ci/.github/workflows/base_python_build.yml at main · QueroDelivery/ci · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
name: CI-BASE

on:

  workflow_call:

    inputs:
      WF_SERVICE_NAME:
        type: string
        required: true
      WF_ENV_TYPE_DEPLOY:
        type: string
        required: true
      WF_CODEARTIFACT_DOMAIN:
        type: string
        required: false
        default: ""
      WF_CODEARTIFACT_REPOSITORY:
        type: string
        required: false
        default: ""

    secrets:
      WF_AWS_CODEARTIFACT_ROLE_ARN:
        required: false

jobs:
  setup:
    environment: ${{ inputs.WF_ENV_TYPE_DEPLOY }}
    name: preparing
    runs-on: ubuntu-latest
    continue-on-error: false
    permissions:
      id-token: write
      contents: read
      actions: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: false

      - name: Configure AWS credentials (OIDC)
        if: inputs.WF_CODEARTIFACT_DOMAIN != ''
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.WF_AWS_CODEARTIFACT_ROLE_ARN }}
          aws-region: us-east-1

      - name: Authenticate CodeArtifact
        if: inputs.WF_CODEARTIFACT_DOMAIN != ''
        run: |
          aws codeartifact login \
            --tool pip \
            --domain ${{ inputs.WF_CODEARTIFACT_DOMAIN }} \
            --repository ${{ inputs.WF_CODEARTIFACT_REPOSITORY }}
          pip config set global.extra-index-url https://pypi.org/simple/
          echo "PIP_CONF=$HOME/.config/pip/pip.conf" >> $GITHUB_ENV

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build Docker image (with CodeArtifact)
        if: inputs.WF_CODEARTIFACT_DOMAIN != ''
        uses: docker/build-push-action@v6
        with:
          context: .
          tags: ${{ inputs.WF_SERVICE_NAME }}:ci-build
          load: true
          provenance: false
          secret-files: |
            pip_conf=${{ env.PIP_CONF }}

      - name: Build Docker image (public PyPI only)
        if: inputs.WF_CODEARTIFACT_DOMAIN == ''
        uses: docker/build-push-action@v6
        with:
          context: .
          tags: ${{ inputs.WF_SERVICE_NAME }}:ci-build
          load: true
          provenance: false

      - name: Save Docker image
        run: |
          docker save ${{ inputs.WF_SERVICE_NAME }}:ci-build | gzip > image.tar.gz

      - name: Upload Docker image as artifact
        uses: actions/upload-artifact@v4
        with:
          name: built-image
          path: image.tar.gz
          retention-days: 1