diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml index 5ce54a2d30..9bc2100efd 100644 --- a/.github/workflows/deploy.yml +++ b/.github/workflows/deploy.yml @@ -16,6 +16,12 @@ permissions: id-token: write # This is required for requesting the JWT contents: read # This is required for actions/checkout +env: + GCP_WORKLOAD_IDENTITY_PROVIDER: "projects/224545243904/locations/global/workloadIdentityPools/gh-nuclia/providers/gh-nuclia-provider" + GCP_SERVICE_ACCOUNT: "github-actions@nuclia-internal.iam.gserviceaccount.com" + ARTIFACT_REGISTRY_URL: oci://europe-west4-docker.pkg.dev/nuclia-internal/charts + + jobs: build-node-image: name: Build node image @@ -36,8 +42,8 @@ jobs: id: push-image uses: ./.github/actions/push-img-nucliadb env: - GCP_WORKLOAD_IDENTITY_PROVIDER: "projects/224545243904/locations/global/workloadIdentityPools/gh-nuclia/providers/gh-nuclia-provider" - GCP_SERVICE_ACCOUNT: "github-actions@nuclia-internal.iam.gserviceaccount.com" + GCP_WORKLOAD_IDENTITY_PROVIDER: ${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }} + GCP_SERVICE_ACCOUNT: ${{ env.GCP_SERVICE_ACCOUNT }} with: imageid: ${{ steps.build-image.outputs.imageid }} image-name: node @@ -83,6 +89,21 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 + - name: Authenticate to Google Cloud + id: gcp-auth + uses: google-github-actions/auth@v2 + with: + workload_identity_provider: "${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}" + service_account: "${{ env.GCP_SERVICE_ACCOUNT }}" + token_format: access_token + + - name: Login to Google Artifact Registry + uses: docker/login-action@v3 + with: + registry: europe-west4-docker.pkg.dev + username: oauth2accesstoken + password: ${{ steps.gcp-auth.outputs.access_token }} + - name: Calculate short sha id: env-vars run: |- @@ -112,6 +133,7 @@ jobs: helm lint charts/nucliadb_shared helm package charts/nucliadb_shared curl --data-binary "@nucliadb_shared-${{ steps.version_step.outputs.version_number }}.tgz" ${{ secrets.HELM_CHART_URL }}/api/charts + helm push nucliadb_shared-${{ steps.version_step.outputs.version_number }}.tgz ${{ env.ARTIFACT_REGISTRY_URL }} upload-chart-nucliadb-node: name: Upload Node chart @@ -131,6 +153,21 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 + - name: Authenticate to Google Cloud + id: gcp-auth + uses: google-github-actions/auth@v2 + with: + workload_identity_provider: "${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}" + service_account: "${{ env.GCP_SERVICE_ACCOUNT }}" + token_format: access_token + + - name: Login to Google Artifact Registry + uses: docker/login-action@v3 + with: + registry: europe-west4-docker.pkg.dev + username: oauth2accesstoken + password: ${{ steps.gcp-auth.outputs.access_token }} + - name: Calculate short sha id: env-vars run: |- @@ -165,6 +202,7 @@ jobs: helm lint charts/nucliadb_node helm package charts/nucliadb_node curl --data-binary "@nucliadb_node-${{ steps.version_step.outputs.version_number }}.tgz" ${{ secrets.HELM_CHART_URL }}/api/charts + helm push nucliadb_node-${{ steps.version_step.outputs.version_number }}.tgz ${{ env.ARTIFACT_REGISTRY_URL }} upload-charts-nucliadb-component: name: Upload NucliaDB component charts @@ -193,6 +231,21 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 + - name: Authenticate to Google Cloud + id: gcp-auth + uses: google-github-actions/auth@v2 + with: + workload_identity_provider: "${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}" + service_account: "${{ env.GCP_SERVICE_ACCOUNT }}" + token_format: access_token + + - name: Login to Google Artifact Registry + uses: docker/login-action@v3 + with: + registry: europe-west4-docker.pkg.dev + username: oauth2accesstoken + password: ${{ steps.gcp-auth.outputs.access_token }} + - name: Calculate short sha id: env-vars run: |- @@ -226,6 +279,7 @@ jobs: helm lint charts/nucliadb_${{ matrix.component }} helm package charts/nucliadb_${{ matrix.component }} curl --data-binary "@nucliadb_${{ matrix.component }}-${{ steps.version_step.outputs.version_number }}.tgz" ${{ secrets.HELM_CHART_URL }}/api/charts + helm push nucliadb_${{ matrix.component }}-${{ steps.version_step.outputs.version_number }}.tgz ${{ env.ARTIFACT_REGISTRY_URL }} upload-chart-nidx: name: Upload nidx chart @@ -245,6 +299,21 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 + - name: Authenticate to Google Cloud + id: gcp-auth + uses: google-github-actions/auth@v2 + with: + workload_identity_provider: "${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}" + service_account: "${{ env.GCP_SERVICE_ACCOUNT }}" + token_format: access_token + + - name: Login to Google Artifact Registry + uses: docker/login-action@v3 + with: + registry: europe-west4-docker.pkg.dev + username: oauth2accesstoken + password: ${{ steps.gcp-auth.outputs.access_token }} + - name: Calculate short sha id: env-vars run: |- @@ -278,6 +347,7 @@ jobs: helm lint charts/nidx helm package charts/nidx curl --data-binary "@nidx-${{ steps.version_step.outputs.version_number }}.tgz" ${{ secrets.HELM_CHART_URL }}/api/charts + helm push nidx-${{ steps.version_step.outputs.version_number }}.tgz ${{ env.ARTIFACT_REGISTRY_URL }} deploy-nucliadb-components: name: Deploy NucliaDB components diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index fef4d2bb49..106a3f10d9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,6 +3,15 @@ name: PyPI and Helm Releases on: workflow_call: +env: + GCP_WORKLOAD_IDENTITY_PROVIDER: "projects/224545243904/locations/global/workloadIdentityPools/gh-nuclia/providers/gh-nuclia-provider" + GCP_SERVICE_ACCOUNT: "github-actions@nuclia-internal.iam.gserviceaccount.com" + ARTIFACT_REGISTRY_URL: oci://europe-west4-docker.pkg.dev/nuclia-internal/charts + +permissions: + id-token: write # This is required for requesting the JWT + contents: read # This is required for actions/checkout + jobs: build_wheels: name: Build wheels @@ -129,6 +138,21 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 + - name: Authenticate to Google Cloud + id: gcp-auth + uses: google-github-actions/auth@v2 + with: + workload_identity_provider: "${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}" + service_account: "${{ env.GCP_SERVICE_ACCOUNT }}" + token_format: access_token + + - name: Login to Google Artifact Registry + uses: docker/login-action@v3 + with: + registry: europe-west4-docker.pkg.dev + username: oauth2accesstoken + password: ${{ steps.gcp-auth.outputs.access_token }} + - name: Calculate short sha id: env-vars run: |- @@ -167,6 +191,7 @@ jobs: helm lint charts/nucliadb helm package charts/nucliadb curl --data-binary "@nucliadb-${{ steps.version_step.outputs.helm_version }}.tgz" ${{ secrets.HELM_CHART_URL }}/api/charts + helm push nucliadb-${{ steps.version_step.outputs.version_number }}.tgz ${{ env.ARTIFACT_REGISTRY_URL }} - name: Send to promotion queue id: send-to-promo