diff --git a/.github/workflows/build-image.yaml b/.github/workflows/build-image.yaml deleted file mode 100644 index 2513ac2..0000000 --- a/.github/workflows/build-image.yaml +++ /dev/null @@ -1,37 +0,0 @@ -name: Build Image - -on: - push: - branches: [main] - paths: - - "examples/auth-fastapi/app/**" - - "examples/auth-fastapi/Dockerfile" - workflow_dispatch: - -env: - IMAGE_NAME: ghcr.io/nebari-dev/nebari-software-pack-template/auth-fastapi-example - -jobs: - build-and-push: - runs-on: ubuntu-latest - permissions: - contents: read - packages: write - steps: - - uses: actions/checkout@v5 - - - name: Log in to GHCR - uses: docker/login-action@v4 - with: - registry: ghcr.io - username: ${{ github.actor }} - password: ${{ secrets.GITHUB_TOKEN }} - - - name: Build and push - uses: docker/build-push-action@v7 - with: - context: examples/auth-fastapi - push: true - tags: | - ${{ env.IMAGE_NAME }}:latest - ${{ env.IMAGE_NAME }}:${{ github.sha }} diff --git a/.github/workflows/build-images.yaml b/.github/workflows/build-images.yaml new file mode 100644 index 0000000..b56406e --- /dev/null +++ b/.github/workflows/build-images.yaml @@ -0,0 +1,37 @@ +name: Build Docker Images + +# Builds and publishes the pack's first-party image(s) via the shared reusable +# workflow in nebari-dev/.github. Each image is pushed to GHCR and quay.io with +# `sha-` and `latest` tags. Publishing to quay.io/nebari/* uses the +# org-provided QUAY_TOKEN / QUAY_USERNAME secrets, so this works for official +# packs in the nebari-dev org. +# +# The Chart.yaml path is included in the trigger on purpose: release.yaml pins +# image tags to sha-, so the release commit (a Chart.yaml bump) +# must produce images with that sha. Building here on the bump ensures they +# exist. This runs in parallel with the release workflow. + +on: + push: + branches: [main] + paths: + - "examples/auth-fastapi/app/**" + - "examples/auth-fastapi/Dockerfile" + - ".github/workflows/build-images.yaml" + - "examples/auth-fastapi/chart/Chart.yaml" + pull_request: + paths: + - "examples/auth-fastapi/app/**" + - "examples/auth-fastapi/Dockerfile" + workflow_dispatch: + +jobs: + auth-fastapi-example: + uses: nebari-dev/.github/.github/workflows/pack-build-image.yaml@v1 + with: + image: auth-fastapi-example + context: examples/auth-fastapi + push: ${{ github.event_name != 'pull_request' }} + secrets: + QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }} + QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 5e883eb..7f344c7 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -1,105 +1,38 @@ name: Release Chart +# Releases a pack chart via the shared reusable workflow in nebari-dev/.github. +# On a Chart.yaml version bump it pins the chart's image tag(s) to the release +# commit's sha, packages the chart, creates a GitHub Release, and opens a PR in +# nebari-dev/helm-repository (which then publishes to quay.io/nebari/charts). +# +# This pattern only works for official packs in the nebari-dev org: it relies on +# the org-provided NEBARI_HELM_REPO_TOKEN secret and the central +# nebari-dev/helm-repository. Forks outside the org must supply their own +# publishing infrastructure. +# +# To adapt this for your pack, point the inputs at your chart: +# - chart-path: directory containing your Chart.yaml +# - chart-name: chart name (used for the release tag and the destination +# directory in nebari-dev/helm-repository) +# - tag-paths: newline-separated dotted values.yaml keys to pin to the +# release commit's sha (one per first-party image tag) +# and update the paths filter to your chart's Chart.yaml. Make sure your image +# build runs on the same Chart.yaml bump so the pinned sha- tag exists +# (see build-images.yaml). + on: - workflow_dispatch: - inputs: - chart_path: - description: "Path to the chart directory to release" - required: true - default: "examples/basic-nginx/chart" - type: choice - options: - - "examples/basic-nginx/chart" - - "examples/auth-fastapi/chart" - - "examples/wrap-existing-chart/chart" + push: + branches: [main] + paths: + - "examples/auth-fastapi/chart/Chart.yaml" jobs: release: - runs-on: ubuntu-latest - permissions: - contents: write - pages: write - - steps: - - name: Checkout - uses: actions/checkout@v5 - with: - fetch-depth: 0 - - - name: Configure Git - run: | - git config user.name "$GITHUB_ACTOR" - git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - - - name: Set up Helm - uses: azure/setup-helm@v5 - - - name: Update dependencies - run: helm dependency update ${{ inputs.chart_path }} || true - - - name: Get chart version - id: chart - run: | - echo "version=$(grep '^version:' ${{ inputs.chart_path }}/Chart.yaml | awk '{print $2}')" >> $GITHUB_OUTPUT - echo "name=$(grep '^name:' ${{ inputs.chart_path }}/Chart.yaml | awk '{print $2}')" >> $GITHUB_OUTPUT - - - name: Check if release exists - id: check - run: | - if gh release view "${{ steps.chart.outputs.name }}-${{ steps.chart.outputs.version }}" &>/dev/null; then - echo "exists=true" >> $GITHUB_OUTPUT - else - echo "exists=false" >> $GITHUB_OUTPUT - fi - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Package chart - if: steps.check.outputs.exists == 'false' - run: helm package ${{ inputs.chart_path }} - - - name: Create GitHub release - if: steps.check.outputs.exists == 'false' - run: | - gh release create "${{ steps.chart.outputs.name }}-${{ steps.chart.outputs.version }}" \ - --title "${{ steps.chart.outputs.name }}-${{ steps.chart.outputs.version }}" \ - --generate-notes \ - *.tgz - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Update Helm repo index - if: steps.check.outputs.exists == 'false' - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: | - set -euo pipefail - GH_PAGES_URL="https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git" - REPO_URL="https://github.com/${{ github.repository }}/releases/download/${{ steps.chart.outputs.name }}-${{ steps.chart.outputs.version }}" - - # Preserve any existing gh-pages history (and index) so prior chart - # releases are not lost. Bootstrap the branch on first release. - if git ls-remote --exit-code --heads "${GH_PAGES_URL}" gh-pages >/dev/null 2>&1; then - git clone --depth 1 --branch gh-pages "${GH_PAGES_URL}" gh-pages - else - mkdir -p gh-pages - git -C gh-pages init -b gh-pages - git -C gh-pages remote add origin "${GH_PAGES_URL}" - fi - - cp *.tgz gh-pages/ - cd gh-pages - - # Merge with the existing index when present so old chart versions - # remain installable from the Helm repo. - if [ -f index.yaml ]; then - helm repo index . --url "${REPO_URL}" --merge index.yaml - else - helm repo index . --url "${REPO_URL}" - fi - - git config user.name "$GITHUB_ACTOR" - git config user.email "$GITHUB_ACTOR@users.noreply.github.com" - git add . - git commit -m "Release ${{ steps.chart.outputs.name }}-${{ steps.chart.outputs.version }}" - git push origin gh-pages + uses: nebari-dev/.github/.github/workflows/pack-release.yaml@v1 + with: + chart-path: examples/auth-fastapi/chart + chart-name: my-pack + tag-paths: | + image.tag + secrets: + NEBARI_HELM_REPO_TOKEN: ${{ secrets.NEBARI_HELM_REPO_TOKEN }} diff --git a/.github/workflows/test-integration.yaml b/.github/workflows/test-integration.yaml index 259d906..77c437c 100644 --- a/.github/workflows/test-integration.yaml +++ b/.github/workflows/test-integration.yaml @@ -103,10 +103,10 @@ jobs: # ============================================================ - name: Build and load auth-fastapi image run: | - docker build -t ghcr.io/nebari-dev/nebari-software-pack-template/auth-fastapi-example:latest \ + docker build -t ghcr.io/nebari-dev/software-pack-template/auth-fastapi-example:latest \ examples/auth-fastapi/ kind load docker-image \ - ghcr.io/nebari-dev/nebari-software-pack-template/auth-fastapi-example:latest \ + ghcr.io/nebari-dev/software-pack-template/auth-fastapi-example:latest \ --name pack-integration # ============================================================ diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index 5cf418c..9541bdf 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -86,8 +86,8 @@ jobs: # Test auth-fastapi Helm example - name: Build and load auth-fastapi image run: | - docker build -t ghcr.io/nebari-dev/nebari-software-pack-template/auth-fastapi-example:latest examples/auth-fastapi/ - kind load docker-image ghcr.io/nebari-dev/nebari-software-pack-template/auth-fastapi-example:latest --name pack-test + docker build -t ghcr.io/nebari-dev/software-pack-template/auth-fastapi-example:latest examples/auth-fastapi/ + kind load docker-image ghcr.io/nebari-dev/software-pack-template/auth-fastapi-example:latest --name pack-test - name: Install auth-fastapi chart run: | diff --git a/README.md b/README.md index 9a8e0c9..25ce005 100644 --- a/README.md +++ b/README.md @@ -1,8 +1,8 @@ # Nebari Software Pack Template -[![Lint](https://github.com/nebari-dev/nebari-software-pack-template/actions/workflows/lint.yaml/badge.svg)](https://github.com/nebari-dev/nebari-software-pack-template/actions/workflows/lint.yaml) -[![Test](https://github.com/nebari-dev/nebari-software-pack-template/actions/workflows/test.yaml/badge.svg)](https://github.com/nebari-dev/nebari-software-pack-template/actions/workflows/test.yaml) -[![Integration Test](https://github.com/nebari-dev/nebari-software-pack-template/actions/workflows/test-integration.yaml/badge.svg)](https://github.com/nebari-dev/nebari-software-pack-template/actions/workflows/test-integration.yaml) +[![Lint](https://github.com/nebari-dev/software-pack-template/actions/workflows/lint.yaml/badge.svg)](https://github.com/nebari-dev/software-pack-template/actions/workflows/lint.yaml) +[![Test](https://github.com/nebari-dev/software-pack-template/actions/workflows/test.yaml/badge.svg)](https://github.com/nebari-dev/software-pack-template/actions/workflows/test.yaml) +[![Integration Test](https://github.com/nebari-dev/software-pack-template/actions/workflows/test-integration.yaml/badge.svg)](https://github.com/nebari-dev/software-pack-template/actions/workflows/test-integration.yaml) A template repository for building **Nebari Software Packs** - Kubernetes applications that deploy on the [Nebari](https://nebari.dev) platform with @@ -115,13 +115,13 @@ For local development (optional): ## Repository Structure ``` -nebari-software-pack-template/ +software-pack-template/ .github/workflows/ - build-image.yaml # Build + publish auth-fastapi image to GHCR + build-images.yaml # Build + publish images via reusable pack-build-image lint.yaml # Manifest validation (all examples) test.yaml # Integration tests on kind cluster test-integration.yaml # NebariApp integration tests (full stack) - release.yaml # Helm package + GitHub release + gh-pages index + release.yaml # Release chart via reusable pack-release workflow examples/ vanilla-yaml/ # Example 1: Plain Kubernetes manifests deployment.yaml # nginx Deployment @@ -383,7 +383,7 @@ def get_id_token(request: Request) -> str | None: ```bash # Run locally (shows "Not Authenticated" - no IdToken cookie without Envoy Gateway) -docker run -p 8000:8000 ghcr.io/nebari-dev/nebari-software-pack-template/auth-fastapi-example:latest +docker run -p 8000:8000 ghcr.io/nebari-dev/software-pack-template/auth-fastapi-example:latest # Deploy on Nebari with auth helm install my-pack examples/auth-fastapi/chart/ \ @@ -539,11 +539,26 @@ Runs on every push and PR. Validates all examples: - `kubectl kustomize` for each Kustomize overlay - `helm lint` and `helm template` for each Helm chart (both NebariApp enabled and disabled) -### Build Image (`build-image.yaml`) - -Runs on pushes to main that modify `examples/auth-fastapi/app/` or the -`Dockerfile`, plus manual dispatch. Builds and publishes the auth-fastapi -example image to `ghcr.io/nebari-dev/nebari-software-pack-template/auth-fastapi-example`. +### Build Images (`build-images.yaml`) + +Calls the shared reusable workflow +`nebari-dev/.github/.github/workflows/pack-build-image.yaml@v1` to build and +publish the auth-fastapi example image to GHCR +(`ghcr.io/nebari-dev/software-pack-template/auth-fastapi-example`) and quay.io, +tagged `sha-` and `latest`. Runs on pushes to main that modify the +example's `app/`, `Dockerfile`, or its chart `Chart.yaml` (so the release commit +produces the sha-pinned image the release workflow references), on pull requests +(build only, no push), and on manual dispatch. + +> **Manual prerequisite (official packs).