Push charts to artifact registry (#2595)

* Push charts to artifact registry * Add missing env * Fix error on matrix component
nuclia · Nov 4, 2024 · 3dc0f5d · 3dc0f5d
1 parent f2f4b7e
commit 3dc0f5d
Show file tree

Hide file tree

Showing 2 changed files with 97 additions and 2 deletions.
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -16,6 +16,12 @@ permissions:
   id-token: write   # This is required for requesting the JWT
   contents: read    # This is required for actions/checkout
 
+env:
+  GCP_WORKLOAD_IDENTITY_PROVIDER: "projects/224545243904/locations/global/workloadIdentityPools/gh-nuclia/providers/gh-nuclia-provider"
+  GCP_SERVICE_ACCOUNT: "[email protected]"
+  ARTIFACT_REGISTRY_URL: oci://europe-west4-docker.pkg.dev/nuclia-internal/charts
+
+
 jobs:
   build-node-image:
     name: Build node image
@@ -36,8 +42,8 @@ jobs:
         id: push-image
         uses: ./.github/actions/push-img-nucliadb
         env:
-          GCP_WORKLOAD_IDENTITY_PROVIDER: "projects/224545243904/locations/global/workloadIdentityPools/gh-nuclia/providers/gh-nuclia-provider"
-          GCP_SERVICE_ACCOUNT: "[email protected]"
+          GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          GCP_SERVICE_ACCOUNT: ${{ env.GCP_SERVICE_ACCOUNT }}
         with:
           imageid: ${{ steps.build-image.outputs.imageid }}
           image-name: node
@@ -83,6 +89,21 @@ jobs:
     - name: Checkout repository
       uses: actions/checkout@v4
 
+    - name: Authenticate to Google Cloud
+      id: gcp-auth
+      uses: google-github-actions/auth@v2
+      with:
+        workload_identity_provider: "${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}"
+        service_account: "${{ env.GCP_SERVICE_ACCOUNT }}"
+        token_format: access_token
+
+    - name: Login to Google Artifact Registry
+      uses: docker/login-action@v3
+      with:
+        registry: europe-west4-docker.pkg.dev
+        username: oauth2accesstoken
+        password: ${{ steps.gcp-auth.outputs.access_token }}
+
     - name: Calculate short sha
       id: env-vars
       run: |-
@@ -112,6 +133,7 @@ jobs:
         helm lint charts/nucliadb_shared
         helm package charts/nucliadb_shared
         curl --data-binary "@nucliadb_shared-${{ steps.version_step.outputs.version_number }}.tgz" ${{ secrets.HELM_CHART_URL }}/api/charts
+        helm push nucliadb_shared-${{ steps.version_step.outputs.version_number }}.tgz ${{ env.ARTIFACT_REGISTRY_URL }}
 
   upload-chart-nucliadb-node:
     name: Upload Node chart
@@ -131,6 +153,21 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Authenticate to Google Cloud
+        id: gcp-auth
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: "${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}"
+          service_account: "${{ env.GCP_SERVICE_ACCOUNT }}"
+          token_format: access_token
+
+      - name: Login to Google Artifact Registry
+        uses: docker/login-action@v3
+        with:
+          registry: europe-west4-docker.pkg.dev
+          username: oauth2accesstoken
+          password: ${{ steps.gcp-auth.outputs.access_token }}
+
       - name: Calculate short sha
         id: env-vars
         run: |-
@@ -165,6 +202,7 @@ jobs:
           helm lint charts/nucliadb_node
           helm package charts/nucliadb_node
           curl --data-binary "@nucliadb_node-${{ steps.version_step.outputs.version_number }}.tgz" ${{ secrets.HELM_CHART_URL }}/api/charts
+          helm push nucliadb_node-${{ steps.version_step.outputs.version_number }}.tgz ${{ env.ARTIFACT_REGISTRY_URL }}
 
