Skip to content

Commit b048f03

Browse files
v1vv1v
authored
ci: release automation (#197)
1 parent dd18e43 commit b048f03

File tree

10 files changed

+356
-1
lines changed

10 files changed

+356
-1
lines changed

‎.buildkite/hooks/post-command

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#!/usr/bin/env bash
2+
## This script reverts the Vault context for the release and snapshot pipelines.
3+
##
4+
## NOTE: *_SECRET or *_TOKEN env variables are masked, hence if you'd like to avoid any
5+
## surprises please use the suffix _SECRET or _TOKEN for those values that contain
6+
## any sensitive data. Buildkite can mask those values automatically
7+
8+
set -euo pipefail
9+
10+
VAULT_TOKEN=$PREVIOUS_VAULT_TOKEN
11+
export VAULT_TOKEN

‎.buildkite/hooks/pre-command

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
#!/usr/bin/env bash
2+
## This script prepares the Vault context and required tooling
3+
## for the release and snapshot pipelines.
4+
##
5+
## NOTE: *_SECRET or *_TOKEN env variables are masked, hence if you'd like to avoid any
6+
## surprises please use the suffix _SECRET or _TOKEN for those values that contain
7+
## any sensitive data. Buildkite can mask those values automatically
8+
9+
set -eo pipefail
10+
11+
echo "--- Prepare vault context"
12+
VAULT_ROLE_ID_SECRET=$(vault read -field=role-id secret/ci/elastic-ecs-logging-java/internal-ci-approle)
13+
export VAULT_ROLE_ID_SECRET
14+
15+
VAULT_SECRET_ID_SECRET=$(vault read -field=secret-id secret/ci/elastic-ecs-logging-java/internal-ci-approle)
16+
export VAULT_SECRET_ID_SECRET
17+
18+
VAULT_ADDR=$(vault read -field=vault-url secret/ci/elastic-ecs-logging-java/internal-ci-approle)
19+
export VAULT_ADDR
20+
21+
# Delete the vault specific accessing the ci vault
22+
PREVIOUS_VAULT_TOKEN=$VAULT_TOKEN
23+
export PREVIOUS_VAULT_TOKEN
24+
unset VAULT_TOKEN
25+
26+
echo "--- Prepare keys context"
27+
VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id="$VAULT_ROLE_ID_SECRET" secret_id="$VAULT_SECRET_ID_SECRET")
28+
export VAULT_TOKEN
29+
30+
# Signing keys
31+
vault read -field=key secret/release/signing >$KEY_FILE
32+
KEYPASS_SECRET=$(vault read -field=passphrase secret/release/signing)
33+
export KEYPASS_SECRET
34+
export KEY_ID_SECRET=D88E42B4
35+
36+
# Prepare a secure temp folder not shared between other jobs to store the key ring
37+
export TMP_WORKSPACE=/tmp/secured
38+
export KEY_FILE=$TMP_WORKSPACE"/private.key"
39+
# Secure home for our keyring
40+
export GNUPGHOME=$TMP_WORKSPACE"/keyring"
41+
mkdir -p $GNUPGHOME
42+
chmod -R 700 $TMP_WORKSPACE
43+
44+
# Import the key into the keyring
45+
echo "$KEYPASS_SECRET" | gpg --batch --import "$KEY_FILE"
46+
47+
# Export secring
48+
export SECRING_FILE=$GNUPGHOME"/secring.gpg"
49+
gpg --pinentry-mode=loopback --passphrase "$KEYPASS_SECRET" --export-secret-key $KEY_ID_SECRET > "$SECRING_FILE"
50+
51+
echo "--- Configure git context"
52+
# Configure the committer since the maven release requires to push changes to GitHub
53+
# This will help with the SLSA requirements.
54+
git config --global user.email "infra-root+apmmachine@elastic.co"
55+
git config --global user.name "apmmachine"
56+
57+
echo "--- Install JDK17"
58+
JAVA_URL=https://jvm-catalog.elastic.co/jdk
59+
JAVA_HOME=$(pwd)/.openjdk17
60+
JAVA_PKG="$JAVA_URL/latest_openjdk_17_linux.tar.gz"
61+
curl -L --output /tmp/jdk.tar.gz "$JAVA_PKG"
62+
mkdir -p "$JAVA_HOME"
63+
tar --extract --file /tmp/jdk.tar.gz --directory "$JAVA_HOME" --strip-components 1
64+
65+
export JAVA_HOME
66+
export PATH=$JAVA_HOME/bin:$PATH
67+

