From 85c49b09800a8f0905c0c540cda4b76c7e09fa4d Mon Sep 17 00:00:00 2001 From: fheinecke <23390735+fheinecke@users.noreply.github.com> Date: Mon, 7 Aug 2023 23:52:03 -0500 Subject: [PATCH] Added parallel OS package publishing and rolling release channel (#28659) * Added parallel OS package publishing and rolling release channel * Bump `e` for test * Fixed parallelism issue * Re-ran make dronegen * Addressed PR comments * reverted accidental e ref change * Linter fix * Bumped `e` to `gravitational/teleport` master ref --- .drone.yml | 1232 +++++++++-------- .../tooling/cmd/gh-trigger-workflow/args.go | 22 +- .../tooling/cmd/gh-trigger-workflow/main.go | 10 + dronegen/gha.go | 74 +- dronegen/os_repos.go | 17 +- e | 2 +- 6 files changed, 752 insertions(+), 605 deletions(-) diff --git a/.drone.yml b/.drone.yml index e89bd6f5d13..01e24a4c427 100644 --- a/.drone.yml +++ b/.drone.yml @@ -1053,17 +1053,17 @@ steps: - name: Configure Staging AWS Profile image: amazon/aws-cli commands: - - aws sts get-caller-identity - - |- - printf "[staging]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - > /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile staging + - aws sts get-caller-identity + - |- + printf "[staging]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + > /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile staging environment: AWS_ACCESS_KEY_ID: from_secret: STAGING_TELEPORT_DRONE_USER_ECR_KEY @@ -1072,23 +1072,23 @@ steps: AWS_ROLE: from_secret: STAGING_TELEPORT_DRONE_ECR_AWS_ROLE volumes: - - name: awsconfig - path: /root/.aws + - name: awsconfig + path: /root/.aws - name: Configure Production AWS Profile image: amazon/aws-cli commands: - - aws sts get-caller-identity - - |- - printf "[production]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - >> /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile production + - aws sts get-caller-identity + - |- + printf "[production]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + >> /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile production environment: AWS_ACCESS_KEY_ID: from_secret: PRODUCTION_TELEPORT_DRONE_USER_ECR_KEY @@ -1116,7 +1116,7 @@ steps: - export TELEPORT_TAG=$(cat /go/build/CURRENT_VERSION_TAG.txt | tr -d '^v') - export TELEPORT_LAB_IMAGE_NAME_STAGING="146628656107.dkr.ecr.us-west-2.amazonaws.com/gravitational/teleport-lab:$(cat /go/build/CURRENT_VERSION_TAG_GENERIC.txt)-$CURRENT_DATE" - export TELEPORT_LAB_IMAGE_NAME_PROD="public.ecr.aws/gravitational/teleport-lab:$(cat /go/build/CURRENT_VERSION_TAG_GENERIC.txt)" - # Check out code + # Check out code - mkdir -p /go/src/github.com/gravitational/teleport - cd /go/src/github.com/gravitational/teleport - git init && git remote add origin ${DRONE_REMOTE_URL} @@ -1239,8 +1239,8 @@ steps: AWS_S3_BUCKET: from_secret: PRODUCTION_CHARTS_AWS_S3_BUCKET volumes: - - name: awsconfig - path: /root/.aws + - name: awsconfig + path: /root/.aws - name: Send Slack notification image: plugins/slack:1.4.1 @@ -4294,241 +4294,241 @@ name: build-linux-arm64-deb trigger: event: include: - - tag + - tag ref: include: - - refs/tags/v* + - refs/tags/v* repo: include: - - gravitational/* + - gravitational/* workspace: path: /go clone: disable: true depends_on: -- build-linux-arm64 -- clean-up-previous-build + - build-linux-arm64 + - clean-up-previous-build steps: -- name: Check out code - image: docker:git - commands: - - mkdir -p /go/src/github.com/gravitational/teleport - - cd /go/src/github.com/gravitational/teleport - - git clone https://github.com/gravitational/${DRONE_REPO_NAME}.git . - - git checkout ${DRONE_TAG:-$DRONE_COMMIT} - - mkdir -m 0700 /root/.ssh && echo -n "$GITHUB_PRIVATE_KEY" > /root/.ssh/id_rsa - && chmod 600 /root/.ssh/id_rsa - - ssh-keyscan -H github.com > /root/.ssh/known_hosts 2>/dev/null && chmod 600 /root/.ssh/known_hosts - - git submodule update --init e - - rm -f /root/.ssh/id_rsa - - mkdir -p /go/cache /go/artifacts - - |- - VERSION=$(egrep ^VERSION Makefile | cut -d= -f2) - if [ "$$VERSION" != "${DRONE_TAG##v}" ]; then - echo "Mismatch between Makefile version: $$VERSION and git tag: $DRONE_TAG" - exit 1 - fi - echo "$$VERSION" > /go/.version.txt - environment: - GITHUB_PRIVATE_KEY: - from_secret: GITHUB_PRIVATE_KEY -- name: Wait for docker - image: docker - commands: - - timeout 30s /bin/sh -c 'while [ ! -S /var/run/docker.sock ]; do sleep 1; done' - volumes: - - name: dockersock - path: /var/run -- name: Assume Download AWS Role - image: amazon/aws-cli - commands: - - aws sts get-caller-identity - - |- - printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - > /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile default - environment: - AWS_ACCESS_KEY_ID: - from_secret: AWS_ACCESS_KEY_ID - AWS_ROLE: - from_secret: AWS_ROLE - AWS_SECRET_ACCESS_KEY: - from_secret: AWS_SECRET_ACCESS_KEY - volumes: - - name: awsconfig - path: /root/.aws -- name: Download artifacts from S3 - image: amazon/aws-cli - commands: - - export VERSION=$(cat /go/.version.txt) - - if [[ "${DRONE_TAG}" != "" ]]; then export S3_PATH="tag/$${DRONE_TAG##v}/"; else - export S3_PATH="tag/"; fi - - aws s3 cp s3://$AWS_S3_BUCKET/teleport/$${S3_PATH}teleport-v$${VERSION}-linux-arm64-bin.tar.gz - /go/artifacts/ - - aws s3 cp s3://$AWS_S3_BUCKET/teleport/$${S3_PATH}teleport-ent-v$${VERSION}-linux-arm64-bin.tar.gz - /go/artifacts/ - environment: - AWS_REGION: us-west-2 - AWS_S3_BUCKET: - from_secret: AWS_S3_BUCKET - volumes: - - name: awsconfig - path: /root/.aws -- name: Assume Build AWS Role - image: amazon/aws-cli - commands: - - aws sts get-caller-identity - - |- - printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - > /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile default - environment: - AWS_ACCESS_KEY_ID: - from_secret: TELEPORT_BUILD_USER_READ_ONLY_KEY - AWS_ROLE: - from_secret: TELEPORT_BUILD_READ_ONLY_AWS_ROLE - AWS_SECRET_ACCESS_KEY: - from_secret: TELEPORT_BUILD_USER_READ_ONLY_SECRET - volumes: - - name: awsconfig - path: /root/.aws -- name: Build artifacts - image: docker - commands: - - apk add --no-cache bash curl gzip make tar - - apk add --no-cache aws-cli - - cd /go/src/github.com/gravitational/teleport - - export VERSION=$(cat /go/.version.txt) - - aws ecr-public get-login-password --region us-east-1 | docker login -u="AWS" --password-stdin - public.ecr.aws - - make deb - environment: - ARCH: arm64 - ENT_TARBALL_PATH: /go/artifacts - OSS_TARBALL_PATH: /go/artifacts - TMPDIR: /go - volumes: - - name: dockersock - path: /var/run - - name: awsconfig - path: /root/.aws -- name: Copy artifacts - image: docker - commands: - - cd /go/src/github.com/gravitational/teleport - - find build -maxdepth 1 -iname "teleport*.deb*" -print -exec cp {} /go/artifacts - \; - - find e/build -maxdepth 1 -iname "teleport*.deb*" -print -exec cp {} /go/artifacts - \; -- name: Assume Upload AWS Role - image: amazon/aws-cli - commands: - - aws sts get-caller-identity - - |- - printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - > /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile default - environment: - AWS_ACCESS_KEY_ID: - from_secret: AWS_ACCESS_KEY_ID - AWS_ROLE: - from_secret: AWS_ROLE - AWS_SECRET_ACCESS_KEY: - from_secret: AWS_SECRET_ACCESS_KEY - volumes: - - name: awsconfig - path: /root/.aws -- name: Upload to S3 - image: amazon/aws-cli - commands: - - cd /go/artifacts/ - - aws s3 sync . s3://$AWS_S3_BUCKET/teleport/tag/${DRONE_TAG##v} - environment: - AWS_REGION: us-west-2 - AWS_S3_BUCKET: - from_secret: AWS_S3_BUCKET - volumes: - - name: awsconfig - path: /root/.aws -- name: Register artifacts - image: docker - commands: - - WORKSPACE_DIR=$${WORKSPACE_DIR:-/} - - VERSION=$(cat "$WORKSPACE_DIR/go/.version.txt") - - RELEASES_HOST='https://releases-prod.platform.teleport.sh' - - echo "$RELEASES_CERT" | base64 -d > "$WORKSPACE_DIR/releases.crt" - - echo "$RELEASES_KEY" | base64 -d > "$WORKSPACE_DIR/releases.key" - - trap "rm -f '$WORKSPACE_DIR/releases.crt' '$WORKSPACE_DIR/releases.key'" EXIT - - CREDENTIALS="--cert $WORKSPACE_DIR/releases.crt --key $WORKSPACE_DIR/releases.key" - - which curl || apk add --no-cache curl - - |- - cd "$WORKSPACE_DIR/go/artifacts" - find . -type f ! -iname '*.sha256' ! -iname '*-unsigned.zip*' | while read -r file; do - # Skip files that are not results of this build - # (e.g. tarballs from which OS packages are made) - [ -f "$file.sha256" ] || continue - - name="$(basename "$file" | sed -E 's/(-|_)v?[0-9].*$//')" # extract part before -vX.Y.Z - description="Linux ARM64/ARMv8 (64-bit) DEB" - products="$name" - if [ "$name" = "tsh" ]; then - products="teleport teleport-ent" - elif [ "$name" = "Teleport Connect" -o "$name" = "teleport-connect" ]; then - description="Teleport Connect" - products="teleport teleport-ent" - fi - shasum="$(cat "$file.sha256" | cut -d ' ' -f 1)" - - release_params="" # List of "-F releaseId=XXX" parameters to curl - - for product in $products; do - status_code=$(curl $CREDENTIALS -o "$WORKSPACE_DIR/curl_out.txt" -w "%{http_code}" -F "product=$product" -F "version=$VERSION" -F notesMd="# Teleport $VERSION" -F status=draft "$RELEASES_HOST/releases") - if [ $status_code -ne 200 ] && [ $status_code -ne 409 ]; then - echo "curl HTTP status: $status_code" - cat $WORKSPACE_DIR/curl_out.txt + - name: Check out code + image: docker:git + commands: + - mkdir -p /go/src/github.com/gravitational/teleport + - cd /go/src/github.com/gravitational/teleport + - git clone https://github.com/gravitational/${DRONE_REPO_NAME}.git . + - git checkout ${DRONE_TAG:-$DRONE_COMMIT} + - mkdir -m 0700 /root/.ssh && echo -n "$GITHUB_PRIVATE_KEY" > /root/.ssh/id_rsa + && chmod 600 /root/.ssh/id_rsa + - ssh-keyscan -H github.com > /root/.ssh/known_hosts 2>/dev/null && chmod 600 /root/.ssh/known_hosts + - git submodule update --init e + - rm -f /root/.ssh/id_rsa + - mkdir -p /go/cache /go/artifacts + - |- + VERSION=$(egrep ^VERSION Makefile | cut -d= -f2) + if [ "$$VERSION" != "${DRONE_TAG##v}" ]; then + echo "Mismatch between Makefile version: $$VERSION and git tag: $DRONE_TAG" exit 1 fi + echo "$$VERSION" > /go/.version.txt + environment: + GITHUB_PRIVATE_KEY: + from_secret: GITHUB_PRIVATE_KEY + - name: Wait for docker + image: docker + commands: + - timeout 30s /bin/sh -c 'while [ ! -S /var/run/docker.sock ]; do sleep 1; done' + volumes: + - name: dockersock + path: /var/run + - name: Assume Download AWS Role + image: amazon/aws-cli + commands: + - aws sts get-caller-identity + - |- + printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + > /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile default + environment: + AWS_ACCESS_KEY_ID: + from_secret: AWS_ACCESS_KEY_ID + AWS_ROLE: + from_secret: AWS_ROLE + AWS_SECRET_ACCESS_KEY: + from_secret: AWS_SECRET_ACCESS_KEY + volumes: + - name: awsconfig + path: /root/.aws + - name: Download artifacts from S3 + image: amazon/aws-cli + commands: + - export VERSION=$(cat /go/.version.txt) + - if [[ "${DRONE_TAG}" != "" ]]; then export S3_PATH="tag/$${DRONE_TAG##v}/"; else + export S3_PATH="tag/"; fi + - aws s3 cp s3://$AWS_S3_BUCKET/teleport/$${S3_PATH}teleport-v$${VERSION}-linux-arm64-bin.tar.gz + /go/artifacts/ + - aws s3 cp s3://$AWS_S3_BUCKET/teleport/$${S3_PATH}teleport-ent-v$${VERSION}-linux-arm64-bin.tar.gz + /go/artifacts/ + environment: + AWS_REGION: us-west-2 + AWS_S3_BUCKET: + from_secret: AWS_S3_BUCKET + volumes: + - name: awsconfig + path: /root/.aws + - name: Assume Build AWS Role + image: amazon/aws-cli + commands: + - aws sts get-caller-identity + - |- + printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + > /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile default + environment: + AWS_ACCESS_KEY_ID: + from_secret: TELEPORT_BUILD_USER_READ_ONLY_KEY + AWS_ROLE: + from_secret: TELEPORT_BUILD_READ_ONLY_AWS_ROLE + AWS_SECRET_ACCESS_KEY: + from_secret: TELEPORT_BUILD_USER_READ_ONLY_SECRET + volumes: + - name: awsconfig + path: /root/.aws + - name: Build artifacts + image: docker + commands: + - apk add --no-cache bash curl gzip make tar + - apk add --no-cache aws-cli + - cd /go/src/github.com/gravitational/teleport + - export VERSION=$(cat /go/.version.txt) + - aws ecr-public get-login-password --region us-east-1 | docker login -u="AWS" --password-stdin + public.ecr.aws + - make deb + environment: + ARCH: arm64 + ENT_TARBALL_PATH: /go/artifacts + OSS_TARBALL_PATH: /go/artifacts + TMPDIR: /go + volumes: + - name: dockersock + path: /var/run + - name: awsconfig + path: /root/.aws + - name: Copy artifacts + image: docker + commands: + - cd /go/src/github.com/gravitational/teleport + - find build -maxdepth 1 -iname "teleport*.deb*" -print -exec cp {} /go/artifacts + \; + - find e/build -maxdepth 1 -iname "teleport*.deb*" -print -exec cp {} /go/artifacts + \; + - name: Assume Upload AWS Role + image: amazon/aws-cli + commands: + - aws sts get-caller-identity + - |- + printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + > /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile default + environment: + AWS_ACCESS_KEY_ID: + from_secret: AWS_ACCESS_KEY_ID + AWS_ROLE: + from_secret: AWS_ROLE + AWS_SECRET_ACCESS_KEY: + from_secret: AWS_SECRET_ACCESS_KEY + volumes: + - name: awsconfig + path: /root/.aws + - name: Upload to S3 + image: amazon/aws-cli + commands: + - cd /go/artifacts/ + - aws s3 sync . s3://$AWS_S3_BUCKET/teleport/tag/${DRONE_TAG##v} + environment: + AWS_REGION: us-west-2 + AWS_S3_BUCKET: + from_secret: AWS_S3_BUCKET + volumes: + - name: awsconfig + path: /root/.aws + - name: Register artifacts + image: docker + commands: + - WORKSPACE_DIR=$${WORKSPACE_DIR:-/} + - VERSION=$(cat "$WORKSPACE_DIR/go/.version.txt") + - RELEASES_HOST='https://releases-prod.platform.teleport.sh' + - echo "$RELEASES_CERT" | base64 -d > "$WORKSPACE_DIR/releases.crt" + - echo "$RELEASES_KEY" | base64 -d > "$WORKSPACE_DIR/releases.key" + - trap "rm -f '$WORKSPACE_DIR/releases.crt' '$WORKSPACE_DIR/releases.key'" EXIT + - CREDENTIALS="--cert $WORKSPACE_DIR/releases.crt --key $WORKSPACE_DIR/releases.key" + - which curl || apk add --no-cache curl + - |- + cd "$WORKSPACE_DIR/go/artifacts" + find . -type f ! -iname '*.sha256' ! -iname '*-unsigned.zip*' | while read -r file; do + # Skip files that are not results of this build + # (e.g. tarballs from which OS packages are made) + [ -f "$file.sha256" ] || continue - release_params="$release_params -F releaseId=$product@$VERSION" - done + name="$(basename "$file" | sed -E 's/(-|_)v?[0-9].*$//')" # extract part before -vX.Y.Z + description="Linux ARM64/ARMv8 (64-bit) DEB" + products="$name" + if [ "$name" = "tsh" ]; then + products="teleport teleport-ent" + elif [ "$name" = "Teleport Connect" -o "$name" = "teleport-connect" ]; then + description="Teleport Connect" + products="teleport teleport-ent" + fi + shasum="$(cat "$file.sha256" | cut -d ' ' -f 1)" - curl $CREDENTIALS --fail -o /dev/null -F description="$description" -F os="linux" -F arch="arm64" -F "file=@$file" -F "sha256=$shasum" $release_params "$RELEASES_HOST/assets"; - done - environment: - RELEASES_CERT: - from_secret: RELEASES_CERT - RELEASES_KEY: - from_secret: RELEASES_KEY + release_params="" # List of "-F releaseId=XXX" parameters to curl + + for product in $products; do + status_code=$(curl $CREDENTIALS -o "$WORKSPACE_DIR/curl_out.txt" -w "%{http_code}" -F "product=$product" -F "version=$VERSION" -F notesMd="# Teleport $VERSION" -F status=draft "$RELEASES_HOST/releases") + if [ $status_code -ne 200 ] && [ $status_code -ne 409 ]; then + echo "curl HTTP status: $status_code" + cat $WORKSPACE_DIR/curl_out.txt + exit 1 + fi + + release_params="$release_params -F releaseId=$product@$VERSION" + done + + curl $CREDENTIALS --fail -o /dev/null -F description="$description" -F os="linux" -F arch="arm64" -F "file=@$file" -F "sha256=$shasum" $release_params "$RELEASES_HOST/assets"; + done + environment: + RELEASES_CERT: + from_secret: RELEASES_CERT + RELEASES_KEY: + from_secret: RELEASES_KEY services: -- name: Start Docker - image: docker:dind - privileged: true - volumes: - - name: dockersock - path: /var/run + - name: Start Docker + image: docker:dind + privileged: true + volumes: + - name: dockersock + path: /var/run volumes: -- name: dockersock - temp: {} -- name: awsconfig - temp: {} + - name: dockersock + temp: {} + - name: awsconfig + temp: {} --- ################################################ @@ -4811,255 +4811,255 @@ name: build-linux-arm64-rpm trigger: event: include: - - tag + - tag ref: include: - - refs/tags/v* + - refs/tags/v* repo: include: - - gravitational/* + - gravitational/* workspace: path: /go clone: disable: true depends_on: -- build-linux-arm64 -- clean-up-previous-build + - build-linux-arm64 + - clean-up-previous-build steps: -- name: Check out code - image: docker:git - commands: - - mkdir -p /go/src/github.com/gravitational/teleport - - cd /go/src/github.com/gravitational/teleport - - git clone https://github.com/gravitational/${DRONE_REPO_NAME}.git . - - git checkout ${DRONE_TAG:-$DRONE_COMMIT} - - mkdir -m 0700 /root/.ssh && echo -n "$GITHUB_PRIVATE_KEY" > /root/.ssh/id_rsa - && chmod 600 /root/.ssh/id_rsa - - ssh-keyscan -H github.com > /root/.ssh/known_hosts 2>/dev/null && chmod 600 /root/.ssh/known_hosts - - git submodule update --init e - - rm -f /root/.ssh/id_rsa - - mkdir -p /go/cache /go/artifacts - - |- - VERSION=$(egrep ^VERSION Makefile | cut -d= -f2) - if [ "$$VERSION" != "${DRONE_TAG##v}" ]; then - echo "Mismatch between Makefile version: $$VERSION and git tag: $DRONE_TAG" - exit 1 - fi - echo "$$VERSION" > /go/.version.txt - environment: - GITHUB_PRIVATE_KEY: - from_secret: GITHUB_PRIVATE_KEY -- name: Wait for docker - image: docker - commands: - - timeout 30s /bin/sh -c 'while [ ! -S /var/run/docker.sock ]; do sleep 1; done' - volumes: - - name: dockersock - path: /var/run -- name: Assume Download AWS Role - image: amazon/aws-cli - commands: - - aws sts get-caller-identity - - |- - printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - > /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile default - environment: - AWS_ACCESS_KEY_ID: - from_secret: AWS_ACCESS_KEY_ID - AWS_ROLE: - from_secret: AWS_ROLE - AWS_SECRET_ACCESS_KEY: - from_secret: AWS_SECRET_ACCESS_KEY - volumes: - - name: awsconfig - path: /root/.aws -- name: Download artifacts from S3 - image: amazon/aws-cli - commands: - - export VERSION=$(cat /go/.version.txt) - - if [[ "${DRONE_TAG}" != "" ]]; then export S3_PATH="tag/$${DRONE_TAG##v}/"; else - export S3_PATH="tag/"; fi - - aws s3 cp s3://$AWS_S3_BUCKET/teleport/$${S3_PATH}teleport-v$${VERSION}-linux-arm64-bin.tar.gz - /go/artifacts/ - - aws s3 cp s3://$AWS_S3_BUCKET/teleport/$${S3_PATH}teleport-ent-v$${VERSION}-linux-arm64-bin.tar.gz - /go/artifacts/ - environment: - AWS_REGION: us-west-2 - AWS_S3_BUCKET: - from_secret: AWS_S3_BUCKET - volumes: - - name: awsconfig - path: /root/.aws -- name: Assume Build AWS Role - image: amazon/aws-cli - commands: - - aws sts get-caller-identity - - |- - printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - > /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile default - environment: - AWS_ACCESS_KEY_ID: - from_secret: TELEPORT_BUILD_USER_READ_ONLY_KEY - AWS_ROLE: - from_secret: TELEPORT_BUILD_READ_ONLY_AWS_ROLE - AWS_SECRET_ACCESS_KEY: - from_secret: TELEPORT_BUILD_USER_READ_ONLY_SECRET - volumes: - - name: awsconfig - path: /root/.aws -- name: Build artifacts - image: docker - commands: - - apk add --no-cache bash curl gzip make tar go - - apk add --no-cache aws-cli - - cd /go/src/github.com/gravitational/teleport - - export VERSION=$(cat /go/.version.txt) - - aws ecr-public get-login-password --region us-east-1 | docker login -u="AWS" --password-stdin - public.ecr.aws - - mkdir -m0700 $GNUPG_DIR - - echo "$GPG_RPM_SIGNING_ARCHIVE" | base64 -d | tar -xzf - -C $GNUPG_DIR - - chown -R