From 59900c8d941f6c71ceb88fadb78ea1c44d8ac2f1 Mon Sep 17 00:00:00 2001 From: Nick Santamaria Date: Mon, 6 Jul 2026 13:56:00 +1000 Subject: [PATCH 1/8] Added second workflow job for mysql db image --- .docker/Dockerfile.seed | 3 +- .github/workflows/run_db_trigger.yml | 110 ++++++++++++++++++++++++++- 2 files changed, 109 insertions(+), 4 deletions(-) diff --git a/.docker/Dockerfile.seed b/.docker/Dockerfile.seed index 381d99f3..2de290c1 100644 --- a/.docker/Dockerfile.seed +++ b/.docker/Dockerfile.seed @@ -1,4 +1,5 @@ -FROM ghcr.io/dpc-sdp/bay/mariadb:6.x +ARG BASE_IMAGE=ghcr.io/dpc-sdp/bay/mariadb:6.x +FROM $BASE_IMAGE ARG DATA_DIR=/tmp/data diff --git a/.github/workflows/run_db_trigger.yml b/.github/workflows/run_db_trigger.yml index c6086b4f..de014fc8 100644 --- a/.github/workflows/run_db_trigger.yml +++ b/.github/workflows/run_db_trigger.yml @@ -146,16 +146,120 @@ jobs: annotations: ${{ steps.meta.outputs.annotations }} push: true + export-db-mysql: + runs-on: ${{ inputs.runner }} + permissions: + contents: read + packages: write + id-token: write + env: + REGISTRY: ghcr.io + IMAGE_NAME: ${{ github.repository }}/mysql + TMP_DATA_DIR: data + DB_FILE: db.sql + steps: + - name: Start the database container + id: container + run: | + CONTAINER_ID=$(docker run -d -e "MYSQL_ROOT_PASSWORD=${{ secrets.DB_IMAGE_MARIADB_ROOT_PASSWORD }}" ghcr.io/dpc-sdp/bay/mysql:6.x) + timeout 60s docker exec --user 1000 -i "${CONTAINER_ID}" sh -c "until nc -z localhost 3306; do sleep 1; echo -n .; done; echo" + echo "id=$CONTAINER_ID" >> $GITHUB_OUTPUT + + - name: Configure AWS actions + uses: aws-actions/configure-aws-credentials@v4 + with: + aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} + aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + aws-region: ap-southeast-2 + + - name: Download the database + run: aws s3 cp ${{ inputs.s3_uri }} "${{ env.DB_FILE }}" + + - name: Import the database into the running container + run: cat "${{ env.DB_FILE }}" | docker exec -i "${{ steps.container.outputs.id }}" /usr/bin/mysql + + - name: Verify database is available + run: | + if docker exec --user 1000 "${{ steps.container.outputs.id }}" /usr/bin/mysql -e "show tables;" | grep -q users; then + echo "Database import successfully" + else + echo "Database was not imported successfully" + exit 1 + fi + + - name: Update permissions of database files + run: docker exec "${{ steps.container.outputs.id }}" bash -c "chown -R mysql /var/lib/mysql && /bin/fix-permissions /var/lib/mysql" || true + continue-on-error: true + + - name: Gracefully shutdown the intermediary container + run: docker exec -i "${{ steps.container.outputs.id }}" mysqladmin -u root -p${{ secrets.DB_IMAGE_MARIADB_ROOT_PASSWORD }} shutdown + continue-on-error: true + + - name: Copy database files out of the intermediary container + run: | + mkdir -p "${{ env.TMP_DATA_DIR }}" + docker cp "${{ steps.container.outputs.id }}":/var/lib/mysql/. "${{ env.TMP_DATA_DIR }}/" + ls -la "${{ env.TMP_DATA_DIR }}" + + - name: Verify the data directory + run: | + if [ -d "${{ env.TMP_DATA_DIR }}/mysql" ]; then + echo "Files exist on the host" + else + ls -la "${{ env.TMP_DATA_DIR }}" + exit 1 + fi + + - name: Download the DB image dockerfile + run: curl -o Dockerfile.seed https://raw.githubusercontent.com/dpc-sdp/github-actions/main/.docker/Dockerfile.seed + + # Login against a Docker registry except on PR + # https://github.com/docker/login-action + - name: Log into registry ghcr.io + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ secrets.REGISTRY_USER }} + password: ${{ secrets.REGISTRY_TOKEN }} + + # Extract metadata (tags, labels) for Docker + # https://github.com/docker/metadata-action + - name: Extract Docker metadata + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} + tags: | + type=ref,event=branch + + + - name: Set up QEMU + uses: docker/setup-qemu-action@v3 