‎.buildkite/release.yml

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
agents:
2+
provider: "gcp"
3+
4+
steps:
5+
- label: "Run the release"
6+
key: "release"
7+
commands: .ci/release.sh | tee release.out
8+
artifact_paths: "release.out"
9+
10+
notify:
11+
- slack:
12+
channels:
13+
- "#apm-agent-java"

‎.buildkite/snapshot.yml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
agents:
2+
provider: "gcp"
3+
4+
steps:
5+
- label: "Run the snapshot"
6+
key: "release"
7+
commands: .ci/snapshot.sh | tee snapshot.out
8+
artifact_paths:
9+
- "snapshot.out"
10+
- "**/target/*"
11+
12+
notify:
13+
- slack:
14+
channels:
15+
- "#apm-agent-java"

‎.ci/release.sh

+31
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/usr/bin/env bash
2+
## This script runs the release given the different environment variables
3+
## branch_specifier
4+
## dry_run
5+
##
6+
## It relies on the .buildkite/hooks/pre-command so the Vault is prepared
7+
## automatically by buildkite.
8+
9+
set -e
10+
11+
# Make sure we delete this folder before leaving even in case of failure
12+
clean_up () {
13+
ARG=$?
14+
export VAULT_TOKEN=$PREVIOUS_VAULT_TOKEN
15+
echo "--- Deleting tmp workspace"
16+
rm -rf $TMP_WORKSPACE
17+
exit $ARG
18+
}
19+
trap clean_up EXIT
20+
21+
# Avoid detached HEAD since the release plugin requires to be on a branch
22+
git checkout -f "${branch_specifier}"
23+
24+
set +x
25+
echo "--- Release the binaries to Maven Central"
26+
if [[ "$dry_run" == "true" ]] ; then
27+
echo './mvnw release:prepare release:perform --settings .ci/settings.xml --batch-mode'
28+
else
29+
# providing settings in arguments to make sure they are propagated to the forked maven release process
30+
./mvnw release:prepare release:perform --settings .ci/settings.xml -Darguments="--settings .ci/settings.xml" --batch-mode
31+
fi

‎.ci/snapshot.sh

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/usr/bin/env bash
2+
## This script runs the snapshot given the different environment variables
3+
## dry_run
4+
##
5+
## It relies on the .buildkite/hooks/pre-command so the Vault and other tooling
6+
## are prepared automatically by buildkite.
7+
##
8+
9+
set -e
10+
11+
# Make sure we delete this folder before leaving even in case of failure
12+
clean_up () {
13+
ARG=$?
14+
export VAULT_TOKEN=$PREVIOUS_VAULT_TOKEN
15+
echo "--- Deleting tmp workspace"
16+
rm -rf $TMP_WORKSPACE
17+
exit $ARG
18+
}
19+
trap clean_up EXIT
20+
21+
set +x
22+
echo "--- Deploy the snapshot"
23+
if [[ "$dry_run" == "true" ]] ; then
24+
echo './mvnw -s .ci/settings.xml -Pgpg clean deploy --batch-mode'
25+
else
26+
./mvnw -s .ci/settings.xml -Pgpg clean deploy --batch-mode
27+
fi

