-
Notifications
You must be signed in to change notification settings - Fork 30
chore: add gha for workflow worker #194
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,66 @@ | ||||||||||||||||||||||||||||||||||
| name: (Develop) Build and Push Workflow Worker to AWS and GCP | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| on: | ||||||||||||||||||||||||||||||||||
| workflow_dispatch: | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| env: | ||||||||||||||||||||||||||||||||||
| PROJECT_ID: aesy-330511 | ||||||||||||||||||||||||||||||||||
| GCP_REGION: asia-south1 | ||||||||||||||||||||||||||||||||||
| GAR_LOCATION: asia-south1-docker.pkg.dev/aesy-330511/root-hub | ||||||||||||||||||||||||||||||||||
| IMAGE_NAME: wavefront-workflow-worker | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| jobs: | ||||||||||||||||||||||||||||||||||
| build-push-artifact: | ||||||||||||||||||||||||||||||||||
| runs-on: ubuntu-latest | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| steps: | ||||||||||||||||||||||||||||||||||
| - name: "Checkout" | ||||||||||||||||||||||||||||||||||
| uses: "actions/checkout@v3" | ||||||||||||||||||||||||||||||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion | 🟠 Major Update actions/checkout to v4. The 🔎 Proposed fix - name: "Checkout"
- uses: "actions/checkout@v3"
+ uses: "actions/checkout@v4"Based on static analysis hints. 📝 Committable suggestion
Suggested change
🧰 Tools🪛 actionlint (1.7.9)18-18: the runner of "actions/checkout@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| - name: Get commit hash | ||||||||||||||||||||||||||||||||||
| id: get-commit-hash | ||||||||||||||||||||||||||||||||||
| run: echo "::set-output name=commit-hash::$(git rev-parse --short HEAD)" | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| - name: Get timestamp | ||||||||||||||||||||||||||||||||||
| id: get-timestamp | ||||||||||||||||||||||||||||||||||
| run: echo "::set-output name=timestamp::$(date +'%Y-%m-%d-%H-%M')" | ||||||||||||||||||||||||||||||||||
|
Comment on lines
+20
to
+26
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion | 🟠 Major Replace deprecated set-output commands. The 🔎 Proposed fix - name: Get commit hash
id: get-commit-hash
- run: echo "::set-output name=commit-hash::$(git rev-parse --short HEAD)"
+ run: echo "commit-hash=$(git rev-parse --short HEAD)" >> $GITHUB_OUTPUT
- name: Get timestamp
id: get-timestamp
- run: echo "::set-output name=timestamp::$(date +'%Y-%m-%d-%H-%M')"
+ run: echo "timestamp=$(date +'%Y-%m-%d-%H-%M')" >> $GITHUB_OUTPUTBased on static analysis hints. 📝 Committable suggestion
Suggested change
🧰 Tools🪛 actionlint (1.7.9)22-22: workflow command "set-output" was deprecated. use (deprecated-commands) 26-26: workflow command "set-output" was deprecated. use (deprecated-commands) |
||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| - name: Cache Docker layers | ||||||||||||||||||||||||||||||||||
| id: cache-docker-layers | ||||||||||||||||||||||||||||||||||
| uses: actions/cache@v3 | ||||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||||
| path: /tmp/.buildx-cache | ||||||||||||||||||||||||||||||||||
| key: ${{ runner.os }}-docker-${{ github.sha }} | ||||||||||||||||||||||||||||||||||
| restore-keys: | | ||||||||||||||||||||||||||||||||||
| ${{ runner.os }}-docker- | ||||||||||||||||||||||||||||||||||
|
Comment on lines
+28
to
+35
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion | 🟠 Major Update actions/cache to v4. The 🔎 Proposed fix - name: Cache Docker layers
id: cache-docker-layers
- uses: actions/cache@v3
+ uses: actions/cache@v4
with:
path: /tmp/.buildx-cache
key: ${{ runner.os }}-docker-${{ github.sha }}
restore-keys: |
${{ runner.os }}-docker-Based on static analysis hints. 📝 Committable suggestion
Suggested change
🧰 Tools🪛 actionlint (1.7.9)30-30: the runner of "actions/cache@v3" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| - name: Set up Docker Buildx | ||||||||||||||||||||||||||||||||||
| uses: docker/setup-buildx-action@v3 | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| - name: Build Docker Image | ||||||||||||||||||||||||||||||||||
| id: build-image | ||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||
| docker build -f wavefront/server/docker/workflow.Dockerfile -t rootflo:${{ steps.get-commit-hash.outputs.commit-hash }}-${{ steps.get-timestamp.outputs.timestamp }} . | ||||||||||||||||||||||||||||||||||
| echo "IMAGE_TAG=${{ steps.get-commit-hash.outputs.commit-hash }}-${{ steps.get-timestamp.outputs.timestamp }}" >> $GITHUB_ENV | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| - id: "Auth-to-GCP" | ||||||||||||||||||||||||||||||||||
| uses: "google-github-actions/auth@v1" | ||||||||||||||||||||||||||||||||||
| with: | ||||||||||||||||||||||||||||||||||
| credentials_json: "${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}" | ||||||||||||||||||||||||||||||||||
|
Comment on lines
+46
to
+49
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion | 🟠 Major Update google-github-actions/auth to v2. The 🔎 Proposed fix - id: "Auth-to-GCP"
- uses: "google-github-actions/auth@v1"
+ uses: "google-github-actions/auth@v2"
with:
credentials_json: "${{ secrets.GCP_SERVICE_ACCOUNT_KEY }}"Based on static analysis hints. 🧰 Tools🪛 actionlint (1.7.9)47-47: the runner of "google-github-actions/auth@v1" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| - name: "Set up Cloud SDK" | ||||||||||||||||||||||||||||||||||