** The shared workflow does **not** +> create Quay repositories. Before the first push, a maintainer must create the +> image's Quay repository under the `nebari` org and grant the CI robot account +> write access (make it public if the pack is public). For this example that is +> `quay.io/nebari/software-pack-template-auth-fastapi-example`; in general it is +> `quay.io/nebari/-`. GHCR repositories are created +> automatically on first push, so only Quay needs this step. The `QUAY_TOKEN`, +> `QUAY_USERNAME`, and `NEBARI_HELM_REPO_TOKEN` secrets are provided +> organizationally to public nebari-dev repos. ### Test (`test.yaml`) @@ -572,11 +587,16 @@ setup that the standalone test cannot detect. ### Release (`release.yaml`) -Manual dispatch. Packages and releases a Helm chart: +Calls the shared reusable workflow +`nebari-dev/.github/.github/workflows/pack-release.yaml@v1` when the auth-fastapi +example's `Chart.yaml` version changes on main. The reusable workflow pins the +chart's image tag to the release commit's sha, packages the chart, creates a +GitHub Release, and opens a PR in `nebari-dev/helm-repository` (which publishes +to `quay.io/nebari/charts`). -- Packages the selected chart as a `.tgz` -- Creates a GitHub release with the package -- Updates the `gh-pages` branch with a Helm repo index +This flow works only for official packs in the nebari-dev org: it relies on the +org's `NEBARI_HELM_REPO_TOKEN` secret and the central `nebari-dev/helm-repository`. +Forks outside the org must supply their own publishing infrastructure. ## Deploying to a Nebari Cluster diff --git a/docs/release-readiness-checklist.md b/docs/release-readiness-checklist.md index 7ef5165..9bcd67d 100644 --- a/docs/release-readiness-checklist.md +++ b/docs/release-readiness-checklist.md @@ -197,7 +197,7 @@ If "product owner" has not been named for a pack, the tech lead acts as product - `[B]` `appVersion` in `Chart.yaml` matches the upstream application version being wrapped - `[GA]` Chart version is set to `1.0.0` and follows the [version tagging convention](#version-tagging-convention) - `[GA]` Custom container images (if any) are published and accessible -- `[GA]` Helm repo index updates correctly after release +- `[GA]` Chart syncs to `nebari-dev/helm-repository` and publishes to `quay.io/nebari/charts` after release - `[GA]` Upgrade smoke test in CI: `helm install` + `helm upgrade` succeeds without errors ### Pre-sales Verification diff --git a/docs/site/src/content/docs/build-your-own.md b/docs/site/src/content/docs/build-your-own.md index eeba9d5..9030405 100644 --- a/docs/site/src/content/docs/build-your-own.md +++ b/docs/site/src/content/docs/build-your-own.md @@ -12,7 +12,7 @@ If your app already runs on Kubernetes - via Helm, Kustomize, or plain YAML - ad ## Start from the template -The easiest way to create a pack is the [Software Pack template](https://github.com/nebari-dev/nebari-software-pack-template). +The easiest way to create a pack is the [Software Pack template](https://github.com/nebari-dev/software-pack-template). 1. Click **Use this template** on the template repository. 2. Clone your new repo. diff --git a/docs/site/src/content/docs/index.md b/docs/site/src/content/docs/index.md index 64fd27f..d99fc3c 100644 --- a/docs/site/src/content/docs/index.md +++ b/docs/site/src/content/docs/index.md @@ -19,4 +19,4 @@ A software pack is a Kubernetes application bundled with a `NebariApp` custom re ## Pack template -Use the [nebari-software-pack-template](https://github.com/nebari-dev/nebari-software-pack-template) as your starting point. It includes five examples spanning plain YAML, Kustomize, basic Helm, auth-aware apps, and wrapping an existing upstream chart. +Use the [software-pack-template](https://github.com/nebari-dev/software-pack-template) as your starting point. It includes five examples spanning plain YAML, Kustomize, basic Helm, auth-aware apps, and wrapping an existing upstream chart. diff --git a/docs/site/src/content/docs/release-readiness.md b/docs/site/src/content/docs/release-readiness.md index 38caf09..a31eba8 100644 --- a/docs/site/src/content/docs/release-readiness.md +++ b/docs/site/src/content/docs/release-readiness.md @@ -220,7 +220,7 @@ promotion purposes, but this should be resolved before the next promotion attemp - `[B]` `appVersion` in `Chart.yaml` matches the upstream application version being wrapped - `[GA]` Chart version is set to `1.0.0` and follows the version tagging convention - `[GA]` Custom container images (if any) are published and accessible -- `[GA]` Helm repo index updates correctly after release +- `[GA]` Chart syncs to `nebari-dev/helm-repository` and publishes to `quay.io/nebari/charts` after release - `[GA]` Upgrade smoke test in CI: `helm install` + `helm upgrade` succeeds without errors ### Pre-sales Verification diff --git a/docs/superpowers/specs/2026-07-17-release-workflow-reusable-migration-design.md b/docs/superpowers/specs/2026-07-17-release-workflow-reusable-migration-design.md new file mode 100644 index 0000000..e728280 --- /dev/null +++ b/docs/superpowers/specs/2026-07-17-release-workflow-reusable-migration-design.md @@ -0,0 +1,225 @@ +# Migrate the template release workflow to the reusable `pack-release.yaml@v1` + +- **Date:** 2026-07-17 +- **Repo:** nebari-dev/software-pack-template (renamed from nebari-software-pack-template) +- **Status:** Approved (design) + +## Goal + +Replace the template's hand-rolled `release.yaml` with a thin caller of the +shared reusable workflow `nebari-dev/.github/.github/workflows/pack-release.yaml@v1`, +so the template becomes a faithful, copy-paste-ready reference that mirrors what +real nebari-dev packs (e.g. `llm-serving-pack`) already use. The primary +audience is pack authors who need an easy on-ramp. + +This pattern only works for **official packs in the nebari-dev org**: the +reusable workflow syncs the packaged chart into `nebari-dev/helm-repository` +(which then publishes to `quay.io/nebari/charts`) using the org's +`NEBARI_HELM_REPO_TOKEN` secret. Forks outside the org would need their own +publishing infrastructure. + +## Background / current state + +`.github/workflows/release.yaml` today is a ~106-line manual +(`workflow_dispatch`) workflow that packages a chosen example chart, creates a +GitHub Release, and maintains a **self-hosted Helm repo index on the template's +own `gh-pages` branch**. This is inconsistent with the template's own docs, +which tell authors to publish to the central +`nebari-dev.github.io/helm-repository`. The docs site deploys to Cloudflare +Pages, so the `gh-pages` branch is used only for this Helm index; removing it is +a clean simplification. + +The reusable `pack-release.yaml@v1` (verified by reading its source) is called +via `workflow_call` and: + +1. Reads the chart version from `/Chart.yaml`. +2. Skips if a GitHub Release for `-` already exists + (idempotent). +3. Pins each `tag-paths` dotted `values.yaml` key to `sha-` of the + release commit, in the working copy only (never committed back). +4. Packages the chart and attaches the `.tgz` to a GitHub Release + (auto-detects prerelease from a `-` in the version). +5. Syncs the pinned chart source into `nebari-dev/helm-repository` (opens a PR + there) via the shared `sync-chart` action. + +Required inputs: `chart-path`, `chart-name`, `tag-paths`. Required secret: +`NEBARI_HELM_REPO_TOKEN`. + +Syntax for `uses:` / `with:` / `secrets:` at job level confirmed against the +official GitHub Actions "Reusing workflows" docs; the `on: push: paths:` + +reusable-workflow-call combination is already proven by the working +`llm-serving-pack` caller. + +## Scope decision + +Wire **one representative example: `auth-fastapi`**. It is the only example with +a first-party built image, so it is the only one that meaningfully demonstrates +the workflow's `tag-paths` image-pinning feature. `basic-nginx` (upstream +`nginx`) and `wrap-existing-chart` (podinfo subchart) have no first-party image +to pin and remain unchanged. + +## Design + +### 1. `.github/workflows/release.yaml` (rewrite) + +Replace the entire inline workflow with a thin caller mirroring +`llm-serving-pack`: + +```yaml +name: Release Chart + +# Reusable release workflow for official Nebari packs in the nebari-dev org. +# Publishes the chart to