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Build and push the database image + uses: docker/build-push-action@v5 + with: + file: Dockerfile.seed + context: . + build-args: DATA_DIR=${{ env.TMP_DATA_DIR }} BASE_IMAGE=ghcr.io/dpc-sdp/bay/mysql:6.x + tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest + platforms: linux/amd64,linux/arm64 + labels: ${{ steps.meta.outputs.labels }} + annotations: ${{ steps.meta.outputs.annotations }} + push: true + notify_slack: runs-on: ubuntu-latest - needs: [export-db] + needs: [export-db, export-db-mysql] if: ${{ always() }} steps: - name: Send Notification to Slack on Failure - if: ${{ needs.export-db.result == 'failure' }} + if: ${{ needs.export-db.result == 'failure' || needs.export-db-mysql.result == 'failure' }} uses: 8398a7/action-slack@v3 with: - status: ${{ needs.export-db.result }} + status: failure text: 'Attention: The db-trigger workflow has FAILED in project "${{ inputs.project }}" for repo "${{ github.repository }}"!' fields: 'project: ${{ inputs.project }}, repo: ${{ github.repository }}' mention: 'here' From a5c1315eb31cd1e01d1448a716e0cb0d2f2390ff Mon Sep 17 00:00:00 2001 From: Nick Santamaria Date: Mon, 6 Jul 2026 14:35:00 +1000 Subject: [PATCH 2/8] nc not available in mysql image --- .github/workflows/run_db_trigger.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/run_db_trigger.yml b/.github/workflows/run_db_trigger.yml index de014fc8..208b7c52 100644 --- a/.github/workflows/run_db_trigger.yml +++ b/.github/workflows/run_db_trigger.yml @@ -162,7 +162,7 @@ jobs: id: container run: | CONTAINER_ID=$(docker run -d -e "MYSQL_ROOT_PASSWORD=${{ secrets.DB_IMAGE_MARIADB_ROOT_PASSWORD }}" ghcr.io/dpc-sdp/bay/mysql:6.x) - timeout 60s docker exec --user 1000 -i "${CONTAINER_ID}" sh -c "until nc -z localhost 3306; do sleep 1; echo -n .; done; echo" + sleep 30 echo "id=$CONTAINER_ID" >> $GITHUB_OUTPUT - name: Configure AWS actions From d5ae0795c7e3f730184ee12dfe5a7140ad904c10 Mon Sep 17 00:00:00 2001 From: Nick Santamaria Date: Mon, 6 Jul 2026 15:05:13 +1000 Subject: [PATCH 3/8] Create db and use credentials --- .github/workflows/run_db_trigger.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/run_db_trigger.yml b/.github/workflows/run_db_trigger.yml index 208b7c52..0dc83de9 100644 --- a/.github/workflows/run_db_trigger.yml +++ b/.github/workflows/run_db_trigger.yml @@ -176,7 +176,9 @@ jobs: run: aws s3 cp ${{ inputs.s3_uri }} "${{ env.DB_FILE }}" - name: Import the database into the running container - run: cat "${{ env.DB_FILE }}" | docker exec -i "${{ steps.container.outputs.id }}" /usr/bin/mysql + run: | + echo 'create database if not exists drupal;' | docker exec -i "${{ steps.container.outputs.id }}" /usr/bin/mysql -u root -p${{ secrets.DB_IMAGE_MARIADB_ROOT_PASSWORD }} + cat "${{ env.DB_FILE }}" | docker exec -i "${{ steps.container.outputs.id }}" /usr/bin/mysql -u root -p${{ secrets.DB_IMAGE_MARIADB_ROOT_PASSWORD }} drupal - name: Verify database is available run: | From e97a6f2273ff3dda14a3847677f23f25c9b062b2 Mon Sep 17 00:00:00 2001 From: Nick Santamaria Date: Mon, 6 Jul 2026 15:19:34 +1000 Subject: [PATCH 4/8] Ensure credentials are used --- .github/workflows/run_db_trigger.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/run_db_trigger.yml b/.github/workflows/run_db_trigger.yml index 0dc83de9..f966c58a 100644 --- a/.github/workflows/run_db_trigger.yml +++ b/.github/workflows/run_db_trigger.yml @@ -182,17 +182,13 @@ jobs: - name: Verify database is available run: | - if docker exec --user 1000 "${{ steps.container.outputs.id }}" /usr/bin/mysql -e "show tables;" | grep -q users; then + if docker exec -i "${{ steps.container.outputs.id }}" /usr/bin/mysql -u root -p${{ secrets.DB_IMAGE_MARIADB_ROOT_PASSWORD }} -e "show tables;" drupal | grep -q users; then echo "Database import successfully" else echo "Database was not imported successfully" exit 1 fi - - name: Update permissions of