Skip to content

Commit bdaa44a

Browse files
ahmedmarzougui-enclaiveahmedmarzougui-enclaive
committed
feat: combined pipeline + version detection
1 parent adf5044 commit bdaa44a

2 files changed

Lines changed: 96 additions & 55 deletions

File tree

‎.github/workflows/build.yml‎

Lines changed: 95 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,76 +1,121 @@
11
name: Build and Deploy Garnet
22

33
on:
4+
workflow_dispatch:
45
push:
6+
tags:
7+
- v*
58
branches:
9+
- deploy/staging
10+
- deploy/prod
611
- garnet-privacy-proxy
712
paths:
813
- 'backend/privacy_proxy/**'
914
- 'src/**'
1015
- 'backend/open_webui/**'
1116
- 'Dockerfile'
1217
- 'docker-compose.yml'
18+
- 'version/VERSION'
1319
- '.github/workflows/**'
1420

1521
jobs:
16-
build-proxy:
22+
23+
get-meta:
1724
runs-on: ubuntu-latest
18-
permissions:
19-
contents: read
2025
outputs:
21-
changed: ${{ steps.changes.outputs.proxy }}
26+
version: ${{ steps.get_version.outputs.version }}
27+
tag: ${{ steps.get_tag.outputs.name }}
28+
proxy_changed: ${{ steps.changes.outputs.proxy }}
29+
webui_changed: ${{ steps.changes.outputs.webui }}
2230
steps:
23-
- name: Checkout code
24-
uses: actions/checkout@v4
31+
- name: Checkout
32+
run: |
33+
git clone --branch ${{ github.ref_name }} \
34+
https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/enclaive/garnet.git .
2535
26-
- name: Check proxy files changed
36+
- name: Get version
37+
id: get_version
38+
run: |
39+
if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
40+
echo "version=${GITHUB_REF_NAME}" >> $GITHUB_OUTPUT
41+
else
42+
echo "version=$(cat version/VERSION).nightly" >> $GITHUB_OUTPUT
43+
fi
44+
45+
- name: Get tag
46+
id: get_tag
47+
run: |
48+
case "${GITHUB_REF}" in
49+
refs/heads/deploy/staging) NAME=staging ;;
50+
refs/heads/deploy/prod) NAME=prod ;;
51+
refs/tags/v*) NAME=latest ;;
52+
*) NAME=dev ;;
53+
esac
54+
echo "name=${NAME}" >> $GITHUB_OUTPUT
55+
56+
- name: Check changed files
2757
id: changes
2858
run: |
29-
git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep '^backend/privacy_proxy/' \
59+
git diff --name-only HEAD~1 HEAD | grep '^backend/privacy_proxy/' \
3060
&& echo "proxy=true" >> $GITHUB_OUTPUT \
3161
|| echo "proxy=false" >> $GITHUB_OUTPUT
62+
git diff --name-only HEAD~1 HEAD | grep -E '^src/|^backend/open_webui/' \
63+
&& echo "webui=true" >> $GITHUB_OUTPUT \
64+
|| echo "webui=false" >> $GITHUB_OUTPUT
65+
66+
# ── PROXY ─────────────────────────────────────────────
67+
build-proxy:
68+
needs: get-meta
69+
if: needs.get-meta.outputs.proxy_changed == 'true'
70+
runs-on: ubuntu-latest
71+
permissions:
72+
contents: read
73+
steps:
74+
- name: Checkout
75+
run: |
76+
git clone --branch ${{ github.ref_name }} \
77+
https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/enclaive/garnet.git .
3278
3379
- name: Free disk space
34-
if: steps.changes.outputs.proxy == 'true'
3580
run: |
3681
sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache
3782
df -h
3883
3984
- name: Login to Harbor
40-
if: steps.changes.outputs.proxy == 'true'
4185
run: |
4286
echo "${{ secrets.HARBOR_PASSWORD }}" | docker login harbor.enclaive.cloud \
4387
-u "${{ secrets.HARBOR_USERNAME }}" --password-stdin
4488
4589
- name: Build proxy image
46-
if: steps.changes.outputs.proxy == 'true'
4790
run: |
4891
docker build --no-cache \
4992
-f backend/privacy_proxy/Dockerfile \
93+
--build-arg PRODUCT_VERSION=${{ needs.get-meta.outputs.version }} \
94+
-t harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.tag }} \
95+
-t harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.version }} \
5096
-t harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ github.sha }} \
51-
-t harbor.enclaive.cloud/garnetdemo/privacy-proxy:latest \
5297
backend/privacy_proxy/
5398
54-
- name: Scan proxy image for vulnerabilities
55-
if: steps.changes.outputs.proxy == 'true'
56-
uses: aquasecurity/trivy-action@master
57-
with:
58-
image-ref: harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ github.sha }}
59-
exit-code: '1'
60-
severity: 'CRITICAL,HIGH'
61-
ignore-unfixed: true
62-
env:
63-
TRIVY_SCANNERS: vuln
99+
- name: Scan proxy image
100+
run: |
101+
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
102+
| sh -s -- -b /usr/local/bin
103+
trivy image \
104+
--exit-code 1 \
105+
--severity CRITICAL,HIGH \
106+
--ignore-unfixed \
107+
--scanners vuln \
108+
harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ github.sha }}
64109
65110
