Skip to content

Commit a28c87c

Browse files
hgiasachgiasac
committed
upgrade Pythong 3.12
1 parent 8d4a064 commit a28c87c

4 files changed

Lines changed: 176 additions & 110 deletions

File tree

‎.github/workflows/ndc-python-lambda-connector.yaml‎

Lines changed: 161 additions & 108 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ on:
66
- test-ci/**
77
push:
88
branches:
9-
- 'main'
9+
- "main"
1010
- test-ci/**
1111
tags:
1212
- v**
@@ -21,9 +21,9 @@ jobs:
2121
runs-on: ubuntu-latest
2222
steps:
2323
- uses: actions/checkout@v4
24-
- uses: actions/setup-python@v4
24+
- uses: actions/setup-python@v5
2525
with:
26-
python-version: '3.9'
26+
python-version: "3.12"
2727
- name: Install dependencies
2828
run: |
2929
python -m pip install --upgrade pip
@@ -45,10 +45,10 @@ jobs:
4545
steps:
4646
- uses: actions/checkout@v4
4747
with:
48-
fetch-depth: 0 # This is important for git describe to work correctly
49-
- uses: actions/setup-python@v4
48+
fetch-depth: 0 # This is important for git describe to work correctly
49+
- uses: actions/setup-python@v5
5050
with:
51-
python-version: '3.9'
51+
python-version: "3.12"
5252
- name: Build connector
5353
run: |
5454
cd connector-definition
@@ -60,7 +60,7 @@ jobs:
6060
echo "sha256=$SHA256" >> $GITHUB_OUTPUT
6161
- name: Get commit hash
6262
id: get_commit_hash
63-
run: |
63+
run: |
6464
COMMIT_HASH=$(git rev-parse HEAD)
6565
echo "commit_hash=$COMMIT_HASH" >> $GITHUB_OUTPUT
6666
- name: Debug information
@@ -82,30 +82,83 @@ jobs:
8282
if: startsWith(github.ref, 'refs/tags/v')
8383
steps:
8484
- uses: actions/checkout@v4
85+
86+
- name: Set up containerd
87+
uses: crazy-max/ghaction-setup-containerd@v3
88+
89+
- name: Fix containerd socket permissions
90+
run: |
91+
sudo chgrp docker /run/containerd/containerd.sock
92+
8593
- name: Set up QEMU
86-
uses: docker/setup-qemu-action@v2
94+
uses: docker/setup-qemu-action@v3
95+
8796
- name: Set up Docker Buildx
8897
uses: docker/setup-buildx-action@v3
98+
8999
- name: Login to GitHub Container Registry
90100
uses: docker/login-action@v3
91101
with:
92-
registry: ${{ env.DOCKER_REGISTRY }}
93-
username: ${{ github.actor }}
94-
password: ${{ secrets.GITHUB_TOKEN }}
102+
registry: ${{ env.DOCKER_REGISTRY }}
103+
username: ${{ github.actor }}
104+
password: ${{ secrets.GITHUB_TOKEN }}
105+
95106
- name: Extract metadata (tags, labels) for Docker
96107
id: docker-metadata
97108
uses: docker/metadata-action@v5
98109
with:
99-
images: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}
100-
- name: Build and push Docker image
101-
uses: docker/build-push-action@v5
110+
images: ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }}
111+
112+
- name: Build Docker image
113+
uses: docker/build-push-action@v6
114+
with:
115+
context: .
116+
push: false
117+
platforms: linux/amd64,linux/arm64
118+
tags: ${{ steps.docker-metadata.outputs.tags }}
119+
labels: ${{ steps.docker-metadata.outputs.labels }}
120+
# Export the image to a tar so it can be imported into containerd so gokakashi can scan it
121+
outputs: type=oci,dest=/tmp/image.tar
122+
123+
- name: Import docker image into containerd store
124+
run: |
125+
