Skip to content

Commit 56c1774

Browse files
authored
Merge branch 'main' into dependabot/npm_and_yarn/devcontainers/cli-0.83.0
2 parents 82a7082 + b7823e9 commit 56c1774

9 files changed

Lines changed: 187 additions & 35 deletions

File tree

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
#!/usr/bin/env bash
2+
set -e
3+
4+
get_container_package_name() {
5+
local container_name=$1
6+
7+
if [[ -z "${container_name}" ]]; then
8+
echo "Container name is required" >&2
9+
return 1
10+
fi
11+
12+
# URL-encode the package path (eps-devcontainers/${container_name}) for the GH API
13+
printf 'eps-devcontainers/%s' "${container_name}" | jq -sRr @uri
14+
}
15+
16+
get_container_versions_json() {
17+
local container_name=$1
18+
local package_name
19+
20+
package_name=$(get_container_package_name "${container_name}")
21+
22+
gh api \
23+
-H "Accept: application/vnd.github+json" \
24+
"/orgs/nhsdigital/packages/container/${package_name}/versions" \
25+
--paginate
26+
}
27+
28+
delete_pr_images() {
29+
local container_name=$1
30+
local package_name
31+
local versions_json
32+
local tags
33+
34+
if [[ -z "${container_name}" ]]; then
35+
echo "Container name is required" >&2
36+
return 1
37+
fi
38+
39+
package_name=$(get_container_package_name "${container_name}")
40+
versions_json=$(get_container_versions_json "${container_name}")
41+
tags=$(jq -r '[.[].metadata.container.tags[]?] | unique | .[]' <<<"${versions_json}")
42+
43+
if [[ -z "${tags}" ]]; then
44+
return 0
45+
fi
46+
47+
while IFS= read -r tag; do
48+
if [[ "${tag}" =~ ^pr-[0-9]+- ]]; then
49+
local pull_request
50+
local pr_json
51+
local pr_state
52+
53+
pull_request=${tag#pr-}
54+
pull_request=${pull_request%%-*}
55+
56+
if ! pr_json=$(gh api \
57+
-H "Accept: application/vnd.github+json" \
58+
"/repos/NHSDigital/eps-devcontainers/pulls/${pull_request}"); then
59+
continue
60+
fi
61+
echo "Checking PR #${pull_request} for tag ${tag} in container ${container_name}..."
62+
pr_state=$(jq -r '.state // empty' <<<"${pr_json}")
63+
if [[ "${pr_state}" != "closed" ]]; then
64+
echo "State is not closed - not deleting images"
65+
continue
66+
fi
67+
68+
jq -r --arg tag "${tag}" '.[] | select(.metadata.container.tags[]? == $tag) | .id' \
69+
<<<"${versions_json}" \
70+
| while IFS= read -r version_id; do
71+
if [[ -n "${version_id}" ]]; then
72+
echo "Deleting image with tag ${tag} (version ID: ${version_id}) from container ${container_name}..."
73+
gh api \
74+
-H "Accept: application/vnd.github+json" \
75+
-X DELETE \
76+
"/orgs/nhsdigital/packages/container/${package_name}/versions/${version_id}"
77+
fi
78+
done
79+
fi
80+
done <<<"${tags}"
81+
}
82+
83+
84+
language_folders=$(find src/languages -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | jq -R -s -c 'split("\n")[:-1]')
85+
project_folders=$(find src/projects -mindepth 1 -maxdepth 1 -type d -printf '%f\n' | jq -R -s -c 'split("\n")[:-1]')
86+
87+
for container_name in $(jq -r '.[]' <<<"${project_folders}"); do
88+
delete_pr_images "${container_name}"
89+
done
90+
91+
for container_name in $(jq -r '.[]' <<<"${language_folders}"); do
92+
delete_pr_images "${container_name}"
93+
done
94+
95+
delete_pr_images "base"

.github/workflows/build_all_images.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@ jobs:
1717
language_folders: ${{ steps.find-folders.outputs.languages }}
1818
project_folders: ${{ steps.find-folders.outputs.projects }}
1919
steps:
20-
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
20+
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
2121

2222
- id: find-folders
2323
run: |

.github/workflows/build_multi_arch_image.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -53,11 +53,11 @@ jobs:
5353
username: ${{github.actor}}
5454
password: ${{secrets.GITHUB_TOKEN}}
5555
- name: Checkout code
56-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
56+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
5757
with:
5858
fetch-depth: 0
5959
- name: setup node
60-
uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
60+
uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238
6161
with:
6262
node-version-file: .tool-versions
6363

