mirror of
https://github.com/home-assistant/operating-system.git
synced 2026-04-17 15:45:07 +01:00
d9e46d6dbb
If an attempt to access R2 artifacts is made before the files exist, the 404 reply gets cached and it's not possible to access the file after it's been created without purging the cache, essentially doing a cache poisoning for future build artifacts. To avoid it, list all files that have been created by the build and call the purge cache API. As there's a limit for number of files that can be purged in a single API call [1], the GNU split utility is used to split intermediary list of files to chunks of 30 URLs, which is then converted to a JSON array and passed to the curl command. [1] https://developers.cloudflare.com/api/operations/zone-purge#purge-cached-content-by-url
103 lines
3.7 KiB
YAML
103 lines
3.7 KiB
YAML
name: Update artifacts index
|
|
|
|
on:
|
|
# Manual run for specified version
|
|
workflow_dispatch:
|
|
inputs:
|
|
version:
|
|
description: Version of HAOS to build index for
|
|
required: true
|
|
type: string
|
|
|
|
# Called by other workflows (e.g. build.yaml)
|
|
workflow_call:
|
|
inputs:
|
|
version:
|
|
description: Version of HAOS to build index for
|
|
required: true
|
|
type: string
|
|
secrets:
|
|
R2_OS_ARTIFACTS_ID:
|
|
required: true
|
|
R2_OS_ARTIFACTS_KEY:
|
|
required: true
|
|
R2_OS_ARTIFACTS_BUCKET:
|
|
required: true
|
|
R2_OS_ARTIFACTS_ENDPOINT:
|
|
required: true
|
|
CF_ZONE:
|
|
required: true
|
|
CF_PURGE_TOKEN:
|
|
required: true
|
|
|
|
env:
|
|
PYTHON_VERSION: "3.10"
|
|
|
|
jobs:
|
|
build-index:
|
|
name: Build Home Assistant OS artifacts index
|
|
runs-on: ubuntu-22.04
|
|
steps:
|
|
- name: Checkout source
|
|
uses: actions/checkout@v4
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Setup Python version ${{ env.PYTHON_VERSION }}
|
|
uses: actions/setup-python@v5
|
|
with:
|
|
python-version: ${{ env.PYTHON_VERSION }}
|
|
|
|
- name: Install AWS CLI
|
|
run: pip install awscli
|
|
|
|
- name: Create build index
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.R2_OS_ARTIFACTS_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_OS_ARTIFACTS_KEY }}
|
|
run: |
|
|
aws s3api list-objects-v2 \
|
|
--bucket "${{ secrets.R2_OS_ARTIFACTS_BUCKET }}" \
|
|
--endpoint-url "${{ secrets.R2_OS_ARTIFACTS_ENDPOINT }}" \
|
|
--prefix "${{ inputs.version }}/" \
|
|
--query 'Contents[].Key' | jq 'map(split("/")[1]) | sort' > "${{ inputs.version }}.json"
|
|
aws s3 cp \
|
|
"${{ inputs.version }}.json" \
|
|
s3://${{ secrets.R2_OS_ARTIFACTS_BUCKET }}/indexes/ \
|
|
--endpoint-url "${{ secrets.R2_OS_ARTIFACTS_ENDPOINT }}"
|
|
|
|
- name: Regenerate artifacts index
|
|
env:
|
|
AWS_ACCESS_KEY_ID: ${{ secrets.R2_OS_ARTIFACTS_ID }}
|
|
AWS_SECRET_ACCESS_KEY: ${{ secrets.R2_OS_ARTIFACTS_KEY }}
|
|
run: |
|
|
aws s3api list-objects-v2 \
|
|
--bucket "${{ secrets.R2_OS_ARTIFACTS_BUCKET }}" \
|
|
--endpoint-url "${{ secrets.R2_OS_ARTIFACTS_ENDPOINT }}" \
|
|
--prefix "indexes/" \
|
|
--query 'Contents[].Key' | jq 'map(capture("indexes/(?<version>[[:digit:]].+).json").version) | sort' > .os-artifacts/index.json
|
|
aws s3 sync \
|
|
.os-artifacts/ \
|
|
s3://${{ secrets.R2_OS_ARTIFACTS_BUCKET }}/ \
|
|
--endpoint-url "${{ secrets.R2_OS_ARTIFACTS_ENDPOINT }}" \
|
|
|
|
- name: Flush CloudFlare cache
|
|
run: |
|
|
# Create purge list of all artifacts
|
|
jq -r '. | map("https://os-artifacts.home-assistant.io/${{ inputs.version }}/" + .) | join("\n")' < "${{ inputs.version }}.json" > purge_list
|
|
# Add indexes to purge list too
|
|
echo "https://os-artifacts.home-assistant.io/indexes/${{ inputs.version }}.json" >> purge_list
|
|
echo "https://os-artifacts.home-assistant.io/index.html" >> purge_list
|
|
echo "https://os-artifacts.home-assistant.io/index.json" >> purge_list
|
|
# Split to chunks of 30 files (limit of CF API)
|
|
split -d -l30 purge_list purge_list_chunked
|
|
# Convert chunked lists to JSON arrays and call CF purge API
|
|
for f in purge_list_chunked*; do
|
|
files=$(jq -R -s 'split("\n")[:-1]' < "$f")
|
|
curl --silent --show-error --fail -X POST \
|
|
"https://api.cloudflare.com/client/v4/zones/${{ secrets.CF_ZONE }}/purge_cache" \
|
|
-H "Authorization: Bearer ${{ secrets.CF_PURGE_TOKEN }}" \
|
|
-H "Content-Type: application/json" \
|
|
--data "{\"files\": ${files}}"
|
|
done
|