Skip to content

Commit 985ff9a

Browse files
72636c72636c
authored
Use Docker Build secrets in API templates (#471)
This is now well-supported by the v5 Buildkite stack and https://github.com/seek-oss/docker-ecr-cache-buildkite-plugin.
1 parent 3f0f14d commit 985ff9a

14 files changed

+160
-122
lines changed

‎.changeset/afraid-humans-design.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
'skuba': patch
3+
---
4+
5+
**template/express-rest-api:** Add `test:ci` script

‎.changeset/new-falcons-raise.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
'skuba': patch
3+
---
4+
5+
**template/express-rest-api:** Use [Docker Build secrets](https://docs.docker.com/develop/develop-images/build_enhancements/#new-docker-build-secret-information)

‎.changeset/quiet-actors-live.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
'skuba': patch
3+
---
4+
5+
**template/koa-rest-api:** Add `test:ci` script

‎.changeset/wicked-dodos-occur.md

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
'skuba': patch
3+
---
4+
5+
**template/koa-rest-api:** Use [Docker Build secrets](https://docs.docker.com/develop/develop-images/build_enhancements/#new-docker-build-secret-information)

‎template/express-rest-api/.buildkite/pipeline.yml

+50-30
Original file line numberDiff line numberDiff line change
@@ -1,52 +1,72 @@
11
configs:
2-
- &aws-sm
3-
seek-oss/aws-sm#v2.0.0:
4-
env:
5-
NPM_READ_TOKEN: arn:aws:secretsmanager:ap-southeast-2:987872074697:secret:npm/npm-read-token
2+
environments:
3+
- &dev
4+
agents:
5+
queue: <%- devBuildkiteQueueName %>
66

7-
- &docker-ecr-cache
8-
seek-oss/docker-ecr-cache#v1.9.0:
9-
build-args:
10-
- NPM_READ_TOKEN
11-
cache-on:
12-
- package.json
13-
- yarn.lock
14-
target: dev-deps
7+
- &prod
8+
agents:
9+
queue: <%- prodBuildkiteQueueName %>
1510

16-
- &deploy
17-
concurrency: 1
18-
retry:
19-
manual:
20-
# Only use this if you need to roll back a deployment ASAP.
21-
# Always follow up with a proper revert or fix in Git history.
22-
permit_on_passed: true
11+
plugins:
12+
- &aws-sm
13+
seek-oss/aws-sm#v2.3.1:
14+
env:
15+
NPM_READ_TOKEN: arn:aws:secretsmanager:ap-southeast-2:987872074697:secret:npm/npm-read-token
2316

24-
- &dev
25-
agents:
26-
queue: <%- devBuildkiteQueueName %>
17+
- &docker-ecr-cache
18+
seek-oss/docker-ecr-cache#v1.11.0:
19+
cache-on:
20+
- package.json
21+
- yarn.lock
22+
dockerfile: Dockerfile.dev-deps
23+
secrets: id=npm,src=.npmrc
2724

28-
- &prod
29-
agents:
30-
queue: <%- prodBuildkiteQueueName %>
25+
- &private-npm
26+
seek-oss/private-npm#v1.2.0:
27+
env: NPM_READ_TOKEN
28+
29+
base-steps:
30+
- &deploy
31+
concurrency: 1
32+
retry:
33+
manual:
34+
# Only use this if you need to roll back a deployment ASAP.
35+
# Always follow up with a proper revert or fix in Git history.
36+
permit_on_passed: true
3137

3238
steps:
39+
- <<: *prod
40+
label: 🧖‍♀️ Warm Prod
41+
command: ':'
42+
key: warm-prod
43+
plugins:
44+
- *aws-sm
45+
- *private-npm
46+
- *docker-ecr-cache
47+
3348
- <<: *prod
3449
label: 🧪 Test & Lint
3550
commands:
36-
- echo '+++ yarn test'
37-
- yarn test
38-
- echo '+++ yarn lint'
51+
- echo '+++ yarn test:ci'
52+
- yarn test:ci
53+
- echo '--- yarn lint'
3954
- yarn lint
55+
depends_on: warm-prod
4056
plugins:
4157
- *aws-sm
58+
- *private-npm
4259
- *docker-ecr-cache
4360
- docker-compose#v3.7.0:
4461
run: app
4562

4663
- <<: *prod
4764
label: 📦 Build & Package
65+
depends_on: warm-prod
4866
plugins:
4967
- *aws-sm
68+
- *private-npm
69+
- *docker-ecr-cache
5070
- seek-jobs/gantry#v1.3.0:
5171
command: build
5272
file: gantry.build.yml
@@ -61,6 +81,7 @@ steps:
6181
<<: *deploy
6282
label: 🤞 Deploy Dev
6383
concurrency_group: <%- teamName %>/deploy/gantry/<%- devGantryEnvironmentName %>
84+
key: deploy-dev
6485
plugins:
6586
- seek-jobs/gantry#v1.3.0:
6687
command: apply
@@ -71,13 +92,12 @@ steps:
7192
- .gantry/common.yml
7293
- .gantry/dev.yml
7394

