From ba3329faf4572d726cbada41c09e742721510629 Mon Sep 17 00:00:00 2001 From: sulhicader Date: Sat, 5 Apr 2025 17:02:52 +0530 Subject: [PATCH 1/5] fix: Changed the vulnerable versions of python dependencies of Tour app --- py/apps/tour/requirements.txt | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/py/apps/tour/requirements.txt b/py/apps/tour/requirements.txt index fff9b60e79..135180f151 100644 --- a/py/apps/tour/requirements.txt +++ b/py/apps/tour/requirements.txt @@ -1,14 +1,14 @@ altair==4.2.0 bokeh==2.4.2 Faker==13.3.4 -h2o-wave-ml==0.8.1 +h2o-wave[ml]==1.6.3 h2o_wave=={{VERSION}} loguru==0.6.0 matplotlib==3.5.1 -numpy==1.21.6 -opencv-python==4.5.5.64 +numpy==1.26 +opencv-python==4.8.1.78 pandas==1.3.5 plotly==5.7.0 -scikit-learn==1.0.2 +scikit-learn==1.5.2 toml==0.10.2 vega-datasets==0.9.0 From 9809dc70b518d13f22478b8d7f17d90230310b74 Mon Sep 17 00:00:00 2001 From: sulhicader Date: Sat, 5 Apr 2025 18:34:19 +0530 Subject: [PATCH 2/5] Temp --- .github/workflows/release-wave.yml | 263 +++++++++-------------------- py/apps/tour/.appignore | 2 + py/apps/tour/Dockerfile-bundle | 6 + py/apps/tour/Dockerfile-runtime | 41 +++++ py/apps/tour/app.toml | 2 + 5 files changed, 127 insertions(+), 187 deletions(-) create mode 100644 py/apps/tour/.appignore create mode 100644 py/apps/tour/Dockerfile-bundle create mode 100644 py/apps/tour/Dockerfile-runtime diff --git a/.github/workflows/release-wave.yml b/.github/workflows/release-wave.yml index 9007d4a21a..8c6fa95561 100644 --- a/.github/workflows/release-wave.yml +++ b/.github/workflows/release-wave.yml @@ -1,20 +1,12 @@ name: Release Wave on: - workflow_dispatch: - inputs: - version: - description: "Release Version" - required: true - skipDocsPublish: - description: "Skip publishing docs site" - required: false - default: "false" + push: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - VERSION: "${{ github.event.inputs.version }}" - TAG: "v${{ github.event.inputs.version }}" + VERSION: "1.6.5-test" + TAG: "v1.6.5-test" permissions: id-token: write @@ -33,162 +25,13 @@ jobs: with: token: ${{ secrets.GIT_TOKEN }} - - uses: actions/setup-go@v1 - with: - go-version: "1.23.0" - - - uses: actions/setup-node@v3 - with: - node-version-file: ".nvmrc" - - - name: Setup - run: make setup - # - uses: r-lib/actions/setup-r@v2 # - uses: r-lib/actions/setup-r-dependencies@v2 # with: # working-directory: ./r - - name: Build Release - run: make release - env: - NODE_OPTIONS: "--max-old-space-size=8192" - - - name: Unit Test - run: | - make test-ui-ci - make setup-py-tests - make test-py-ci - - - name: Create GitHub Release - id: create_release - uses: actions/create-release@v1 - with: - tag_name: ${{ env.TAG }} - release_name: ${{ env.TAG }} - draft: false - - - name: Release - uses: softprops/action-gh-release@v1 - with: - files: | - build/wave-${{ env.VERSION }}-darwin-amd64.tar.gz - build/wave-${{ env.VERSION }}-darwin-arm64.tar.gz - build/wave-${{ env.VERSION }}-linux-amd64.tar.gz - build/wave-${{ env.VERSION }}-windows-amd64.tar.gz - py/h2o_wave/dist/h2o_wave-${{ env.VERSION }}-py3-none-macosx_10_9_x86_64.whl - py/h2o_wave/dist/h2o_wave-${{ env.VERSION }}-py3-none-macosx_11_0_arm64.whl - py/h2o_wave/dist/h2o_wave-${{ env.VERSION }}-py3-none-macosx_12_0_arm64.whl - py/h2o_wave/dist/h2o_wave-${{ env.VERSION }}-py3-none-manylinux1_x86_64.whl - py/h2o_wave/dist/h2o_wave-${{ env.VERSION }}-py3-none-win_amd64.whl - py/h2o_wave/dist/h2o_wave-${{ env.VERSION }}-py3-none-any.whl - # r/build/h2owave_${{ env.VERSION }}_R.tar.gz - tag_name: ${{ env.TAG }} - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Publish to Conda - uses: marek-mihok/publish_conda_package_action@v1.0.1 - with: - CondaDir: "py/h2o_wave/conda" - Platforms: "noarch" - CondaUsername: ${{ secrets.CONDA_USERNAME }} - CondaPassword: ${{ secrets.CONDA_PASSWORD }} - env: - # VERSION clashes with conda build. Use PKG_VERSION instead. - PKG_VERSION: ${{ env.VERSION }} - - - name: Publish to PyPI - uses: pypa/gh-action-pypi-publish@master - with: - packages_dir: py/h2o_wave/dist - password: ${{ secrets.PYPI_API_TOKEN }} - - - name: Configure HAIC AWS Credentials - uses: aws-actions/configure-aws-credentials@v3 - with: - role-to-assume: ${{ secrets.AWS_IAM_ROLE }} - role-session-name: wave-s3 - aws-region: ${{ secrets.AWS_WEST_REGION }} - - name: Publish apps for Cloud - run: make build-apps publish-apps-s3-hac - env: - HAC_S3_BUCKET: ${{ secrets.HAC_S3_BUCKET }} - - - name: Configure Wave AWS Credentials - uses: aws-actions/configure-aws-credentials@v3 - with: - role-to-assume: ${{ secrets.AWS_WAVE_IAM_ROLE }} - role-session-name: wave - aws-region: ${{ secrets.AWS_EAST_REGION }} - - - name: Publish to S3 - run: make publish-release-s3 - env: - AWS_DEFAULT_REGION: ${{ secrets.AWS_EAST_REGION }} - - - name: Configure Shared Services AWS Credentials - uses: aws-actions/configure-aws-credentials@v3 - with: - role-to-assume: ${{ secrets.AWS_SHARED_SERVICES_IAM_ROLE }} - role-session-name: wave-shared - aws-region: ${{ secrets.AWS_WEST_REGION }} - - - name: Publish Docs - if: ${{ github.event.inputs.skipDocsPublish == 'false' }} - run: | - make publish-website - - - name: Invalidate CDN cache - if: ${{ github.event.inputs.skipDocsPublish == 'false' }} - run: | - aws cloudfront create-invalidation --distribution-id $AWS_CLOUDFRONT_DISTRIBUTION_ID --paths "/*" - env: - AWS_CLOUDFRONT_DISTRIBUTION_ID: ${{ secrets.AWS_CLOUDFRONT_DISTRIBUTION_ID }} - - - name: Configure MC AWS Credentials - uses: aws-actions/configure-aws-credentials@v3 - with: - role-to-assume: ${{ secrets.MC_IAM_ROLE }} - role-session-name: wave-apps - aws-region: ${{ secrets.MC_AWS_REGION }} - - - name: Publish apps for Managed Cloud - run: make publish-apps-s3-mc - env: - MC_S3_BUCKET: ${{ secrets.MC_S3_BUCKET }} - AWS_REGION: ${{ secrets.MC_AWS_REGION }} - - - name: Build university - run: make publish-university - - - name: Publish to PyPI - wave_university - uses: pypa/gh-action-pypi-publish@master - with: - packages_dir: university/dist - password: ${{ secrets.PYPI_UNIVERSITY_TOKEN }} - - - name: Publish to PyPI - lightwave - uses: pypa/gh-action-pypi-publish@master - with: - packages_dir: py/h2o_lightwave/dist - password: ${{ secrets.PYPI_LIGTHWAVE_TOKEN }} - - - name: Publish to PyPI - lightwave_web - uses: pypa/gh-action-pypi-publish@master - with: - packages_dir: py/h2o_lightwave_web/dist - password: ${{ secrets.PYPI_LIGTHWAVE_WEB_TOKEN }} - - # Call some time after cloudfront cache bust - crawler needs to hit fresh cache. - - name: Reindex Algolia search - run: | - curl -X POST -H "Content-Type: application/json" --user $ALGOLIA_CRAWLER_USER_ID:$ALGOLIA_CRAWLER_API_KEY https://crawler.algolia.com/api/1/crawlers/$ALGOLIA_CRAWLER_ID/reindex - env: - ALGOLIA_CRAWLER_API_KEY: ${{ secrets.ALGOLIA_CRAWLER_API_KEY }} - ALGOLIA_CRAWLER_ID: ${{ secrets.ALGOLIA_CRAWLER_ID }} - ALGOLIA_CRAWLER_USER_ID: ${{ secrets.ALGOLIA_CRAWLER_USER_ID }} + run: make build-apps - name: Download H2O CLI working-directory: ./py/tmp/tour/ @@ -200,16 +43,7 @@ jobs: - name: Make air-gapped bundle working-directory: ./py/tmp/tour/ - run: | - .bin/h2o bundle \ - --docker-base-image 524466471676.dkr.ecr.us-east-1.amazonaws.com/q8s/launcher:v0.31.0-310 \ - --docker-use-buildkit \ - --generate-helm-charts \ - --helm-chart-version ${{ env.VERSION }} \ - --helm-chart-name tour \ - --helm-app-bundle-image-repo 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour-bundle \ - --helm-app-runtime-image-repo 524466471676.