From b69ee206dab9c19f6c73b0f3985baa6570dc9981 Mon Sep 17 00:00:00 2001 From: Tim Holmes-Mitra Date: Tue, 20 Feb 2024 16:42:13 +0000 Subject: [PATCH] ci: Workflow to check, build and publish oci image Builds the service as a docker image and upload it to ghcr.io. We want to use a rock in the future but using a rocks right now will slow our progress. I've refined the check jobs to include cargo audit and clippy and make their output available in github's ui. In time we can evolve this to trigger another action (like create an issue for a security vulnerability). --- .github/workflows/build-and-test.yaml | 18 ++-- .github/workflows/check-build-publish.yaml | 106 +++++++++++++++++++++ Cargo.toml | 4 +- docker/ratings/Dockerfile | 9 ++ rockcraft.yaml | 53 ----------- 5 files changed, 125 insertions(+), 65 deletions(-) create mode 100644 .github/workflows/check-build-publish.yaml create mode 100644 docker/ratings/Dockerfile delete mode 100644 rockcraft.yaml diff --git a/.github/workflows/build-and-test.yaml b/.github/workflows/build-and-test.yaml index aee3794b..2444edbf 100644 --- a/.github/workflows/build-and-test.yaml +++ b/.github/workflows/build-and-test.yaml @@ -8,30 +8,28 @@ jobs: name: Build Ratings runs-on: ubuntu-latest steps: - - name: Checkout code - uses: actions/checkout@v4 + - uses: actions/checkout@v4 - - name: Setup Rust toolchain - uses: actions-rs/toolchain@v1 + - uses: actions-rs/toolchain@v1 with: - toolchain: 1.76.0 + toolchain: stable components: clippy, rustfmt - - name: Install additional build dependencies + - name: Install build dependencies run: | sudo apt-get update sudo apt-get install -y libssl-dev pkg-config protobuf-compiler - - name: Check code format + + - name: Check code formating uses: actions-rs/cargo@v1 with: command: fmt args: --check - - name: Lint code - uses: actions-rs/clippy-check@v1 + - uses: actions-rs/clippy-check@v1 with: token: ${{ secrets.GITHUB_TOKEN }} - args: --all-features + args: --all-features --all-targets -- -Dwarnings - name: Setup and Run Tests run: | diff --git a/.github/workflows/check-build-publish.yaml b/.github/workflows/check-build-publish.yaml new file mode 100644 index 00000000..e33cac29 --- /dev/null +++ b/.github/workflows/check-build-publish.yaml @@ -0,0 +1,106 @@ +name: Check, build and publish + +on: + push: + branches: + - main + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + checks: + name: Test and lint + runs-on: ubuntu-22.04 + permissions: + checks: write + steps: + - name: Install build dependencies + run: | + sudo apt-get update + sudo apt-get install -y libssl-dev pkg-config protobuf-compiler libprotobuf-dev + + - name: Checkout code + uses: actions/checkout@v4 + + - name: Setup rust toolchain + uses: actions-rs/toolchain@v1 + with: # seems to ignore rust-toolchain but it should be supported + toolchain: "1.76.0" + components: rustfmt, clippy + + - name: Check code formatting + uses: actions-rs/cargo@v1 + with: + command: fmt + args: --check + + - name: Clippy linting + uses: giraffate/clippy-action@v1 + with: + reporter: "github-pr-review" + github_token: ${{ secrets.GITHUB_TOKEN }} + + - name: Dependencies security audit + uses: actions-rust-lang/audit@v1 + with: + ignore: RUSTSEC-2023-0071 # patch not available att + + - name: Run tests + run: | + cp example.env .env + cargo install cargo-make + cargo make db-up + cargo make full-test + + publish: + name: Publish to ghcr.io + runs-on: ubuntu-22.04 + permissions: + contents: read + packages: write + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Install build dependencies + run: | + sudo apt-get update + sudo apt-get install -y libssl-dev pkg-config protobuf-compiler libprotobuf-dev + + - name: Setup rust toolchain + uses: actions-rs/toolchain@v1 + with: # seems to ignore rust-toolchain but it should be supported + toolchain: "1.76.0" + + - name: Build release binary + uses: actions-rs/cargo@v1 + with: + command: build + args: --release + + - name: Log in to gchr.io + uses: docker/login-action@v3 + with: + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Extract metadata for image labels and tags + id: meta + uses: docker/metadata-action@v5 + with: + images: ghcr.io/${{ github.repository }} + tags: | + type=semver,pattern={{version}} + type=sha,format=short + + - name: Build and push image + uses: docker/build-push-action@v5 + with: + context: . + push: true + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + file: ./docker/ratings/Dockerfile diff --git a/Cargo.toml b/Cargo.toml index 67ac520c..8d543723 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,9 +1,9 @@ [package] name = "ratings" -description = "Backend for ratings for the Ubuntu app center." +description = "Ubuntu App Center ratings service" license = "GPL-3.0-only" authors = ["Canonical"] -version = "0.2.0" +version = "0.0.3" edition = "2021" [dependencies] diff --git a/docker/ratings/Dockerfile b/docker/ratings/Dockerfile new file mode 100644 index 00000000..40661b47 --- /dev/null +++ b/docker/ratings/Dockerfile @@ -0,0 +1,9 @@ +FROM ubuntu:22.04 + +RUN apt-get update && apt-get upgrade -y && rm -rf /var/lib/apt/lists/* + +WORKDIR /app +COPY target/release/ratings /app/ratings + +EXPOSE 8080 +ENTRYPOINT ["/app/ratings"] diff --git a/rockcraft.yaml b/rockcraft.yaml deleted file mode 100644 index 7945d2ee..00000000 --- a/rockcraft.yaml +++ /dev/null @@ -1,53 +0,0 @@ -name: ratings -version: 0.0.4 -license: GPL-3.0 - -base: bare -build_base: ubuntu:22.04 -platforms: - amd64: - -summary: Ubuntu App Ratings Service -description: | - Backend service to support application ratings in the new Ubuntu Software Centre. - -run_user: _daemon_ - -environment: - APP_ENV: dev - APP_HOST: 0.0.0.0 - APP_LOG_LEVEL: info - APP_NAME: ratings - APP_PORT: 18080 - -services: - ratings: - override: replace - startup: enabled - command: "/bin/ratings" - -parts: - rust-dependencies: - plugin: nil - override-pull: | - curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal - - ratings: - after: [ rust-dependencies ] - plugin: rust - build-packages: - - libssl-dev - - pkg-config - build-snaps: - - protobuf - source: . - stage-packages: - - libc6_libs - - libgcc-s1_libs - - ca-certificates_data - - migrations: - plugin: dump - source: ./sql/ - organize: - migrations : sql/migrations