root:root $GNUPG_DIR - - make rpm - - rm -rf $GNUPG_DIR - environment: - ARCH: arm64 - ENT_TARBALL_PATH: /go/artifacts - GNUPG_DIR: /tmpfs/gnupg - GPG_RPM_SIGNING_ARCHIVE: - from_secret: GPG_RPM_SIGNING_ARCHIVE - OSS_TARBALL_PATH: /go/artifacts - TMPDIR: /go - volumes: - - name: dockersock - path: /var/run - - name: awsconfig - path: /root/.aws - - name: tmpfs - path: /tmpfs -- name: Copy artifacts - image: docker - commands: - - cd /go/src/github.com/gravitational/teleport - - find build -maxdepth 1 -iname "teleport*.rpm*" -print -exec cp {} /go/artifacts - \; - - find e/build -maxdepth 1 -iname "teleport*.rpm*" -print -exec cp {} /go/artifacts - \; -- name: Assume Upload AWS Role - image: amazon/aws-cli - commands: - - aws sts get-caller-identity - - |- - printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - > /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile default - environment: - AWS_ACCESS_KEY_ID: - from_secret: AWS_ACCESS_KEY_ID - AWS_ROLE: - from_secret: AWS_ROLE - AWS_SECRET_ACCESS_KEY: - from_secret: AWS_SECRET_ACCESS_KEY - volumes: - - name: awsconfig - path: /root/.aws -- name: Upload to S3 - image: amazon/aws-cli - commands: - - cd /go/artifacts/ - - aws s3 sync . s3://$AWS_S3_BUCKET/teleport/tag/${DRONE_TAG##v} - environment: - AWS_REGION: us-west-2 - AWS_S3_BUCKET: - from_secret: AWS_S3_BUCKET - volumes: - - name: awsconfig - path: /root/.aws -- name: Register artifacts - image: docker - commands: - - WORKSPACE_DIR=$${WORKSPACE_DIR:-/} - - VERSION=$(cat "$WORKSPACE_DIR/go/.version.txt") - - RELEASES_HOST='https://releases-prod.platform.teleport.sh' - - echo "$RELEASES_CERT" | base64 -d > "$WORKSPACE_DIR/releases.crt" - - echo "$RELEASES_KEY" | base64 -d > "$WORKSPACE_DIR/releases.key" - - trap "rm -f '$WORKSPACE_DIR/releases.crt' '$WORKSPACE_DIR/releases.key'" EXIT - - CREDENTIALS="--cert $WORKSPACE_DIR/releases.crt --key $WORKSPACE_DIR/releases.key" - - which curl || apk add --no-cache curl - - |- - cd "$WORKSPACE_DIR/go/artifacts" - find . -type f ! -iname '*.sha256' ! -iname '*-unsigned.zip*' | while read -r file; do - # Skip files that are not results of this build - # (e.g. tarballs from which OS packages are made) - [ -f "$file.sha256" ] || continue - - name="$(basename "$file" | sed -E 's/(-|_)v?[0-9].*$//')" # extract part before -vX.Y.Z - description="Linux ARM64/ARMv8 (64-bit) RPM" - products="$name" - if [ "$name" = "tsh" ]; then - products="teleport teleport-ent" - elif [ "$name" = "Teleport Connect" -o "$name" = "teleport-connect" ]; then - description="Teleport Connect" - products="teleport teleport-ent" - fi - shasum="$(cat "$file.sha256" | cut -d ' ' -f 1)" - - release_params="" # List of "-F releaseId=XXX" parameters to curl - - for product in $products; do - status_code=$(curl $CREDENTIALS -o "$WORKSPACE_DIR/curl_out.txt" -w "%{http_code}" -F "product=$product" -F "version=$VERSION" -F notesMd="# Teleport $VERSION" -F status=draft "$RELEASES_HOST/releases") - if [ $status_code -ne 200 ] && [ $status_code -ne 409 ]; then - echo "curl HTTP status: $status_code" - cat $WORKSPACE_DIR/curl_out.txt + - name: Check out code + image: docker:git + commands: + - mkdir -p /go/src/github.com/gravitational/teleport + - cd /go/src/github.com/gravitational/teleport + - git clone https://github.com/gravitational/${DRONE_REPO_NAME}.git . + - git checkout ${DRONE_TAG:-$DRONE_COMMIT} + - mkdir -m 0700 /root/.ssh && echo -n "$GITHUB_PRIVATE_KEY" > /root/.ssh/id_rsa + && chmod 600 /root/.ssh/id_rsa + - ssh-keyscan -H github.com > /root/.ssh/known_hosts 2>/dev/null && chmod 600 /root/.ssh/known_hosts + - git submodule update --init e + - rm -f /root/.ssh/id_rsa + - mkdir -p /go/cache /go/artifacts + - |- + VERSION=$(egrep ^VERSION Makefile | cut -d= -f2) + if [ "$$VERSION" != "${DRONE_TAG##v}" ]; then + echo "Mismatch between Makefile version: $$VERSION and git tag: $DRONE_TAG" exit 1 fi + echo "$$VERSION" > /go/.version.txt + environment: + GITHUB_PRIVATE_KEY: + from_secret: GITHUB_PRIVATE_KEY + - name: Wait for docker + image: docker + commands: + - timeout 30s /bin/sh -c 'while [ ! -S /var/run/docker.sock ]; do sleep 1; done' + volumes: + - name: dockersock + path: /var/run + - name: Assume Download AWS Role + image: amazon/aws-cli + commands: + - aws sts get-caller-identity + - |- + printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + > /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile default + environment: + AWS_ACCESS_KEY_ID: + from_secret: AWS_ACCESS_KEY_ID + AWS_ROLE: + from_secret: AWS_ROLE + AWS_SECRET_ACCESS_KEY: + from_secret: AWS_SECRET_ACCESS_KEY + volumes: + - name: awsconfig + path: /root/.aws + - name: Download artifacts from S3 + image: amazon/aws-cli + commands: + - export VERSION=$(cat /go/.version.txt) + - if [[ "${DRONE_TAG}" != "" ]]; then export S3_PATH="tag/$${DRONE_TAG##v}/"; else + export S3_PATH="tag/"; fi + - aws s3 cp s3://$AWS_S3_BUCKET/teleport/$${S3_PATH}teleport-v$${VERSION}-linux-arm64-bin.tar.gz + /go/artifacts/ + - aws s3 cp s3://$AWS_S3_BUCKET/teleport/$${S3_PATH}teleport-ent-v$${VERSION}-linux-arm64-bin.tar.gz + /go/artifacts/ + environment: + AWS_REGION: us-west-2 + AWS_S3_BUCKET: + from_secret: AWS_S3_BUCKET + volumes: + - name: awsconfig + path: /root/.aws + - name: Assume Build AWS Role + image: amazon/aws-cli + commands: + - aws sts get-caller-identity + - |- + printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + > /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile default + environment: + AWS_ACCESS_KEY_ID: + from_secret: TELEPORT_BUILD_USER_READ_ONLY_KEY + AWS_ROLE: + from_secret: TELEPORT_BUILD_READ_ONLY_AWS_ROLE + AWS_SECRET_ACCESS_KEY: + from_secret: TELEPORT_BUILD_USER_READ_ONLY_SECRET + volumes: + - name: awsconfig + path: /root/.aws + - name: Build artifacts + image: docker + commands: + - apk add --no-cache bash curl gzip make tar go + - apk add --no-cache aws-cli + - cd /go/src/github.com/gravitational/teleport + - export VERSION=$(cat /go/.version.txt) + - aws ecr-public get-login-password --region us-east-1 | docker login -u="AWS" --password-stdin + public.ecr.aws + - mkdir -m0700 $GNUPG_DIR + - echo "$GPG_RPM_SIGNING_ARCHIVE" | base64 -d | tar -xzf - -C $GNUPG_DIR + - chown -R root:root $GNUPG_DIR + - make rpm + - rm -rf $GNUPG_DIR + environment: + ARCH: arm64 + ENT_TARBALL_PATH: /go/artifacts + GNUPG_DIR: /tmpfs/gnupg + GPG_RPM_SIGNING_ARCHIVE: + from_secret: GPG_RPM_SIGNING_ARCHIVE + OSS_TARBALL_PATH: /go/artifacts + TMPDIR: /go + volumes: + - name: dockersock + path: /var/run + - name: awsconfig + path: /root/.aws + - name: tmpfs + path: /tmpfs + - name: Copy artifacts + image: docker + commands: + - cd /go/src/github.com/gravitational/teleport + - find build -maxdepth 1 -iname "teleport*.rpm*" -print -exec cp {} /go/artifacts + \; + - find e/build -maxdepth 1 -iname "teleport*.rpm*" -print -exec cp {} /go/artifacts + \; + - name: Assume Upload AWS Role + image: amazon/aws-cli + commands: + - aws sts get-caller-identity + - |- + printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + > /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile default + environment: + AWS_ACCESS_KEY_ID: + from_secret: AWS_ACCESS_KEY_ID + AWS_ROLE: + from_secret: AWS_ROLE + AWS_SECRET_ACCESS_KEY: + from_secret: AWS_SECRET_ACCESS_KEY + volumes: + - name: awsconfig + path: /root/.aws + - name: Upload to S3 + image: amazon/aws-cli + commands: + - cd /go/artifacts/ + - aws s3 sync . s3://$AWS_S3_BUCKET/teleport/tag/${DRONE_TAG##v} + environment: + AWS_REGION: us-west-2 + AWS_S3_BUCKET: + from_secret: AWS_S3_BUCKET + volumes: + - name: awsconfig + path: /root/.aws + - name: Register artifacts + image: docker + commands: + - WORKSPACE_DIR=$${WORKSPACE_DIR:-/} + - VERSION=$(cat "$WORKSPACE_DIR/go/.version.txt") + - RELEASES_HOST='https://releases-prod.platform.teleport.sh' + - echo "$RELEASES_CERT" | base64 -d > "$WORKSPACE_DIR/releases.crt" + - echo "$RELEASES_KEY" | base64 -d > "$WORKSPACE_DIR/releases.key" + - trap "rm -f '$WORKSPACE_DIR/releases.crt' '$WORKSPACE_DIR/releases.key'" EXIT + - CREDENTIALS="--cert $WORKSPACE_DIR/releases.crt --key $WORKSPACE_DIR/releases.key" + - which curl || apk add --no-cache curl + - |- + cd "$WORKSPACE_DIR/go/artifacts" + find . -type f ! -iname '*.sha256' ! -iname '*-unsigned.zip*' | while read -r file; do + # Skip files that are not results of this build + # (e.g. tarballs from which OS packages are made) + [ -f "$file.sha256" ] || continue - release_params="$release_params -F releaseId=$product@$VERSION" - done + name="$(basename "$file" | sed -E 's/(-|_)v?[0-9].*$//')" # extract part before -vX.Y.Z + description="Linux ARM64/ARMv8 (64-bit) RPM" + products="$name" + if [ "$name" = "tsh" ]; then + products="teleport teleport-ent" + elif [ "$name" = "Teleport Connect" -o "$name" = "teleport-connect" ]; then + description="Teleport Connect" + products="teleport teleport-ent" + fi + shasum="$(cat "$file.sha256" | cut -d ' ' -f 1)" - curl $CREDENTIALS --fail -o /dev/null -F description="$description" -F os="linux" -F arch="arm64" -F "file=@$file" -F "sha256=$shasum" $release_params "$RELEASES_HOST/assets"; - done - environment: - RELEASES_CERT: - from_secret: RELEASES_CERT - RELEASES_KEY: - from_secret: RELEASES_KEY + release_params="" # List of "-F releaseId=XXX" parameters to curl + + for product in $products; do + status_code=$(curl $CREDENTIALS -o "$WORKSPACE_DIR/curl_out.txt" -w "%{http_code}" -F "product=$product" -F "version=$VERSION" -F notesMd="# Teleport $VERSION" -F status=draft "$RELEASES_HOST/releases") + if [ $status_code -ne 200 ] && [ $status_code -ne 409 ]; then + echo "curl HTTP status: $status_code" + cat $WORKSPACE_DIR/curl_out.txt + exit 1 + fi + + release_params="$release_params -F releaseId=$product@$VERSION" + done + + curl $CREDENTIALS --fail -o /dev/null -F description="$description" -F os="linux" -F arch="arm64" -F "file=@$file" -F "sha256=$shasum" $release_params "$RELEASES_HOST/assets"; + done + environment: + RELEASES_CERT: + from_secret: RELEASES_CERT + RELEASES_KEY: + from_secret: RELEASES_KEY services: -- name: Start Docker - image: docker:dind - privileged: true - volumes: - - name: tmpfs - path: /tmpfs - - name: dockersock - path: /var/run + - name: Start Docker + image: docker:dind + privileged: true + volumes: + - name: tmpfs + path: /tmpfs + - name: dockersock + path: /var/run volumes: -- name: dockersock - temp: {} -- name: awsconfig - temp: {} -- name: tmpfs - temp: - medium: memory + - name: dockersock + temp: {} + - name: awsconfig + temp: {} + - name: tmpfs + temp: + medium: memory --- ################################################ @@ -5590,17 +5590,17 @@ steps: - name: Assume Download AWS Role image: amazon/aws-cli commands: - - aws sts get-caller-identity - - |- - printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - > /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile default + - aws sts get-caller-identity + - |- + printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + > /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile default environment: AWS_ACCESS_KEY_ID: from_secret: AWS_ACCESS_KEY_ID @@ -5629,17 +5629,17 @@ steps: - name: Assume Packer AWS Role image: amazon/aws-cli commands: - - aws sts get-caller-identity - - |- - printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - > /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile default + - aws sts get-caller-identity + - |- + printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + > /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile default environment: AWS_ACCESS_KEY_ID: from_secret: AWS_PACKER_ACCESS_KEY_ID @@ -5676,17 +5676,17 @@ steps: - name: Assume S3 Timestamp Sync AWS Role image: amazon/aws-cli commands: - - aws sts get-caller-identity - - |- - printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - > /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile default + - aws sts get-caller-identity + - |- + printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + > /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile default environment: AWS_ACCESS_KEY_ID: from_secret: AWS_ACCESS_KEY_ID @@ -5764,17 +5764,17 @@ steps: - name: Assume Download AWS Role image: amazon/aws-cli commands: - - aws sts get-caller-identity - - |- - printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - > /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile default + - aws sts get-caller-identity + - |- + printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + > /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile default environment: AWS_ACCESS_KEY_ID: from_secret: AWS_ACCESS_KEY_ID @@ -5804,17 +5804,17 @@ steps: - name: Assume Packer AWS Role image: amazon/aws-cli commands: - - aws sts get-caller-identity - - |- - printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - > /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile default + - aws sts get-caller-identity + - |- + printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + > /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile default environment: AWS_ACCESS_KEY_ID: from_secret: AWS_PACKER_ACCESS_KEY_ID @@ -5852,17 +5852,17 @@ steps: - name: Assume S3 Timestamp Sync AWS Role image: amazon/aws-cli