- name: Push proxy image
66-
if: steps.changes.outputs.proxy == 'true'
67111
run: |
112+
docker push harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.tag }}
113+
docker push harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ needs.get-meta.outputs.version }}
68114
docker push harbor.enclaive.cloud/garnetdemo/privacy-proxy:${{ github.sha }}
69-
docker push harbor.enclaive.cloud/garnetdemo/privacy-proxy:latest
70115
71116
deploy-proxy:
72-
needs: build-proxy
73-
if: needs.build-proxy.outputs.changed == 'true'
117+
needs: [get-meta, build-proxy]
118+
if: needs.get-meta.outputs.proxy_changed == 'true'
74119
runs-on: ubuntu-latest
75120
permissions:
76121
contents: read
@@ -99,63 +144,58 @@ jobs:
99144
ssh root@${{ secrets.CVM_HOST }} "\
100145
docker exec -w /service garnet-privacy-proxy-1 python3 app/test_proxy.py"
101146
147+
# ── WEBUI ─────────────────────────────────────────────
102148
build-webui:
149+
needs: get-meta
150+
if: needs.get-meta.outputs.webui_changed == 'true'
103151
runs-on: ubuntu-latest
104152
permissions:
105153
contents: read
106-
outputs:
107-
changed: ${{ steps.changes.outputs.webui }}
108154
steps:
109-
- name: Checkout code
110-
uses: actions/checkout@v4
111-
112-
- name: Check webui files changed
113-
id: changes
155+
- name: Checkout
114156
run: |
115-
git diff --name-only ${{ github.event.before }} ${{ github.sha }} | grep -E '^src/|^backend/open_webui/' \
116-
&& echo "webui=true" >> $GITHUB_OUTPUT \
117-
|| echo "webui=false" >> $GITHUB_OUTPUT
157+
git clone --branch ${{ github.ref_name }} \
158+
https://x-access-token:${{ secrets.GH_TOKEN }}@github.com/enclaive/garnet.git .
118159
119160
- name: Free disk space
120-
if: steps.changes.outputs.webui == 'true'
121161
run: |
122162
sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /opt/hostedtoolcache
123163
df -h
124164
125165
- name: Login to Harbor
126-
if: steps.changes.outputs.webui == 'true'
127166
run: |
128167
echo "${{ secrets.HARBOR_PASSWORD }}" | docker login harbor.enclaive.cloud \
129168
-u "${{ secrets.HARBOR_USERNAME }}" --password-stdin
130169
131170
- name: Build webui image
132-
if: steps.changes.outputs.webui == 'true'
133171
run: |
134172
docker build --no-cache \
173+
--build-arg PRODUCT_VERSION=${{ needs.get-meta.outputs.version }} \
174+
-t harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.tag }} \
175+
-t harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.version }} \
135176
-t harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ github.sha }} \
136-
-t harbor.enclaive.cloud/garnetdemo/garnet-webui:latest \
137177
.
138178
139-
- name: Scan webui image for vulnerabilities
140-
if: steps.changes.outputs.webui == 'true'
141-
uses: aquasecurity/trivy-action@master
142-
with:
143-
image-ref: harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ github.sha }}
144-
exit-code: '1'
145-
severity: 'CRITICAL,HIGH'
146-
ignore-unfixed: true
147-
env:
148-
TRIVY_SCANNERS: vuln
179+
- name: Scan webui image
180+
run: |
181+
curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh \
182+
| sh -s -- -b /usr/local/bin
183+
trivy image \
184+
--exit-code 1 \
185+
--severity CRITICAL,HIGH \
186+
--ignore-unfixed \
187+
--scanners vuln \
188+
harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ github.sha }}
149189
150190
- name: Push webui image
151-
if: steps.changes.outputs.webui == 'true'
152191
run: |
192+
docker push harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.tag }}
193+
docker push harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ needs.get-meta.outputs.version }}
153194
docker push harbor.enclaive.cloud/garnetdemo/garnet-webui:${{ github.sha }}
154-
docker push harbor.enclaive.cloud/garnetdemo/garnet-webui:latest
155195
156196
deploy-webui:
157-
needs: build-webui
158-
if: needs.build-webui.outputs.changed == 'true'
197+
needs: [get-meta, build-webui]
198+
if: needs.get-meta.outputs.webui_changed == 'true'
159199
runs-on: ubuntu-latest
160200
permissions:
161201
contents: read
@@ -177,4 +217,4 @@ jobs:
177217
sleep 15
178218
ssh root@${{ secrets.CVM_HOST }} "\
179219
docker exec garnet-open-webui-1 python3 -c \
180-
'import urllib.request; print(urllib.request.urlopen(\"http://localhost:8080/\").read()[:50])'"
220+
'import urllib.request; print(urllib.request.urlopen(\"http://localhost:8080/\").read()[:50])'"

‎version/VERSION‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
1.0.0

0 commit comments

Comments
 (0)