-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
CUS-356: CI: use released engflow_auth to authenticate, upload BES (#24)
Added login.sh, which downloads a released engflow_auth binary, uses it to import a credential, then configures Bazel to use it. Added logout.sh, which removes the imported credential. The presubmit and postsubmit jobs all run login.sh before and logout.sh after running bazel. .bazelrc now has some common remote execution flags, but currently only uploads BES. No remote execution or caching yet.
- Loading branch information
Showing
5 changed files
with
239 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,67 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| # Copyright 2024 EngFlow Inc. All rights reserved. | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
|
|
||
| # login.sh configures the build environment to authenticate with a | ||
| # remote execution service. It should be run in CI before any bazel command. | ||
| # logout.sh should be run afterward to remove stored credentials. | ||
|
|
||
| set -o nounset -o pipefail -o errexit | ||
| [[ "${SCRIPT_DEBUG:-"off"}" == "on" ]] && set -o xtrace | ||
|
|
||
| if [[ -z "${ARCH:-}" ]]; then | ||
| echo "ARCH not set" | ||
| exit 1 | ||
| fi | ||
| if [[ -z "${CLUSTER_HOST:-}" ]]; then | ||
| echo "CLUSTER_HOST not set" | ||
| exit 1 | ||
| fi | ||
| if [[ -z "${CRED_HELPER_TOKEN:-}" ]]; then | ||
| echo "CRED_HELPER_TOKEN not set" | ||
| exit 1 | ||
| fi | ||
| if [[ -z "${OS:-}" ]]; then | ||
| echo "OS not set" | ||
| exit 1 | ||
| fi | ||
|
|
||
| # Download a recent version of engflow_auth to a local directory, | ||
| # then use it to import the credential. | ||
| readonly ENGFLOW_AUTH_VERSION=v0.0.6 | ||
| readonly TOOLS_DIR=$(pwd)/_tools | ||
| readonly ENGFLOW_AUTH_URL="https://github.com/EngFlow/auth/releases/download/${ENGFLOW_AUTH_VERSION}/engflow_auth_${OS}_${ARCH}" | ||
| if [[ "${OS}" == "windows" ]]; then | ||
| # On Windows, ensure engflow_auth has an .exe extension. Use an absolute | ||
| # Windows path with forward slashes (C:/a/b), NOT a cygwin path (/c/a/b), | ||
| # and NOT backslashes (C:\a\b). Bazel only accepts the first form. | ||
| readonly ENGFLOW_AUTH_PATH="$(cygpath --mixed "${TOOLS_DIR}/engflow_auth.exe")" | ||
| else | ||
| readonly ENGFLOW_AUTH_PATH="${TOOLS_DIR}/engflow_auth" | ||
| fi | ||
| mkdir -p "${TOOLS_DIR}" | ||
| if ! curl --fail-with-body --location --output "${ENGFLOW_AUTH_PATH}" "${ENGFLOW_AUTH_URL}"; then | ||
| cat "${ENGFLOW_AUTH_PATH}" >&2 | ||
| exit 1 | ||
| fi | ||
| chmod +x "${ENGFLOW_AUTH_PATH}" | ||
|
|
||
| # Import the credential. | ||
| "${ENGFLOW_AUTH_PATH}" import -store=file <<<"${CRED_HELPER_TOKEN}" | ||
|
|
||
| # Configure Bazel to use the credential. | ||
| cat >.bazelrc.user <<EOF | ||
| common --credential_helper=${CLUSTER_HOST}=${ENGFLOW_AUTH_PATH} | ||
| EOF |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| #!/usr/bin/env bash | ||
|
|
||
| # Copyright 2024 EngFlow Inc. All rights reserved. | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
|
|
||
| # logout.sh removes a stored credential for a remote execution service. | ||
| # It should be run in CI after all bazel commands. | ||
|
|
||
| set -o nounset -o pipefail -o errexit | ||
| [[ "${SCRIPT_DEBUG:-"off"}" == "on" ]] && set -o xtrace | ||
|
|
||
| if [[ -z "${CLUSTER_HOST:-}" ]]; then | ||
| echo "CLUSTER_HOST not set" | ||
| exit 1 | ||
| fi | ||
| if [[ -z "${OS:-}" ]]; then | ||
| echo "OS not set" | ||
| exit 1 | ||
| fi | ||
|
|
||
| readonly TOOLS_DIR=$(pwd)/_tools | ||
| if [[ "${OS}" == "windows" ]]; then | ||
| readonly ENGFLOW_AUTH_PATH="${TOOLS_DIR}/engflow_auth.exe" | ||
| else | ||
| readonly ENGFLOW_AUTH_PATH="${TOOLS_DIR}/engflow_auth" | ||
| fi | ||
|
|
||
| "${ENGFLOW_AUTH_PATH}" logout "${CLUSTER_HOST}" |