74-
- wait
75-
7695
- <<: *prod
7796
<<: *deploy
7897
label: 🚀 Deploy Prod
7998
branches: master
8099
concurrency_group: <%- teamName %>/deploy/gantry/<%- prodGantryEnvironmentName %>
100+
depends_on: deploy-dev
81101
plugins:
82102
- seek-jobs/gantry#v1.3.0:
83103
command: apply

‎template/express-rest-api/Dockerfile

+4-29
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,15 @@
1-
# Docker image history includes ARG values, so never target this stage directly
2-
FROM node:14-alpine AS unsafe-dev-deps
3-
4-
WORKDIR /workdir
5-
6-
COPY package.json yarn.lock ./
7-
8-
ARG NPM_READ_TOKEN
9-
10-
RUN yarn config set cache-folder /yarn
11-
12-
RUN \
13-
echo '//registry.npmjs.org/:_authToken=${NPM_READ_TOKEN}' > .npmrc && \
14-
yarn install --frozen-lockfile --ignore-optional --non-interactive && \
15-
rm .npmrc
16-
17-
###
18-
19-
FROM node:14-alpine AS dev-deps
20-
21-
WORKDIR /workdir
22-
23-
COPY --from=unsafe-dev-deps /workdir .
24-
25-
COPY --from=unsafe-dev-deps /yarn /yarn
26-
27-
RUN yarn config set cache-folder /yarn
1+
ARG BASE_IMAGE
2+
ARG BASE_TAG
283

294
###
305

31-
FROM dev-deps AS deps
6+
FROM ${BASE_IMAGE}:${BASE_TAG} AS deps
327

338
RUN yarn install --ignore-optional --ignore-scripts --non-interactive --offline --production
349

3510
###
3611

37-
FROM dev-deps AS build
12+
FROM ${BASE_IMAGE}:${BASE_TAG} AS build
3813

3914
COPY . .
4015

‎template/express-rest-api/Dockerfile.dev-deps

+11
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
# syntax=docker/dockerfile:1.2
2+
3+
FROM node:14-alpine AS dev-deps
4+
5+
WORKDIR /workdir
6+
7+
COPY package.json yarn.lock ./
8+
9+
RUN \
10+
--mount=type=secret,id=npm,dst=/workdir/.npmrc \
11+
yarn install --frozen-lockfile --ignore-optional --non-interactive

‎template/express-rest-api/gantry.build.yml

+3-1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ schemaVersion: v0.0
55
image: '{{values "image"}}'
66

77
buildArgs:
8-
NPM_READ_TOKEN: '{{.Env.NPM_READ_TOKEN}}'
8+
# https://github.com/seek-oss/docker-ecr-cache-buildkite-plugin#building-on-the-resulting-image
9+
BASE_IMAGE: '{{.Env.BUILDKITE_PLUGIN_DOCKER_ECR_CACHE_EXPORT_IMAGE}}'
10+
BASE_TAG: '{{.Env.BUILDKITE_PLUGIN_DOCKER_ECR_CACHE_EXPORT_TAG}}'
911

1012
failOnScanFindings: true

‎template/express-rest-api/package.json

+2-1
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@
2626
"lint": "skuba lint",
2727
"start": "ENVIRONMENT=local skuba start",
2828
"start:debug": "yarn start --inspect-brk",
29-
"test": "skuba test --coverage",
29+
"test": "skuba test",
30+
"test:ci": "skuba test --coverage",
3031
"test:watch": "skuba test --watch"
3132
}
3233
}

‎template/koa-rest-api/.buildkite/pipeline.yml

+50-30
Original file line numberDiff line numberDiff line change
@@ -1,52 +1,72 @@
11
configs:
2-
- &aws-sm
3-
seek-oss/aws-sm#v2.0.0:
4-
env:
5-
NPM_READ_TOKEN: arn:aws:secretsmanager:ap-southeast-2:987872074697:secret:npm/npm-read-token
2+
environments:
3+
- &dev
4+
agents:
5+
queue: <%- devBuildkiteQueueName %>
66

7-
- &docker-ecr-cache
8-
seek-oss/docker-ecr-cache#v1.9.0:
9-
build-args:
10-
- NPM_READ_TOKEN
11-
cache-on:
12-
- package.json
13-
- yarn.lock
14-
target: dev-deps
7+
- &prod
8+
agents:
9+
queue: <%- prodBuildkiteQueueName %>
1510

