Skip to content
.github/workflows/build.yml

seperate tests #41

Sign in to view logs

seperate tests

seperate tests #41

Workflow file for this run

.github/workflows/build.yml at 72dc280
name: Build and Deploy Garnet
on:
workflow_dispatch:
push:
tags:
- v*
branches:
- deploy/staging
- deploy/prod
- garnet-privacy-proxy
paths:
- 'backend/privacy_proxy/**'
- 'src/**'
- 'backend/open_webui/**'
- 'Dockerfile'
- 'docker-compose.yml'
- 'version/VERSION'
- '.github/workflows/**'
pull_request:
branches:
- garnet-privacy-proxy
jobs:
# ── GET VERSION + TAG ─────────────────────────────────
get-meta:
runs-on: ubuntu-latest
outputs:
version: ${{ steps.get_version.outputs.version }}
tag: ${{ steps.get_tag.outputs.name }}
revision: ${{ steps.get_revision.outputs.revision }}
proxy_changed: ${{ steps.changes.outputs.proxy }}
webui_changed: ${{ steps.changes.outputs.webui }}
steps:
- name: Checkout
run: |
git clone --branch ${{ github.ref_name }} \
https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/enclaive/garnet.git .
- name: Get version
id: get_version
run: |
if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
echo "version=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
else
echo "version=$(cat version/VERSION).nightly" >> $GITHUB_OUTPUT
fi
- name: Get revision
id: get_revision
run: echo "revision=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
- name: Get tag
id: get_tag
run: |
case "${GITHUB_REF}" in
refs/heads/deploy/staging) NAME=staging ;;
refs/heads/deploy/prod) NAME=prod ;;
refs/tags/v*) NAME=latest ;;
*) NAME="${FALLBACK}" ;;
esac
echo "name=${NAME}" >> $GITHUB_OUTPUT
env:
FALLBACK: ${{ steps.get_revision.outputs.revision }}
- name: Check changed files
id: changes
run: |
git diff --name-only HEAD~1 HEAD | grep '^backend/privacy_proxy/' \
&& echo "proxy=true" >> $GITHUB_OUTPUT \
|| echo "proxy=false" >> $GITHUB_OUTPUT
git diff --name-only HEAD~1 HEAD | grep -E '^src/|^backend/open_webui/' \
&& echo "webui=true" >> $GITHUB_OUTPUT \
|| echo "webui=false" >> $GITHUB_OUTPUT
# ── SECRET SCAN (PR) ──────────────────────────────────
secret-scan-pr:
needs: get-meta
if: github.event_name == 'pull_request'
uses: enclaive/security-workflows/.github/workflows/trufflehog-pr.yml@v1
# ── SECRET SCAN (FULL) ────────────────────────────────
secret-scan-full:
needs: get-meta
if: github.event_name == 'push'
uses: enclaive/security-workflows/.github/workflows/trufflehog-full.yml@v1

