Merge pull request #656 from rstudio/dev

Release PPM 2023.08.4-20 and Connect 2023.10.0
rstudio · Nov 1, 2023 · b4a1151 · b4a1151
2 parents 6f29f2a + 635874d
commit b4a1151
Show file tree

Hide file tree

Showing 19 changed files with 136 additions and 77 deletions.
diff --git a/.github/actions/build-test-scan-push/action.yaml b/.github/actions/build-test-scan-push/action.yaml
@@ -63,37 +63,53 @@ runs:
         sudo rm -rf /usr/share/dotnet # will release about 20GB
 
     - name: Login to ghcr.io
-      uses: docker/login-action@v2
+      uses: docker/login-action@v3
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
         password: ${{ inputs.ghcr-token }}
 
     - name: Login to Docker Hub
-      uses: docker/login-action@v2
+      uses: docker/login-action@v3
       with:
         username: ${{ inputs.dockerhub-username }}
         password: ${{ inputs.dockerhub-token }}
 
-    - name: Authenticate to Google Cloud
+    - name: Login to GCAR us-central1
       continue-on-error: true
-      uses: google-github-actions/auth@v1
+      uses: docker/login-action@v3
       with:
-        credentials_json: '${{ inputs.gcp-json }}'
+        registry: us-central1-docker.pkg.dev
+        username: _json_key
+        password: '${{ inputs.gcp-json }}'
 
-    - name: Authenticate GCAR
-      shell: bash
-      run: |
-        if [[ "${{ inputs.gcp-json != '' }}" == "true" ]]; then
-          gcloud auth configure-docker -q us-central1-docker.pkg.dev
-          gcloud auth configure-docker -q us-docker.pkg.dev
-          gcloud auth configure-docker -q asia-docker.pkg.dev
-          gcloud auth configure-docker -q europe-docker.pkg.dev
-        fi
+    - name: Login to GCAR us
+      continue-on-error: true
+      uses: docker/login-action@v3
+      with:
+        registry: us-docker.pkg.dev
+        username: _json_key
+        password: '${{ inputs.gcp-json }}'
+
+    - name: Login to GCAR asia
+      continue-on-error: true
+      uses: docker/login-action@v3
+      with:
+        registry: asia-docker.pkg.dev
+        username: _json_key
+        password: '${{ inputs.gcp-json }}'
+
+    - name: Login to GCAR europe
+      continue-on-error: true
+      uses: docker/login-action@v3
+      with:
+        registry: europe-docker.pkg.dev
+        username: _json_key
+        password: '${{ inputs.gcp-json }}'
 
     - name: Build
       id: image-build
-      uses: docker/build-push-action@v4
+      uses: docker/build-push-action@v5
       with:
         load: true
         context: ${{ inputs.context }}
@@ -150,7 +166,7 @@ runs:
         command: ${{ steps.eval-snyk-command.outputs.SNYK_COMMAND }}
 
     - name: Push - ${{ inputs.push-image }}
-      uses: docker/build-push-action@v4
+      uses: docker/build-push-action@v5
       with:
         push: ${{ inputs.push-image }}
         context: ${{ inputs.context }}

diff --git a/.github/workflows/build-content.yaml b/.github/workflows/build-content.yaml
@@ -22,6 +22,11 @@ jobs:
     runs-on: ubuntu-latest
     needs: matrix
     name: content-base-${{ matrix.config.os }}-r${{ matrix.config.r }}-py${{ matrix.config.py }}--${{ github.ref }}
+
+    permissions:
+      contents: read
+      packages: write
+
     concurrency:
       group: content-base-${{ matrix.config.os }}-r${{ matrix.config.r }}-py${{ matrix.config.py }}-${{ github.ref }}
       cancel-in-progress: true
@@ -81,9 +86,10 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
 
       # Begin retry logic
 
@@ -105,9 +111,10 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
 
       # End retry logic
 
@@ -175,9 +182,10 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
 
       # Begin retry logic
 
@@ -199,8 +207,9 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
 
       # End retry logic
diff --git a/.github/workflows/build-manual.yaml b/.github/workflows/build-manual.yaml
@@ -59,6 +59,10 @@ jobs:
     runs-on: ubuntu-latest
     name: manual-build
 
