feat: add AMI build step to release workflow#706
Open
3alpha wants to merge 4 commits into
Open
Conversation
3alpha
force-pushed
the
feat/ami-build-on-release
branch
2 times, most recently
from
9a63712 to
b7820f1
Compare
Appends a build-ami job that runs after the release job: - Authenticates via OIDC (gha-imagebuilder role, no stored credentials) - Patch-bumps the Image Builder recipe version - Triggers EC2 Image Builder pipeline on Ubuntu 24 LTS All ARNs stored as repo secrets.
Replaces fragile 'head -n -12' line-stripping of the prerequisites script with a self-contained build script that: - Installs Docker, wireguard, lsof, iptables - Sets up /etc/rc.local for first-boot DAppNode installation - Skips network connectivity checks (not needed during AMI build) - Handles Ubuntu 24 LTS properly
- Create standalone .github/workflows/build-ami.yml triggered on Pre-release workflow completion - Remove build-ami job and OIDC permissions from release.yml - Update scripts/dappnode_ami_build.sh to require PROFILE_URL env var - Workflow creates thin per-release component that downloads and runs the repo script with pinned PROFILE_URL for that specific release tag - Remove IMAGE_BUILDER_COMPONENT_ARN secret (no longer needed)
3alpha
force-pushed
the
feat/ami-build-on-release
branch
from
c241447 to
529782a
Compare
- Add .github/workflows/build-ami.yml (triggers after Release completes) - Add scripts/dappnode_ami_build.sh (prerequisites + pre-download + rc.local) - release.yml: rename to Release, mark as full release (not prerelease) - Workflow reuses existing AWS component, just bumps recipe and triggers - IAM role updated: added GetImageRecipe, removed unused CreateComponent
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a
build-amijob at the end of the release workflow that automatically builds a fresh DAppNode AMI on each release.How it works
gha-imagebuilder, no long-lived credentials)Setup done
gha-imagebuildercreated with minimal Image Builder permissionsrepo:dappnode/*)Secrets added
IMAGE_BUILDER_ROLE_ARNIMAGE_BUILDER_PIPELINE_ARNIMAGE_BUILDER_INFRA_ARNIMAGE_BUILDER_DIST_ARNIMAGE_BUILDER_COMPONENT_ARN