feat: pro rock in ACR (WIP)

Jobs to be done: Rebuild, Continuous scanning

Author: zhijie-yang

.github/actions/commit-releases-json/action.yaml

@@ -47,6 +47,9 @@ runs:
         git config user.name "${{ inputs.actor }}"
 
         git add oci/${{ inputs.image-name }}/_releases.json
+        if [[ -f oci/${{ inputs.image-name }}/_pro_releases.json ]]; then
+          git add oci/${{ inputs.image-name }}/_pro_releases.json
+        fi
         git commit -m "${{ inputs.message }}"
         
         for i in {1..10}; do

.github/actions/fetch-releases-json/copy-releases-files.sh

@@ -14,10 +14,14 @@ if [[ "$RUNNER_DEBUG" == "1" ]]; then
 fi
 
 if [[ "$image_name" = "*" ]]; then
-    echo "Copying all _releases.json files"
+    echo "Copying all _releases.json (including _pro_releases.json) files"
     cd "$directory" || exit 1
     find . -name "_releases.json" -exec cp --parents {} "$OLDPWD" \;
+    find . -name "_pro_releases.json" -exec cp --parents {} "$OLDPWD" \;
     cd "$OLDPWD" || exit 1
 elif [[ -f "$directory/oci/$image_name/_releases.json" ]]; then
     cp "$directory/oci/$image_name/_releases.json" "oci/$image_name/_releases.json"
+    if [[ -f "$directory/oci/$image_name/_pro_releases.json" ]]; then
+        cp "$directory/oci/$image_name/_pro_releases.json" "oci/$image_name/_pro_releases.json"
+    fi
 fi

.github/workflows/Image.yaml

@@ -197,7 +197,11 @@ jobs:
       rock-repo-commit: ${{ matrix.commit }}
       rockfile-directory: ${{ matrix.directory }}
       lpci-fallback: true
-    secrets: inherit
+      pro-services: ${{ matrix.pro-services }}
+    secrets:
+      source-github-token: ${{ secrets.ROCKSBOT_TOKEN }}
+      pro-token: ${{ secrets[matrix.pro-token] }}
+      pro-artifact-passphrase: ${{ secrets[matrix.pro-artifact-passphrase] }}
 
   test-rock:
     needs: [prepare-build, build-rock]
@@ -210,7 +214,8 @@ jobs:
       oci-archive-name: "${{ matrix.name }}_${{ matrix.commit }}_${{ matrix.dir_identifier }}"
       trivyignore-path: ${{ matrix.ignored-vulnerabilities == '' && format('oci/{0}/.trivyignore', matrix.name) || '' }}
       ignored-vulnerabilities: ${{ matrix.ignored-vulnerabilities }}
-    secrets: inherit
+    secrets:
+      pro-artifact-passphrase: ${{ secrets[matrix.pro-artifact-passphrase] }}
 
   prepare-upload:
     runs-on: self-hosted-linux-amd64-noble-private-endpoint-small
@@ -318,7 +323,7 @@ jobs:
       UMOCI_VERSION: "v0.4.7"
       UMOCI_BINARY: "umoci.amd64"
     outputs:
-      artefacts-hashes: ${{ steps.artefacts-hashes.outputs.hashes }}
+      artifacts-hashes: ${{ steps.artifacts-hashes.outputs.hashes }}
 
     permissions:
       packages: write
@@ -350,7 +355,17 @@ jobs:
         with:
           name: ${{ env.OCI_ARCHIVE_NAME }}
 
-      - name: Name output artefact
+      - name: Decrypt pro artifact
+        if: ${{ matrix.pro-services != '' }}
+        uses: ./.github/actions/crypt-artifact
+        with:
+          mode: decrypt
+          input-path: ${{ env.OCI_ARCHIVE_NAME }}.gpg
+          passphrase: ${{ secrets[matrix.pro-artifact-passphrase] }}
+          output-path: ${{ env.OCI_ARCHIVE_NAME }}
+          preserve-original: false
+
+      - name: Name output artifact
         id: rename-oci-archive
         run: |
           # Rename the OCI archive tarball
@@ -460,8 +475,8 @@ jobs:
           name: ${{ env.OCI_ARCHIVE_NAME }}${{ env.VULNERABILITY_REPORT_SUFFIX }}
 
       # https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/generic/README.md
-      - name: Calculate artefacts hashes
-        id: artefacts-hashes
+      - name: Calculate artifacts hashes
+        id: artifacts-hashes
         env:
           VULN_REPORT: ${{ env.OCI_ARCHIVE_NAME }}${{ env.VULNERABILITY_REPORT_SUFFIX }}
           SBOMS: ${{ steps.generate-sboms.outputs.sboms }}
@@ -475,6 +490,7 @@ jobs:
 
