mirror of
https://github.com/apache/arrow.git
synced 2026-10-29 09:05:47 +08:00
### Rationale for this change This PR moves crossbow builds to short-lived S3 credentials. It does this via GitHub's OIDC provider and an AWS ROLE_ARN with a trust relationship configured. This configuration is detailed here: - [Use IAM roles to connect GitHub Actions to actions in AWS](https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/) The benefits of short-lived / temporary credentials discussed further here: [AWS Well-architected Framework Best Practices SEC02-BP02 Use temporary credentials](https://docs.aws.amazon.com/wellarchitected/latest/framework/sec_identities_unique.html) sccache supports a variety of S3 creds: [S3 credentials](https://github.com/mozilla/sccache/blob/main/docs/S3.md#credentials) ### What changes are included in this PR? Use [AssumeRoleWithWebIdentity](https://github.com/mozilla/sccache/blob/main/docs/S3.md#credentials) for sccache S3 credentials. By assuming the AWS_ROLE_ARN, the sccache session relies on credentials that expire\*, issued only to workflows in the trusted repository, and scoped to the sccache bucket. Specific tasks: - create a role in IAM with the bucket and object level permissions, - trust the github oidc-provider, - define AWS_ROLE_ARN and set id-token permission - grant sts:AssumeRoleWithWebIdentity for the specific repositories or organization. - pass AWS_SESSION_TOKEN - add a `aws-actions/configure-aws-credentials@ v6` step to the workflow. Separately, someone will need to add the role and trust to AWS: - Procedure is in https://aws.amazon.com/blogs/security/use-iam-roles-to-connect-github-actions-to-actions-in-aws/ - Set a "Maximum session duration" to maximum runtime of any job... maybe 4 hours? 8 hours? - Permissions: Role needs BucketLevel and ObjectLevels permissions to the bucket. \* I can share an example if needed ### Are these changes tested? Yes, locally and on a fork. ### Are there any user-facing changes? No * GitHub Issue: #50899 Authored-by: paul@iqmo.com <paul@iqmo.com> Signed-off-by: Sutou Kouhei <kou@clear-code.com>
156 lines
5.5 KiB
YAML
156 lines
5.5 KiB
YAML
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
{% import 'macros.jinja' as macros with context %}
|
|
|
|
{{ macros.github_header() }}
|
|
|
|
permissions:
|
|
packages: write
|
|
# For OIDC token for sccache
|
|
id-token: write
|
|
|
|
jobs:
|
|
build:
|
|
name: "Build wheel for {{ linux_wheel_kind }} {{ linux_wheel_version }}"
|
|
{% if arch == "amd64" %}
|
|
runs-on: ubuntu-latest
|
|
{% else %}
|
|
runs-on: ubuntu-24.04-arm
|
|
{% endif %}
|
|
env:
|
|
{% if linux_wheel_kind == "musllinux" %}
|
|
ALPINE_LINUX: "3.23"
|
|
{% endif %}
|
|
# archery uses these environment variables
|
|
{% if arch == "amd64" %}
|
|
ARCH: amd64
|
|
{% else %}
|
|
ARCH: arm64/v8
|
|
{% endif %}
|
|
PYTHON: "{{ python_version }}"
|
|
PYTHON_ABI_TAG: "{{ python_abi_tag }}"
|
|
{% if python_version == "3.15" %}
|
|
# TODO: Remove -rc suffix after 3.15 release
|
|
PYTHON_IMAGE_TAG: "{{ python_version }}-rc"
|
|
{% else %}
|
|
PYTHON_IMAGE_TAG: "{{ python_version }}"
|
|
{% endif %}
|
|
|
|
steps:
|
|
{{ macros.github_checkout_arrow()|indent }}
|
|
{{ macros.github_free_space()|indent }}
|
|
{{ macros.github_install_archery()|indent }}
|
|
{{ macros.github_login_dockerhub()|indent }}
|
|
|
|
# Detect free-threaded Python builds
|
|
- name: Prepare
|
|
run: |
|
|
if [[ "${PYTHON_ABI_TAG}" == *t ]]; then
|
|
test_image_prefix=python-free-threaded
|
|
else
|
|
test_image_prefix=python
|
|
fi
|
|
echo "TEST_IMAGE_PREFIX=${test_image_prefix}" >> ${GITHUB_ENV}
|
|
|
|
{{ macros.github_configure_aws_credentials()|indent }}
|
|
- name: Build wheel
|
|
shell: bash
|
|
env:
|
|
{{ macros.github_set_sccache_envvars()|indent(8) }}
|
|
GITHUB_TOKEN: {{ '${{ secrets.GITHUB_TOKEN }}' }}
|
|
run: |
|
|
if [ "{{ linux_wheel_kind }}" = "musllinux" ] && [ "{{ arch }}" = "arm64" ]; then
