Build fat image #807
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build fat image | |
| 'on': | |
| workflow_dispatch: | |
| # checkov:skip=CKV_GHA_7: "The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. " | |
| inputs: | |
| ci_cloud: | |
| description: 'Select the CI_CLOUD' | |
| required: true | |
| type: choice | |
| options: | |
| - default | |
| - LEAFCLOUD | |
| - SMS | |
| - ARCUS | |
| default: default # Use repo CI_CLOUD setting | |
| cleanup_on_failure: | |
| description: Cleanup Packer resources on failure | |
| type: boolean | |
| required: true | |
| default: true | |
| permissions: {} | |
| jobs: | |
| openstack: | |
| name: openstack-imagebuild | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }}-${{ matrix.build.image_name }} # to branch/PR + OS | |
| cancel-in-progress: true | |
| runs-on: ubuntu-24.04 | |
| strategy: | |
| fail-fast: false # allow other matrix jobs to continue even if one fails | |
| matrix: # build RL8, RL9 | |
| build: | |
| - image_name: openhpc-RL8 | |
| source_image_name: Rocky-8-GenericCloud-Base-8.10-20240528.0.x86_64.qcow2 | |
| inventory_groups: fatimage | |
| - image_name: openhpc-RL9 | |
| source_image_name: Rocky-9-GenericCloud-Base-9.7-20251123.2.x86_64.qcow2 | |
| inventory_groups: fatimage | |
| env: | |
| ANSIBLE_FORCE_COLOR: 'true' | |
| OS_CLOUD: openstack | |
| CI_CLOUD: ${{ github.event.inputs.ci_cloud == 'default' && vars.CI_CLOUD || github.event.inputs.ci_cloud }} | |
| ARK_PASSWORD: ${{ secrets.ARK_PASSWORD }} | |
| PACKER_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PACKER_ON_ERROR: ${{ github.event.inputs.cleanup_on_failure == 'true' && 'cleanup' || 'abort' }} | |
| steps: | |
| - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 | |
| with: | |
| persist-credentials: false | |
| - name: Record settings for CI cloud | |
| run: | | |
| echo "CI_CLOUD: ${CI_CLOUD}" | tee -a "$GITHUB_STEP_SUMMARY" | |
| echo "PACKER_ON_ERROR | tee -a ${PACKER_ON_ERROR}" | |
| - name: Setup ssh | |
| run: | | |
| set -x | |
| mkdir ~/.ssh | |
| echo "$SECRETS_SSH_KEY" > ~/.ssh/id_rsa | |
| chmod 0600 ~/.ssh/id_rsa | |
| ssh-keygen -f ~/.ssh/id_rsa -y # tests key format is correct | |
| shell: bash | |
| env: | |
| SECRETS_SSH_KEY: ${{ secrets[format('{0}_SSH_KEY', env.CI_CLOUD)] }} # zizmor: ignore[overprovisioned-secrets] | |
| - name: Add bastion ssh fingerprints to known_hosts | |
| run: | | |
| cat >> ~/.ssh/known_hosts <<< "${VARS_BASTION_FINGERPRINTS}" | |
| shell: bash | |
| env: | |
| VARS_BASTION_FINGERPRINTS: ${{ vars.BASTION_FINGERPRINTS }} | |
| - name: Install ansible etc | |
| run: dev/setup-env.sh | |
| - name: Write clouds.yaml | |
| run: | | |
| mkdir -p ~/.config/openstack/ | |
| echo "$SECRETS_CLOUD" > ~/.config/openstack/clouds.yaml | |
| shell: bash | |
| env: | |
| SECRETS_CLOUD: ${{ secrets[format('{0}_CLOUDS_YAML', env.CI_CLOUD)] }} # zizmor: ignore[overprovisioned-secrets] | |
| - name: Setup environment | |
| run: | | |
| . venv/bin/activate | |
| . environments/.stackhpc/activate | |
| - name: Build fat image with packer | |
| id: packer_build | |
| run: | | |
| set -x | |
| . venv/bin/activate | |
| . environments/.stackhpc/activate | |
| cd packer/ | |
| packer init . | |
| PACKER_LOG=1 packer build \ | |
| -on-error="$PACKER_ON_ERROR" \ | |
| -var-file="$PKR_VAR_environment_root/${CI_CLOUD}.pkrvars.hcl" \ | |
| -var "source_image_name=$MATRIX_BUILD_SOURCE_IMAGE_NAME" \ | |
| -var "image_name=$MATRIX_BUILD_IMAGE_NAME" \ | |
| -var "inventory_groups=$MATRIX_BUILD_INVENTORY_GROUPS" \ | |
| openstack.pkr.hcl | |
| env: | |
| MATRIX_BUILD_SOURCE_IMAGE_NAME: ${{ matrix.build.source_image_name }} | |
| MATRIX_BUILD_IMAGE_NAME: ${{ matrix.build.image_name }} | |
| MATRIX_BUILD_INVENTORY_GROUPS: ${{ matrix.build.inventory_groups }} | |
| - name: Get created image names from manifest | |
| id: manifest | |
| run: | | |
| . venv/bin/activate | |
| IMAGE_ID=$(jq --raw-output '.builds[-1].artifact_id' packer/packer-manifest.json) | |
| while ! openstack image show -f value -c name "$IMAGE_ID"; do | |
| sleep 5 | |
| done | |
| IMAGE_NAME=$(openstack image show -f value -c name "$IMAGE_ID") | |
| echo "image-name=${IMAGE_NAME}" | tee -a "$GITHUB_OUTPUT" "$GITHUB_STEP_SUMMARY" | |
| echo "image-id=$IMAGE_ID" | tee -a "$GITHUB_OUTPUT" "$GITHUB_STEP_SUMMARY" | |
| echo "$IMAGE_ID" > image-id.txt | |
| echo "$IMAGE_NAME" > image-name.txt | |
| - name: Make image usable for further builds | |
| run: | | |
| . venv/bin/activate | |
| openstack image unset --property signature_verified "${STEPS_MANIFEST_OUTPUTS_IMAGE_ID}" || true | |
| env: | |
| STEPS_MANIFEST_OUTPUTS_IMAGE_ID: ${{ steps.manifest.outputs.image-id }} | |
| - name: Set image properties | |
| run: | | |
| . venv/bin/activate | |
| . dev/image-set-properties.sh "${STEPS_MANIFEST_OUTPUTS_IMAGE_ID}" | |
| env: | |
| STEPS_MANIFEST_OUTPUTS_IMAGE_ID: ${{ steps.manifest.outputs.image-id }} | |
| - name: Upload manifest artifact | |
| uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 | |
| with: | |
| name: image-details-${{ matrix.build.image_name }} | |
| path: | | |
| ./image-id.txt | |
| ./image-name.txt | |
| overwrite: true |