       - name: Login to GHCR
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121
+        if: ${{ matrix.pro-services == '' }}
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -487,16 +503,26 @@ jobs:
           path: ${{ steps.generate-sboms.outputs.sboms }}
           if-no-files-found: error
 
+      - name: Encrypt pro artifact
+        if: ${{ matrix.pro-services != '' }}
+        uses: ./.github/actions/crypt-artifact
+        with:
+          mode: encrypt
+          input-path: ${{ steps.rename-oci-archive.outputs.name }}
+          passphrase: ${{ secrets[matrix.pro-artifact-passphrase] }}
+          output-path: ${{ steps.rename-oci-archive.outputs.name }}.gpg
+
       - name: Upload image
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
         with:
           name: ${{ steps.rename-oci-archive.outputs.name }}
-          path: ${{ steps.rename-oci-archive.outputs.name }}
+          path: ${{ matrix.pro-services == '' && steps.rename-oci-archive.outputs.name || format('{0}.gpg', steps.rename-oci-archive.outputs.name) }}
           if-no-files-found: error
 
       - name: Upload to GHCR
         id: upload-image
         uses: ./.github/actions/upload-rock
+        if: ${{ matrix.pro-services == '' }}
         with:
           artifact_name: ${{ env.OCI_ARCHIVE_NAME }}
           name: ${{ github.repository_owner }}/oci-factory/${{ matrix.name }}
@@ -521,12 +547,14 @@ jobs:
           MATRIX_NAME: ${{ matrix.name }}
           MATRIX_TRACK: ${{ matrix.track }}
           MATRIX_REVISION: ${{ matrix.revision }}
+          PRO_SERVICES: ${{ matrix.pro-services }}
           STEPS_GENERATE_SBOMS_OUTPUTS_SBOMS: ${{ steps.generate-sboms.outputs.sboms }}
         run: |
           jq --arg base "${MATRIX_BASE}" \
             --arg digest "${STEPS_UPLOAD_IMAGE_OUTPUTS_DIGEST}" \
             --arg ignored_vulnerabilities "${MATRIX_IGNORED_VULNERABILITIES}" \
-            '. + {base: $base, digest: $digest, "ignored-vulnerabilities": $ignored_vulnerabilities}' \
+            --arg pro_services "${PRO_SERVICES}" \
+            '. + {base: $base, digest: $digest, "ignored-vulnerabilities": $ignored_vulnerabilities, "pro-services": $pro_services}' \
             <<< '${{ toJSON(matrix) }}' > build_metadata.json
           ./src/uploads/upload_to_swift.sh \
             "${MATRIX_NAME}" \
@@ -694,7 +722,7 @@ jobs:
   #     contents: write # Needed for release uploads
   #   uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@7f4fdb871876c23e455853d694197440c5a91506
   #   with:
-  #     base64-subjects: "${{ needs.upload.outputs.artefacts-hashes }}"
+  #     base64-subjects: "${{ needs.upload.outputs.artifacts-hashes }}"
 
   notify:
     runs-on: ubuntu-22.04

.github/workflows/Release.yaml

@@ -85,6 +85,8 @@ jobs:
     needs: [validate-push-release-request]
     outputs:
       gh-releases-matrix: ${{ steps.release-image.outputs.gh-releases-matrix }}
+      is-public-release: ${{ steps.release-type.outputs.is-public-release }}
+      is-pro-release: ${{ steps.release-type.outputs.is-pro-release }}
     env:
       IS_PROD: ${{ ! startsWith(inputs.oci-image-name, 'mock-') }}
       RELEASES_BRANCH: _releases
@@ -108,6 +110,62 @@ jobs:
           key: ${{ inputs.image-trigger-cache-key }}
           fail-on-cache-miss: true
 