@@ -88,7 +88,7 @@ jobs:
8888
IMAGE_TAG: ":${{ inputs.docker_tag }}-${{ matrix.arch }}"
8989
BASE_FOLDER: "${{ inputs.base_folder }}"
9090
- name: Check docker vulnerabilities - json output
91-
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
91+
uses: aquasecurity/trivy-action@c1824fd6edce30d7ab345a9989de00bbd46ef284
9292
with:
9393
scan-type: "image"
9494
image-ref: "ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}:${{ inputs.docker_tag }}-${{ matrix.arch }}"
@@ -105,7 +105,7 @@ jobs:
105105
name: "scan_results_docker_${{ inputs.container_name }}_${{ matrix.arch }}.json"
106106
path: scan_results_docker.json
107107
- name: Check docker vulnerabilities - table output
108-
uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8
108+
uses: aquasecurity/trivy-action@c1824fd6edce30d7ab345a9989de00bbd46ef284
109109
with:
110110
scan-type: "image"
111111
image-ref: "ghcr.io/nhsdigital/eps-devcontainers/${{ inputs.container_name }}:${{ inputs.docker_tag }}-${{ matrix.arch }}"

.github/workflows/ci.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ jobs:
1111
tag_format: '${{ steps.load-config.outputs.TAG_FORMAT }}'
1212
steps:
1313
- name: Checkout code
14-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
14+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
1515
- name: Get asdf version
1616
id: asdf-version
1717
run: >-
@@ -23,7 +23,7 @@ jobs:
2323
TAG_FORMAT=$(yq '.TAG_FORMAT' .github/config/settings.yml)
2424
echo "TAG_FORMAT=$TAG_FORMAT" >> "$GITHUB_OUTPUT"
2525
quality_checks:
26-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@5ccebbf821beef2de6abdce9e392b3cbeb4999e3
26+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@997a1946c83bb2a9eda418847ed640738af949ff
2727
needs:
2828
- get_asdf_version
2929
with:
@@ -32,7 +32,7 @@ jobs:
3232
SONAR_TOKEN: '${{ secrets.SONAR_TOKEN }}'
3333
tag_release:
3434
needs: [quality_checks, get_asdf_version]
35-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release.yml@e31e25273fb87450be4ef763ddbed4f531c45f8e
35+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release.yml@997a1946c83bb2a9eda418847ed640738af949ff
3636
with:
3737
dry_run: true
3838
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}
Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
name: "Delete old cloudformation stacks"
2+
3+
# Controls when the action will run - in this case triggered manually and on schedule
4+
on:
5+
workflow_dispatch:
6+
schedule:
7+
- cron: "0 1,13 * * *"
8+
push:
9+
branches: [main]
10+
11+
jobs:
12+
delete-old-cloudformation-stacks:
13+
runs-on: ubuntu-22.04
14+
permissions:
15+
id-token: write
16+
contents: read
17+
18+
steps:
19+
- name: Checkout local code
20+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
21+
with:
22+
ref: ${{ env.BRANCH_NAME }}
23+
fetch-depth: 0
24+
25+
- name: Configure AWS Credentials
26+
uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7
27+
with:
28+
aws-region: eu-west-2
29+
role-to-assume: ${{ secrets.DEV_CLOUD_FORMATION_DEPLOY_ROLE }}
30+
role-session-name: psu-delete-old-stacks
31+
32+
- name: delete stacks
33+
shell: bash
34+
working-directory: .github/scripts
35+
run: ./delete_stacks.sh
36+
env:
37+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
38+
39+
delete-old-proxygen-deployments:
40+
runs-on: ubuntu-22.04
41+
permissions:
42+
id-token: write
43+
contents: read
44+
45+
steps:
46+
- name: Checkout local code
47+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
48+
with:
49+
ref: ${{ env.BRANCH_NAME }}
50+
fetch-depth: 0
51+
52+
- name: delete unused images
53+
shell: bash
54+
working-directory: .github/scripts
55+
run: ./delete_unused_images.sh

