From a77d02177ac71a398ce2155290fb6b7817ba079b Mon Sep 17 00:00:00 2001 From: Emil Tullstedt Date: Tue, 11 Jul 2023 14:04:05 +0200 Subject: [PATCH] [v9.5.x] CI: Provide a Drone promotion to build the build-container (#71351) CI: Provide a Drone promotion to build the build-container (#71133) (cherry picked from commit 7a9847e1962e09c8a098079d5d5a53ad97a9fcc0) --- .drone.star | 2 + .drone.yml | 61 +++++++++++++++++++++++++- scripts/drone/pipelines/ci_images.star | 53 ++++++++++++++++++++++ scripts/drone/vault.star | 6 +++ 4 files changed, 121 insertions(+), 1 deletion(-) diff --git a/.drone.star b/.drone.star index 36c55cbe47a..f496a0cb2df 100644 --- a/.drone.star +++ b/.drone.star @@ -30,6 +30,7 @@ load( ) load( "scripts/drone/pipelines/ci_images.star", + "publish_ci_build_container_image_pipeline", "publish_ci_windows_test_image_pipeline", ) load("scripts/drone/pipelines/github.star", "publish_github_pipeline") @@ -66,6 +67,7 @@ def main(_ctx): version_branch_pipelines() + integration_test_pipelines() + publish_ci_windows_test_image_pipeline() + + publish_ci_build_container_image_pipeline() + cronjobs() + secrets() ) diff --git a/.drone.yml b/.drone.yml index b92dfe78162..bdcf40b2668 100644 --- a/.drone.yml +++ b/.drone.yml @@ -6426,6 +6426,59 @@ volumes: path: //./pipe/docker_engine/ name: docker --- +clone: + retries: 3 +depends_on: [] +image_pull_secrets: +- dockerconfigjson +kind: pipeline +name: publish-ci-build-container-image +node: + type: no-parallel +platform: + arch: amd64 + os: linux +services: [] +steps: +- commands: + - if [ -z "${BUILD_CONTAINER_VERSION}" ]; then echo Missing BUILD_CONTAINER_VERSION; + false; fi + image: alpine:3.17.1 + name: validate-version +- commands: + - printenv GCP_KEY > /tmp/key.json + - gcloud auth activate-service-account --key-file=/tmp/key.json + - gsutil cp gs://grafana-private-downloads/MacOSX10.15.sdk.tar.xz ./scripts/build/ci-build/MacOSX10.15.sdk.tar.xz + environment: + GCP_KEY: + from_secret: gcp_download_build_container_assets_key + image: google/cloud-sdk:431.0.0 + name: download-macos-sdk +- commands: + - printenv DOCKER_PASSWORD | docker login -u "$DOCKER_USERNAME" --password-stdin + - docker build -t "grafana/build-container:${BUILD_CONTAINER_VERSION}" ./scripts/build/ci-build + - docker push "grafana/build-container:${BUILD_CONTAINER_VERSION}" + environment: + DOCKER_PASSWORD: + from_secret: docker_password + DOCKER_USERNAME: + from_secret: docker_username + image: google/cloud-sdk:431.0.0 + name: build-and-publish + volumes: + - name: docker + path: /var/run/docker.sock +trigger: + event: + - promote + target: + - ci-build-container-image +type: docker +volumes: +- host: + path: /var/run/docker.sock + name: docker +--- clone: retries: 3 kind: pipeline @@ -6675,6 +6728,12 @@ get: kind: secret name: gcp_upload_artifacts_key --- +get: + name: credentials.json + path: infra/data/ci/grafana/assets-downloader-build-container-service-account +kind: secret +name: gcp_download_build_container_assets_key +--- get: name: application_id path: infra/data/ci/datasources/cpp-azure-resourcemanager-credentials @@ -6826,6 +6885,6 @@ kind: secret name: github_token --- kind: signature -hmac: 2350d00c90676307742d678277a788e584c470f2c373f27b3ac5d3536244af37 +hmac: 2838a4ea6de63512556ec81bcc6fe0f6875453f059efa8d71faa7849bd6fdb2f ... diff --git a/scripts/drone/pipelines/ci_images.star b/scripts/drone/pipelines/ci_images.star index 269798741c5..efda2339e35 100644 --- a/scripts/drone/pipelines/ci_images.star +++ b/scripts/drone/pipelines/ci_images.star @@ -9,11 +9,16 @@ load( load( "scripts/drone/vault.star", "from_secret", + "gcp_download_build_container_assets_key", ) load( "scripts/drone/utils/windows_images.star", "windows_images", ) +load( + "scripts/drone/utils/images.star", + "images", +) def publish_ci_windows_test_image_pipeline(): trigger = { @@ -65,3 +70,51 @@ def publish_ci_windows_test_image_pipeline(): } return [pl] + +def publish_ci_build_container_image_pipeline(): + trigger = { + "event": ["promote"], + "target": ["ci-build-container-image"], + } + pl = pipeline( + name = "publish-ci-build-container-image", + trigger = trigger, + edition = "", + steps = [ + { + "name": "validate-version", + "image": images["alpine_image"], + "commands": [ + "if [ -z \"${BUILD_CONTAINER_VERSION}\" ]; then echo Missing BUILD_CONTAINER_VERSION; false; fi", + ], + }, + { + "name": "download-macos-sdk", + "image": images["cloudsdk_image"], + "environment": { + "GCP_KEY": from_secret(gcp_download_build_container_assets_key), + }, + "commands": [ + "printenv GCP_KEY > /tmp/key.json", + "gcloud auth activate-service-account --key-file=/tmp/key.json", + "gsutil cp gs://grafana-private-downloads/MacOSX10.15.sdk.tar.xz ./scripts/build/ci-build/MacOSX10.15.sdk.tar.xz", + ], + }, + { + "name": "build-and-publish", # Consider splitting the build and the upload task. + "image": images["cloudsdk_image"], + "volumes": [{"name": "docker", "path": "/var/run/docker.sock"}], + "environment": { + "DOCKER_USERNAME": from_secret("docker_username"), + "DOCKER_PASSWORD": from_secret("docker_password"), + }, + "commands": [ + "printenv DOCKER_PASSWORD | docker login -u \"$DOCKER_USERNAME\" --password-stdin", + "docker build -t \"grafana/build-container:${BUILD_CONTAINER_VERSION}\" ./scripts/build/ci-build", + "docker push \"grafana/build-container:${BUILD_CONTAINER_VERSION}\"", + ], + }, + ], + ) + + return [pl] diff --git a/scripts/drone/vault.star b/scripts/drone/vault.star index 7c62ca16cb8..7fba1e1c613 100644 --- a/scripts/drone/vault.star +++ b/scripts/drone/vault.star @@ -5,6 +5,7 @@ pull_secret = "dockerconfigjson" drone_token = "drone_token" prerelease_bucket = "prerelease_bucket" gcp_upload_artifacts_key = "gcp_upload_artifacts_key" +gcp_download_build_container_assets_key = "gcp_download_build_container_assets_key" azure_sp_app_id = "azure_sp_app_id" azure_sp_app_pw = "azure_sp_app_pw" azure_tenant = "azure_tenant" @@ -38,6 +39,11 @@ def secrets(): "infra/data/ci/grafana/releng/artifacts-uploader-service-account", "credentials.json", ), + vault_secret( + gcp_download_build_container_assets_key, + "infra/data/ci/grafana/assets-downloader-build-container-service-account", + "credentials.json", + ), vault_secret( azure_sp_app_id, "infra/data/ci/datasources/cpp-azure-resourcemanager-credentials",