CI: use OIDC for CodeCov #1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Statistician Test and Push | ||
| env: | ||
| IMAGE_NAME: opendatacube/datacube-statistician | ||
| on: | ||
| pull_request: | ||
| paths: | ||
| - 'docker/**' | ||
| - '!docker/readme.md' | ||
| push: | ||
| branches: | ||
| - develop | ||
| paths: | ||
| - 'docker/**' | ||
| - '!docker/readme.md' | ||
| workflow_run: | ||
| workflows: ["Publish to S3 and PyPI"] | ||
| branches: [develop] | ||
| types: | ||
| - completed | ||
| env: | ||
| DOCKER_IMAGE: ghcr.io/opendatacube/odc-stats | ||
| permissions: | ||
| id-token: write # This is required for requesting the JWT | ||
| contents: read # This is required for actions/checkout | ||
| packages: write # This is required for pushing to ghcr | ||
| jobs: | ||
| test: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | ||
| - name: lint Dockerfile | ||
| uses: hadolint/hadolint-action@54c9adbab1582c2ef04b2016b760714a4bfde3cf # v3.1.0 | ||
| with: | ||
| dockerfile: docker/Dockerfile | ||
| ignore: DL3008,DL3002,DL3013,DL3059,SC2102 | ||
| - name: Build Statistician image | ||
| timeout-minutes: 20 | ||
| shell: bash | ||
| run: | | ||
| cd docker | ||
| docker compose build | ||
| - name: Run Dockerized Tests for Statistician | ||
| shell: bash | ||
| run: | | ||
| cd docker | ||
| make test | ||
| set_tags: | ||
| if: github.ref == 'refs/heads/develop' | ||
| && (github.event_name == 'push' || (github.event_name == 'workflow_run' && | ||
| github.event.workflow_run.conclusion == 'success')) | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | ||
| - name: Build a new docker image with tag | ||
| id: tag-image | ||
| run: | | ||
| echo "TAG=dev$(git rev-parse --short HEAD)" \ | ||
| >> $GITHUB_OUTPUT | ||
| outputs: | ||
| image_tag: ${{ steps.tag-image.outputs.TAG }} | ||
| push_ecr: | ||
| if: github.ref == 'refs/heads/develop' | ||
| && (needs.set_tags.outputs.image_tag) | ||
| needs: [test, set_tags] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | ||
| - name: Configure AWS credentials | ||
| uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1 | ||
| with: | ||
| role-to-assume: arn:aws:iam::538673716275:role/github-actions-role | ||
| aws-region: ap-southeast-2 | ||
| - name: Push image to ECR | ||
| uses: whoan/docker-build-with-cache-action@d8d3ad518e7ac382b880720d0751815e656fe032 # v8.1.0 | ||
| with: | ||
| context: ./docker | ||
| registry: 538673716275.dkr.ecr.ap-southeast-2.amazonaws.com | ||
| image_name: ${{ env.IMAGE_NAME }} | ||
| image_tag: latest,${{ needs.set_tags.outputs.image_tag }} | ||
| build_extra_args: '{"--build-arg": "UPDATE_VERSION=${{ needs.set_tags.outputs.image_tag }}"}' | ||
| push_public: | ||
| if: github.ref == 'refs/heads/develop' | ||
| && (needs.set_tags.outputs.image_tag) | ||
| needs: [test, set_tags] | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | ||
| - name: Push image to ghcr | ||
| uses: whoan/docker-build-with-cache-action@d8d3ad518e7ac382b880720d0751815e656fe032 # v8.1.0 | ||
| with: | ||
| context: ./docker | ||
| registry: ghcr.io | ||
| username: ${{ github.actor }} | ||
| password: ${{ secrets.GITHUB_TOKEN }} | ||
| image_name: ${{ env.DOCKER_IMAGE }} | ||
| image_tag: latest,${{ needs.set_tags.outputs.image_tag }} | ||
| build_extra_args: '{"--build-arg": "UPDATE_VERSION=${{ needs.set_tags.outputs.image_tag }}"}' | ||
