fix(containers): expose Service DNS as read-only host output (#135) (… #24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json | |
| --- | |
| name: Notify Radius | |
| # Fires a `repository_dispatch` event to radius-project/radius so it can re-sync | |
| # what it consumes from this repository. | |
| # | |
| # This is the resource-types-contrib side of the "sync default resource types | |
| # without a fake Go module" design (radius PR #12236), Phase A. It adopts the | |
| # hybrid of Option 3 (pinned git-ref) and Option 6 (automated, Dependabot-like | |
| # PR sync), with the per-unit variant: | |
| # | |
| # * Option 3 (pinned git-ref): the dispatch carries an immutable pin -- the | |
| # pushed commit SHA on the moving channel, or the release tag on the release | |
| # channel -- that Radius records in `deploy/manifest/defaults.yaml`. The pin | |
| # is no longer "informational only" (the old fake-module model fetched via | |
| # `go get ...@latest`); it is the exact revision Radius vendors. | |
| # * Option 6 (automated PR sync): Radius's contrib-update-resource-types.yaml | |
| # turns the dispatch into a reviewable `bot/update-resource-types` PR that | |
| # runs `make update-resource-types` / `make update-recipe-packs`, surfacing | |
| # the full YAML diff and the drift check + CI on every bump. | |
| # * Per-unit variant: the payload lists exactly the units this event affected, | |
| # so Radius advances only those instead of re-vendoring everything. The two | |
| # unit kinds match the two pin sections Radius keeps in defaults.yaml | |
| # (radius PR #12567): | |
| # - `namespaces` -> `resourceTypes[]`, the `Radius.<Category>` manifests | |
| # that are copied into the Radius repo. | |
| # - `recipe_packs` -> `recipePacks[]`, the packs under `recipe-packs/`. | |
| # Radius pins these but never vendors them; its deploy | |
| # workflows fetch the pack Bicep from here at deploy | |
| # time, so the pin records which revision they target. | |
| # | |
| # Channels (both delivered as a reviewable PR, nothing fetched at build/runtime): | |
| # * edge -> push to `main`. Keeps Radius `latest`/`edge` current with this | |
| # repo's `main`; affected units come from the changed manifest | |
| # YAML files and `recipe-packs/` files, pinned to the pushed | |
| # commit SHA. | |
| # * release -> a published release. Pins a stable upstream tag at Radius | |
| # release time; a scope-prefixed tag affects a single namespace | |
| # (`Radius.Data/vX.Y.Z`) or a single recipe pack | |
| # (`recipe-pack/azure/vX.Y.Z`), a plain `vX.Y.Z` tag affects all. | |
| # | |
| # End-to-end flow: | |
| # 1. This workflow computes the per-unit payload and fires | |
| # repository_dispatch (event-type `resource-types-contrib-updated`). | |
| # 2. Radius's contrib-update-resource-types.yaml receives it and opens/refreshes | |
| # a PR that re-runs the manifest copy and the pin rewrite for the pinned ref. | |
| # 3. A maintainer reviews the YAML diff and merges the PR. | |
| # | |
| # Note: Radius only advances entries it already registers -- resource types | |
| # listed in its deploy/manifest/defaults.yaml `defaultRegistration`, and packs | |
| # listed under `recipePacks`. A namespace or pack added here but not registered | |
| # there produces a dispatch with no effective changes and no PR. | |
| # | |
| # See the design note in the radius repo: | |
| # eng/design-notes/extensibility/2026-06-resource-types-sync-without-fake-go-module.md | |
| on: | |
| push: | |
| branches: | |
| - main | |
| paths: | |
| # Trigger on any YAML change that could be a resource type manifest. | |
| # Excludes .github/ and docs/ which contain non-manifest YAML files. | |
| # This avoids hardcoding namespace folder names (Compute/, Data/, etc.) | |
| # so new top-level namespace folders are automatically covered. | |
| - "**/*.yaml" | |
| - "**/*.yml" | |
| - "!.github/**" | |
| - "!docs/**" | |
| # Recipe packs are Bicep, not YAML, and Radius pins them separately. | |
