 @@ -420,7 +433,7 @@ jobs: if: ${{ env.AUTO_PUSH_IMAGES == 'true' }} env: PFLT_DOCKERCONFIG: /tmp/.docker_${{ matrix.build }}_${{ matrix.arch }}_${{ needs.init_build.outputs.sha_short }} - PFLT_CERTIFICATION_PROJECT_ID: ${{ steps.login_credentials.outputs.username }} + PFLT_CERTIFICATION_PROJECT_ID: ${{ secrets[format('{0}_{1}_PROJECT', needs.init_build.outputs.secret_prefix, steps.var_format.outputs.matrix_build)] }} PFLT_PYXIS_API_TOKEN: ${{ secrets.REDHAT_API_TOKEN }} PFLT_ARTIFACTS: ${{ env.PFLT_ARTIFACTS }} PFLT_LOGLEVEL: ${{ env.PFLT_LOGLEVEL }} @@ -449,7 +462,7 @@ jobs: podman rmi -i -f "$PREFLIGHT_IMAGE" echo "::endgroup::" - - name: Push to RedHat certification procedure + - name: Push to RedHat certification procedure (2nd) id: push_to_registry_all_tags if: ${{ env.AUTO_PUSH_IMAGES == 'true' }} uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2.7.1 diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml index ad5c2bc92..252c73636 100644 --- a/.github/workflows/sonarcloud.yml +++ b/.github/workflows/sonarcloud.yml @@ -30,9 +30,7 @@ name: SonarCloud analysis on: push: - branches: - - '[0-9]+.[0-9]+' - - 'trunk' + branches: [ "6.4" ] pull_request: branches: [ "6.4" ] workflow_dispatch: diff --git a/build.json b/build.json index 0ed215f15..c337325f2 100644 --- a/build.json +++ b/build.json @@ -20,6 +20,10 @@ "linux/amd64", "linux/arm64", "linux/ppc64le" + ], + "rhel": [ + "X64", + "ARM64" ] }, "os-windows": { @@ -27,18 +31,18 @@ "windows-2019": "ltsc2019" }, "components": { - "agent": "build-mysql", - "agent2": "build-mysql", - "java-gateway": "build-mysql", - "proxy-mysql": "build-mysql", - "proxy-sqlite3": "build-sqlite3", - "server-mysql": "build-mysql", - "server-pgsql": "build-pgsql", - "snmptraps": "", - "web-apache-mysql": "build-mysql", - "web-apache-pgsql": "build-pgsql", - "web-nginx-mysql": "build-mysql", - "web-nginx-pgsql": "build-mysql", - "web-service": "build-mysql" + "agent": { "base" : "build-mysql", "rhel" : true }, + "agent2": { "base" : "build-mysql", "rhel" : true }, + "java-gateway": { "base" : "build-mysql", "rhel" : true }, + "proxy-mysql": { "base" : "build-mysql", "rhel" : true }, + "proxy-sqlite3": { "base" : "build-sqlite3", "rhel" : true }, + "server-mysql": { "base" : "build-mysql", "rhel" : true }, + "server-pgsql": { "base" : "build-pgsql", "rhel" : false }, + "snmptraps": { "base" : "", "rhel" : true }, + "web-apache-mysql": { "base" : "build-mysql", "rhel" : false }, + "web-apache-pgsql": { "base" : "build-pgsql", "rhel" : false }, + "web-nginx-mysql": { "base" : "build-mysql", "rhel" : true }, + "web-nginx-pgsql": { "base" : "build-mysql", "rhel" : false }, + "web-service": { "base" : "build-mysql", "rhel" : true } } -} \ No newline at end of file +}