Run tag_image_push workflows during PR builder [DI-315]

[JackPGreen]

The tag_image_push workflows are triggered only with a release, which means that any changes are not able to be tested.

Using a DRY_RUN mode we can execute the workflow as a non-destructive sanity check, without making any publicly observable changes.

Changes:

• Add execution of tag_image_push workflows (in DRY_RUN mode) to PR builder
• Add DRY_RUN mode to tag_image_push_rhel workflow
• Extend tag_image_push workflow's DRY_RUN parameter by also skipping Dockerhub description/readme updates
• Support calling tag_image_push workflows from other workflows via workflow_call (requires duplication of parameters)
• update how we query inputs (github.event.inputs -> inputs) to support workflow_call executions
• give log artifacts more unique names now were running more jobs at once to avoid collisions

Fixes: DI-315

Post-merge actions:

• backport

[ldziedziul]

• Invert DRY_RUN check so that it only runs if it's false (previously - ran always unless true) as a safety net for bad inputs (e.g. ``!)

It was done on purpose to avoid backward incompatibility here:

• hazelcast-docker/.github/workflows/check-base-images.yml

  Lines 115 to 116 in 79f6ded

  	gh workflow run tag_image_push.yml --ref v${{ matrix.version }} -f HZ_VERSION=${{ matrix.version }} -f RELEASE_TYPE=EE
  	gh workflow run tag_image_push_rhel.yml --ref v${{ matrix.version }} -f HZ_VERSION=${{ matrix.version }}

If you change the default value of DRY_RUN then you have to add DRY_RUN flag in the lines above, but this won't work when rebuilding older versions without this flag. So you would have to backport DRY_RUN to older releases

[JackPGreen]

• Invert DRY_RUN check so that it only runs if it's false (previously - ran always unless true) as a safety net for bad inputs (e.g. ``!)

It was done on purpose to avoid backward incompatibility here:

• hazelcast-docker/.github/workflows/check-base-images.yml

  Lines 115 to 116 in 79f6ded

  	gh workflow run tag_image_push.yml --ref v${{ matrix.version }} -f HZ_VERSION=${{ matrix.version }} -f RELEASE_TYPE=EE
  	gh workflow run tag_image_push_rhel.yml --ref v${{ matrix.version }} -f HZ_VERSION=${{ matrix.version }}

If you change the default value of DRY_RUN then you have to add DRY_RUN flag in the lines above, but this won't work when rebuilding older versions without this flag. So you would have to backport DRY_RUN to older releases

👍

f1ca0b4

[nishaatr]

Is this in relation to discussion we had to reduce Docker image testing during release?
https://hazelcast.atlassian.net/wiki/spaces/EN/pages/4681302104/Create+release+5.x#Docker-release-tag-test

BTW...JIRA needs parent, SP and description

[JackPGreen]

Is this in relation to discussion we had to reduce Docker image testing during release? https://hazelcast.atlassian.net/wiki/spaces/EN/pages/4681302104/Create+release+5.x#Docker-release-tag-test

Partially, but it's primarily to give test coverage for:

• Remove Hazelcast 4 RHEL support #811
• Get OCP credentials from AWS during RHEL release [DI-78] #812

[JackPGreen]

@ldziedziul are you able to take a look at this, please?

[ldziedziul]

I'm concerned that we pass all the secrets needed to do the actual push to the prod registry. What if one creates a PR and modifies tag_image_push.yml that DRY_RUN is not working anymore? We would end up with pushing broken image to prod.

WDYT about passing here secrets explicitly and only the ones that are used for read-only operations?

[JackPGreen]

WDYT about passing here secrets explicitly and only the ones that are used for read-only operations?

I was trying to avoid a change to the push action necessitating a change to build-pr as well, but I can see your concern.

However, if they are passed explicitly, how are they accessed in the workflow? AFAIK with the with syntax it passes them as environment variables, so the ${{ secrets.MY_CRED }} would fail if MY_CRED was instead an environment variable?

[ldziedziul]

There's also secrets section. Check the first example https://docs.github.com/en/enterprise-cloud@latest/actions/sharing-automations/reusing-workflows#passing-inputs-and-secrets-to-a-reusable-workflow:

jobs:
  call-workflow-passing-data:
    uses: octo-org/example-repo/.github/workflows/reusable-workflow.yml@main
    with:
      config-path: .github/labeler.yml
    secrets:
      personal_access_token: ${{ secrets.token }}

[JackPGreen]

I've tried in f1f1a3f

However the RHEL push needs the credentials for pushing, but also the preflight etc stuff we actually want to test, so it's still inherit.