diff --git a/.github/workflows/create-test-mirror-pr.yml b/.github/workflows/create-test-mirror-pr.yml index 1cc1619..a6ba077 100644 --- a/.github/workflows/create-test-mirror-pr.yml +++ b/.github/workflows/create-test-mirror-pr.yml @@ -18,7 +18,7 @@ jobs: - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 id: octo-sts with: - scope: DataDog/images + scope: ddoghq/images policy: dd-trace-java-docker-build.update-mirror - name: Checkout DataDog/dd-trace-java-docker-build @@ -27,10 +27,10 @@ jobs: path: dd-trace-java-docker-build ref: refs/pull/${{ github.event.inputs.pr_number }}/merge - - name: Checkout DataDog/images + - name: Checkout ddoghq/images uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - repository: DataDog/images + repository: ddoghq/images token: ${{ steps.octo-sts.outputs.token }} path: images @@ -80,7 +80,7 @@ jobs: if: ${{ steps.create-commit.outputs.has_changes == 'true' }} uses: DataDog/commit-headless@2801f6e08acb3a69b6c4d7b0d5deef27c1a15bc7 # action/v3.3.1 with: - target: DataDog/images + target: ddoghq/images token: "${{ steps.octo-sts.outputs.token }}" branch: "${{ steps.define-branch.outputs.branch }}" head-sha: "${{ steps.images-head.outputs.sha }}" @@ -96,7 +96,7 @@ jobs: PR_NUMBER: ${{ github.event.inputs.pr_number }} run: | PR_URL=$(gh pr create \ - --repo DataDog/images \ + --repo ddoghq/images \ --title "Update dd-trace-java-docker-build test images for PR #${PR_NUMBER}" \ --base master \ --head "${{ steps.define-branch.outputs.branch }}" \ diff --git a/.github/workflows/delete-test-mirror-pr.yml b/.github/workflows/delete-test-mirror-pr.yml index 6a164e8..1a75675 100644 --- a/.github/workflows/delete-test-mirror-pr.yml +++ b/.github/workflows/delete-test-mirror-pr.yml @@ -17,7 +17,7 @@ jobs: - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 id: octo-sts with: - scope: DataDog/images + scope: ddoghq/images policy: dd-trace-java-docker-build.update-mirror - name: Checkout DataDog/dd-trace-java-docker-build @@ -25,10 +25,10 @@ jobs: with: path: dd-trace-java-docker-build - - name: Checkout DataDog/images + - name: Checkout ddoghq/images uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - repository: DataDog/images + repository: ddoghq/images token: ${{ steps.octo-sts.outputs.token }} path: images @@ -65,7 +65,7 @@ jobs: - name: Push changes uses: DataDog/commit-headless@2801f6e08acb3a69b6c4d7b0d5deef27c1a15bc7 # action/v3.3.1 with: - target: DataDog/images + target: ddoghq/images token: "${{ steps.octo-sts.outputs.token }}" branch: "${{ steps.define-branch.outputs.branch }}" head-sha: "${{ steps.images-head.outputs.sha }}" @@ -79,7 +79,7 @@ jobs: PR_NUMBER: ${{ github.event.inputs.pr_number }} run: | gh pr create \ - --repo DataDog/images \ + --repo ddoghq/images \ --title "Remove dd-trace-java-docker-build test images for PR #${PR_NUMBER}" \ --base master \ --head "${{ steps.define-branch.outputs.branch }}" \ diff --git a/.github/workflows/update-mirror-digests.yml b/.github/workflows/update-mirror-digests.yml index 24f46be..c768c69 100644 --- a/.github/workflows/update-mirror-digests.yml +++ b/.github/workflows/update-mirror-digests.yml @@ -17,7 +17,7 @@ jobs: - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4 id: octo-sts with: - scope: DataDog/images + scope: ddoghq/images policy: dd-trace-java-docker-build.update-mirror - name: Checkout DataDog/dd-trace-java-docker-build @@ -25,10 +25,10 @@ jobs: with: path: dd-trace-java-docker-build - - name: Checkout DataDog/images + - name: Checkout ddoghq/images uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - repository: DataDog/images + repository: ddoghq/images token: ${{ steps.octo-sts.outputs.token }} path: images @@ -96,7 +96,7 @@ jobs: if: ${{ steps.create-commit.outputs.has_changes == 'true' }} uses: DataDog/commit-headless@2801f6e08acb3a69b6c4d7b0d5deef27c1a15bc7 # action/v3.3.1 with: - target: DataDog/images + target: ddoghq/images token: "${{ steps.octo-sts.outputs.token }}" branch: "${{ steps.define-branch.outputs.branch }}" head-sha: "${{ steps.images-head.outputs.sha }}" @@ -110,7 +110,7 @@ jobs: GH_TOKEN: ${{ steps.octo-sts.outputs.token }} run: | gh pr create \ - --repo DataDog/images \ + --repo ddoghq/images \ --title "Update dd-trace-java-docker-build ci-* image digests" \ --base master \ --head "${{ steps.define-branch.outputs.branch }}" \ diff --git a/README.md b/README.md index 2774082..407e86b 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,7 @@ The `7` and `ibm8` variants are amd64-only because the upstream JDK images are n Images are tagged with `ci-` prefixes via the [Tag new images version](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/docker-tag.yml) workflow, which runs quarterly on `master` and when manually triggered. A **48-hour cooldown** is enforced: the workflow verifies that all external upstream dependencies (Eclipse Temurin, Azul Zulu, IBM Semeru, GraalVM, etc.) referenced in the Dockerfile were built at least 48 hours ago before tagging. This ensures that upstream images have had sufficient time for vulnerability scans and community review before being CI use. On completion, it automatically triggers the [Update mirror digests for ci-* images](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/update-mirror-digests.yml) workflow, -which opens a PR in [DataDog/images](https://github.com/DataDog/images) updating the pinned `ci-*` mirror image digests. +which opens a PR in [ddoghq/images](https://github.com/ddoghq/images) updating the pinned `ci-*` mirror image digests. Once that PR is merged, `dd-trace-java` CI picks up the updated images from `registry.ddbuild.io`. Images are mirrored in `registry.ddbuild.io` to ensure they are signed before use in CI. ## Development @@ -51,10 +51,10 @@ Images are built per PR for ease in testing. These test images are prefixed with To test these images in `dd-trace-java` CI: 1. Open a PR in [DataDog/dd-trace-java-docker-build](https://github.com/DataDog/dd-trace-java-docker-build) with the changes you want to test. Let's say these changes are made in PR #N. -2. After the PR images are built in the [GitHub Container Registry](https://github.com/DataDog/dd-trace-java-docker-build/pkgs/container/dd-trace-java-docker-build), run the [Create test image mirror PR](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/create-test-mirror-pr.yml) workflow with the corresponding PR number: `N`. This automatically opens a PR in [DataDog/images](https://github.com/DataDog/images) that adds mirror entries for the `N_merge-*` test images. Merge the PR that should be automatically approved by the `dd-prapprover` bot. After merging, the images may take 30 min or more to update. +2. After the PR images are built in the [GitHub Container Registry](https://github.com/DataDog/dd-trace-java-docker-build/pkgs/container/dd-trace-java-docker-build), run the [Create test image mirror PR](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/create-test-mirror-pr.yml) workflow with the corresponding PR number: `N`. This automatically opens a PR in [ddoghq/images](https://github.com/ddoghq/images) that adds mirror entries for the `N_merge-*` test images. Merge the PR that should be automatically approved by the `dd-prapprover` bot. After merging, the images may take 30 min or more to update. 3. Open a PR in [DataDog/dd-trace-java](https://github.com/DataDog/dd-trace-java) that sets `BUILDER_IMAGE_VERSION_PREFIX: "N_merge-"` in `.gitlab-ci.yml`. Here, you can check your test images with `DataDog/dd-trace-java` CI. -4. Every time you want to test changes made in PR #N, ensure the test image SHAs in `DataDog/images` are updated by running the [Create test image mirror PR](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/create-test-mirror-pr.yml) workflow with `N`. Confirm that these PRs are approved and merged by the `dd-prapprover` bot. +4. Every time you want to test changes made in PR #N, ensure the test image SHAs in `ddoghq/images` are updated by running the [Create test image mirror PR](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/create-test-mirror-pr.yml) workflow with `N`. Confirm that these PRs are approved and merged by the `dd-prapprover` bot. 5. When the test images look good and `DataDog/dd-trace-java` CI is green, merge your `DataDog/dd-trace-java-docker-build` PR #N. 6. Close the test `DataDog/dd-trace-java` PR. -7. Run the [Delete test image mirror PR](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/delete-test-mirror-pr.yml) workflow with `N` to remove the `N_merge-*` images from `DataDog/images`. Confirm that this PR is