Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

docs: add overview of automated releases in readme #823

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs: add overview of automated releases in readme #823

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 31 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ The following documentation represents the services, APIs and endpoints responsi
- [Tests](#tests)
- [Auditing Dependencies](#auditing-dependencies)
- [Container Scans](#container-scans)
- [Automated Releases](#automated-releases)

## Running Locally

Expand Down Expand Up @@ -62,7 +63,7 @@ Logs are sent to standard output by default.

## Tests

Tests include unit, functional, and integration.
Tests include unit, functional, and integration.

Running the tests:

Expand Down Expand Up @@ -111,3 +112,32 @@ For more information on anchore and anchore-cli, refer to:
- [Anchore CLI](https://github.com/anchore/anchore-cli)
- [Circle Orb Registry](https://circleci.com/orbs/registry/orb/anchore/anchore-engine)

## Automated Releases

As part of our CI/CD process, we use a combination of CircleCI, standard-version
npm package and github-release CircleCI orb to automatically trigger our releases
and image builds. This process essentially mimics a manual tag and release.

On a merge to master, CircleCI is configured to use the mojaloopci github account
to push the latest generated CHANGELOG and package version number.

Once those changes are pushed, CircleCI will pull the updated master, tag and
push a release triggering another subsequent build that also publishes a docker image.

### Potential problems

* There is a case where the merge to master workflow will resolve successfully, triggering
a release. Then that tagged release workflow subsequently failing due to the image scan,
audit check, vulnerability check or other "live" checks.

This will leave master without an associated published build. Fixes that require
a new merge will essentially cause a skip in version number or require a clean up
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it not be possible to check if there is an associated release?

I.e. only increment the version if there was a successful publish.

of the master branch to the commit before the CHANGELOG and bump.

This may be resolved by relying solely on the previous checks of the
merge to master workflow to assume that our tagged release is of sound quality.
We are still mulling over this solution since catching bugs/vulnerabilities/etc earlier
is a boon.

* It is unknown if a race condition might occur with multiple merges with master in
quick succession, but this is a suspected edge case.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This could only be an issue if a later build finishes prior to an earlier build, or can you think of any other situation where this would be possible?

I do not believe CircleCI has the ability to ensure the above consistency, in fact here is a feature request for that very purpose: https://discuss.circleci.com/t/prevent-concurrent-builds-of-a-branch/1142

But as you can see from that request, CircleCI does cancel redundant builds if configured as such. We currently have this enabled. This should help ensure that this does not occur.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

https://github.com/bellkev/circle-lock-test <-- there is an apparent work-around.