From cd54919ca65685195c440b83d353f6bbd2c5ca9c Mon Sep 17 00:00:00 2001 From: Pepe Fagoaga Date: Tue, 2 Apr 2024 11:38:35 +0200 Subject: [PATCH] chore(action): Prepare containers release for v4 (#3597) --- .../workflows/build-lint-push-containers.yml | 89 +++++++++++++++---- .github/workflows/pypi-release.yml | 37 +------- 2 files changed, 74 insertions(+), 52 deletions(-) diff --git a/.github/workflows/build-lint-push-containers.yml b/.github/workflows/build-lint-push-containers.yml index 43fd281c13..f8fb79064d 100644 --- a/.github/workflows/build-lint-push-containers.yml +++ b/.github/workflows/build-lint-push-containers.yml @@ -3,6 +3,8 @@ name: build-lint-push-containers on: push: branches: + # TODO: update it for v3 and v4 + # - "v3" - "master" paths-ignore: - ".github/**" @@ -13,15 +15,27 @@ on: types: [published] env: + # AWS Configuration AWS_REGION_STG: eu-west-1 AWS_REGION_PLATFORM: eu-west-1 AWS_REGION: us-east-1 + + # Container's configuration IMAGE_NAME: prowler + DOCKERFILE_PATH: ./Dockerfile + + # Tags LATEST_TAG: latest STABLE_TAG: stable - TEMPORARY_TAG: temporary - DOCKERFILE_PATH: ./Dockerfile - PYTHON_VERSION: 3.9 + # The RELEASE_TAG is set during runtime in releases + RELEASE_TAG: "" + # The PROWLER_VERSION and PROWLER_VERSION_MAJOR are set during runtime in releases + PROWLER_VERSION: "" + PROWLER_VERSION_MAJOR: "" + # TEMPORARY_TAG: temporary + + # Python configuration + PYTHON_VERSION: 3.11 jobs: # Build Prowler OSS container @@ -30,26 +44,57 @@ jobs: runs-on: ubuntu-latest env: POETRY_VIRTUALENVS_CREATE: "false" + steps: - name: Checkout uses: actions/checkout@v4 - - name: Setup python (release) - if: github.event_name == 'release' + - name: Setup Python uses: actions/setup-python@v5 with: python-version: ${{ env.PYTHON_VERSION }} - - name: Install dependencies (release) - if: github.event_name == 'release' + - name: Install Poetry run: | pipx install poetry pipx inject poetry poetry-bumpversion + - name: Get Prowler version + run: | + PROWLER_VERSION="$(poetry version -s 2>/dev/null)" + + # Store prowler version major just for the release + PROWLER_VERSION_MAJOR="${PROWLER_VERSION%%.*}" + echo "PROWLER_VERSION_MAJOR=${PROWLER_VERSION_MAJOR}" >> "${GITHUB_ENV}" + + case ${PROWLER_VERSION_MAJOR} in + 3) + # TODO: update it for v3 and v4 + # echo "LATEST=v3-latest" >> "${GITHUB_ENV}" + # echo "STABLE_TAG=v3-stable" >> "${GITHUB_ENV}" + echo "LATEST=latest" >> "${GITHUB_ENV}" + echo "STABLE_TAG=stable" >> "${GITHUB_ENV}" + ;; + + # TODO: uncomment for v3 and v4 + # 4) + # echo "LATEST=latest" >> "${GITHUB_ENV}" + # echo "STABLE_TAG=stable" >> "${GITHUB_ENV}" + # ;; + + *) + # Fallback if any other version is present + echo "Releasing another Prowler major version, aborting..." + exit 1 + ;; + esac + - name: Update Prowler version (release) if: github.event_name == 'release' run: | - poetry version ${{ github.event.release.tag_name }} + PROWLER_VERSION="${{ github.event.release.tag_name }}" + poetry version "${PROWLER_VERSION}" + echo "PROWLER_VERSION="${PROWLER_VERSION}" >> "${GITHUB_ENV}" - name: Login to DockerHub uses: docker/login-action@v3 @@ -90,9 +135,9 @@ jobs: context: . push: true tags: | - ${{ secrets.DOCKER_HUB_REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }} + ${{ secrets.DOCKER_HUB_REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ env.PROWLER_VERSION }} ${{ secrets.DOCKER_HUB_REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ env.STABLE_TAG }} - ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }} + ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ env.PROWLER_VERSION }} ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ env.STABLE_TAG }} file: ${{ env.DOCKERFILE_PATH }} cache-from: type=gha @@ -102,16 +147,26 @@ jobs: needs: container-build-push runs-on: ubuntu-latest steps: - - name: Get latest commit info + - name: Get latest commit info (latest) if: github.event_name == 'push' run: | LATEST_COMMIT_HASH=$(echo ${{ github.event.after }} | cut -b -7) echo "LATEST_COMMIT_HASH=${LATEST_COMMIT_HASH}" >> $GITHUB_ENV - - name: Dispatch event for latest - if: github.event_name == 'push' + + - name: Dispatch event (latest) + if: github.event_name == 'push' && ${{ env. PROWLER_VERSION_MAJOR }} == '3' run: | - curl https://api.github.com/repos/${{ secrets.DISPATCH_OWNER }}/${{ secrets.DISPATCH_REPO }}/dispatches -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.ACCESS_TOKEN }}" -H "X-GitHub-Api-Version: 2022-11-28" --data '{"event_type":"dispatch","client_payload":{"version":"latest", "tag": "${{ env.LATEST_COMMIT_HASH }}"}}' - - name: Dispatch event for release - if: github.event_name == 'release' + curl https://api.github.com/repos/${{ secrets.DISPATCH_OWNER }}/${{ secrets.DISPATCH_REPO }}/dispatches \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${{ secrets.ACCESS_TOKEN }}" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + --data '{"event_type":"dispatch","client_payload":{"version":"latest", "tag": "${{ env.LATEST_COMMIT_HASH }}"}}' + + - name: Dispatch event (release) + if: github.event_name == 'release' && ${{ env. PROWLER_VERSION_MAJOR }} == '3' run: | - curl https://api.github.com/repos/${{ secrets.DISPATCH_OWNER }}/${{ secrets.DISPATCH_REPO }}/dispatches -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.ACCESS_TOKEN }}" -H "X-GitHub-Api-Version: 2022-11-28" --data '{"event_type":"dispatch","client_payload":{"version":"release", "tag":"${{ github.event.release.tag_name }}"}}' + curl https://api.github.com/repos/${{ secrets.DISPATCH_OWNER }}/${{ secrets.DISPATCH_REPO }}/dispatches \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${{ secrets.ACCESS_TOKEN }}" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + --data '{"event_type":"dispatch","client_payload":{"version":"release", "tag":"${{ env.PROWLER_VERSION }}"}}' diff --git a/.github/workflows/pypi-release.yml b/.github/workflows/pypi-release.yml index 94fa808034..ba7994903c 100644 --- a/.github/workflows/pypi-release.yml +++ b/.github/workflows/pypi-release.yml @@ -8,10 +8,7 @@ env: RELEASE_TAG: ${{ github.event.release.tag_name }} PYTHON_VERSION: 3.11 CACHE: "poetry" - # This base branch is used to create a PR with the updated version - # We'd need to handle the base branch for v4 and v3, since they will be - # `master` and `3.0-dev`, respectively - GITHUB_BASE_BRANCH: "master" + # TODO: create a bot user for this kind of tasks, like prowler-bot GIT_COMMITTER_EMAIL: "sergio@prowler.com" jobs: @@ -21,24 +18,16 @@ jobs: POETRY_VIRTUALENVS_CREATE: "false" name: Release Prowler to PyPI steps: - - name: Get base branch regarding Prowler version + - name: Get Prowler version run: | PROWLER_VERSION="${{ env.RELEASE_TAG }}" - BASE_BRANCH="" case ${PROWLER_VERSION%%.*} in 3) echo "Releasing Prowler v3 with tag ${PROWLER_VERSION}" - # TODO: modify it once v4 is ready - # echo "BASE_BRANCH=3.0-dev" >> "${GITHUB_ENV}" - echo "BASE_BRANCH=master" >> "${GITHUB_ENV}" ;; 4) echo "Releasing Prowler v4 with tag ${PROWLER_VERSION}" - # TODO: modify it once v4 is ready - # echo "BASE_BRANCH=master" >> "${GITHUB_ENV}" - echo "Not available, aborting..." - exit 1 ;; *) echo "Releasing another Prowler major version, aborting..." @@ -87,11 +76,6 @@ jobs: # Push the tag git push -f origin ${{ env.RELEASE_TAG }} - - name: Create new branch for the version update - run: | - git switch -c release-${{ env.RELEASE_TAG }} - git push --set-upstream origin release-${{ env.RELEASE_TAG }} - - name: Build Prowler package run: | poetry build @@ -101,23 +85,6 @@ jobs: poetry config pypi-token.pypi ${{ secrets.PYPI_API_TOKEN }} poetry publish - - name: Create PR to update version in the branch - run: | - echo "### Description - - This PR updates Prowler Version to ${{ env.RELEASE_TAG }}. - - ### License - - By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license." |\ - gh pr create \ - --base ${{ env.BASE_BRANCH }} \ - --head release-${{ env.RELEASE_TAG }} \ - --title "chore(release): update Prowler Version to ${{ env.RELEASE_TAG }}." \ - --body-file - - env: - GH_TOKEN: ${{ secrets.PROWLER_ACCESS_TOKEN }} - - name: Replicate PyPI package run: | rm -rf ./dist && rm -rf ./build && rm -rf prowler.egg-info