Migrate to github actions #50
Conversation
thomasferrandiz
force-pushed
the
migrateToGHA
branch
from
9014675
to
40d201c
Compare
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
| tags: rancher/hardened-coredns:${{ env.TAG }}-arm64 | ||
| file: Dockerfile | ||
| outputs: type=docker | ||
| platforms: linux/arm64 |
There was a problem hiding this comment.
I wonder if it makes sense to also run trivy here, maybe there are extra stuff when using arm64 code?
There was a problem hiding this comment.
I'm not sure if it's necessary or not.
I remember that we didn't do it for s390x but maybe for arm64 it's more useful.
There was a problem hiding this comment.
Not sure there is much value on per-arch Trivy scan, I would assume the majority of times you will get the same (or very similar results).
For reference, atm all our internal scans are solely on amd64.
There was a problem hiding this comment.
Agree, if the packages in the final images per arch are the same, you could only do the scan in amd64. Although, it shouldn't be a big issue if you scan all of them, it's more a way of saving time in the pipeline.
| - name: Build container image | ||
| uses: docker/build-push-action@v5 | ||
| with: |
There was a problem hiding this comment.
Any specific reason to break the builds per platform? One of the key benefits of docker buildx is optimised cross-compilation builds.
There was a problem hiding this comment.
@pjbgf I think it might be because of this issue: docker/buildx#59
The default image store in Docker Engine doesn't support loading multi-platform images. You can enable the containerd image store, or push multi-platform images is to directly push to a registry
using --load and --platform at the same time in docker buildx is not supported
There was a problem hiding this comment.
yes exactly @manuelbuil did some tests for this PR: rancher/image-build-flannel#76 and concluded the build per platform was needed
There was a problem hiding this comment.
If we are solely testing the build (e.g. confirm whether it works for all target platforms), you can remove both --load and --push and set --platform. That effectively means you will build to all target platforms. Like we did here.
|
@galal-hussein is doing this for a lot of the other, non networking related repositories. Let's make sure we're doing all of them as similar as possible. |
|
lets also remove the .drone part from updatecli as well https://github.com/rancher/image-build-coredns/blob/master/updatecli/updatecli.d/updatebuildbase.yaml#L45-L53 |
|
The drone webhooks should also be removed - probably one for EIO. |
| tags: rancher/hardened-coredns:${{ env.TAG }}-arm64 | ||
| file: Dockerfile | ||
| outputs: type=docker | ||
| platforms: linux/arm64 |
There was a problem hiding this comment.
Agree, if the packages in the final images per arch are the same, you could only do the scan in amd64. Although, it shouldn't be a big issue if you scan all of them, it's more a way of saving time in the pipeline.
| @@ -53,3 +49,14 @@ image-manifest: | |||
| .PHONY: image-scan | |||
| image-scan: | |||
There was a problem hiding this comment.
Should this target also be removed?
|
Please note that the host-arch is taking 2min while the cross arch is taking 14min. We could get this optimised by letting the heavy lifting be done at the build arch instead of cross emulating network operations. However that could be dealt with on a follow-up PR. |
thomasferrandiz
force-pushed
the
migrateToGHA
branch
2 times, most recently
from
d3d163f
to
7bb2cbc
Compare
Yes, although we already have such info in our internal image-scanning, having it per repo can speed up specific analysis and visibility by the teams themselves. |
Thanks! I'm trying to write down all taken decisions in this migration so that we can replicate them in other repos :) |
thomasferrandiz
force-pushed
the
migrateToGHA
branch
from
7bb2cbc
to
cf06453
Compare
@manuelbuil Nice! We can help review the doc and add specific guidance if needed. |
It's in the description of this EPIC: rancher/ecm-distro-tools#375 |
Signed-off-by: Thomas Ferrandiz <thomas.ferrandiz@suse.com>
thomasferrandiz
force-pushed
the
migrateToGHA
branch
from
cf06453
to
2adc200
Compare
|
replaced by #52 |
|
reference issue: rancher/ecm-distro-tools#382 |
Issue: rancher/ecm-distro-tools#382