16-
- &deploy
17-
concurrency: 1
18-
retry:
19-
manual:
20-
# Only use this if you need to roll back a deployment ASAP.
21-
# Always follow up with a proper revert or fix in Git history.
22-
permit_on_passed: true
11+
plugins:
12+
- &aws-sm
13+
seek-oss/aws-sm#v2.3.1:
14+
env:
15+
NPM_READ_TOKEN: arn:aws:secretsmanager:ap-southeast-2:987872074697:secret:npm/npm-read-token
2316

24-
- &dev
25-
agents:
26-
queue: <%- devBuildkiteQueueName %>
17+
- &docker-ecr-cache
18+
seek-oss/docker-ecr-cache#v1.11.0:
19+
cache-on:
20+
- package.json
21+
- yarn.lock
22+
dockerfile: Dockerfile.dev-deps
23+
secrets: id=npm,src=.npmrc
2724

28-
- &prod
29-
agents:
30-
queue: <%- prodBuildkiteQueueName %>
25+
- &private-npm
26+
seek-oss/private-npm#v1.2.0:
27+
env: NPM_READ_TOKEN
28+
29+
base-steps:
30+
- &deploy
31+
concurrency: 1
32+
retry:
33+
manual:
34+
# Only use this if you need to roll back a deployment ASAP.
35+
# Always follow up with a proper revert or fix in Git history.
36+
permit_on_passed: true
3137

3238
steps:
39+
- <<: *prod
40+
label: 🧖‍♀️ Warm Prod
41+
command: ':'
42+
key: warm-prod
43+
plugins:
44+
- *aws-sm
45+
- *private-npm
46+
- *docker-ecr-cache
47+
3348
- <<: *prod
3449
label: 🧪 Test & Lint
3550
commands:
36-
- echo '+++ yarn test'
37-
- yarn test
38-
- echo '+++ yarn lint'
51+
- echo '+++ yarn test:ci'
52+
- yarn test:ci
53+
- echo '--- yarn lint'
3954
- yarn lint
55+
depends_on: warm-prod
4056
plugins:
4157
- *aws-sm
58+
- *private-npm
4259
- *docker-ecr-cache
4360
- docker-compose#v3.7.0:
4461
run: app
4562

4663
- <<: *prod
4764
label: 📦 Build & Package
65+
depends_on: warm-prod
4866
plugins:
4967
- *aws-sm
68+
- *private-npm
69+
- *docker-ecr-cache
5070
- seek-jobs/gantry#v1.3.0:
5171
command: build
5272
file: gantry.build.yml
@@ -61,6 +81,7 @@ steps:
6181
<<: *deploy
6282
label: 🤞 Deploy Dev
6383
concurrency_group: <%- teamName %>/deploy/gantry/<%- devGantryEnvironmentName %>
84+
key: deploy-dev
6485
plugins:
6586
- seek-jobs/gantry#v1.3.0:
6687
command: apply
@@ -71,13 +92,12 @@ steps:
7192
- .gantry/common.yml
7293
- .gantry/dev.yml
7394

74-
- wait
75-
7695
- <<: *prod
7796
<<: *deploy
7897
label: 🚀 Deploy Prod
7998
branches: master
8099
concurrency_group: <%- teamName %>/deploy/gantry/<%- prodGantryEnvironmentName %>
100+
depends_on: deploy-dev
81101
plugins:
82102
- seek-jobs/gantry#v1.3.0:
83103
command: apply

‎template/koa-rest-api/Dockerfile

+4-29
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,15 @@
1-
# Docker image history includes ARG values, so never target this stage directly
2-
FROM node:14-alpine AS unsafe-dev-deps
3-
4-
WORKDIR /workdir
5-
6-
COPY package.json yarn.lock ./
7-
8-
ARG NPM_READ_TOKEN
9-
10-
RUN yarn config set cache-folder /yarn
11-
12-
RUN \
13-
echo '//registry.npmjs.org/:_authToken=${NPM_READ_TOKEN}' > .npmrc && \
14-
yarn install --frozen-lockfile --ignore-optional --non-interactive && \
15-
rm .npmrc
16-
17-
###
18-
19-
FROM node:14-alpine AS dev-deps
20-
21-
WORKDIR /workdir
22-
23-
COPY --from=unsafe-dev-deps /workdir .
24-
25-
COPY --from=unsafe-dev-deps /yarn /yarn
26-
27-
RUN yarn config set cache-folder /yarn
1+
ARG BASE_IMAGE
2+
ARG BASE_TAG
283

294
###
305

31-
FROM dev-deps AS deps
6+
FROM ${BASE_IMAGE}:${BASE_TAG} AS deps
327

338
RUN yarn install --ignore-optional --ignore-scripts --non-interactive --offline --production
349

3510
###
3611

37-
FROM dev-deps AS build
12+
FROM ${BASE_IMAGE}:${BASE_TAG} AS build
3813

3914
COPY . .
4015

0 commit comments

Comments
 (0)