+
+      # Use yq to find out if `pro-release` is present and non-empty in the image trigger.
+      - name: Release type
+        id: release-type
+        run: |
+          set -e
+          if [[ "$RUNNER_DEBUG" == "1" ]]; then
+            set -x
+          fi
+          source src/shared/logs.sh
+          image_trigger_file="oci/${INPUTS_OCI_IMAGE_NAME}/image.yaml"
+          yq eval '.["pro-release"] | length > 0' "$image_trigger_file" > is_pro_release.txt
+          yq eval '.["release"] | length > 0' "$image_trigger_file" > is_public_release.txt
+          is_pro_release=$(cat is_pro_release.txt)
+          echo "is-pro-release=$is_pro_release" >> "$GITHUB_OUTPUT"
+          is_public_release=$(cat is_public_release.txt)
+          echo "is-public-release=$is_public_release" >> "$GITHUB_OUTPUT"
+        env:
+          INPUTS_OCI_IMAGE_NAME: ${{ inputs.oci-image-name }}
+
+      # Download the image if `pro-release` is present and non-empty in the image trigger.
+      # pattern should match <image_name>_<version>-<base>_*, e.g., mock-rock_1.2-22.04_*
+      - name: Download image artifact
+        id: download-image-artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        if: ${{ steps.release-type.outputs.is-pro-release == 'true' }}
+        env:
+          INPUTS_OCI_IMAGE_NAME: ${{ inputs.oci-image-name }}
+        with:
+          pattern: +([A-Za-z0-9-])_+([A-Za-z0-9.-])-[0-9][0-9].[0-9][0-9]_+([0-9])
+          merge-multiple: true
+
+      # Decrypt the Pro image artifact being downloaded.
+      # They are encrypted with GPG, and has the same name as the downloaded artifact, but with .gpg extension.
+      # put a for loop to use the script ./.github/action/crypt-artifact/crypt-artifact.sh to decrypt the artifact,
+      - name: Decrypt Pro image artifact
+        id: decrypt-pro-image-artifact
+        if: ${{ steps.release-type.outputs.is-pro-release == 'true' }}
+        run: |
+          set -e
+          if [[ "$RUNNER_DEBUG" == "1" ]]; then
+            set -x
+          fi
+          source src/shared/logs.sh
+          artifact_path="${{ steps.download-image-artifact.outputs.download-path }}"
+          for artifact in $artifact_path/*.gpg; do
+            if [ -f "$artifact" ]; then
+              log_info "Decrypting artifact: $artifact"
+              ./.github/actions/crypt-artifact/crypt-artifact.sh decrypt \
+                -i "$artifact" \
+                -p "${{ secrets.ROCKS_PRO_ARTIFACT_PASSPHRASE }}"
+            else
+              log_info "No .gpg artifacts found to decrypt."
+            fi
+          done
+
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
         with:
           python-version: "3.x"
@@ -139,6 +197,7 @@ jobs:
 
       - name: Do releases from ${{ inputs.oci-image-name }}
         id: release-image
+        if: ${{ steps.release-type.outputs.is-public-release == 'true' }}
         env:
           # GH has issues with boolean expressions
           # https://github.com/actions/runner/issues/1483
@@ -174,7 +233,34 @@ jobs:
             --all-revision-tags "${STEPS_GET_ALL_CANONICAL_TAGS_OUTPUTS_CANONICAL_TAGS_FILE}" \
             --ghcr-repo "${{ github.repository_owner }}/oci-factory"
 
+      - name: Do Pro releases from ${{ inputs.oci-image-name }}
+        if: ${{ steps.release-type.outputs.is-pro-release == 'true' }}
+        id: release-pro-image
+        env:
+          # GH has issues with boolean expressions
+          ACR_CREDS_USR: ${{ env.IS_PROD == 'true' && secrets.ACR_CREDS_USR || secrets.ACR_CREDS_USR_DEV }}
+          ACR_CREDS_PSW: ${{ env.IS_PROD == 'true' && secrets.ACR_CREDS_PSW || secrets.ACR_CREDS_PSW_DEV }}
+          ACR_REGISTRY: ${{ env.IS_PROD == 'true' && 'ubuntu.azurecr.io' || secrets.ACR_REGISTRY_DEV }}
+          PYTHONUNBUFFERED: 1
+          INPUTS_OCI_IMAGE_NAME: ${{ inputs.oci-image-name }}
+          STEPS_GET_ALL_CANONICAL_TAGS_OUTPUTS_CANONICAL_TAGS_FILE: ${{ steps.get-all-canonical-tags.outputs.canonical-tags-file }}
+        run: |
+          set -e
+          if [[ "$RUNNER_DEBUG" == "1" ]]; then
+            set -x
+          fi
+          source src/shared/logs.sh
+          log_info "Running in production? $([[ "$IS_PROD" == "true" ]] && echo YES || echo NO)"
+          
+          python3 -m src.image.release \
+            --image-trigger oci/${INPUTS_OCI_IMAGE_NAME}/image.yaml \
+            --image-name ${INPUTS_OCI_IMAGE_NAME} \
+            --all-releases oci/${INPUTS_OCI_IMAGE_NAME}/_releases.json \
+            --all-revision-tags "${STEPS_GET_ALL_CANONICAL_TAGS_OUTPUTS_CANONICAL_TAGS_FILE}" \
+            --pro
+
       - name: Update _releases.json
+        if: ${{ steps.release-type.outputs.is-public-release == 'true' }}
         run: |
           python3 -m src.image.release \
             --image-trigger oci/${INPUTS_OCI_IMAGE_NAME}/image.yaml \
@@ -186,27 +272,53 @@ jobs:
           INPUTS_OCI_IMAGE_NAME: ${{ inputs.oci-image-name }}
           STEPS_GET_ALL_CANONICAL_TAGS_OUTPUTS_CANONICAL_TAGS_FILE: ${{ steps.get-all-canonical-tags.outputs.canonical-tags-file }}
 