‎.github/workflows/release.yml

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
---
2+
name: release
3+
4+
permissions:
5+
contents: read
6+
7+
on:
8+
workflow_dispatch:
9+
inputs:
10+
branch_specifier:
11+
description: The branch to release ex. main or 0.6.
12+
required: true
13+
default: "main"
14+
type: string
15+
16+
dry_run:
17+
description: If set, run a dry-run release
18+
default: false
19+
type: boolean
20+
21+
jobs:
22+
release:
23+
name: Release
24+
runs-on: ubuntu-latest
25+
26+
steps:
27+
- id: buildkite
28+
name: Run Release
29+
uses: elastic/apm-pipeline-library/.github/actions/buildkite@current
30+
with:
31+
vaultUrl: ${{ secrets.VAULT_ADDR }}
32+
vaultRoleId: ${{ secrets.VAULT_ROLE_ID }}
33+
vaultSecretId: ${{ secrets.VAULT_SECRET_ID }}
34+
pipeline: ecs-logging-java-release
35+
waitFor: false
36+
printBuildLogs: false
37+
buildEnvVars: |
38+
branch_specifier=${{ inputs.branch_specifier || 'main' }}
39+
dry_run=${{ inputs.dry_run || 'false' }}
40+
41+
- if: ${{ success() }}
42+
uses: elastic/apm-pipeline-library/.github/actions/slack-message@current
43+
with:
44+
url: ${{ secrets.VAULT_ADDR }}
45+
roleId: ${{ secrets.VAULT_ROLE_ID }}
46+
secretId: ${{ secrets.VAULT_SECRET_ID }}
47+
channel: "#apm-agent-java"
48+
message: |
49+
:runner: [${{ github.repository }}] Release *${{ github.ref_name }}* has been triggered in Buildkite: (<${{ steps.buildkite.outputs.build }}|build>)
50+
51+
- if: ${{ failure() }}
52+
uses: elastic/apm-pipeline-library/.github/actions/slack-message@current
53+
with:
54+
url: ${{ secrets.VAULT_ADDR }}
55+
roleId: ${{ secrets.VAULT_ROLE_ID }}
56+
secretId: ${{ secrets.VAULT_SECRET_ID }}
57+
channel: "#apm-agent-java"
58+
message: |
59+
:ghost: [${{ github.repository }}] Release *${{ github.ref_name }}* didn't get triggered in Buildkite.
60+
Build: (<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|here>)

‎.github/workflows/snapshot.yml

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
---
2+
name: snapshot
3+
4+
on:
5+
push:
6+
branches:
7+
- "main"
8+
workflow_dispatch:
9+
inputs:
10+
dry_run:
11+
description: If set, run a dry-run snapshot
12+
default: false
13+
type: boolean
14+
15+
jobs:
16+
deploy:
17+
name: Deploy
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- id: buildkite
22+
name: Run Deploy
23+
uses: elastic/apm-pipeline-library/.github/actions/buildkite@current
24+
with:
25+
vaultUrl: ${{ secrets.VAULT_ADDR }}
26+
vaultRoleId: ${{ secrets.VAULT_ROLE_ID }}
27+
vaultSecretId: ${{ secrets.VAULT_SECRET_ID }}
28+
pipeline: ecs-logging-java-snapshot
29+
waitFor: false
30+
printBuildLogs: false
31+
buildEnvVars: |
32+
dry_run=${{ inputs.dry_run || 'false' }}
33+
34+
- if: ${{ failure() }}
35+
uses: elastic/apm-pipeline-library/.github/actions/slack-message@current
36+
with:
37+
url: ${{ secrets.VAULT_ADDR }}
38+
roleId: ${{ secrets.VAULT_ROLE_ID }}
39+
secretId: ${{ secrets.VAULT_SECRET_ID }}
40+
channel: "#apm-agent-java"
41+
message: |
42+
:ghost: [${{ github.repository }}] Snapshot *${{ github.ref_name }}* didn't get triggered in Buildkite.
43+
Build: (<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|here>)