|
|
# We can't use NuGet on musl arm systems because the official NuGet binary for arm doesn't exist.
|
|
:
|
|
else
|
|
export VCPKG_BINARY_SOURCES="clear;nuget,GitHub,readwrite"
|
|
fi
|
|
archery docker run \
|
|
-e SETUPTOOLS_SCM_PRETEND_VERSION={{ arrow.no_rc_version }} \
|
|
python-wheel-{{ linux_wheel_kind }}-{{ linux_wheel_version }}
|
|
|
|
- uses: actions/upload-artifact@v4
|
|
with:
|
|
name: wheel
|
|
path: arrow/python/repaired_wheels/*.whl
|
|
|
|
# TODO(kszucs): auditwheel show
|
|
- name: Test wheel
|
|
shell: bash
|
|
run: |
|
|
source arrow/ci/scripts/util_enable_core_dumps.sh
|
|
archery docker run ${TEST_IMAGE_PREFIX}-wheel-{{ linux_wheel_kind }}-test-imports
|
|
archery docker run ${TEST_IMAGE_PREFIX}-wheel-{{ linux_wheel_kind }}-test-unittests
|
|
|
|
- name: Test wheel on AlmaLinux 8
|
|
shell: bash
|
|
if: |
|
|
'{{ python_version }}' == '3.12' && '{{ linux_wheel_kind }}' == 'manylinux'
|
|
env:
|
|
ALMALINUX: "8"
|
|
run: |
|
|
archery docker run \
|
|
-e ARROW_GANDIVA=OFF \
|
|
-e TEST_DEFAULT=0 \
|
|
-e TEST_PYARROW_VERSION={{ arrow.no_rc_version }} \
|
|
-e TEST_PYTHON_VERSIONS={{ python_version }} \
|
|
-e TEST_WHEEL_PLATFORM_TAGS={{ wheel_platform_tag }} \
|
|
-e TEST_WHEELS=1 \
|
|
almalinux-verify-rc
|
|
|
|
- name: Test wheel on Ubuntu 22.04
|
|
shell: bash
|
|
if: |
|
|
'{{ python_version }}' == '3.11' && '{{ linux_wheel_kind }}' == 'manylinux'
|
|
env:
|
|
UBUNTU: "22.04"
|
|
run: |
|
|
archery docker run \
|
|
-e TEST_DEFAULT=0 \
|
|
-e TEST_PYARROW_VERSION={{ arrow.no_rc_version }} \
|
|
-e TEST_PYTHON_VERSIONS={{ python_version }} \
|
|
-e TEST_WHEEL_PLATFORM_TAGS={{ wheel_platform_tag }} \
|
|
-e TEST_WHEELS=1 \
|
|
ubuntu-verify-rc
|
|
|
|
- name: Test wheel on Ubuntu 24.04
|
|
shell: bash
|
|
if: |
|
|
'{{ python_version }}' == '3.12' && '{{ linux_wheel_kind }}' == 'manylinux'
|
|
env:
|
|
UBUNTU: "24.04"
|
|
run: |
|
|
archery docker run \
|
|
-e TEST_DEFAULT=0 \
|
|
-e TEST_PYARROW_VERSION={{ arrow.no_rc_version }} \
|
|
-e TEST_PYTHON_VERSIONS={{ python_version }} \
|
|
-e TEST_WHEEL_PLATFORM_TAGS={{ wheel_platform_tag }} \
|
|
-e TEST_WHEELS=1 \
|
|
ubuntu-verify-rc
|
|
|
|
{{ macros.github_upload_releases("arrow/python/repaired_wheels/*.whl")|indent }}
|
|
{{ macros.github_upload_wheel_scientific_python("arrow/python/repaired_wheels/*.whl")|indent }}
|
|
|
|
{% if arrow.is_default_branch() %}
|
|
- name: Push Docker images
|
|
shell: bash
|
|
run: |
|
|
archery docker push python-wheel-{{ linux_wheel_kind }}-{{ linux_wheel_version }}
|
|
archery docker push ${TEST_IMAGE_PREFIX}-wheel-{{ linux_wheel_kind }}-test-unittests
|
|
{% endif %}
|