+      - name: Update _pro_releases.json
+        if: ${{ steps.release-type.outputs.is-pro-release == 'true' }}
+        run: |
+          python3 -m src.image.release \
+            --image-trigger oci/${INPUTS_OCI_IMAGE_NAME}/image.yaml \
+            --image-name ${INPUTS_OCI_IMAGE_NAME} \
+            --all-releases oci/${INPUTS_OCI_IMAGE_NAME}/_pro_releases.json \
+            --all-revision-tags "${STEPS_GET_ALL_CANONICAL_TAGS_OUTPUTS_CANONICAL_TAGS_FILE}" \
+            --update-releases-json \
+            --pro
+        env:
+          INPUTS_OCI_IMAGE_NAME: ${{ inputs.oci-image-name }}
+          STEPS_GET_ALL_CANONICAL_TAGS_OUTPUTS_CANONICAL_TAGS_FILE: ${{ steps.get-all-canonical-tags.outputs.canonical-tags-file }}
+
       - name: Overwrite _releases.json
+        if: ${{ steps.release-type.outputs.is-public-release == 'true' }}
         run: |
           mkdir -p ${{ env.RELEASE_REPO_DIR }}/oci/${INPUTS_OCI_IMAGE_NAME}
           cp oci/${INPUTS_OCI_IMAGE_NAME}/_releases.json ${{ env.RELEASE_REPO_DIR }}/oci/${INPUTS_OCI_IMAGE_NAME}/_releases.json
         env:
           INPUTS_OCI_IMAGE_NAME: ${{ inputs.oci-image-name }}
 
+      - name: Overwrite _pro_releases.json
+        if: ${{ steps.release-type.outputs.is-pro-release == 'true' }}
+        run: |
+          mkdir -p ${{ env.RELEASE_REPO_DIR }}/oci/${INPUTS_OCI_IMAGE_NAME}
+          cp oci/${INPUTS_OCI_IMAGE_NAME}/_pro_releases.json ${{ env.RELEASE_REPO_DIR }}/oci/${INPUTS_OCI_IMAGE_NAME}/_pro_releases.json
+        env:
+          INPUTS_OCI_IMAGE_NAME: ${{ inputs.oci-image-name }}
+
       # Commit with actor's GitHub noreply email to pass CLA and keep the privacy of the actor
       # Use force push, to bypass the branch protection rules
       - name: Commit oci/${{ inputs.oci-image-name }}/_releases.json
         uses: ./.github/actions/commit-releases-json
         with:
           directory: ${{ env.RELEASE_REPO_DIR }}
           image-name: ${{ inputs.oci-image-name }}
-          message: 'ci: automatically update oci/${{ inputs.oci-image-name }}/_releases.json, from ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+          message: 'ci: automatically update releases in oci/${{ inputs.oci-image-name }}/, from ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
           email: '${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com'
 
 
   update-documentation:
     name: Update documentation
     needs: [do-releases]
+    # Documentation should only be updated for public releases, not for pro releases.
+    # As ACR does not have a Web UI.
+    if: ${{ needs.do-releases.outputs.is-public-release == 'true' }}
     uses: ./.github/workflows/Documentation.yaml
     with:
       oci-image-name: "${{ inputs.oci-image-name }}"

oci/mock-rock/image.yaml

@@ -55,6 +55,24 @@ upload:
     ignored-vulnerabilities:
       - "CVE-2023-1234"
       - "CVE-2023-5678"
+  - source: "canonical/rocks-toolbox"
+    commit: eee5f5ebeff62848903156fb3fe93c5d37174085
+    directory: mock_rock/1.2
+    pro:
+      services:
+        - esm-infra
+        - esm-apps
+      config:
+        token: secrets.ROCKS_PRO_TOKEN
+        artifact-passphrase: secrets.ROCKS_PRO_ARTIFACT_PASSPHRASE
+    release:
+      1.2-22.04:
+        end-of-life: "2030-05-01T00:00:00Z"
+        risks:
+          - beta
+    ignored-vulnerabilities:
+      - "CVE-2023-1234"
+      - "CVE-2023-5678"
   # TODO: Restore the devel release once the https://github.com/canonical/rockcraft/issues/1262 is resolved.
   # - source: "canonical/rocks-toolbox"
   #   commit: bb9138fbe81f893b4303a0e29df7cf9581069de0