OWP deployment: public GHCR images, deployment docs, CI cleanup

.github/workflows/ci-cd.yml

@@ -1,8 +1,10 @@
 name: CI/CD Pipeline
 
 on:
+  pull_request:
+    branches: [main]
   push:
-    branches: [pw-demo]
+    branches: [main]
 
 permissions:
   contents: read
@@ -11,6 +13,7 @@ permissions:
 
 env:
   REGISTRY: ghcr.io
+  PYTHON_VERSION: '3.12'
 
 jobs:
   setup:
@@ -28,7 +31,7 @@ jobs:
         run: |
           set -euo pipefail
           ORG="$(echo "${GITHUB_REPOSITORY_OWNER}" | tr '[:upper:]' '[:lower:]')"
-          REPO="autoeval-coordinator"
+          REPO="auto-eval-coordinator"
           IMAGE_BASE="${REGISTRY}/${ORG}/${REPO}"
           echo "image_base=${IMAGE_BASE}" >> "$GITHUB_OUTPUT"
           if [ "${GITHUB_EVENT_NAME}" = "pull_request" ]; then
@@ -44,11 +47,14 @@ jobs:
             echo "commit_sha_short=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
             echo "test_image_tag=${SHORT_SHA}" >> "$GITHUB_OUTPUT"
           fi
+
   build:
     name: build
     if: github.event_name == 'pull_request' || github.event_name == 'push'
     runs-on: ubuntu-latest
     needs: setup
+    env:
+      CAN_PUSH: ${{ github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository }}
     steps:
       - uses: actions/checkout@v4
 
@@ -57,18 +63,19 @@ jobs:
         run: echo "date=$(date -u +'%Y-%m-%dT%H:%M:%SZ')" >> $GITHUB_OUTPUT
 
       - name: Log in to registry
+        if: env.CAN_PUSH == 'true'
         uses: docker/login-action@v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build & push autoeval-coordinator image
+      - name: Build & push auto-eval-coordinator image
         uses: docker/build-push-action@v6
         with:
           context: .
           file: ./Dockerfile
-          push: true
+          push: ${{ env.CAN_PUSH == 'true' }}
           labels: |
             org.opencontainers.image.title=AutoEval Coordinator
             org.opencontainers.image.description=Automated evaluation coordinator application
@@ -80,35 +87,26 @@ jobs:
             org.opencontainers.image.documentation=${{ github.server_url }}/${{ github.repository }}
             org.opencontainers.image.authors=${{ github.actor }}
             org.opencontainers.image.licenses=MIT
-            org.opencontainers.image.vendor=Your Organization
+            org.opencontainers.image.vendor=NGWPC
             maintainer=${{ github.actor }}
           tags: |
             ${{ needs.setup.outputs.image_base }}:${{ needs.setup.outputs.test_image_tag }}
             ${{ needs.setup.outputs.image_base }}:latest
 
-      - name: Set lowercase owner
-        id: owner
-        run: echo "owner=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> $GITHUB_OUTPUT
-
-      - name: Build & push local-nomad-server image
-        uses: docker/build-push-action@v6
+  container-scanning:
+    if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    needs: [setup, build]
+    steps:
+      - name: Scan container
+        uses: aquasecurity/trivy-action@v0.36.0
         with:
-          context: ./local-nomad
-          file: ./local-nomad/Dockerfile
-          push: true
-          labels: |
-            org.opencontainers.image.title=Local Nomad Server
-            org.opencontainers.image.description=Local Nomad server for development
-            org.opencontainers.image.version=${{ github.ref_name }}
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ steps.date.outputs.date }}
-            org.opencontainers.image.source=${{ github.server_url }}/${{ github.repository }}
-            org.opencontainers.image.url=${{ github.server_url }}/${{ github.repository }}
-            org.opencontainers.image.documentation=${{ github.server_url }}/${{ github.repository }}
-            org.opencontainers.image.authors=${{ github.actor }}
-            org.opencontainers.image.licenses=MIT
-            org.opencontainers.image.vendor=Your Organization
-            maintainer=${{ github.actor }}
-          tags: |
-            ${{ env.REGISTRY }}/${{ steps.owner.outputs.owner }}/local-nomad-server:${{ needs.setup.outputs.test_image_tag }}
-            ${{ env.REGISTRY }}/${{ steps.owner.outputs.owner }}/local-nomad-server:latest
+          image-ref: ${{ needs.setup.outputs.image_base }}:${{ needs.setup.outputs.test_image_tag }}
+          format: 'template'
+          template: '@/contrib/sarif.tpl'
+          output: 'trivy-results.sarif'
+          severity: 'CRITICAL,HIGH'
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: 'trivy-results.sarif'

.gitignore

@@ -25,3 +25,5 @@ local-reports/
 cache/aiohttp_cache.sqlite
 reports/
 analysis/
+
+*.gitkeep

README.md

@@ -13,8 +13,8 @@ While the current evaluation pipeline is primarily designed to generate HAND FIM
 4. Run `docker compose -f docker-compose-local.yml up`
 5. Register Jobs (see ./local-nomad/README.md)
 6. Load the test stac data by running `./testdata/benchmark/load-test-stac-data.sh`
-7. Create required container images from autoeval-jobs repo. Once cloned the autoeval-jobs repo and inside it, execute `docker build -f Dockerfile.gval -t autoeval-jobs-gval:local . && docker build -t autoeval-jobs:local .`
-8. Build the container image inside this repo with `docker build -t autoeval-coordinator:local .`
+7. Obtain job images from the autoeval-jobs repo. Pull from GHCR (`docker pull ghcr.io/ngwpc/autoeval-jobs:latest && docker pull ghcr.io/ngwpc/autoeval-jobs-gval:latest`) or build locally by cloning the repo and running `docker build -f Dockerfile.gval -t autoeval-jobs-gval:local . && docker build -t autoeval-jobs:local .`
+8. Build the coordinator image inside this repo with `docker build -t autoeval-coordinator:local .`
 9. Obtain AWS credentials for the NGWPC fimc-data bucket that give read privileges to bucket objects. This is necessary to allow loading masking dictionaries for the agreement job.
 10. Make sure your host machine's shell has the correct NOMAD_ADDR variable set. For working locally `NOMAD_ADDR="http://localhost:4646"`. This is mostly important for running commands using the Nomad CLI program.
 11. Dispatch a pipeline job through Nomad UI or API (see example below)
@@ -102,3 +102,5 @@ This will:
 ### Running a batch of pipelines
 
 The above instructions are for running a single test evaluation pipeline using a local nomad cluster. If you know which HAND outputs you want to evaluate and where its HAND index is located and you have access to the FIM Benchmark STAC this should be sufficient to run single pipelines. This repository also contains functionality for running batches of dozens to thousands of pipelines using either a local Nomad cluster running within the Parallel Works environment or a Nomad cluster deployed to the NGWPC AWS Test account. For more information on running batches please refer to `docs/batch-run-guide-ParallelWorks.md` and `docs/batch-run-guide-AWS-Test.md`.
+
+For deploying to the OWP environment, refer to `docs/Deployment_Runbook.md` for a full phased deployment guide and `docs/Verification_Guide.md` for an end-to-end verification checklist.