ctr images import --base-name ${{ env.DOCKER_REGISTRY }}/${{ env.DOCKER_IMAGE_NAME }} --digests --all-platforms /tmp/image.tar
126+
127+
- name: Get first docker tag for gokakashi
128+
id: first-docker-tag
129+
run: |
130+
FIRST_TAG=$(echo "${{ steps.docker-metadata.outputs.tags }}" | head -n 1)
131+
echo "First docker tag: $FIRST_TAG"
132+
echo "tag=$FIRST_TAG" >> $GITHUB_OUTPUT
133+
134+
- name: Scan docker image with gokakashi
135+
uses: shinobistack/gokakashi-action@v0.1.1
136+
with:
137+
image: ${{ steps.first-docker-tag.outputs.tag }}
138+
labels: agentKey=${{ github.run_id }}
139+
policy: ci-platform
140+
server: https://gokakashi-server.hasura-app.io
141+
token: ${{ secrets.GOKAKASHI_API_TOKEN }}
142+
cf_client_id: ${{ secrets.CF_ACCESS_CLIENT_ID }}
143+
cf_client_secret: ${{ secrets.CF_ACCESS_CLIENT_SECRET }}
144+
interval: 10
145+
retries: 8
146+
147+
- name: Upload Trivy report as artifact
148+
uses: actions/upload-artifact@v4
102149
with:
103-
context: .
104-
push: true
105-
platforms: linux/amd64,linux/arm64
106-
tags: ${{ steps.docker-metadata.outputs.tags }}
107-
labels: ${{ steps.docker-metadata.outputs.labels }}
108-
150+
name: trivy-report
151+
path: /tmp/trivy-report-*.json
152+
153+
- name: Push Docker image
154+
uses: docker/build-push-action@v6
155+
with:
156+
context: .
157+
push: true
158+
platforms: linux/amd64,linux/arm64
159+
tags: ${{ steps.docker-metadata.outputs.tags }}
160+
labels: ${{ steps.docker-metadata.outputs.labels }}
161+
109162
release-connector:
110163
name: Release connector
111164
runs-on: ubuntu-latest
@@ -126,91 +179,91 @@ jobs:
126179
run: |
127180
echo "tagged_version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
128181
shell: bash
129-
- uses: mindsers/changelog-reader-action@v2
130-
id: changelog-reader
131-
with:
132-
version: ${{ steps.get-version.outputs.tagged_version }}
133-
path: ./CHANGELOG.md
134-
- uses: softprops/action-gh-release@v1
135-
with:
136-
draft: false
137-
tag_name: v${{ steps.get-version.outputs.tagged_version }}
138-
body: ${{ steps.changelog-reader.outputs.changes }}
139-
files: |
140-
./connector-definition/dist/connector-definition.tgz
141-
fail_on_unmatched_files: true
142-
143-
- name: Update ndc-hub
144-
env:
145-
REGISTRY_NAME: hasura
146-
CONNECTOR_NAME: ndc-python-lambda
147-
COMMIT_HASH: ${{ needs.build-connector.outputs.commit_hash }}
148-
SHA256: ${{ needs.build-connector.outputs.sha256 }}
149-
GH_TOKEN: ${{ secrets.PAT_TOKEN }}
150-
run: |
151-
# Clone ndc-hub repository
152-
git clone https://github.com/hasura/ndc-hub.git
153-
cd ndc-hub
154-
155-
# Create a new branch
156-
NEW_BRANCH="update-${{ env.CONNECTOR_NAME }}-connector-v${{ steps.get-version.outputs.tagged_version }}"
157-
git checkout -b $NEW_BRANCH
158-
159-
cd registry/${{ env.REGISTRY_NAME }}/python
160-
161-
# Create releases directory if it doesn't exist
162-
mkdir -p releases/v${{ steps.get-version.outputs.tagged_version }}
163-
164-
# Create connector-packaging.json
165-
cat << EOF > releases/v${{ steps.get-version.outputs.tagged_version }}/connector-packaging.json
166-
{
167-
"version": "v${{ steps.get-version.outputs.tagged_version }}",
168-