commands: - - aws sts get-caller-identity - - |- - printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ - $(aws sts assume-role \ - --role-arn "$AWS_ROLE" \ - --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ - --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ - --output text) \ - > /root/.aws/credentials - - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY - - aws sts get-caller-identity --profile default + - aws sts get-caller-identity + - |- + printf "[default]\naws_access_key_id = %s\naws_secret_access_key = %s\naws_session_token = %s\n" \ + $(aws sts assume-role \ + --role-arn "$AWS_ROLE" \ + --role-session-name $(echo "drone-${DRONE_REPO}-${DRONE_BUILD_NUMBER}" | sed "s|/|-|g") \ + --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]" \ + --output text) \ + > /root/.aws/credentials + - unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY + - aws sts get-caller-identity --profile default environment: AWS_ACCESS_KEY_ID: from_secret: AWS_ACCESS_KEY_ID @@ -6162,60 +6162,132 @@ steps: - mkdir -pv "/go/vars" - (go run ./cmd/check -tag ${DRONE_TAG} -check prerelease && echo "promote" || echo "build") > "/go/vars/release-environment.txt" + depends_on: + - Check out code - name: Publish Teleport to stable/${DRONE_TAG} apt repo image: golang:1.18-alpine pull: if-not-exists commands: - cd "/go/src/github.com/gravitational/teleport/build.assets/tooling" - 'go run ./cmd/gh-trigger-workflow -owner ${DRONE_REPO_OWNER} -repo teleport.e - -tag-workflow -series-run -timeout 12h0m0s -workflow deploy-packages.yaml -workflow-ref=refs/heads/master - -input "artifact-tag=${DRONE_TAG}" -input "environment=$(cat "/go/vars/release-environment.txt")" - -input "package-name-filter=$($DRONE_REPO_PRIVATE && echo "*ent*" || echo "")" - -input "package-to-test=teleport-ent" -input "release-channel=stable" -input "repo-type=apt" - -input "version-channel=${DRONE_TAG}" ' + -tag-workflow -series-run -series-run-filter .*apt.* -timeout 12h0m0s -workflow + deploy-packages.yaml -workflow-ref=refs/heads/master -input "artifact-tag=${DRONE_TAG}" + -input "environment=$(cat "/go/vars/release-environment.txt")" -input "package-name-filter=$($DRONE_REPO_PRIVATE + && echo "*ent*" || echo "")" -input "package-to-test=teleport-ent" -input "release-channel=stable" + -input "repo-type=apt" -input "version-channel=${DRONE_TAG}" ' environment: GHA_APP_KEY: from_secret: GITHUB_WORKFLOW_APP_PRIVATE_KEY + depends_on: + - Determine if release should go to development or production +- name: Wait - Publish Teleport to stable/${DRONE_TAG} yum repo + image: alpine:latest + commands: + - sleep 10 + depends_on: + - Determine if release should go to development or production - name: Publish Teleport to stable/${DRONE_TAG} yum repo image: golang:1.18-alpine pull: if-not-exists commands: - cd "/go/src/github.com/gravitational/teleport/build.assets/tooling" - 'go run ./cmd/gh-trigger-workflow -owner ${DRONE_REPO_OWNER} -repo teleport.e - -tag-workflow -series-run -timeout 12h0m0s -workflow deploy-packages.yaml -workflow-ref=refs/heads/master - -input "artifact-tag=${DRONE_TAG}" -input "environment=$(cat "/go/vars/release-environment.txt")" - -input "package-name-filter=$($DRONE_REPO_PRIVATE && echo "*ent*" || echo "")" - -input "package-to-test=teleport-ent" -input "release-channel=stable" -input "repo-type=yum" - -input "version-channel=${DRONE_TAG}" ' + -tag-workflow -series-run -series-run-filter .*yum.* -timeout 12h0m0s -workflow + deploy-packages.yaml -workflow-ref=refs/heads/master -input "artifact-tag=${DRONE_TAG}" + -input "environment=$(cat "/go/vars/release-environment.txt")" -input "package-name-filter=$($DRONE_REPO_PRIVATE + && echo "*ent*" || echo "")" -input "package-to-test=teleport-ent" -input "release-channel=stable" + -input "repo-type=yum" -input "version-channel=${DRONE_TAG}" ' environment: GHA_APP_KEY: from_secret: GITHUB_WORKFLOW_APP_PRIVATE_KEY + depends_on: + - Wait - Publish Teleport to stable/${DRONE_TAG} yum repo +- name: Wait - Publish teleport-ent-updater to stable/cloud apt repo + image: alpine:latest + commands: + - sleep 20 + depends_on: + - Determine if release should go to development or production - name: Publish teleport-ent-updater to stable/cloud apt repo image: golang:1.18-alpine pull: if-not-exists commands: - cd "/go/src/github.com/gravitational/teleport/build.assets/tooling" - 'go run ./cmd/gh-trigger-workflow -owner ${DRONE_REPO_OWNER} -repo teleport.e - -tag-workflow -series-run -timeout 12h0m0s -workflow deploy-packages.yaml -workflow-ref=refs/heads/master - -input "artifact-tag=${DRONE_TAG}" -input "environment=$(cat "/go/vars/release-environment.txt")" - -input "package-name-filter=teleport-ent-updater*" -input "release-channel=stable" - -input "repo-type=apt" -input "version-channel=cloud" ' + -tag-workflow -series-run -series-run-filter .*apt.* -timeout 12h0m0s -workflow + deploy-packages.yaml -workflow-ref=refs/heads/master -input "artifact-tag=${DRONE_TAG}" + -input "environment=$(cat "/go/vars/release-environment.txt")" -input "package-name-filter=teleport-ent-updater*" + -input "release-channel=stable" -input "repo-type=apt" -input "version-channel=cloud" ' environment: GHA_APP_KEY: from_secret: GITHUB_WORKFLOW_APP_PRIVATE_KEY + depends_on: + - Wait - Publish teleport-ent-updater to stable/cloud apt repo +- name: Wait - Publish teleport-ent-updater to stable/cloud yum repo + image: alpine:latest + commands: + - sleep 30 + depends_on: + - Determine if release should go to development or production - name: Publish teleport-ent-updater to stable/cloud yum repo image: golang:1.18-alpine pull: if-not-exists commands: - cd "/go/src/github.com/gravitational/teleport/build.assets/tooling" - 'go run ./cmd/gh-trigger-workflow -owner ${DRONE_REPO_OWNER} -repo teleport.e - -tag-workflow -series-run -timeout 12h0m0s -workflow deploy-packages.yaml -workflow-ref=refs/heads/master - -input "artifact-tag=${DRONE_TAG}" -input "environment=$(cat "/go/vars/release-environment.txt")" - -input "package-name-filter=teleport-ent-updater*" -input "release-channel=stable" - -input "repo-type=yum" -input "version-channel=cloud" ' + -tag-workflow -series-run -series-run-filter .*yum.