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour \ - --generate-dockerfile + run: .bin/h2o bundle - uses: actions/upload-artifact@v4 with: @@ -218,22 +52,77 @@ jobs: ./py/tmp/tour/*.Dockerfile ./py/tmp/tour/*.wave - - uses: actions/upload-artifact@v4 + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@v3 + + - name: Configure AWS credentials + uses: aws-actions/configure-aws-credentials@v4 with: - name: wave-bundle-helm - path: py/tmp/tour/helm/ + role-to-assume: arn:aws:iam::353750902984:role/GitHub-OIDC-Role + role-session-name: GitHub_to_AWS_via_FederatedOIDC + aws-region: us-east-1 + + - name: Login to Amazon ECR + uses: aws-actions/amazon-ecr-login@v2 + + - name: "Ensure ECR Repository for the bundle" + # Tries to describe the repository and if it fails, creates it + run: | + aws ecr describe-repositories \ + --repository-names h2oai/tour-bundle 2>/dev/null || + aws ecr create-repository \ + --repository-name h2oai/tour-bundle \ + --image-tag-mutability IMMUTABLE \ + --tag \ + Key=GithubRepo,Value=github.com/h2oai/${{ github.event.repository.name }} \ + Key=ManagedBy,Value=GitHubActions \ + Key=CreatedByWorkflow,Value=${{ github.workflow_ref }} + + - name: Build and Export Bundle Image + uses: docker/build-push-action@v6 + id: bundle-build + with: + push: true + context: ./py/tmp/tour/ + file: ./Dockerfile-wave-bundle + platforms: linux/amd64 + provenance: false + build-args: VERSION=${{ env.VERSION }} + tags: | + 353750902984.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour-bundle:${{ env.VERSION }} + + - name: "Ensure ECR Repository for the runtime" + # Tries to describe the repository and if it fails, creates it + run: | + aws ecr describe-repositories \ + --repository-names h2oai/tour 2>/dev/null || + aws ecr create-repository \ + --repository-name h2oai/tour \ + --image-tag-mutability IMMUTABLE \ + --tag \ + Key=GithubRepo,Value=github.com/h2oai/${{ github.event.repository.name }} \ + Key=ManagedBy,Value=GitHubActions \ + Key=CreatedByWorkflow,Value=${{ github.workflow_ref }} + + - name: Build and Export Runtime Image + uses: docker/build-push-action@v6 + id: runtime-build + with: + push: true + context: ./py/tmp/tour/ + file: ./Dockerfile-runtime + platforms: linux/amd64 + provenance: false + build-args: VERSION=${{ env.VERSION }} + tags: | + 353750902984.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:${{ env.VERSION }} + + - name: Published Images Summary + run: | + echo "#### Wave Runtime Image" >> $GITHUB_STEP_SUMMARY + echo "\`\`\`" >> $GITHUB_STEP_SUMMARY + echo "docker image push 353750902984.dkr.ecr.us-east-1.amazonaws.com/h2oai/tour:${{ env.VERSION }}" >> $GITHUB_STEP_SUMMARY + echo "\`\`\`" >> $GITHUB_STEP_SUMMARY - name: Remove files in tmp folder - run: make remove-build-apps-directory - - build-and-publish: - needs: release - permissions: - id-token: write # This is required for requesting the JWT - contents: read # This is required for actions/checkout - - uses: ./.github/workflows/wave-bundle-docker-build-publish.yaml - with: - build-version: ${{ needs.release.outputs.build-version }} - bundle-artifact: wave-bundle - wave-app-name: tour + run: make remove-build-apps-directory \ No newline at end of file diff --git a/py/apps/tour/.appignore b/py/apps/tour/.appignore new file mode 100644 index 0000000000..c61ed43e04 --- /dev/null +++ b/py/apps/tour/.appignore @@ -0,0 +1,2 @@ +./Dockerfile-bundle +./Dockerfile-runtime \ No newline at end of file diff --git a/py/apps/tour/Dockerfile-bundle b/py/apps/tour/Dockerfile-bundle new file mode 100644 index 0000000000..212ab51736 --- /dev/null +++ b/py/apps/tour/Dockerfile-bundle @@ -0,0 +1,6 @@ +FROM alpine:3.18 + +ARG VERSION=latest + +COPY ai.h2o.wave.tour.