"uri": "https://github.com/${{ github.repository }}/releases/download/v${{ steps.get-version.outputs.tagged_version }}/connector-definition.tgz",
169-
"checksum": {
170-
"type": "sha256",
171-
"value": "$SHA256"
172-
},
173-
"source": {
174-
"hash": "$COMMIT_HASH"
175-
}
176-
}
177-
EOF
178-
179-
# Update metadata.json to remove 'packages' field if it exists and update 'latest_version'
180-
jq --arg version_tag "v${{ steps.get-version.outputs.tagged_version }}" \
181-
--arg commit_hash "$COMMIT_HASH" \
182-
'if has("packages") then del(.packages) else . end |
183-
.overview.latest_version = $version_tag |
184-
if has("source_code") then
185-
.source_code.version += [{
186-
"tag": $version_tag,
187-
"hash": $commit_hash,
188-
"is_verified": false
189-
}]
190-
else
191-
. + {"source_code": {"version": [{
192-
"tag": $version_tag,
193-
"hash": $commit_hash,
194-
"is_verified": false
195-
}]}}
196-
end' \
197-
metadata.json > tmp.json && mv tmp.json metadata.json
198-
199-
cp ../../../../README.md ./README.md
200-
201-
# Commit changes
202-
git config user.name "GitHub Action"
203-
git config user.email "action@github.com"
204-
git add metadata.json README.md releases
205-
git commit -m "Update ${{ env.CONNECTOR_NAME }} connector metadata to version ${{ steps.get-version.outputs.tagged_version }}"
206-
207-
# Push changes
208-
git push https://${{ secrets.PAT_TOKEN }}@github.com/hasura/ndc-hub.git HEAD:$NEW_BRANCH
209-
210-
# Create PR using GitHub CLI
211-
cd ../..
212-
gh pr create --repo hasura/ndc-hub \
213-
--base main \
214-
--head $NEW_BRANCH \
215-
--title "Update ${{ env.CONNECTOR_NAME }} connector to v${{ steps.get-version.outputs.tagged_version }}" \
216-
--body "This PR updates the ${{ env.CONNECTOR_NAME }} connector metadata to version ${{ steps.get-version.outputs.tagged_version }}."
182+
# - uses: mindsers/changelog-reader-action@v2
183+
# id: changelog-reader
184+
# with:
185+
# version: ${{ steps.get-version.outputs.tagged_version }}
186+
# path: ./CHANGELOG.md
187+
# - uses: softprops/action-gh-release@v1
188+
# with:
189+
# draft: false
190+
# tag_name: v${{ steps.get-version.outputs.tagged_version }}
191+
# body: ${{ steps.changelog-reader.outputs.changes }}
192+
# files: |
193+
# ./connector-definition/dist/connector-definition.tgz
194+
# fail_on_unmatched_files: true
195+
196+
# - name: Update ndc-hub
197+
# env:
198+
# REGISTRY_NAME: hasura
199+
# CONNECTOR_NAME: ndc-python-lambda
200+
# COMMIT_HASH: ${{ needs.build-connector.outputs.commit_hash }}
201+
# SHA256: ${{ needs.build-connector.outputs.sha256 }}
202+
# GH_TOKEN: ${{ secrets.PAT_TOKEN }}
203+
# run: |
204+
# # Clone ndc-hub repository
205+
# git clone https://github.com/hasura/ndc-hub.git
206+
# cd ndc-hub
207+
208+
# # Create a new branch
209+
# NEW_BRANCH="update-${{ env.CONNECTOR_NAME }}-connector-v${{ steps.get-version.outputs.tagged_version }}"
210+
# git checkout -b $NEW_BRANCH
211+
212+
# cd registry/${{ env.REGISTRY_NAME }}/python
213+
214+
# # Create releases directory if it doesn't exist
215+
# mkdir -p releases/v${{ steps.get-version.outputs.tagged_version }}
216+
217+
# # Create connector-packaging.json
218+
# cat << EOF > releases/v${{ steps.get-version.outputs.tagged_version }}/connector-packaging.json
219+
