introduce an automation for GHA runner version update #3034
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| name: Bump GHA runner version (WIP) | ||
| on: | ||
| # schedule: | ||
| # - cron: '30 6 1,15 * *' # Monthly on the 1st and 15th at 06:30 | ||
| workflow_dispatch: | ||
|
|
||
| jobs: | ||
| bump_gha_runner_version: | ||
| runs-on: ubuntu-24.04 | ||
| name: Bump GHA runner version | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | ||
|
|
||
| - name: Check for the latest version and create a PR to splice | ||
| uses: ./.github/actions/nix/run_bash_command_in_nix | ||
| with: | ||
| cmd: | | ||
| git config user.email "[email protected]" | ||
| git config user.name "DA Automation" | ||
| ./scripts/bump_gha_runner_version.sh | ||
| additional_nix_args: "--keep GH_TOKEN" | ||
| env: | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,7 +1,10 @@ | ||
| ARG RUNNER_VERSION=2.328.0 | ||
| ARG RUNNER_DIGEST=sha256:db0dcae6d28559e54277755a33aba7d0665f255b3bd2a66cdc5e132712f155e0 | ||
|
|
||
| # Note that we don't currently support arm64 runners, so we build this only for amd64 | ||
| FROM --platform=$BUILDPLATFORM ghcr.io/actions/actions-runner:${RUNNER_VERSION}@${RUNNER_DIGEST} | ||
|
|
||
| LABEL org.opencontainers.image.base.name="ghcr.io/actions/actions-runner:${RUNNER_VERSION}" | ||
|
|
||
| COPY target/index.js /home/runner/k8s/index.js | ||
| COPY target/LICENSE . |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| # Copyright (c) 2024 Digital Asset (Switzerland) GmbH and/or its affiliates. All rights reserved. | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
|
|
||
| set -euo pipefail | ||
|
|
||
| runner_version=$( | ||
| gh release view \ | ||
| --repo actions/runner \ | ||
| --json tagName \ | ||
| | jq -r '.tagName' \ | ||
| | sed 's/^v//' # remove the 'v' prefix | ||
| ) | ||
|
|
||
| runner_digest=$( | ||
| docker manifest inspect "ghcr.io/actions/actions-runner:${runner_version}" \ | ||
| | jq -r '.manifests[] | select(.platform.architecture == "amd64") | .digest' | ||
| ) | ||
|
|
||
| docker_runner_file="${SPLICE_ROOT}/cluster/images/splice-test-docker-runner/Dockerfile" | ||
| runner_hook_file="${SPLICE_ROOT}/cluster/images/splice-test-runner-hook/Dockerfile" | ||
|
|
||
| sed \ | ||
| --in-place \ | ||
| --expression "s/^\(ARG RUNNER_VERSION=\).*/\1${runner_version}/" \ | ||
| --expression "s/^\(ARG RUNNER_DIGEST=\).*/\1${runner_digest}/" \ | ||
| "${docker_runner_file}" \ | ||
| "${runner_hook_file}" | ||
|
|
||
| if git diff --exit-code --quiet "${docker_runner_file}" "${runner_hook_file}"; then | ||
| echo "GHA runner version is up to date." | ||
| exit 0 | ||
| fi | ||
|
|
||
| git add --all | ||
| updated_branch="gha-runner-version-bump-$(date +%Y-%m-%d)" | ||
| git switch -c "${updated_branch}" | ||
| git commit -m "[static] bump GHA runner version to the latest (auto-generated)" -s | ||
|
Contributor
There was a problem hiding this comment. Is "build docker images" part of If not we might want to either:
I think I like the second option more (we change images ~rarely and when we do we typically also do full cluster tests which do build docker images), assuming that 1. we can do that without forcing a full splice build ( 🤞 ) and 2. we get notifications and a failures board entry in case this flow fails (see my other comment).
Contributor
Author
There was a problem hiding this comment. Good idea! I've added explicit |
||
| git push origin "${updated_branch}" | ||
|
|
||
| gh pr create \ | ||
| --base "main" \ | ||
| --head "$updated_branch" \ | ||
| --title "Bump GHA runner version to the latest (auto-generated)" \ | ||
| --reviewer isegall-da,martinflorian-da,ray-roestenburg-da,mblaze-da | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Do we get notified if this fails? Not 100% sure but I think you need some more boilerplate for that...
S.a.:
splice/.github/actions/tests/failure_notifications/action.yml
Line 1 in 92d74d5
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
(Unless it's super annoying to add, let's add notifications; we're very likely to not notice this getting hard broken otherwise.)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've copied the job from other workflows. I hope it works.