Check failure on line 87 in .github/workflows/build.yml

View workflow run for this annotation

GitHub Actions / .github/workflows/build.yml

Invalid workflow file 

error parsing called workflow
".github/workflows/build.yml"
-> "enclaive/security-workflows/.github/workflows/trufflehog-full.yml@v1"
: workflow was not found. See https://docs.github.com/actions/learn-github-actions/reusing-workflows#access-to-reusable-workflows for more information.
# ── PROXY ─────────────────────────────────────────────
build-proxy:
needs: get-meta
if: needs.get-meta.outputs.proxy_changed == 'true'
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Checkout
run: |
git clone --branch ${{ github.ref_name }} \
https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/enclaive/garnet.git .
- name: Free disk space
run: |
sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache
df -h
- name: Set up Docker Buildx
run: |
docker buildx create --use --name garnet-builder
docker buildx inspect --bootstrap
- name: Login to Harbor
run: |
echo "${{ secrets.HARBOR_PASSWORD }}" | docker login harbor.enclaive.cloud \
-u "${{ secrets.HARBOR_USERNAME }}" --password-stdin
- name: Build and push proxy image
id: build-proxy
run: |
DIGEST=$(docker buildx build \
-f backend/privacy_proxy/Dockerfile \
--build-arg PRODUCT_VERSION=${{ needs.get-meta.outputs.version }} \
--build-arg PRODUCT_REVISION=${{ needs.get-meta.outputs.revision }} \
--cache-from type=registry,ref=harbor.enclaive.cloud/garnetdemo/privacy-proxy:cache \
--cache-to type=registry,ref=harbor.enclaive.cloud/garnetdemo/privacy-proxy:cache,mode=max \
--tag harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.tag }} \
--tag harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.version }} \
--tag harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.revision }} \
--tag harbor.enclaive.cloud/garnetdemo/privacy-proxy:gh-run-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.run_number }} \
--push \
--metadata-file /tmp/proxy-meta.json \
backend/privacy_proxy/ && \
cat /tmp/proxy-meta.json | python3 -c "import sys,json; print(json.load(sys.stdin)['containerimage.digest'])")
echo "digest=harbor.enclaive.cloud/garnetdemo/privacy-proxy@${DIGEST}" >> $GITHUB_OUTPUT
- name: Install cosign
run: |
curl -sfL https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 \
-o /usr/local/bin/cosign && chmod +x /usr/local/bin/cosign
- name: Sign proxy image
run: |
echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > /tmp/cosign.key
chmod 600 /tmp/cosign.key
COSIGN_PASSWORD="" cosign sign --yes --key /tmp/cosign.key \
${{ steps.build-proxy.outputs.digest }}
rm /tmp/cosign.key
# ── PYTHON CHECKS (pip-audit, ruff, mypy, trivy, bandit) ──
python-checks:
needs: [get-meta, build-proxy]
if: needs.get-meta.outputs.proxy_changed == 'true'
uses: ./.github/workflows/pythoncheck.yml
with:
image_tag: ${{ needs.get-meta.outputs.revision }}
secrets:
HARBOR_USERNAME: ${{ secrets.HARBOR_USERNAME }}
HARBOR_PASSWORD: ${{ secrets.HARBOR_PASSWORD }}
# ── DEPLOY PROXY ──────────────────────────────────────
deploy-proxy:
needs: [get-meta, build-proxy, python-checks]
if: needs.get-meta.outputs.proxy_changed == 'true'
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Deploy proxy to cVM
run: |
mkdir -p ~/.ssh
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_rsa
ssh-keyscan ${{ secrets.CVM_HOST }} >> ~/.ssh/known_hosts
ssh root@${{ secrets.CVM_HOST }} "cd /opt/garnet && \
echo '${{ secrets.HARBOR_PASSWORD }}' | docker login harbor.enclaive.cloud \
-u '${{ secrets.HARBOR_USERNAME }}' --password-stdin && \
docker compose pull privacy-proxy && \
docker compose up -d --force-recreate privacy-proxy"
- name: Health check proxy
run: |
sleep 10
ssh root@${{ secrets.CVM_HOST }} "\
docker exec garnet-privacy-proxy-1 python3 -c \
'import urllib.request; print(urllib.request.urlopen(\"http://localhost:8080/health\").read())'"
# ── RUN TESTS ─────────────────────────────────────────
run-tests:
needs: deploy-proxy
if: needs.get-meta.outputs.proxy_changed == 'true'
uses: ./.github/workflows/proxy-tests.yml
secrets:
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}
CVM_HOST: ${{ secrets.CVM_HOST }}
# ── WEBUI ─────────────────────────────────────────────
build-webui:
needs: get-meta
if: needs.get-meta.outputs.webui_changed == 'true'
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Checkout
run: |
git clone --branch ${{ github.ref_name }} \
https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/enclaive/garnet.git .
- name: Free disk space
run: |
sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache
df -h
- name: Set up Docker Buildx
run: |
docker buildx create --use --name garnet-builder
docker buildx inspect --bootstrap
- name: Login to Harbor
run: |
echo "${{ secrets.HARBOR_PASSWORD }}" | docker login harbor.enclaive.cloud \
-u "${{ secrets.HARBOR_USERNAME }}" --password-stdin
- name: Build and push webui image
id: build-webui
run: |
DIGEST=$(docker buildx build \
--build-arg PRODUCT_VERSION=${{ needs.get-meta.outputs.version }} \
--build-arg PRODUCT_REVISION=${{ needs.get-meta.outputs.revision }} \
--cache-from type=registry,ref=harbor.enclaive.cloud/garnetdemo/garnet-webui:cache \
--cache-to type=registry,ref=harbor.enclaive.cloud/garnetdemo/garnet-webui:cache,mode=max \
--tag harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.tag }} \
--tag harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.version }} \
--tag harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.revision }} \
--tag harbor.enclaive.cloud/garnetdemo/garnet-webui:gh-run-${{ github.run_id }}-${{ github.run_attempt }}-${{ github.run_number }} \
--push \
--metadata-file /tmp/webui-meta.json \
. && \
cat /tmp/webui-meta.json | python3 -c "import sys,json; print(json.load(sys.stdin)['containerimage.digest'])")
echo "digest=harbor.enclaive.cloud/garnetdemo/garnet-webui@${DIGEST}" >> $GITHUB_OUTPUT
- name: Install cosign
run: |
curl -sfL https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 \
-o /usr/local/bin/cosign && chmod +x /usr/local/bin/cosign
- name: Sign webui image
run: |
sleep 10
echo "${{ secrets.COSIGN_PRIVATE_KEY }}" > /tmp/cosign.key
chmod 600 /tmp/cosign.key
COSIGN_PASSWORD="" cosign sign --yes --key /tmp/cosign.key \
${{ steps.build-webui.outputs.digest }}
rm /tmp/cosign.key
# ── DEPLOY WEBUI ──────────────────────────────────────
deploy-webui:
needs: [get-meta, build-webui]
if: needs.get-meta.outputs.webui_changed == 'true'
runs-on: ubuntu-latest
permissions:
contents: read
steps:
- name: Deploy webui to cVM
run: |
mkdir -p ~/.ssh
echo "${{ secrets.SSH_PRIVATE_KEY }}" > ~/.ssh/id_rsa
chmod 600 ~/.ssh/id_rsa
ssh-keyscan ${{ secrets.CVM_HOST }} >> ~/.ssh/known_hosts
ssh root@${{ secrets.CVM_HOST }} "cd /opt/garnet && \
echo '${{ secrets.HARBOR_PASSWORD }}' | docker login harbor.enclaive.cloud \
-u '${{ secrets.HARBOR_USERNAME }}' --password-stdin && \
docker compose pull open-webui && \
docker compose up -d --force-recreate open-webui"
- name: Health check webui
run: |
sleep 15
ssh root@${{ secrets.CVM_HOST }} "\
docker exec garnet-open-webui-1 python3 -c \
'import urllib.request; print(urllib.request.urlopen(\"http://localhost:8080/\").read()[:50])'"