# {
220+
# "version": "v${{ steps.get-version.outputs.tagged_version }}",
221+
# "uri": "https://github.com/${{ github.repository }}/releases/download/v${{ steps.get-version.outputs.tagged_version }}/connector-definition.tgz",
222+
# "checksum": {
223+
# "type": "sha256",
224+
# "value": "$SHA256"
225+
# },
226+
# "source": {
227+
# "hash": "$COMMIT_HASH"
228+
# }
229+
# }
230+
# EOF
231+
232+
# # Update metadata.json to remove 'packages' field if it exists and update 'latest_version'
233+
# jq --arg version_tag "v${{ steps.get-version.outputs.tagged_version }}" \
234+
# --arg commit_hash "$COMMIT_HASH" \
235+
# 'if has("packages") then del(.packages) else . end |
236+
# .overview.latest_version = $version_tag |
237+
# if has("source_code") then
238+
# .source_code.version += [{
239+
# "tag": $version_tag,
240+
# "hash": $commit_hash,
241+
# "is_verified": false
242+
# }]
243+
# else
244+
# . + {"source_code": {"version": [{
245+
# "tag": $version_tag,
246+
# "hash": $commit_hash,
247+
# "is_verified": false
248+
# }]}}
249+
# end' \
250+
# metadata.json > tmp.json && mv tmp.json metadata.json
251+
252+
# cp ../../../../README.md ./README.md
253+
254+
# # Commit changes
255+
# git config user.name "GitHub Action"
256+
# git config user.email "action@github.com"
257+
# git add metadata.json README.md releases
258+
# git commit -m "Update ${{ env.CONNECTOR_NAME }} connector metadata to version ${{ steps.get-version.outputs.tagged_version }}"
259+
260+
# # Push changes
261+
# git push https://${{ secrets.PAT_TOKEN }}@github.com/hasura/ndc-hub.git HEAD:$NEW_BRANCH
262+
263+
# # Create PR using GitHub CLI
264+
# cd ../..
265+
# gh pr create --repo hasura/ndc-hub \
266+
# --base main \
267+
# --head $NEW_BRANCH \
268+
# --title "Update ${{ env.CONNECTOR_NAME }} connector to v${{ steps.get-version.outputs.tagged_version }}" \
269+
# --body "This PR updates the ${{ env.CONNECTOR_NAME }} connector metadata to version ${{ steps.get-version.outputs.tagged_version }}."

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,10 @@ This changelog documents the changes between release versions.
44
## [Unreleased]
55
Changes to be included in the next upcoming release
66

7+
## [0.2.0] - 2025-04-02
8+
* Upgrade Python 3.12
9+
* Use `python:3.12-slim` image tag with non-root user.
10+
711
## [0.1.6] - 2025-01-22
812
* Fix workflows
913

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM python:3.10
1+
FROM python:3.12-slim
22

33
# Install curl for healthcheck
44
RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*

‎connector-definition/Dockerfile‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,17 @@ FROM ghcr.io/hasura/ndc-python-lambda:v{{VERSION}}
33
COPY requirements.txt /functions/
44

55
WORKDIR /functions
6+
67
RUN python3 -m venv venv && \
78
. venv/bin/activate && \
89
pip install -r requirements.txt
910

10-
COPY ./ /functions
11+
COPY ./ /functions
12+
13+
# create the group and user
14+
RUN adduser -u 1000 python
15+
16+
RUN chown -R python:python /functions
17+
18+
# stating USER before WORKDIR means the directory is created with the non-root proper ownership
19+
USER python

0 commit comments

Comments
 (0)