approved and merged by the `dd-prapprover` bot. -8. Finally, run the [Tag new images version](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/docker-tag.yml) workflow. **Note:** The workflow enforces a 48-hour cooldown on external upstream dependencies — it will fail if any upstream image (Eclipse Temurin, Azul Zulu, IBM Semeru, GraalVM, etc.) was rebuilt less than 48 hours ago. If the workflow fails, check the logs to see which dependency is too new, and retry after the cooldown has elapsed. This check can also be skipped when manually triggering the workflow. On success, the [Update mirror digests for ci-* images](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/update-mirror-digests.yml) workflow will automatically open a PR in `DataDog/images`, updating the pinned `ci-*` digests. `dd-trace-java` CI should automatically pick up these updated images a few minutes after the PR is merged. +7. Run the [Delete test image mirror PR](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/delete-test-mirror-pr.yml) workflow with `N` to remove the `N_merge-*` images from `ddoghq/images`. Confirm that this PR is approved and merged by the `dd-prapprover` bot. +8. Finally, run the [Tag new images version](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/docker-tag.yml) workflow. **Note:** The workflow enforces a 48-hour cooldown on external upstream dependencies — it will fail if any upstream image (Eclipse Temurin, Azul Zulu, IBM Semeru, GraalVM, etc.) was rebuilt less than 48 hours ago. If the workflow fails, check the logs to see which dependency is too new, and retry after the cooldown has elapsed. This check can also be skipped when manually triggering the workflow. On success, the [Update mirror digests for ci-* images](https://github.com/DataDog/dd-trace-java-docker-build/actions/workflows/update-mirror-digests.yml) workflow will automatically open a PR in `ddoghq/images`, updating the pinned `ci-*` digests. `dd-trace-java` CI should automatically pick up these updated images a few minutes after the PR is merged. diff --git a/scripts/create-test-mirror-entries.sh b/scripts/create-test-mirror-entries.sh index 54bb6dd..d336cf0 100755 --- a/scripts/create-test-mirror-entries.sh +++ b/scripts/create-test-mirror-entries.sh @@ -1,9 +1,9 @@ #!/usr/bin/env bash # create-test-mirror-entries.sh — add or update {PR_NUMBER}_merge-* test image entries -# in mirror.yaml and mirror.lock.yaml files in the DataDog/images repo. +# in mirror.yaml and mirror.lock.yaml files in the ddoghq/images repo. # # This script is called in the create-test-mirror-pr Github workflow. -# It must be run from the root of DataDog/images and requires crane to be installed. +# It must be run from the root of ddoghq/images and requires crane to be installed. # # Required env var: # PR_NUMBER — pull request number in dd-trace-java-docker-build (numeric) diff --git a/scripts/delete-test-mirror-entries.sh b/scripts/delete-test-mirror-entries.sh index 669d4f0..78f58f7 100644 --- a/scripts/delete-test-mirror-entries.sh +++ b/scripts/delete-test-mirror-entries.sh @@ -1,9 +1,9 @@ #!/usr/bin/env bash # delete-test-mirror-entries.sh — remove {PR_NUMBER}_merge-* test image entries -# from mirror.yaml and mirror.lock.yaml in the DataDog/images repo. +# from mirror.yaml and mirror.lock.yaml in the ddoghq/images repo. # # This script is called in the delete-test-mirror-pr GitHub workflow. -# It must be run from the root of DataDog/images. +# It must be run from the root of ddoghq/images. # # Required env var: # PR_NUMBER — pull request number in dd-trace-java-docker-build (numeric) diff --git a/scripts/update-ci-image-digests.sh b/scripts/update-ci-image-digests.sh index a63f56e..62db16e 100755 --- a/scripts/update-ci-image-digests.sh +++ b/scripts/update-ci-image-digests.sh @@ -1,8 +1,8 @@ #!/usr/bin/env bash -# update-ci-image-digests.sh - add/update ci-* image mirror entries in the DataDog/images repo. +# update-ci-image-digests.sh - add/update ci-* image mirror entries in the ddoghq/images repo. # # This script is called in the update-mirror-digests Github workflow. -# It must be run from the root of DataDog/images and requires crane to be installed. +# It must be run from the root of ddoghq/images and requires crane to be installed. set -euo pipefail