-
Notifications
You must be signed in to change notification settings - Fork 319
130 lines (106 loc) · 4.25 KB
/
container_builds.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
name: Deploy to ECR
on:
push:
branches:
- container_builds-default
- container_builds-dev
- container_builds-prod
jobs:
build:
name: Build Image
runs-on: ubuntu-latest
strategy:
matrix:
include:
- python_version: p39
arch: x86
build_platform: linux/amd64
- python_version: p310
arch: x86
build_platform: linux/amd64
- python_version: p310
arch: arm64
build_platform: linux/arm64
- python_version: p311
arch: x86
build_platform: linux/amd64
- python_version: p311
arch: arm64
build_platform: linux/arm64
- python_version: p312
arch: x86
build_platform: linux/amd64
- python_version: p312
arch: arm64
build_platform: linux/arm64
permissions:
id-token: write
contents: read
steps:
- name: echo Build
run: |
echo python_version: ${{ matrix.python_version }}
echo arch: ${{ matrix.arch }}
echo build_platform: ${{ matrix.build_platform }}
- name: Check out code
uses: actions/checkout@v2
- name: Set AWS Environment variable based on branch
run: |
if [ ${{ github.ref }} == refs/heads/container_builds-default ]
then
echo AWS_ENV=Klayers-defaultp38 >> $GITHUB_ENV
elif [ ${{ github.ref }} == refs/heads/container_builds-dev ]
then
echo AWS_ENV=Klayers-devp38 >> $GITHUB_ENV
elif [ ${{ github.ref }} == refs/heads/container_builds-prod ]
then
echo AWS_ENV=Klayers-prodp38 >> $GITHUB_ENV
else
exit 1
fi
APP_NAME=$(cat ./pipeline/Terraform/terraform.tfvars.json | jq -r '.app_name')
echo APP_NAME=$APP_NAME >> $GITHUB_ENV
shell: bash
- name: Get AWS configuration
run: |
GITHUB_ROLE_ARN=$(cat ./.github/workflows/role_arns.json | jq -r --arg arg $AWS_ENV '.github_role_arn | .[$arg]')
AWS_REGION=$(cat ./pipeline/Terraform/terraform.tfvars.json | jq -r --arg arg $AWS_ENV '.aws_region | .[$arg]')
echo AWS_ROLE_ARN=$GITHUB_ROLE_ARN >> $GITHUB_ENV
echo AWS_DEFAULT_REGION=$AWS_REGION >> $GITHUB_ENV
shell: bash
- name: Configure AWS Credentials
uses: aws-actions/configure-aws-credentials@v2
with:
aws-region: ${{ env.AWS_DEFAULT_REGION }}
role-to-assume: ${{ env.AWS_ROLE_ARN }}
role-duration-seconds: 900 # minimum of 900
role-session-name: container-build-${{ env.AWS_ENV }}
- name: Login to Amazon ECR
id: login-ecr
uses: aws-actions/amazon-ecr-login@v1
- name: Set up repository variables
run: |
PARAM_PREFIX=build/${{ matrix.python_version }}/${{ matrix.arch }}
REPO_PARAM=/kl/$AWS_ENV/$PARAM_PREFIX/repo
REPO_URL=$(aws ssm get-parameter --name $REPO_PARAM | jq -r '.Parameter.Value')
REPO_NAME=$(echo $REPO_URL | cut -d'/' -f2)
BUILD_DIR=pipeline/container_images/build_images/${{ matrix.python_version }}_${{ matrix.arch }}
echo REPO_NAME=$REPO_NAME >> $GITHUB_ENV
echo REPO_URL=$REPO_URL >> $GITHUB_ENV
echo PARAM_PREFIX=$PARAM_PREFIX >> $GITHUB_ENV
echo BUILD_DIR=$BUILD_DIR >> $GITHUB_ENV
cp ./pipeline/container_images/build_images/common/build.py ./$BUILD_DIR
- name: Set up QEMU
uses: docker/setup-qemu-action@v2
if: ${{ matrix.build_platform == 'linux/arm64' }} # only need this for ARM64 builds
- name: Build and push
uses: docker/build-push-action@v4
with:
context: ${{ env.BUILD_DIR }}
push: true
tags: ${{ env.REPO_URL }}:latest
platforms: ${{ matrix.build_platform }}
- name: update SSM
run: |
DIGEST=$(aws ecr describe-images --repository-name $REPO_NAME --image-ids imageTag=latest | jq -r '.imageDetails[0].imageDigest')
aws ssm put-parameter --name /kl/$AWS_ENV/$PARAM_PREFIX/digest --value $DIGEST --overwrite --type String | jq '.'