nebari-dev/helm-repository (-> quay.io/nebari/charts) +# using the org's NEBARI_HELM_REPO_TOKEN secret. Forks outside nebari-dev must +# supply their own publishing infrastructure. Pack authors adapt chart-path, +# chart-name, and tag-paths (dotted values.yaml keys to pin to the release sha). + +on: + push: + branches: [main] + paths: + - "examples/auth-fastapi/chart/Chart.yaml" + +jobs: + release: + uses: nebari-dev/.github/.github/workflows/pack-release.yaml@v1 + with: + chart-path: examples/auth-fastapi/chart + chart-name: my-pack + tag-paths: | + image.tag + secrets: + NEBARI_HELM_REPO_TOKEN: ${{ secrets.NEBARI_HELM_REPO_TOKEN }} +``` + +Trigger: **push on `Chart.yaml` change** (matches the real pack pattern the +template teaches). Tradeoff accepted: a version bump to the example opens a +human-gated PR adding `my-pack` to the central registry. + +### 2. `.github/workflows/build-image.yaml` -> `build-images.yaml` (full migration) + +The release workflow pins `image.tag` to `sha-` of the release commit, +so that image must be built and pushed with the `sha-` tag on the same +commit that bumps `Chart.yaml`. Rather than patch the hand-rolled workflow, +migrate it fully to the shared reusable `pack-build-image.yaml@v1`, copying the +`llm-serving-pack` implementation so the template demonstrates both reusable +workflows as a matched pair. + +Rename the file to `build-images.yaml` (matches the canonical `llm-serving-pack` +name) and replace its body with a single job calling the reusable workflow: + +```yaml +name: Build Docker Images + +on: + push: + branches: [main] + paths: + - "examples/auth-fastapi/app/**" + - "examples/auth-fastapi/Dockerfile" + - ".github/workflows/build-images.yaml" + # The release workflow pins images to sha-, so the + # release commit (a Chart.yaml bump) must produce images with that + # sha. Building here on the bump ensures they exist. + - "examples/auth-fastapi/chart/Chart.yaml" + pull_request: + paths: + - "examples/auth-fastapi/app/**" + - "examples/auth-fastapi/Dockerfile" + workflow_dispatch: + +jobs: + auth-fastapi-example: + uses: nebari-dev/.github/.github/workflows/pack-build-image.yaml@v1 + with: + image: auth-fastapi-example + context: examples/auth-fastapi + push: ${{ github.event_name != 'pull_request' }} + secrets: + QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }} + QUAY_USERNAME: ${{ secrets.QUAY_USERNAME }} +``` + +The reusable workflow tags `sha-` + `latest` and pushes to both GHCR and +Quay, deriving the image names from the repository name +(`github.event.repository.name`). The repo has since been **renamed** from +`nebari-software-pack-template` to `software-pack-template`, so with +`image: auth-fastapi-example` the GHCR path is +`ghcr.io/nebari-dev/software-pack-template/auth-fastapi-example` and Quay is +`quay.io/nebari/software-pack-template-auth-fastapi-example`. The reusable +workflow's default `dockerfile` is `/Dockerfile` = +`examples/auth-fastapi/Dockerfile`, which exists. + +`values.yaml` stays `tag: "latest"` (the release pins in the working copy only). + +### 3. Docs / README + +- Rewrite the README "Release (`release.yaml`)" section (~L573) and the + file-tree comment (~L124) to describe the new flow: calls the reusable + workflow, pins image tags to the release sha, publishes to the central + `nebari-dev/helm-repository`, official-packs-only note. Remove the + self-hosted `gh-pages` index wording. +- Rewrite the README "Build Image" section (~L542) and file-tree comment + (~L120) for the renamed `build-images.yaml`: it calls the reusable + `pack-build-image.yaml@v1` and publishes to GHCR and Quay with + `sha-` + `latest` tags. +- Update `docs/site/src/content/docs/release-readiness.md` and + `docs/release-readiness-checklist.md` release-engineering wording to point at + the reusable workflow where relevant (light touch; the "publishable to + `nebari-dev.github.io/helm-repository`" criterion already matches the new + flow). +- Update `docs/site/src/content/docs/build-your-own.md` if it needs a pointer to + the reusable release workflow. + +### 4. Repo-rename reference updates + +The rename to `software-pack-template` makes