AI DIAL 持续集成

Generic Docker

Requirements

Consumer repository must have:

• Makefile with lint target defined

<details> <summary>Example</summary>

    .PHONY: all lint build run help

    all: lint build

    build:
      docker build -t my-image .

    run:
      docker run my-image

    lint:
      docker run --rm -i hadolint/hadolint < Dockerfile

    help:
      @echo '===================='
      @echo 'lint                         - lint the Dockerfile'
      @echo 'build                        - build docker image'
      @echo 'run                          - run docker image'
    

</details>

• Dockerfile

PR Workflow

pr.yml

name: PR Workflow

on:
  pull_request:
    branches: [development, release-*]

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
  cancel-in-progress: true

jobs:
  run_tests:
    uses: epam/ai-dial-ci/.github/workflows/generic_docker_pr.yml@main
    secrets: inherit

Release Workflow

release.yml

name: Release Workflow

on:
  push:
    branches: [development, release-*]
  workflow_dispatch:
    inputs:
      promote:
        type: boolean
        default: false
        description: Promote release to stable (for release-* branches only)

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  release:
    uses: epam/ai-dial-ci/.github/workflows/generic_docker_release.yml@main
    with:
      promote: ${{ github.event_name == 'workflow_dispatch' && inputs.promote }}
    secrets: inherit

Usage

These workflows could be imported to any repository under EPAM GitHub organization as standard .github/workflows files. See examples below (replace @main with specific version tag).

Trivy configuration file

https://aquasecurity.github.io/trivy/latest/docs/references/configuration/config-file/

db: no-progress: true repository: - mirror.gcr.io/aquasec/trivy-db:2 - public.ecr.aws/aquasecurity/trivy-db:2 - ghcr.io/aquasecurity/trivy-db:2 java-repository: - mirror.gcr.io/aquasec/trivy-java-db:1 - public.ecr.aws/aquasecurity/trivy-java-db:1 - ghcr.io/aquasecurity/trivy-java-db:1 misconfiguration: checks-bundle-repository: mirror.gcr.io/aquasec/trivy-checks:1

#### Dependabot

It's strongly recommended to enable at least [Dependabot security updates](https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/about-dependabot-security-updates) for your repositories to stay protected from known vulnerabilities in dependencies. To do that, create `.github/dependabot.yml` file in your repository.

> [!note]
> The example for `java` with `gradle` as a package manager given. Adjust repo's **primary** [package-ecosystem](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem) accordingly. Keep `github-actions` ecosystem as is

`dependabot.yml`

##### Dependabot Pull Requests Automation

Repository maintainers may want to automate approval/merging of Dependabot PRs to reduce manual effort. The example below will automatically approve all Dependabot PRs, and merge those that belong to `ai-dial-ci` group and are **not major** version updates.

> [!warning]
> The workflow requires [auto-merge](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/configuring-pull-request-merges/managing-auto-merge-for-pull-requests-in-your-repository#managing-auto-merge) option in repository settings enabled

> [!tip]
> You can modify the conditions to fit your needs, e.g remove `steps.metadata.outputs.dependency-group == 'ai-dial-ci'` condition to enable auto-merging for **all** Dependabot PRs except major version updates

`dependabot-automation.yml`

on: pull_request_target

permissions: {}

jobs: dependabot: runs-on: ubuntu-latest if: | github.event.pull_request.user.login == 'dependabot[bot]' && github.repository_owner == 'epam' steps: - name: Dependabot metadata id: metadata uses: dependabot/fetch-metadata@ffa630c65fa7e0ecfa0625b5ceda64399aea1b36 # v3.0.0 - name: Approve PR run: gh pr review --approve "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} GH_TOKEN: ${{ secrets.ACTIONS_BOT_TOKEN }} - name: Merge PR if: | steps.metadata.outputs.dependency-group == 'ai-dial-ci' && steps.metadata.outputs.update-type != 'version-update:semver-major' run: gh pr merge --auto --squash "$PR_URL" env: PR_URL: ${{ github.event.pull_request.html_url }} GH_TOKEN: ${{ secrets.ACTIONS_BOT_TOKEN }} ```

AI DIAL workflows

• AI DIAL workflows
• Overview
• Usage
• Branching
• Skipping Release Candidates (RC)
• Changelog Generation
• Filters and transformers
• NodeJS (npm)
• Requirements
• PR Workflow
• Release Workflow
• Java (gradle)
• Requirements
• PR Workflow (Docker)
• Release Workflow (Docker)
• Dependency Review
• Python (Poetry)
• Requirements
• PR Workflow (Docker)
• Release Workflow (Docker)
• PR Workflow (package)
• Release Workflow (package)
• Generic Docker
• Requirements
• PR Workflow
• Release Workflow
• Others
• Validate PR title
• Deploy review environment
• End-to-end tests
• Test Repository Structure
• Skipping E2E Tests
• Cleanup for untagged images in GHCR
• Trigger deployment of development environment in GitLab
• Trivy additional configuration
• Dependabot
• Dependabot Pull Requests Automation
• Contributing