.github/workflows/pull_request.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
dependabot-auto-approve-and-merge:
1010
needs: quality_checks
1111
uses: >-
12-
NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@5ccebbf821beef2de6abdce9e392b3cbeb4999e3
12+
NHSDigital/eps-common-workflows/.github/workflows/dependabot-auto-approve-and-merge.yml@997a1946c83bb2a9eda418847ed640738af949ff
1313
secrets:
1414
AUTOMERGE_APP_ID: '${{ secrets.AUTOMERGE_APP_ID }}'
1515
AUTOMERGE_PEM: '${{ secrets.AUTOMERGE_PEM }}'
@@ -20,7 +20,7 @@ jobs:
2020
tag_format: '${{ steps.load-config.outputs.TAG_FORMAT }}'
2121
steps:
2222
- name: Checkout code
23-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
23+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
2424
- name: Get asdf version
2525
id: asdf-version
2626
run: >-
@@ -32,7 +32,7 @@ jobs:
3232
TAG_FORMAT=$(yq '.TAG_FORMAT' .github/config/settings.yml)
3333
echo "TAG_FORMAT=$TAG_FORMAT" >> "$GITHUB_OUTPUT"
3434
quality_checks:
35-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@5ccebbf821beef2de6abdce9e392b3cbeb4999e3
35+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@997a1946c83bb2a9eda418847ed640738af949ff
3636
needs:
3737
- get_asdf_version
3838
with:
@@ -41,7 +41,7 @@ jobs:
4141
SONAR_TOKEN: '${{ secrets.SONAR_TOKEN }}'
4242
pr_title_format_check:
4343
uses: >-
44-
NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@5ccebbf821beef2de6abdce9e392b3cbeb4999e3
44+
NHSDigital/eps-common-workflows/.github/workflows/pr_title_check.yml@997a1946c83bb2a9eda418847ed640738af949ff
4545
get_issue_number:
4646
runs-on: ubuntu-22.04
4747
needs: quality_checks
@@ -75,7 +75,7 @@ jobs:
7575
sha_short: '${{ steps.commit_id.outputs.sha_short }}'
7676
steps:
7777
- name: Checkout code
78-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
78+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
7979
with:
8080
ref: '${{ env.BRANCH_NAME }}'
8181
- name: Get Commit ID

.github/workflows/release.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
tag_format: '${{ steps.load-config.outputs.TAG_FORMAT }}'
1313
steps:
1414
- name: Checkout code
15-
uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
15+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
1616
- name: Get asdf version
1717
id: asdf-version
1818
run: >-
@@ -24,7 +24,7 @@ jobs:
2424
TAG_FORMAT=$(yq '.TAG_FORMAT' .github/config/settings.yml)
2525
echo "TAG_FORMAT=$TAG_FORMAT" >> "$GITHUB_OUTPUT"
2626
quality_checks:
27-
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@5ccebbf821beef2de6abdce9e392b3cbeb4999e3
27+
uses: NHSDigital/eps-common-workflows/.github/workflows/quality-checks.yml@997a1946c83bb2a9eda418847ed640738af949ff
2828
needs:
2929
- get_asdf_version
3030
with:
@@ -33,7 +33,7 @@ jobs:
3333
SONAR_TOKEN: '${{ secrets.SONAR_TOKEN }}'
3434
tag_release:
3535
needs: [quality_checks, get_asdf_version]
36-
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release.yml@e31e25273fb87450be4ef763ddbed4f531c45f8e
36+
uses: NHSDigital/eps-common-workflows/.github/workflows/tag-release.yml@997a1946c83bb2a9eda418847ed640738af949ff
3737
with:
3838
dry_run: false
3939
asdfVersion: ${{ needs.get_asdf_version.outputs.asdf_version }}

Makefile

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ build-image: guard-CONTAINER_NAME guard-BASE_VERSION guard-BASE_FOLDER
2525
npx devcontainer build \
2626
--workspace-folder ./src/$${BASE_FOLDER}/$${CONTAINER_NAME} \
2727
--push false \
28+
--cache-from "${CONTAINER_PREFIX}$${CONTAINER_NAME}:latest" \
2829
--label "org.opencontainers.image.revision=$$DOCKER_TAG" \
2930
--image-name "${CONTAINER_PREFIX}$${CONTAINER_NAME}${IMAGE_TAG}"
3031

@@ -70,3 +71,9 @@ test:
7071

7172
lint-githubactions:
7273
actionlint
74+
75+
github-login:
76+
gh auth login --scopes read:packages
77+
78+
lint-githubaction-scripts:
79+
shellcheck .github/scripts/*.sh

poetry.lock

Lines changed: 14 additions & 19 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)