Skip to content

Commit a7fbdaf

Browse files
bertiethorpebertiethorpe
authored
Nightly Slurm CI Rocky update workflow (#440)
* Update openstack.pkr.hcl * new image build workflow * dynamically set packer vars from fatimage workflow * remove openstack. prefix from image name * echo image name * make image_name var in packer config * new changes * fix merge changes * temp workflow changes * test nightly build * change back fatimage workflow * rename images built * add update to builder group * add update to fatimage build groups * fatimage.yml fix * move output image_name declaration into build blocks * delete outdated nightly image * test new fatimage build * debug dnf remove cockpit * --amend * add cuda build back in * cuda nightly build * test cuda nightly builds * test new fatimage build on SMS * test image upploads across clouds * test image uploads in separate workflow * finish nightly build workflow * fix image delete logic * use azimuth-cloud trivy db mirror * use GITHUB_TOKEN env * test new fatimage build * add final nightlybuilds workflow * move trivy scan to separate workflow * bump image and test new trivy scan * fix artifact creation * bump image and test trivy scan * only run trivy scan on image bumps * bump image to test trivy scan run condition * bump cuda image * bump image * extend timeout for trivy scanning cuda image * Run workflow on PR to main * address PR comments * fix source_image_name packer parse * bump image * additional PR comments * bump image
1 parent 85c95f0 commit a7fbdaf

File tree

10 files changed

+482
-97
lines changed

10 files changed

+482
-97
lines changed

‎.github/workflows/fatimage.yml

Lines changed: 44 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
1-
21
name: Build fat image
32
on:
43
workflow_dispatch:
5-
inputs:
6-
ci_cloud:
7-
description: 'Select the CI_CLOUD'
8-
required: true
9-
type: choice
10-
options:
11-
- LEAFCLOUD
12-
- SMS
13-
- ARCUS
4+
inputs:
5+
ci_cloud:
6+
description: 'Select the CI_CLOUD'
7+
required: true
8+
type: choice
9+
options:
10+
- LEAFCLOUD
11+
- SMS
12+
- ARCUS
13+
1414
jobs:
1515
openstack:
1616
name: openstack-imagebuild
@@ -25,7 +25,7 @@ jobs:
2525
- RL8
2626
- RL9
2727
build:
28-
- openstack.openhpc-ofed
28+
- openstack.openhpc
2929
- openstack.openhpc-cuda
3030
exclude:
3131
- os_version: RL8
@@ -34,6 +34,18 @@ jobs:
3434
ANSIBLE_FORCE_COLOR: True
3535
OS_CLOUD: openstack
3636
CI_CLOUD: ${{ github.event.inputs.ci_cloud }}
37+
SOURCE_IMAGES_MAP: |
38+
{
39+
"RL8": {
40+
"openstack.openhpc": "rocky-latest-RL8",
41+
"openstack.openhpc-cuda": "rocky-latest-cuda-RL8"
42+
},
43+
"RL9": {
44+
"openstack.openhpc": "rocky-latest-RL9",
45+
"openstack.openhpc-cuda": "rocky-latest-cuda-RL9"
46+
}
47+
}
48+
3749
steps:
3850
- uses: actions/checkout@v2
3951