* -timeout 12h0m0s -workflow + deploy-packages.yaml -workflow-ref=refs/heads/master -input "artifact-tag=${DRONE_TAG}" + -input "environment=$(cat "/go/vars/release-environment.txt")" -input "package-name-filter=teleport-ent-updater*" + -input "release-channel=stable" -input "repo-type=yum" -input "version-channel=cloud" ' environment: GHA_APP_KEY: from_secret: GITHUB_WORKFLOW_APP_PRIVATE_KEY + depends_on: + - Wait - Publish teleport-ent-updater to stable/cloud yum repo +- name: Wait - Publish Teleport to stable/rolling apt repo + image: alpine:latest + commands: + - sleep 40 + depends_on: + - Determine if release should go to development or production +- name: Publish Teleport to stable/rolling apt repo + image: golang:1.18-alpine + pull: if-not-exists + commands: + - cd "/go/src/github.com/gravitational/teleport/build.assets/tooling" + - 'go run ./cmd/gh-trigger-workflow -owner ${DRONE_REPO_OWNER} -repo teleport.e + -tag-workflow -series-run -series-run-filter .*apt.* -timeout 12h0m0s -workflow + deploy-packages.yaml -workflow-ref=refs/heads/master -input "artifact-tag=${DRONE_TAG}" + -input "environment=$(cat "/go/vars/release-environment.txt")" -input "package-name-filter=$($DRONE_REPO_PRIVATE + && echo "*ent*" || echo "")" -input "package-to-test=teleport-ent" -input "release-channel=stable" + -input "repo-type=apt" -input "version-channel=rolling" ' + environment: + GHA_APP_KEY: + from_secret: GITHUB_WORKFLOW_APP_PRIVATE_KEY + depends_on: + - Wait - Publish Teleport to stable/rolling apt repo +- name: Wait - Publish Teleport to stable/rolling yum repo + image: alpine:latest + commands: + - sleep 50 + depends_on: + - Determine if release should go to development or production +- name: Publish Teleport to stable/rolling yum repo + image: golang:1.18-alpine + pull: if-not-exists + commands: + - cd "/go/src/github.com/gravitational/teleport/build.assets/tooling" + - 'go run ./cmd/gh-trigger-workflow -owner ${DRONE_REPO_OWNER} -repo teleport.e + -tag-workflow -series-run -series-run-filter .*yum.* -timeout 12h0m0s -workflow + deploy-packages.yaml -workflow-ref=refs/heads/master -input "artifact-tag=${DRONE_TAG}" + -input "environment=$(cat "/go/vars/release-environment.txt")" -input "package-name-filter=$($DRONE_REPO_PRIVATE + && echo "*ent*" || echo "")" -input "package-to-test=teleport-ent" -input "release-channel=stable" + -input "repo-type=yum" -input "version-channel=rolling" ' + environment: + GHA_APP_KEY: + from_secret: GITHUB_WORKFLOW_APP_PRIVATE_KEY + depends_on: + - Wait - Publish Teleport to stable/rolling yum repo image_pull_secrets: - DOCKERHUB_CREDENTIALS @@ -6311,7 +6383,7 @@ steps: - name: Upload artifacts to production S3 image: amazon/aws-cli environment: - AWS_REGION: us-east-1 + AWS_REGION: us-east-1 AWS_S3_BUCKET: from_secret: PRODUCTION_AWS_S3_BUCKET volumes: @@ -6436,7 +6508,7 @@ steps: - name: "Helm: Download chart repository" image: amazon/aws-cli environment: - AWS_REGION: us-west-2 + AWS_REGION: us-west-2 AWS_S3_BUCKET: from_secret: PRODUCTION_CHARTS_AWS_S3_BUCKET volumes: @@ -6487,7 +6559,7 @@ steps: - name: "Helm: Publish chart repository to S3" image: amazon/aws-cli environment: - AWS_REGION: us-west-2 + AWS_REGION: us-west-2 AWS_S3_BUCKET: from_secret: PRODUCTION_CHARTS_AWS_S3_BUCKET volumes: @@ -6550,12 +6622,12 @@ steps: - name: awsconfig path: /root/.aws commands: - - mkdir -p /rpmrepo/teleport/cache - # we explicitly want to delete anything present locally which has been deleted - # from the upstream S3 bucket - - aws s3 sync s3://$AWS_S3_BUCKET/teleport/ /rpmrepo/teleport/ --delete - - mkdir -p /rpmrepo/teleport/${DRONE_TAG##v} - - cp -a /go/artifacts/*.rpm /rpmrepo/teleport/${DRONE_TAG##v}/ + - mkdir -p /rpmrepo/teleport/cache + # we explicitly want to delete anything present locally which has been deleted + # from the upstream S3 bucket + - aws s3 sync s3://$AWS_S3_BUCKET/teleport/ /rpmrepo/teleport/ --delete + - mkdir -p /rpmrepo/teleport/${DRONE_TAG##v} + - cp -a /go/artifacts/*.rpm /rpmrepo/teleport/${DRONE_TAG##v}/ # we do this using a CentOS 7 container to make sure that the repo files are # compatible with older versions, also there's no createrepo package in alpine main @@ -6565,8 +6637,8 @@ steps: - name: rpmrepo path: /rpmrepo commands: - - yum -y install createrepo - - createrepo --cachedir /rpmrepo/teleport/cache --update /rpmrepo/teleport + - yum -y install createrepo + - createrepo --cachedir /rpmrepo/teleport/cache --update /rpmrepo/teleport # This step requires centos:8 to get gpg 2.2+ # centos:7's gpg 2.0 doesn't understand the format of GPG_RPM_SIGNING_ARCHIVE @@ -6604,7 +6676,7 @@ steps: - name: awsconfig path: /root/.aws commands: - - aws s3 sync /rpmrepo/teleport/ s3://$AWS_S3_BUCKET/teleport/ + - aws s3 sync /rpmrepo/teleport/ s3://$AWS_S3_BUCKET/teleport/ # This step skips all remaining steps in the pipeline if the tag # is not the highest semver *ever* released, to avoid publishing DEBs @@ -6652,10 +6724,10 @@ steps: - name: awsconfig path: /root/.aws commands: - # we explicitly want to delete anything present locally which has been deleted - # from the upstream S3 bucket - - mkdir -p /debrepo/teleport - - aws s3 sync s3://$AWS_S3_BUCKET/teleport /debrepo/teleport --delete + # we explicitly want to delete anything present locally which has been deleted + # from the upstream S3 bucket + - mkdir -p /debrepo/teleport + - aws s3 sync s3://$AWS_S3_BUCKET/teleport /debrepo/teleport --delete - name: Build DEB repo image: ubuntu:20.04 @@ -16997,6 +17069,6 @@ image_pull_secrets: - DOCKERHUB_CREDENTIALS --- kind: signature -hmac: 2236d84644bcfbea2a7633251a0ca64647c411fdfbc6f89eb1055e933bfc3bd8 +hmac: a0cd6e281f864553c31bf642861283cdfa54275907721fcbd1949b3ca239a3e1 ... diff --git a/build.assets/tooling/cmd/gh-trigger-workflow/args.go b/build.assets/tooling/cmd/gh-trigger-workflow/args.go index 4555c31d113..a02db715353 100644 --- a/build.assets/tooling/cmd/gh-trigger-workflow/args.go +++ b/build.assets/tooling/cmd/gh-trigger-workflow/args.go @@ -67,16 +67,17 @@ func (k *key) Set(s string) error { // args holds the parsed command-line arguments for the command. type args struct { - appID int64 - appKey key - owner string - repo string - workflow string - workflowRef string - useWorkflowTag bool - seriesRun bool - timeout time.Duration - inputs inputMap + appID int64 + appKey key + owner string + repo string + workflow string + workflowRef string + useWorkflowTag bool + seriesRun bool + seriesRunFilter string + timeout time.Duration + inputs inputMap } func parseCommandLine() (args, error) { @@ -95,6 +96,7 @@ func parseCommandLine() (args, error) { flag.StringVar(&cliArgs.workflowRef, "workflow-ref", cliArgs.workflowRef, "Revision reference") flag.BoolVar(&cliArgs.useWorkflowTag, "tag-workflow", false, "Use a workflow input to tag and ID workflows spawned by the event") flag.BoolVar(&cliArgs.seriesRun, "series-run", false, "Attempts to wait for any workflows scheduled but not completed before starting this one") + flag.StringVar(&cliArgs.seriesRunFilter, "series-run-filter", ".