   upload-charts-nucliadb-component:
     name: Upload NucliaDB component charts
@@ -193,6 +231,21 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Authenticate to Google Cloud
+        id: gcp-auth
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: "${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}"
+          service_account: "${{ env.GCP_SERVICE_ACCOUNT }}"
+          token_format: access_token
+
+      - name: Login to Google Artifact Registry
+        uses: docker/login-action@v3
+        with:
+          registry: europe-west4-docker.pkg.dev
+          username: oauth2accesstoken
+          password: ${{ steps.gcp-auth.outputs.access_token }}
+
       - name: Calculate short sha
         id: env-vars
         run: |-
@@ -226,6 +279,7 @@ jobs:
           helm lint charts/nucliadb_${{ matrix.component }}
           helm package charts/nucliadb_${{ matrix.component }}
           curl --data-binary "@nucliadb_${{ matrix.component }}-${{ steps.version_step.outputs.version_number }}.tgz" ${{ secrets.HELM_CHART_URL }}/api/charts
+          helm push nucliadb_${{ matrix.component }}-${{ steps.version_step.outputs.version_number }}.tgz ${{ env.ARTIFACT_REGISTRY_URL }}
 
   upload-chart-nidx:
     name: Upload nidx chart
@@ -245,6 +299,21 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Authenticate to Google Cloud
+        id: gcp-auth
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: "${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}"
+          service_account: "${{ env.GCP_SERVICE_ACCOUNT }}"
+          token_format: access_token
+
+      - name: Login to Google Artifact Registry
+        uses: docker/login-action@v3
+        with:
+          registry: europe-west4-docker.pkg.dev
+          username: oauth2accesstoken
+          password: ${{ steps.gcp-auth.outputs.access_token }}
+
       - name: Calculate short sha
         id: env-vars
         run: |-
@@ -278,6 +347,7 @@ jobs:
           helm lint charts/nidx
           helm package charts/nidx
           curl --data-binary "@nidx-${{ steps.version_step.outputs.version_number }}.tgz" ${{ secrets.HELM_CHART_URL }}/api/charts
+          helm push nidx-${{ steps.version_step.outputs.version_number }}.tgz ${{ env.ARTIFACT_REGISTRY_URL }}
 
   deploy-nucliadb-components:
     name: Deploy NucliaDB components

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -3,6 +3,15 @@ name: PyPI and Helm Releases
 on:
   workflow_call:
 
+env:
+  GCP_WORKLOAD_IDENTITY_PROVIDER: "projects/224545243904/locations/global/workloadIdentityPools/gh-nuclia/providers/gh-nuclia-provider"
+  GCP_SERVICE_ACCOUNT: "[email protected]"
+  ARTIFACT_REGISTRY_URL: oci://europe-west4-docker.pkg.dev/nuclia-internal/charts
+
+permissions:
+  id-token: write   # This is required for requesting the JWT
+  contents: read    # This is required for actions/checkout
+
 jobs:
   build_wheels:
     name: Build wheels
@@ -129,6 +138,21 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Authenticate to Google Cloud
+        id: gcp-auth
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: "${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}"
+          service_account: "${{ env.GCP_SERVICE_ACCOUNT }}"
+          token_format: access_token
+
+      - name: Login to Google Artifact Registry
+        uses: docker/login-action@v3
+        with:
+          registry: europe-west4-docker.pkg.dev
+          username: oauth2accesstoken
+          password: ${{ steps.gcp-auth.outputs.access_token }}
+
       - name: Calculate short sha
         id: env-vars
         run: |-
@@ -167,6 +191,7 @@ jobs:
           helm lint charts/nucliadb
           helm package charts/nucliadb
           curl --data-binary "@nucliadb-${{ steps.version_step.outputs.helm_version }}.tgz" ${{ secrets.HELM_CHART_URL }}/api/charts
+          helm push nucliadb-${{ steps.version_step.outputs.version_number }}.tgz ${{ env.ARTIFACT_REGISTRY_URL }}
 
       - name: Send to promotion queue
         id: send-to-promo