| uses: "google-github-actions/setup-gcloud@v1" | ||||||||||||||||||||||||||||||||||
|
Comment on lines
+51
to
+52
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🛠️ Refactor suggestion | 🟠 Major Update google-github-actions/setup-gcloud to v2. The 🔎 Proposed fix - name: "Set up Cloud SDK"
- uses: "google-github-actions/setup-gcloud@v1"
+ uses: "google-github-actions/setup-gcloud@v2"Based on static analysis hints. 📝 Committable suggestion
Suggested change
🧰 Tools🪛 actionlint (1.7.9)52-52: the runner of "google-github-actions/setup-gcloud@v1" action is too old to run on GitHub Actions. update the action's version to fix this issue (action) 🤖 Prompt for AI Agents |
||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| - name: "Docker auth for GCP" | ||||||||||||||||||||||||||||||||||
| run: |- | ||||||||||||||||||||||||||||||||||
| gcloud auth configure-docker ${{ env.GCP_REGION }}-docker.pkg.dev --quiet | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| - name: Tag and push image to GCP Artifact Registry | ||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||
| docker tag rootflo:${{ env.IMAGE_TAG }} ${{ env.GAR_LOCATION }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} | ||||||||||||||||||||||||||||||||||
| docker push ${{ env.GAR_LOCATION }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} | ||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||
| - name: Cleanup Docker images | ||||||||||||||||||||||||||||||||||
| run: | | ||||||||||||||||||||||||||||||||||
| docker rmi rootflo:${{ env.IMAGE_TAG }} || true | ||||||||||||||||||||||||||||||||||
| docker rmi ${{ env.GAR_LOCATION }}/${{ env.IMAGE_NAME }}:${{ env.IMAGE_TAG }} || true | ||||||||||||||||||||||||||||||||||
|
Comment on lines
+14
to
+66
Check warningCode scanning / CodeQL Workflow does not contain permissions Medium
Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}
Copilot AutofixAI 5 months ago Generally, the fix is to define a The best way to fix this without changing behavior is:
Concretely, in permissions:
contents: readdirectly after the
Suggested changeset
1
.github/workflows/build-workflow-worker-develop.yaml
Copilot is powered by AI and may make mistakes. Always verify output.
Refresh and try again.
|
||||||||||||||||||||||||||||||||||
| Original file line number | Diff line number | Diff line change | ||||
|---|---|---|---|---|---|---|
| @@ -0,0 +1,36 @@ | ||||||
| FROM python:3.11-slim | ||||||
|
|
||||||
| WORKDIR /app | ||||||
|
|
||||||
| COPY --from=ghcr.io/astral-sh/uv:0.8.6 /uv /uvx /bin/ | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Update uv to the latest stable version (currently 0.9.18). The Dockerfile pins uv to 0.8.6, which is significantly outdated. The current latest version is 0.9.18. While 0.8.6 addressed a critical ZIP parsing vulnerability, newer versions include additional security patches and improvements. Upgrade to the latest stable release. 🤖 Prompt for AI Agents |
||||||
|
|
||||||
| RUN apt-get update && apt-get install -y \ | ||||||
| git \ | ||||||
| && rm -rf /var/lib/apt/lists/* | ||||||
|
|
||||||
| COPY wavefront/server/pyproject.toml wavefront/server/uv.lock ./ | ||||||
|
|
||||||
| COPY wavefront/server/background_jobs/workflow_job /app/background_jobs/workflow_job | ||||||
| COPY wavefront/server/packages/flo_cloud /app/packages/flo_cloud | ||||||
| COPY wavefront/server/packages/flo_utils /app/packages/flo_utils | ||||||
|
|
||||||
| COPY wavefront/server/modules/api_services_module /app/modules/api_services_module | ||||||
| COPY wavefront/server/modules/auth_module /app/modules/auth_module | ||||||
| COPY wavefront/server/modules/agents_module /app/modules/agents_module | ||||||
| COPY wavefront/server/modules/common_module /app/modules/common_module | ||||||
| COPY wavefront/server/modules/db_repo_module /app/modules/db_repo_module | ||||||
| COPY wavefront/server/modules/knowledge_base_module /app/modules/knowledge_base_module | ||||||
| COPY wavefront/server/modules/plugins_module /app/modules/plugins_module | ||||||
| COPY wavefront/server/modules/tools_module /app/modules/tools_module | ||||||
| COPY wavefront/server/modules/user_management_module /app/modules/user_management_module | ||||||
|
|
||||||
| COPY wavefront/server/plugins/datasource /app/plugins/datasource | ||||||
| COPY wavefront/server/plugins/authenticator /app/plugins/authenticator | ||||||
|
|
||||||
| # Install dependencies (without dependecy resolution and no dev dependencies) | ||||||
|
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Fix typo in comment. The comment has a typo: "dependecy" should be "dependency". 🔎 Proposed fix-# Install dependencies (without dependecy resolution and no dev dependencies)
+# Install dependencies (without dependency resolution and no dev dependencies)📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||
| RUN uv sync --package workflow_job --frozen --no-dev | ||||||
|
|
||||||
| # change WORKDIR | ||||||
| WORKDIR /app/background_jobs/workflow_job/workflow_job | ||||||
|
|
||||||
| CMD ["uv", "run", "main.py"] | ||||||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Add explicit permissions block for security.
The workflow does not specify permissions for the
GITHUB_TOKEN, which grants default write access. Following the principle of least privilege, you should explicitly define minimal permissions.🔎 Proposed fix
jobs: build-push-artifact: runs-on: ubuntu-latest + permissions: + contents: readBased on static analysis hints.
🤖 Prompt for AI Agents