*", "Regexp filter to apply when determining what workflow runs should should be waited on, defaulting to \".*\"") flag.DurationVar(&cliArgs.timeout, "timeout", time.Duration(0), "Timeout. If not specified, waits forever.") flag.Var(cliArgs.inputs, "input", "Input to target workflow") diff --git a/build.assets/tooling/cmd/gh-trigger-workflow/main.go b/build.assets/tooling/cmd/gh-trigger-workflow/main.go index afb0c11e59c..8ab57e8590c 100644 --- a/build.assets/tooling/cmd/gh-trigger-workflow/main.go +++ b/build.assets/tooling/cmd/gh-trigger-workflow/main.go @@ -50,6 +50,7 @@ import ( "flag" "log" "net/http" + "regexp" "strings" "time" @@ -188,12 +189,21 @@ func getIncompleteWorkflowRunID(ctx context.Context, gh *ghapi.Client, args args return nil, trace.Wrap(err, "failed to get a list of current workflow runs") } + regex, err := regexp.Compile(args.seriesRunFilter) + if err != nil { + return nil, trace.Wrap(err, "failed to compile series run regex %q", args.seriesRunFilter) + } + for _, recentRun := range recentRuns { runStatus := recentRun.GetStatus() if runStatus == "" { return nil, trace.Errorf("failed to get status for run ID %q", recentRun.GetID()) } + if !regex.MatchString(*recentRun.Name) { + continue + } + if runStatus != "completed" { return recentRun, nil } diff --git a/dronegen/gha.go b/dronegen/gha.go index f54cad47257..c1e9d416c7f 100644 --- a/dronegen/gha.go +++ b/dronegen/gha.go @@ -33,16 +33,18 @@ type ghaWorkflow struct { slackOnError bool shouldTagWorkflow bool seriesRun bool + seriesRunFilter string inputs map[string]string } type ghaBuildType struct { buildType trigger - pipelineName string - checkoutPath string - dependsOn []string - workflows []ghaWorkflow + pipelineName string + checkoutPath string + dependsOn []string + workflows []ghaWorkflow + enableParallelWorkflowRuns bool } func ghaBuildPipeline(ghaBuild ghaBuildType) pipeline { @@ -73,19 +75,67 @@ func ghaMultiBuildPipeline(setupSteps []step, ghaBuild ghaBuildType) pipeline { }, } + setupStepNames := getStepNames(p.Steps) + if ghaBuild.enableParallelWorkflowRuns && len(setupSteps) >= 1 { + for index := range setupSteps { + setupSteps[index].DependsOn = append(setupSteps[index].DependsOn, setupStepNames...) + } + setupStepNames = getStepNames(setupSteps) + } + p.Steps = append(p.Steps, setupSteps...) - for _, workflow := range ghaBuild.workflows { - p.Steps = append(p.Steps, buildGHAWorkflowCallStep(workflow, checkoutPath)) - - if workflow.slackOnError { - p.Steps = append(p.Steps, sendErrorToSlackStep()) - } + for counter, workflow := range ghaBuild.workflows { + // This wait time is to avoid a GHA pending/queuing issue where multiple workflows fired off at the same time + // (or somewhat close to the same time) will cause only one workflow to be queued, with the others being canceled. + // For details, see + // https://docs.github.com/en/actions/using-jobs/using-concurrency#example-only-cancel-in-progress-jobs-or-runs-for-the-current-workflow:~:text=When%20a%20concurrent,progress%3A%20true. + sleepTime := time.Duration(counter*10) * time.Second // 10 seconds for each workflow + p.Steps = append(p.Steps, buildWorkflowSteps(workflow, checkoutPath, ghaBuild.enableParallelWorkflowRuns, sleepTime, setupStepNames)...) } return p } +func buildWorkflowSteps(workflow ghaWorkflow, checkoutPath string, enableParallelWorkflowRuns bool, sleepTime time.Duration, setupStepNames []string) []step { + var steps []step + workflowStep := buildGHAWorkflowCallStep(workflow, checkoutPath) + + if enableParallelWorkflowRuns { + if sleepTime > 0 { + sleepStep := sleepStep(sleepTime, setupStepNames, workflow.stepName) + steps = append(steps, sleepStep) + workflowStep.DependsOn = append(workflowStep.DependsOn, sleepStep.Name) + } else { + workflowStep.DependsOn = append(workflowStep.DependsOn, setupStepNames...) + } + } + + steps = append(steps, workflowStep) + + if workflow.slackOnError { + slackStep := sendErrorToSlackStep() + if enableParallelWorkflowRuns { + slackStep.DependsOn = append(slackStep.DependsOn, workflowStep.Name) + } + + steps = append(steps, slackStep) + } + + return steps +} + +func sleepStep(sleepTime time.Duration, setupStepNames []string, stepNameSuffix string) step { + return step{ + Name: fmt.Sprintf("Wait - %s", stepNameSuffix), + Image: "alpine:latest", + Commands: []string{ + fmt.Sprintf("sleep %v", sleepTime.Round(time.Second).Seconds()), + }, + DependsOn: setupStepNames, + } +} + func buildGHAWorkflowCallStep(workflow ghaWorkflow, checkoutPath string) step { var cmd strings.Builder cmd.WriteString(`go run ./cmd/gh-trigger-workflow `) @@ -98,6 +148,10 @@ func buildGHAWorkflowCallStep(workflow ghaWorkflow, checkoutPath string) step { if workflow.seriesRun { cmd.WriteString(`-series-run `) + + if workflow.seriesRunFilter != "" { + fmt.Fprintf(&cmd, `-series-run-filter %s `, workflow.seriesRunFilter) + } } fmt.Fprintf(&cmd, `-timeout %s `, workflow.timeout.String()) diff --git a/dronegen/os_repos.go b/dronegen/os_repos.go index 792f64ce094..f8cdac804b9 100644 --- a/dronegen/os_repos.go +++ b/dronegen/os_repos.go @@ -42,6 +42,13 @@ func promoteBuildOsRepoPipeline() pipeline { packageNameFilter: `teleport-ent-updater*`, displayName: "teleport-ent-updater", }, + // Rolling release pipelines + { + versionChannel: "rolling", + packageNameFilter: `$($DRONE_REPO_PRIVATE && echo "*ent*" || echo "")`, + packageToTest: "teleport-ent", + displayName: "Teleport", + }, } return buildPromoteOsPackagePipelines(packageDeployments) @@ -52,10 +59,11 @@ func buildPromoteOsPackagePipelines(packageDeployments []osPackageDeployment) pi clonePath := "/go/src/github.com/gravitational/teleport" ghaBuild := ghaBuildType{ - trigger: triggerPromote, - pipelineName: "publish-os-package-repos", - checkoutPath: clonePath, - workflows: buildWorkflows(releaseEnvironmentFilePath, packageDeployments), + trigger: triggerPromote, + pipelineName: "publish-os-package-repos", + checkoutPath: clonePath, + workflows: buildWorkflows(releaseEnvironmentFilePath, packageDeployments), + enableParallelWorkflowRuns: true, } setupSteps := []step{ { @@ -97,6 +105,7 @@ func buildWorkflows(releaseEnvironmentFilePath string, packageDeployments []osPa timeout: 12 * time.Hour, // DR takes a long time shouldTagWorkflow: true, seriesRun: true, + seriesRunFilter: fmt.Sprintf(".*%s.*", repoType), inputs: inputs, }) } diff --git a/e b/e index 3c75006c294..81061bbb87a 160000 --- a/e +++ b/e @@ -1 +1 @@ -Subproject commit 3c75006c29478bb4b5b693a8819a904ca198f36e +Subproject commit 81061bbb87a369b89d39b47c3a326906b3c54eb7