the reusable image workflow publish +to a new GHCR/Quay path, so update every reference coupled to the old name: + +- `examples/auth-fastapi/chart/values.yaml` `image.repository` -> new GHCR path. +- `.github/workflows/test.yaml` and `test-integration.yaml` local image + build/load tags -> new GHCR path (so kind tests use the image the chart + references). +- `README.md` CI badges, repo file-tree root, and the local `docker run` + example; `examples/auth-fastapi/README.md` `docker run` example. +- `docs/site/src/content/docs/{build-your-own,index}.md` "use this template" + links. +- Intentionally left unchanged: `CF_PROJECT: nebari-software-pack-template` in + `docs.yml` / `docs-preview-cleanup.yml` (the Cloudflare Pages project name is + independent of the GitHub repo name; renaming it would break docs deploys), + and historical `docs/superpowers/plans` and `specs` records. + +## Prerequisites / risks + +- The template repo must have `NEBARI_HELM_REPO_TOKEN` (release sync) and + `QUAY_TOKEN` / `QUAY_USERNAME` (image push) available. These are provided + organizationally to all public nebari-dev repos, and this repo is public. +- **Manual step:** the shared image workflow does not create Quay repositories. + A maintainer must create `quay.io/nebari/software-pack-template-auth-fastapi-example` + (in general `quay.io/nebari/-`) and grant the CI robot write + access before the first image push. GHCR auto-creates on push. Documented in + the README Build Images section. +- Auto-publish tradeoff (see trigger decision above): accepted. + +## Definition of done (verification) + +CI/CD workflow changes; verified without triggering real releases: + +- `actionlint` (or the repo's existing workflow lint) passes on the changed + workflow YAML. +- The `release.yaml` job's `uses` ref and `with`/`secrets` keys match the + reusable workflow's declared interface (`chart-path`, `chart-name`, + `tag-paths`, `NEBARI_HELM_REPO_TOKEN`). +- `helm lint` and `helm package` succeed for `examples/auth-fastapi/chart`. +- `build-images.yaml` is valid YAML, calls `pack-build-image.yaml@v1` with + inputs matching its interface, and the old `build-image.yaml` is removed. +- README and docs no longer reference the self-hosted `gh-pages` Helm index and + accurately describe the reusable-workflow flow. + +## Delivery sequence + +1. Open a tracking issue in `nebari-dev/software-pack-template`. +2. Create a git worktree for an isolated branch. +3. Apply the changes above (including this spec doc) in the worktree. +4. Fresh-eyes review, run the verification checks. +5. Commit, push, open a PR referencing the issue. diff --git a/examples/auth-fastapi/README.md b/examples/auth-fastapi/README.md index 1feeb68..aaa8ab0 100644 --- a/examples/auth-fastapi/README.md +++ b/examples/auth-fastapi/README.md @@ -78,7 +78,7 @@ The container image is pre-built and published to GHCR by CI. You can run it locally without building: ```bash -docker run -p 8000:8000 ghcr.io/nebari-dev/nebari-software-pack-template/auth-fastapi-example:latest +docker run -p 8000:8000 ghcr.io/nebari-dev/software-pack-template/auth-fastapi-example:latest # Open http://localhost:8000 - shows "Not Authenticated" page ``` diff --git a/examples/auth-fastapi/chart/Chart.yaml b/examples/auth-fastapi/chart/Chart.yaml index 718fb25..eed5516 100644 --- a/examples/auth-fastapi/chart/Chart.yaml +++ b/examples/auth-fastapi/chart/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: my-pack description: A Nebari Software Pack with auth-aware FastAPI application type: application -version: 0.1.0 +version: 0.1.1 appVersion: "1.0.0" diff --git a/examples/auth-fastapi/chart/values.yaml b/examples/auth-fastapi/chart/values.yaml index 946d6c9..48f1476 100644 --- a/examples/auth-fastapi/chart/values.yaml +++ b/examples/auth-fastapi/chart/values.yaml @@ -5,7 +5,7 @@ # Application # ============================================================================= image: - repository: ghcr.io/nebari-dev/nebari-software-pack-template/auth-fastapi-example + repository: ghcr.io/nebari-dev/software-pack-template/auth-fastapi-example tag: "latest" pullPolicy: IfNotPresent