| - recipe-packs/** | |
| release: | |
| # Release channel: pin a stable upstream tag at Radius release time. | |
| types: | |
| - published | |
| # workflow_dispatch: # Enable during development for manual testing | |
| permissions: {} | |
| concurrency: | |
| # Serialize per event + ref so an edge push and a release don't race, but | |
| # never cancel an in-flight dispatch. | |
| group: notify-radius-${{ github.event_name }}-${{ github.ref }} | |
| cancel-in-progress: false | |
| jobs: | |
| dispatch: | |
| name: Notify radius-project/radius | |
| if: github.repository == 'radius-project/resource-types-contrib' | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 5 | |
| permissions: | |
| # Needed for actions/checkout to read this repository's history so the | |
| # push diff can resolve which namespaces changed. | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| # Full history so the per-namespace diff can resolve `event.before`. | |
| fetch-depth: 0 | |
| - name: Compute sync payload | |
| # Resolves the channel, the immutable pin (SHA or tag), and the set of | |
| # affected units -- `Radius.<Category>` namespaces and `recipe-packs/` | |
| # packs -- then emits the compact JSON client-payload. Emits | |
| # unit_count=0 when nothing relevant changed (e.g. a prerelease), which | |
| # short-circuits the dispatch. | |
| id: payload | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| BEFORE_SHA: ${{ github.event.before }} | |
| AFTER_SHA: ${{ github.sha }} | |
| RELEASE_TAG: ${{ github.event.release.tag_name }} | |
| RELEASE_PRERELEASE: ${{ github.event.release.prerelease }} | |
| CONTRIB_REPO: ${{ github.repository }} | |
| ACTOR: ${{ github.actor }} | |
| run: ./.github/scripts/compute-radius-sync-payload.sh | |
| - name: Generate App Token | |
| # Uses a GitHub App token instead of a PAT so that the dispatch event | |
| # is sent with scoped, auditable credentials. The app must be installed | |
| # on the target repo (radius-project/radius) with contents:write to | |
| # trigger repository_dispatch. | |
| if: steps.payload.outputs.unit_count != '0' | |
| id: app-token | |
| uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 | |
| with: | |
| client-id: ${{ secrets.RESOURCE_TYPES_BOT_CLIENT_ID }} | |
| private-key: ${{ secrets.RESOURCE_TYPES_BOT_PRIVATE_KEY }} | |
| owner: ${{ github.repository_owner }} | |
| repositories: | | |
| radius | |
| permission-metadata: read | |
| permission-contents: write | |
| - name: Send repository_dispatch to radius-project/radius | |
| # Fires the repository_dispatch event that Radius's | |
| # contrib-update-resource-types.yaml workflow listens for. The per-unit | |
| # client-payload (channel, immutable ref, and the affected namespaces | |
| # and recipe packs) is computed by the previous step. | |
| if: steps.payload.outputs.unit_count != '0' | |
| uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1 | |
| with: | |
| token: ${{ steps.app-token.outputs.token }} | |
| repository: radius-project/radius | |
| event-type: resource-types-contrib-updated | |
| client-payload: ${{ steps.payload.outputs.payload }} | |
| - name: Summarize | |
| # Write a summary to the GitHub Actions UI for visibility. | |
| run: | | |
| { | |
| echo "## Notify radius-project/radius" | |
| echo "" | |
| echo "* Event: \`${{ github.event_name }}\`" | |
| echo "* Channel: \`${{ steps.payload.outputs.channel }}\`" | |
| echo "* Ref: \`${{ steps.payload.outputs.ref }}\`" | |
| echo "* Affected namespaces (${{ steps.payload.outputs.namespace_count }}): \`${{ steps.payload.outputs.affected }}\`" | |
| echo "* Affected recipe packs (${{ steps.payload.outputs.recipe_pack_count }}): \`${{ steps.payload.outputs.affected_recipe_packs }}\`" | |
| if [ "${{ steps.payload.outputs.unit_count }}" = "0" ]; then | |
| echo "" | |
| echo "_No dispatch sent (reason: \`${{ steps.payload.outputs.reason }}\`)._" | |
| else | |
| echo "* Event type: \`resource-types-contrib-updated\`" | |
| fi | |
| } >> "${GITHUB_STEP_SUMMARY}" |