+    permissions:
+      contents: read
+      packages: write
+
     steps:
       - name: Check Out Repo
         uses: actions/checkout@v3
@@ -130,7 +134,8 @@ jobs:
           push-image: ${{ inputs.push }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
 
diff --git a/.github/workflows/build-prerelease.yaml b/.github/workflows/build-prerelease.yaml
@@ -18,6 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     name: build-${{ matrix.config.type }}-${{ matrix.config.product }}-${{ matrix.config.os }}
 
+    permissions:
+      contents: read
+      packages: write
+
     strategy:
       fail-fast: false
       matrix:
@@ -109,9 +113,10 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' || github.ref == 'refs/heads/dev-rspm' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
 
       # Begin retry logic
 
@@ -132,8 +137,9 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
 
       # End retry logic
diff --git a/.github/workflows/build-release.yaml b/.github/workflows/build-release.yaml
@@ -12,6 +12,11 @@ jobs:
   build-base:
     runs-on: ubuntu-latest
     name: product-base-build-${{ matrix.config.os }}-r${{ matrix.config.r-primary }}_${{ matrix.config.r-alternate }}-py${{ matrix.config.py-primary }}_${{ matrix.config.py-alternate }}
+
+    permissions:
+      contents: read
+      packages: write
+
     concurrency:
       group: base-build-${{ matrix.config.os }}-r${{ matrix.config.r-primary }}_${{ matrix.config.r-alternate }}-py${{ matrix.config.py-primary }}_${{ matrix.config.py-alternate }}-${{ github.ref }}
       cancel-in-progress: true
@@ -84,9 +89,10 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' || github.event.schedule == '0 12 * * 1' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
 
       # Begin retry logic
 
@@ -107,9 +113,10 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' || github.event.schedule == '0 12 * * 1' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
 
       # End retry logic
 
@@ -118,6 +125,10 @@ jobs:
     runs-on: ubuntu-latest
     name: product-base-pro-build-${{ matrix.config.os }}-r${{ matrix.config.r-primary }}_${{ matrix.config.r-alternate }}-py${{ matrix.config.py-primary }}_${{ matrix.config.py-alternate }}
 
+    permissions:
+      contents: read
+      packages: write
+
     strategy:
       fail-fast: false
       matrix:
@@ -190,9 +201,10 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' || github.event.schedule == '0 12 * * 1' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
 
       # Begin retry logic
 
@@ -213,9 +225,10 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev' || github.event.schedule == '0 12 * * 1' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
 
       # End retry logic
 
@@ -224,6 +237,10 @@ jobs:
     runs-on: ubuntu-latest
     name: build-${{ matrix.config.product }}-${{ matrix.config.os }}
 
+    permissions:
+      contents: read
+      packages: write
+
     strategy:
       fail-fast: false
       matrix:
@@ -311,9 +328,10 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' || github.event.schedule == '0 12 * * 1' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
 
       # Begin retry logic
 
@@ -334,9 +352,10 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' || github.event.schedule == '0 12 * * 1' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
+          gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
 
       # End retry logic
 
@@ -345,6 +364,10 @@ jobs:
     runs-on: ubuntu-latest
     name: build-workbench-for-google-cloud-workstations
 
+    permissions:
+      contents: read
+      packages: write
+
     concurrency:
       group: build-products-${{ matrix.config.product }}-${{ matrix.config.os }}-${{ github.ref }}
       cancel-in-progress: true
@@ -399,7 +422,7 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' || github.event.schedule == '0 12 * * 1' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
           gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'
@@ -423,7 +446,7 @@ jobs:
           push-image: ${{ github.ref == 'refs/heads/main' || github.event.schedule == '0 12 * * 1' }}
           snyk-token: ${{ secrets.SNYK_TOKEN }}
           snyk-org-id: ${{ secrets.SNYK_ORG_ID }}
-          ghcr-token: ${{ secrets.BUILD_PAT }}
+          ghcr-token: ${{ secrets.GITHUB_TOKEN }}
           dockerhub-username: ${{ secrets.DOCKER_HUB_USERNAME }}
           dockerhub-token: ${{ secrets.DOCKER_HUB_ACCESS_TOKEN }}
           gcp-json: '${{ secrets.GCP_ARTIFACT_REGISTRY_JSON }}'

diff --git a/Justfile b/Justfile
@@ -6,8 +6,8 @@ sed_vars := if os() == "macos" { "-i ''" } else { "-i" }
 