‎CONTRIBUTING.md

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# Contributing to the ECS-based logging for Java applications
2+
3+
The APM Agent is open source and we love to receive contributions from our community — you!
4+
5+
There are many ways to contribute, from writing tutorials or blog posts, improving the
6+
documentation, submitting bug reports and feature requests or writing code.
7+
8+
If you want to be rewarded for your contributions, sign up for
9+
the [Elastic Contributor Program](https://www.elastic.co/community/contributor). Each time you make
10+
a valid contribution, you’ll earn points that increase your chances of winning prizes and being
11+
recognized as a top contributor.
12+
13+
You can get in touch with us through [Discuss](https://discuss.elastic.co/c/apm), feedback and ideas
14+
are always welcome.
15+
16+
## Code contributions
17+
18+
If you have a bugfix or new feature that you would like to contribute, please find or open an issue
19+
about it first. Talk about what you would like to do. It may be that somebody is already working on
20+
it, or that there are particular issues that you should know about before implementing the change.
21+
22+
### Submitting your changes
23+
24+
Generally, we require that you test any code you are adding or modifying. Once your changes are
25+
ready to submit for review:
26+
27+
1. Sign the Contributor License Agreement
28+
29+
Please make sure you have signed
30+
our [Contributor License Agreement](https://www.elastic.co/contributor-agreement/). We are not
31+
asking you to assign copyright to us, but to give us the right to distribute your code without
32+
restriction. We ask this of all contributors in order to assure our users of the origin and
33+
continuing existence of the code. You only need to sign the CLA once.
34+
35+
2. Test your changes
36+
37+
Run the test suite to make sure that nothing is broken. See [testing](#testing) for details.
38+
39+
3. Rebase your changes
40+
41+
Update your local repository with the most recent code from the main repo, and rebase your branch
42+
on top of the latest master branch. We prefer your initial changes to be squashed into a single
43+
commit. Later, if we ask you to make changes, add them as separate commits. This makes them
44+
easier to review. As a final step before merging we will either ask you to squash all commits
45+
yourself or we'll do it for you.
46+
47+
4. Submit a pull request
48+
49+
Push your local changes to your forked copy of the repository
50+
and [submit a pull request](https://help.github.com/articles/using-pull-requests). In the pull
51+
request, choose a title which sums up the changes that you have made, and in the body provide
52+
more details about what your changes do. Also mention the number of the issue where discussion
53+
has taken place, eg "Closes #123".
54+
55+
5. Be patient
56+
57+
We might not be able to review your code as fast as we would like to, but we'll do our best to
58+
dedicate it the attention it deserves. Your effort is much appreciated!
59+
60+
### Workflow
61+
62+
All feature development and most bug fixes hit the master branch first. Pull requests should be
63+
reviewed by someone with commit access. Once approved, the author of the pull request, or reviewer
64+
if the author does not have commit access, should "Squash and merge".
65+
66+
### Testing
67+
68+
You can run the following command to run all the unit tests available:
69+
70+
```bash
71+
./mvnw test
72+
```
73+
74+
### Releasing
75+
76+
The release steps have been defined in `.ci/release.sh` which it gets triggered within the BuildKite context.
77+
78+
Releases are triggered manually using GitHub actions, and the GitHub action is the one contacting BuildKite.
79+
To run a release then
80+
* Navigate to the [GitHub job](https://github.com/elastic/ecs-logging-java/actions/workflows/release.yml)
81+
* Choose Run workflow.
82+
* Fill the form and click `Run workflow` and wait for a few minutes to complete
83+
84+
And email/slack message will be sent with the outcome.
85+
86+
#### Further details
87+
88+
* There are specific vault secrets accessible only in `secret/ci/elastic-ecs-logging-java`

‎README.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
[![Build Status](https://apm-ci.elastic.co/buildStatus/icon?job=apm-agent-java%2Fecs-logging-java-mbp%2Fmain)](https://apm-ci.elastic.co/job/apm-agent-java/job/ecs-logging-java-mbp/job/main/)
1+
[![Build Status](https://github.com/elastic/ecs-logging-java/actions/workflows/test.yml/badge.svg)](https://github.com/elastic/ecs-logging-java/actions/workflows/test.yml)
22
[![Maven Central](https://img.shields.io/maven-central/v/co.elastic.logging/ecs-logging-java-parent.svg)](https://search.maven.org/search?q=g:co.elastic.logging)
33

44
# ECS-based logging for Java applications

0 commit comments

Comments
 (0)