forked from elastic/apm-agent-python
-
Notifications
You must be signed in to change notification settings - Fork 0
151 lines (140 loc) · 4.55 KB
/
Copy pathrelease.yml
File metadata and controls
151 lines (140 loc) · 4.55 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
name: release
on:
push:
tags:
- "v*.*.*"
permissions:
contents: read
jobs:
test:
uses: ./.github/workflows/test.yml
packages:
uses: ./.github/workflows/packages.yml
publish-pypi:
needs:
- test
- packages
runs-on: ubuntu-latest
environment: release
permissions:
id-token: write # IMPORTANT: this permission is mandatory for trusted publishing
steps:
- uses: actions/checkout@v3
- uses: actions/download-artifact@v3
with:
name: packages
path: dist
- name: Upload
uses: pypa/gh-action-pypi-publish@f5622bde02b04381239da3573277701ceca8f6a0
with:
repository-url: https://upload.pypi.org/legacy/
build-distribution:
uses: ./.github/workflows/build-distribution.yml
publish-lambda-layers:
needs:
- build-distribution
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: hashicorp/[email protected]
with:
url: ${{ secrets.VAULT_ADDR }}
method: approle
roleId: ${{ secrets.VAULT_ROLE_ID }}
secretId: ${{ secrets.VAULT_SECRET_ID }}
secrets: |
secret/observability-team/ci/service-account/apm-agent-python access_key_id | AWS_ACCESS_KEY_ID ;
secret/observability-team/ci/service-account/apm-agent-python secret_access_key | AWS_SECRET_ACCESS_KEY
- uses: actions/download-artifact@v3
with:
name: build-distribution
path: ./build
- name: Publish lambda layers to AWS
run: |
# Convert v1.2.3 to ver-1-2-3
VERSION=${GITHUB_REF_NAME/v/ver-}
VERSION=${VERSION//./-}
ELASTIC_LAYER_NAME="elastic-apm-python-${VERSION}" .ci/publish-aws.sh
- uses: actions/upload-artifact@v3
with:
name: arn-file
path: ".arn-file.md"
if-no-files-found: error
publish-docker:
needs:
- build-distribution
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: elastic/apm-pipeline-library/.github/actions/docker-login@current
with:
registry: docker.elastic.co
secret: secret/observability-team/ci/docker-registry/prod
url: ${{ secrets.VAULT_ADDR }}
roleId: ${{ secrets.VAULT_ROLE_ID }}
secretId: ${{ secrets.VAULT_SECRET_ID }}
- uses: actions/download-artifact@v3
with:
name: build-distribution
path: ./build
- id: setup-docker
name: Set up docker variables
run: |-
# version without v prefix (e.g. 1.2.3)
echo "tag=${GITHUB_REF_NAME/v/}" >> "${GITHUB_OUTPUT}"
echo "name=docker.elastic.co/observability/apm-agent-python" >> "${GITHUB_OUTPUT}"
- name: Docker build
run: >-
docker build
-t ${{ steps.setup-docker.outputs.name }}:${{ steps.setup-docker.outputs.tag }}
--build-arg AGENT_DIR=./build/dist/package/python
.
- name: Docker retag
run: >-
docker tag
${{ steps.setup-docker.outputs.name }}:${{ steps.setup-docker.outputs.tag }}
${{ steps.setup-docker.outputs.name }}:latest
- name: Docker push
run: |-
docker push ${{ steps.setup-docker.outputs.name }}:${{ steps.setup-docker.outputs.tag }}
docker push ${{ steps.setup-docker.outputs.name }}:latest
github-draft:
permissions:
contents: write
needs:
- publish-lambda-layers
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/download-artifact@v3
with:
name: arn-file
- name: Create GitHub Draft Release
run: >-
gh release create "${GITHUB_REF_NAME}"
--title="${GITHUB_REF_NAME}"
--generate-notes
--notes-file=".arn-file.md"
--draft
env:
GH_TOKEN: ${{ github.token }}
notify:
runs-on: ubuntu-latest
if: always()
needs:
- publish-lambda-layers
- publish-pypi
- publish-docker
- github-draft
steps:
- id: check
uses: elastic/apm-pipeline-library/.github/actions/check-dependent-jobs@current
with:
needs: ${{ toJSON(needs) }}
- uses: elastic/apm-pipeline-library/.github/actions/notify-build-status@current
with:
status: ${{ steps.check.outputs.status }}
vaultUrl: ${{ secrets.VAULT_ADDR }}
vaultRoleId: ${{ secrets.VAULT_ROLE_ID }}
vaultSecretId: ${{ secrets.VAULT_SECRET_ID }}
slackChannel: "#apm-agent-python"