database files - run: docker exec "${{ steps.container.outputs.id }}" bash -c "chown -R mysql /var/lib/mysql && /bin/fix-permissions /var/lib/mysql" || true - continue-on-error: true - - name: Gracefully shutdown the intermediary container run: docker exec -i "${{ steps.container.outputs.id }}" mysqladmin -u root -p${{ secrets.DB_IMAGE_MARIADB_ROOT_PASSWORD }} shutdown continue-on-error: true From 93439780019aa3e2fe5ad6e185327dbb781c1a4c Mon Sep 17 00:00:00 2001 From: Nick Santamaria Date: Mon, 6 Jul 2026 15:32:18 +1000 Subject: [PATCH 5/8] Use feature branch for seed dockerfile --- .github/workflows/run_db_trigger.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/run_db_trigger.yml b/.github/workflows/run_db_trigger.yml index f966c58a..15d0a97d 100644 --- a/.github/workflows/run_db_trigger.yml +++ b/.github/workflows/run_db_trigger.yml @@ -209,7 +209,7 @@ jobs: fi - name: Download the DB image dockerfile - run: curl -o Dockerfile.seed https://raw.githubusercontent.com/dpc-sdp/github-actions/main/.docker/Dockerfile.seed + run: curl -o Dockerfile.seed https://raw.githubusercontent.com/dpc-sdp/github-actions/feature/mysql-db-image/.docker/Dockerfile.seed # Login against a Docker registry except on PR # https://github.com/docker/login-action @@ -241,7 +241,7 @@ jobs: with: file: Dockerfile.seed context: . - build-args: DATA_DIR=${{ env.TMP_DATA_DIR }} BASE_IMAGE=ghcr.io/dpc-sdp/bay/mysql:6.x + build-args: DATA_DIR=${{ env.TMP_DATA_DIR }},BASE_IMAGE=ghcr.io/dpc-sdp/bay/mysql:6.x tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest platforms: linux/amd64,linux/arm64 labels: ${{ steps.meta.outputs.labels }} From cb57d2a69343ad125b406d67373c69d53f20a38f Mon Sep 17 00:00:00 2001 From: Nick Santamaria Date: Mon, 6 Jul 2026 15:37:31 +1000 Subject: [PATCH 6/8] Try newline delimited build args --- .github/workflows/run_db_trigger.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/run_db_trigger.yml b/.github/workflows/run_db_trigger.yml index 15d0a97d..a411a842 100644 --- a/.github/workflows/run_db_trigger.yml +++ b/.github/workflows/run_db_trigger.yml @@ -241,7 +241,9 @@ jobs: with: file: Dockerfile.seed context: . - build-args: DATA_DIR=${{ env.TMP_DATA_DIR }},BASE_IMAGE=ghcr.io/dpc-sdp/bay/mysql:6.x + build-args: | + DATA_DIR=${{ env.TMP_DATA_DIR }} + BASE_IMAGE=ghcr.io/dpc-sdp/bay/mysql:6.x tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest platforms: linux/amd64,linux/arm64 labels: ${{ steps.meta.outputs.labels }} From cc8aa5f62e8ed4fb4ebd3839f37f8a4c9df6e20b Mon Sep 17 00:00:00 2001 From: Nick Santamaria Date: Mon, 6 Jul 2026 15:48:31 +1000 Subject: [PATCH 7/8] Call commands directly instead of fix-permissions script --- .docker/Dockerfile.seed | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.docker/Dockerfile.seed b/.docker/Dockerfile.seed index 2de290c1..2956aeff 100644 --- a/.docker/Dockerfile.seed +++ b/.docker/Dockerfile.seed @@ -9,7 +9,8 @@ USER root RUN chown -R mysql /var/lib/mysql \ && chgrp -R mysql /var/lib/mysql \ - && /bin/fix-permissions /var/lib/mysql + && find -L "/var/lib/mysql" -exec chgrp 0 {} + \ + && find -L "/var/lib/mysql" -exec chmod g+rwX {} + USER mysql ENV MARIADB_INIT_WAIT_SECONDS=80 From 6e57c616f86295535328617bd1deb3016424d267 Mon Sep 17 00:00:00 2001 From: Nick Santamaria Date: Mon, 6 Jul 2026 15:56:18 +1000 Subject: [PATCH 8/8] Remove fix-permissions commands --- .docker/Dockerfile.seed | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/.docker/Dockerfile.seed b/.docker/Dockerfile.seed index 2956aeff..08c09357 100644 --- a/.docker/Dockerfile.seed +++ b/.docker/Dockerfile.seed @@ -8,9 +8,7 @@ COPY $DATA_DIR /var/lib/mysql USER root RUN chown -R mysql /var/lib/mysql \ - && chgrp -R mysql /var/lib/mysql \ - && find -L "/var/lib/mysql" -exec chgrp 0 {} + \ - && find -L "/var/lib/mysql" -exec chmod g+rwX {} + + && chgrp -R mysql /var/lib/mysql USER mysql ENV MARIADB_INIT_WAIT_SECONDS=80