run our docker ci on gha runners directly #17442
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
|
|
@@ -14,28 +14,57 @@ concurrency: | |||||
| cancel-in-progress: true | ||||||
| jobs: | ||||||
| build: | ||||||
| runs-on: ubuntu-24.04-arm | ||||||
| outputs: | ||||||
| buildId: ${{ github.run_id }} | ||||||
| permissions: | ||||||
| packages: write | ||||||
| steps: | ||||||
| - name: Check out repository | ||||||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||||||
| with: | ||||||
| persist-credentials: false | ||||||
| - name: Set up Docker Buildx | ||||||
| uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 | ||||||
| - name: Cache | ||||||
| uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 # zizmor: ignore[cache-poisoning] | ||||||
| id: cache | ||||||
| with: | ||||||
| path: | | ||||||
| var-cache-apt | ||||||
| var-lib-apt | ||||||
| root-cache-pip | ||||||
| root-npm | ||||||
| key: cache-${{ hashFiles('Dockerfile') }} | ||||||
| - name: inject cache into docker | ||||||
| uses: reproducible-containers/buildkit-cache-dance@653a570f730e3b9460adc576db523788ba59a0d7 # v3.2.0 | ||||||
| with: | ||||||
| cache-map: | | ||||||
| { | ||||||
| "var-cache-apt": "/var/cache/apt", | ||||||
| "var-lib-apt": "/var/lib/apt", | ||||||
| "root-cache-pip": "/root/.cache/pip", | ||||||
| "root-npm": "/root/.npm" | ||||||
| } | ||||||
| skip-extraction: ${{ steps.cache.outputs.cache-hit }} | ||||||
| - name: Login To GHCR | ||||||
| uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0 | ||||||
| with: | ||||||
| registry: ghcr.io | ||||||
| username: ${{ github.actor }} | ||||||
| password: ${{ secrets.GITHUB_TOKEN }} | ||||||
| - name: Build and push | ||||||
| uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0 | ||||||
| with: | ||||||
| context: . | ||||||
| cache-from: type=gha | ||||||
| cache-to: type=gha,mode=max | ||||||
|
There was a problem hiding this comment. I think we need something like:
Suggested change
Otherwise action runs on PRs from untrusted forks can overwrite this cache as well. (cc @woodruffw, should zizmor flag this?) There was a problem hiding this comment. Huh yeah, it should -- I'm actually confused as to why it didn't, since I have a coordinate for the There was a problem hiding this comment. Oh never mind, I see why it didn't: it considers This is a shortcoming in the current audit, I'll file an issue 🙂 There was a problem hiding this comment. Awesome, thanks! Just to confirm, this suggestion resolves the issue, correct? There was a problem hiding this comment. I think so, although I'm murky on whether doing the same for There was a problem hiding this comment. I think we specifically want |
||||||
| push: true | ||||||
| build-args: | | ||||||
| DEVEL=yes | ||||||
| CI=yes | ||||||
| tags: | | ||||||
| ghcr.io/pypi/warehouse:ci-${{ github.run_id }} | ||||||
| test: | ||||||
| # Time out if our test suite has gotten hung | ||||||
| timeout-minutes: 15 | ||||||
|
|
@@ -45,10 +74,8 @@ jobs: | |||||
| include: | ||||||
| - name: Tests | ||||||
| command: bin/tests --postgresql-host postgres | ||||||
| - name: Lint | ||||||
| command: bin/lint | ||||||
| - name: User Documentation | ||||||
| command: bin/user-docs | ||||||
| - name: Developer Documentation | ||||||
|
|
@@ -59,13 +86,13 @@ jobs: | |||||
| command: bin/licenses | ||||||
| - name: Translations | ||||||
| command: bin/translations | ||||||
| runs-on: ubuntu-24.04-arm | ||||||
| container: | ||||||
| image: ghcr.io/pypi/warehouse:ci-${{ needs.build.outputs.buildId }} | ||||||
| env: | ||||||
| BILLING_BACKEND: warehouse.subscriptions.services.MockStripeBillingService api_base=http://stripe:12111 api_version=2020-08-27 | ||||||
| permissions: | ||||||
| packages: read | ||||||
| services: | ||||||
| postgres: | ||||||
| image: ${{ (matrix.name == 'Tests') && 'postgres:16.1' || '' }} | ||||||
|
|
@@ -103,12 +130,12 @@ jobs: | |||||
| check_db: | ||||||
| name: Check Database Consistency | ||||||
| needs: build | ||||||
| runs-on: ubuntu-24.04-arm | ||||||
| continue-on-error: true | ||||||
| container: | ||||||
| image: ghcr.io/pypi/warehouse:ci-${{ needs.build.outputs.buildId }} | ||||||
| permissions: | ||||||
| packages: read | ||||||
| services: | ||||||
| postgres: | ||||||
| image: postgres:16.1 | ||||||
|
|
||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
https://github.com/actions/cache/blob/5a3ec84eff668545956fd18022155c47e93e2684/README.md?plain=1#L78