@@ -52,10 +64,10 @@ jobs:
5264
- name: Add bastion's ssh key to known_hosts
5365
run: cat environments/.stackhpc/bastion_fingerprints >> ~/.ssh/known_hosts
5466
shell: bash
55-
67+
5668
- name: Install ansible etc
5769
run: dev/setup-env.sh
58-
70+
5971
- name: Write clouds.yaml
6072
run: |
6173
mkdir -p ~/.config/openstack/
@@ -66,17 +78,25 @@ jobs:
6678
run: |
6779
. venv/bin/activate
6880
. environments/.stackhpc/activate
69-
81+
7082
- name: Build fat image with packer
7183
id: packer_build
7284
run: |
85+
set -x
7386
. venv/bin/activate
7487
. environments/.stackhpc/activate
7588
cd packer/
7689
packer init .
77-
PACKER_LOG=1 packer build -on-error=${{ vars.PACKER_ON_ERROR }} -only=${{ matrix.build }} -var-file=$PKR_VAR_environment_root/${{ env.CI_CLOUD }}.pkrvars.hcl openstack.pkr.hcl
90+
91+
PACKER_LOG=1 packer build \
92+
-on-error=${{ vars.PACKER_ON_ERROR }} \
93+
-only=${{ matrix.build }} \
94+
-var-file=$PKR_VAR_environment_root/${{ env.CI_CLOUD }}.pkrvars.hcl \
95+
-var "source_image_name=${{ env.SOURCE_IMAGE }}" \
96+
openstack.pkr.hcl
7897
env:
7998
PKR_VAR_os_version: ${{ matrix.os_version }}
99+
SOURCE_IMAGE: ${{ fromJSON(env.SOURCE_IMAGES_MAP)[matrix.os_version][matrix.build] }}
80100

81101
- name: Get created image names from manifest
82102
id: manifest
@@ -87,53 +107,14 @@ jobs:
87107
sleep 5
88108
done
89109
IMAGE_NAME=$(openstack image show -f value -c name $IMAGE_ID)
90-
echo "image-name=${IMAGE_NAME}" >> "$GITHUB_OUTPUT"
91-
echo "image-id=$IMAGE_ID" >> "$GITHUB_OUTPUT"
92-
93-
- name: Download image
94-
run: |
95-
. venv/bin/activate
96-
sudo mkdir /mnt/images
97-
sudo chmod 777 /mnt/images
98-
openstack image save --file /mnt/images/${{ steps.manifest.outputs.image-name }}.qcow2 ${{ steps.manifest.outputs.image-name }}
99-
100-
- name: Set up QEMU
101-
uses: docker/setup-qemu-action@v3
102-
103-
- name: install libguestfs
104-
run: |
105-
sudo apt -y update
106-
sudo apt -y install libguestfs-tools
107-
108-
- name: mkdir for mount
109-
run: sudo mkdir -p './${{ steps.manifest.outputs.image-name }}'
110-
111-
- name: mount qcow2 file
112-
run: sudo guestmount -a /mnt/images/${{ steps.manifest.outputs.image-name }}.qcow2 -i --ro -o allow_other './${{ steps.manifest.outputs.image-name }}'
113-
114-
- name: Run Trivy vulnerability scanner
115-
uses: aquasecurity/[email protected]
116-
with:
117-
scan-type: fs
118-
scan-ref: "${{ steps.manifest.outputs.image-name }}"
119-
scanners: "vuln"
120-
format: sarif
121-
output: "${{ steps.manifest.outputs.image-name }}.sarif"
122-
# turn off secret scanning to speed things up
123-
124-
- name: Upload Trivy scan results to GitHub Security tab
125-
uses: github/codeql-action/upload-sarif@v3
126-
with:
127-
sarif_file: "${{ steps.manifest.outputs.image-name }}.sarif"
128-
category: "${{ matrix.os_version }}-${{ matrix.build }}"
110+
echo $IMAGE_ID > image-id.txt
111+
echo $IMAGE_NAME > image-name.txt
129112
130-
- name: Fail if scan has CRITICAL vulnerabilities
131-
uses: aquasecurity/[email protected]
113+
- name: Upload manifest artifact
114+
uses: actions/upload-artifact@v4
132115
with:
133-
scan-type: fs
134-
scan-ref: "${{ steps.manifest.outputs.image-name }}"
135-
scanners: "vuln"
136-
format: table
137-
exit-code: '1'
138-
severity: 'CRITICAL'
139-
ignore-unfixed: true
116+
name: image-details-${{ matrix.build }}-${{ matrix.os_version }}
117+
path: |
118+
./image-id.txt
119+
./image-name.txt
120+
overwrite: true

0 commit comments

Comments
 (0)