 BUILDX_PATH := ""
 
-RSC_VERSION := "2023.09.0"
-RSPM_VERSION := "2023.08.0-16"
+RSC_VERSION := "2023.10.0"
+RSPM_VERSION := "2023.08.4-20"
 RSW_VERSION := "2023.09.1+494.pro2"
 
 DRIVERS_VERSION := "2023.05.0"

diff --git a/connect-content-init/Dockerfile.ubuntu2204 b/connect-content-init/Dockerfile.ubuntu2204
@@ -10,7 +10,7 @@ RUN apt-get update && \
     apt-get install -y --no-install-recommends ca-certificates curl && \
     rm -rf /var/lib/apt/lists/*
 
-ARG RSC_VERSION=2023.09.0
+ARG RSC_VERSION=2023.10.0
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 RUN mkdir -p /rsc-staging && \
     RSC_VERSION_URL=$(echo -n "${RSC_VERSION}" | sed 's/+/%2B/g') && \

diff --git a/connect-content-init/Justfile b/connect-content-init/Justfile
@@ -6,7 +6,7 @@ IMAGE_PREFIX := "rstudio-"
 PRODUCT := "connect-content-init"
 IMAGE_OS := "ubuntu2204"
 
-RSC_VERSION := "2023.09.0"
+RSC_VERSION := "2023.10.0"
 RSC_TAG_SAFE_VERSION := replace(RSC_VERSION, "+", "-")
 RSC_LICENSE := ""
 

diff --git a/connect-content-init/README.md b/connect-content-init/README.md
@@ -9,7 +9,7 @@
 
 # Supported tags and respective Dockerfile links
 
-* [`jammy`, `ubuntu2204`, `jammy-2023.09.0`, `ubuntu2204-2023.09.0`](https://github.com/rstudio/rstudio-docker-products/blob/main/connect/Dockerfile.2204)
+* [`jammy`, `ubuntu2204`, `jammy-2023.10.0`, `ubuntu2204-2023.10.0`](https://github.com/rstudio/rstudio-docker-products/blob/main/connect/Dockerfile.2204)
 
 # RStudio Connect Content Init Container
 
@@ -31,7 +31,7 @@ The version of the release package to use can be overridden with the
 `RSC_VERSION` build arg.
 
 ```console
-just build ubuntu2204 2023.09.0
+just build ubuntu2204 2023.10.0
 ```
 
 ## Testing
@@ -56,7 +56,7 @@ just test
 You can see the different layers that make up the image:
 
 ```console
-docker history rstudio/rstudio-connect-content-init-preview:2023.09.0-dev-326
+docker history rstudio/rstudio-connect-content-init-preview:2023.10.0-dev-326
 ```
 
 NOTE: almost all the image size is pandoc.

diff --git a/connect/.env b/connect/.env
@@ -1,4 +1,4 @@
-RSC_VERSION=2023.09.0
+RSC_VERSION=2023.10.0
 R_VERSION=4.2.3
 R_VERSION_ALT=4.1.3
 PYTHON_VERSION=3.9.17

diff --git a/connect/Dockerfile.ubuntu2204 b/connect/Dockerfile.ubuntu2204
@@ -13,7 +13,7 @@ ARG R_VERSION=4.2.3
 ARG R_VERSION_ALT=4.1.3
 ARG PYTHON_VERSION=3.9.17
 ARG PYTHON_VERSION_ALT=3.8.17
-ARG RSC_VERSION=2023.09.0
+ARG RSC_VERSION=2023.10.0
 SHELL [ "/bin/bash", "-o", "pipefail", "-c"]
 RUN apt-get update --fix-missing \
     && apt-get install -yq --no-install-recommends \