${VERSION}.wave /app/ai.h2o.wave.tour.${VERSION}.wave +ENV WAVE_BUNDLE_FILE /app/ai.h2o.wave.tour.${VERSION}.wave \ No newline at end of file diff --git a/py/apps/tour/Dockerfile-runtime b/py/apps/tour/Dockerfile-runtime new file mode 100644 index 0000000000..3606305d1a --- /dev/null +++ b/py/apps/tour/Dockerfile-runtime @@ -0,0 +1,41 @@ +FROM cgr.dev/chainguard/wolfi-base:latest@sha256:91ed94ec4e72368a9b5113f2ffb1d8e783a91db489011a89d9fad3e3816a75ba +RUN apk add --no-cache python3=~3.10 make +RUN python -m ensurepip --default-pip +ARG USER="nonroot" +ARG GROUP="nonroot" + +WORKDIR /app/ + +USER root +RUN chown -R $USER:$GROUP /app +USER $USER + +# Create a virtual environment +RUN python3 -m venv /app/venv + +COPY examples ./examples/ +COPY requirements.txt . + +# Upgrade pip inside the virtual environment +RUN /app/venv/bin/pip install --upgrade pip==24.0 setuptools + +COPY --chmod=777 . /app/ + +# Install Python dependencies +RUN --mount=type=cache,target=/home/.cache \ + --mount=type=cache,target=/root/.cache \ + --mount=type=cache,target=/.cache \ + /app/venv/bin/pip3 install -r requirements.txt + +RUN /app/venv/bin/python3 -m pip uninstall pip setuptools -y +USER root +RUN python3 -m pip uninstall pip -y +RUN mkdir -p /resources +RUN chmod -R 777 /resources +USER $USER + +USER nonroot + +EXPOSE 10101 + +ENTRYPOINT ["./venv/bin/wave", "run", "examples.tour"] \ No newline at end of file diff --git a/py/apps/tour/app.toml b/py/apps/tour/app.toml index 467c110f1e..86c0b36c14 100644 --- a/py/apps/tour/app.toml +++ b/py/apps/tour/app.toml @@ -10,3 +10,5 @@ LongDescription = "about.md" Module = "examples.tour" RoutingMode = "BASE_URL" RuntimeVersion = "deb11_py310_wlatest" +AppMode = "container" +Port = 10101 From 91b39f4a5b774a0096ae30afa0a124164be2e5b2 Mon Sep 17 00:00:00 2001 From: sulhicader Date: Mon, 7 Apr 2025 11:40:54 +0530 Subject: [PATCH 3/5] Temp --- py/apps/tour/.appignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/py/apps/tour/.appignore b/py/apps/tour/.appignore index c61ed43e04..17c085d917 100644 --- a/py/apps/tour/.appignore +++ b/py/apps/tour/.appignore @@ -1,2 +1,2 @@ ./Dockerfile-bundle -./Dockerfile-runtime \ No newline at end of file +./Dockerfile-runtime From cf9ccde4c8265c291df4b92c1a52d1057aadb85d Mon Sep 17 00:00:00 2001 From: sulhicader Date: Mon, 7 Apr 2025 11:43:50 +0530 Subject: [PATCH 4/5] Temp --- py/apps/tour/{Dockerfile-bundle => Dockerfile-wave-bundle} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename py/apps/tour/{Dockerfile-bundle => Dockerfile-wave-bundle} (100%) diff --git a/py/apps/tour/Dockerfile-bundle b/py/apps/tour/Dockerfile-wave-bundle similarity index 100% rename from py/apps/tour/Dockerfile-bundle rename to py/apps/tour/Dockerfile-wave-bundle From 2a3d9faeb6f778137b5feb808df72e11fd472e52 Mon Sep 17 00:00:00 2001 From: sulhicader Date: Tue, 8 Apr 2025 13:48:21 +0530 Subject: [PATCH 5/5] Reverted h2o-wave-ml version --- py/apps/tour/requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/py/apps/tour/requirements.txt b/py/apps/tour/requirements.txt index 135180f151..e1c90e810c 100644 --- a/py/apps/tour/requirements.txt +++ b/py/apps/tour/requirements.txt @@ -1,7 +1,7 @@ altair==4.2.0 bokeh==2.4.2 Faker==13.3.4 -h2o-wave[ml]==1.6.3 +h2o-wave-ml==0.8.1 h2o_wave=={{VERSION}} loguru==0.6.0 matplotlib==3.5.1