Skip to content

Commit 7716464

Browse files
ChristophShyperChristophShyper
committed
feat: rename workflow files and update references for clarity
1 parent 693dba4 commit 7716464

27 files changed

Lines changed: 314 additions & 71 deletions

‎.github/workflows/README.md‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@ Reusable callers exist for four profiles:
1717

1818
Each in-scope repository should expose these caller workflows in `.github/workflows/`:
1919

20-
1. `auto-create-pull-request.yml`
21-
2. `cron-check-dependencies.yml`
22-
3. `manual-update-version.yml`
20+
1. `auto-pull-request-create.yml`
21+
2. `cron-dependency-update.yml`
22+
3. `manual-release-create.yml`
2323

2424
Static profile repositories should also expose:
2525

@@ -36,12 +36,12 @@ Example:
3636
```yaml
3737
jobs:
3838
call:
39-
uses: devops-infra/.github/.github/workflows/reusable-auto-create-pull-request.yml@v1
39+
uses: devops-infra/.github/.github/workflows/reusable-auto-pull-request-create.yml@v1
4040
```
4141
4242
## Weekly health workflow behavior
4343
44-
`cron-check-dependencies` is the aggregated weekly check. It combines:
44+
`cron-dependency-update` is the aggregated weekly check. It combines:
4545

4646
- dependency checks
4747
- baseline validation
@@ -50,9 +50,9 @@ jobs:
5050

5151
The workflow creates or updates one repository issue with findings and auto-closes it when clean.
5252

53-
## Manual version update behavior
53+
## Manual release behavior
5454

55-
`manual-update-version` supports two modes:
55+
`manual-release-create` supports two modes:
5656

5757
- bump or set version (and open release PR)
5858
- build/push only without version bump (`build_only: true`)

.github/workflows/auto-create-pull-request.yml renamed to .github/workflows/auto-pull-request-create.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: (Auto) Create Pull Request
1+
name: (Auto) Pull Request Create
22

33
on:
44
push:
@@ -13,10 +13,10 @@ permissions:
1313
pull-requests: write
1414

1515
jobs:
16-
call-auto-create-pull-request:
17-
uses: ./.github/workflows/reusable-auto-create-pull-request.yml
16+
call-auto-pull-request-create:
17+
uses: ./.github/workflows/reusable-auto-pull-request-create.yml
1818
with:
1919
runs-on: ubuntu-24.04-arm
20-
task-version: 3.49
20+
task-version: 3.x
2121
profile: other
2222
secrets: inherit

.github/workflows/cron-check-dependencies.yml renamed to .github/workflows/cron-dependency-update.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: (Cron) Check dependencies
1+
name: (Cron) Dependency Update
22

33
on:
44
schedule:
@@ -13,7 +13,7 @@ permissions:
1313

1414
jobs:
1515
call-weekly-health-check:
16-
uses: ./.github/workflows/reusable-cron-check-dependencies.yml
16+
uses: ./.github/workflows/reusable-cron-dependency-update.yml
1717
with:
1818
runs-on: ubuntu-24.04-arm
1919
task-version: 3.x

.github/workflows/manual-update-version.yml renamed to .github/workflows/manual-release-create.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: (Manual) Update Version
1+
name: (Manual) Release Create
22

33
on:
44
workflow_dispatch:
@@ -30,7 +30,7 @@ permissions:
3030

3131
jobs:
3232
call-version-update:
33-
uses: ./.github/workflows/reusable-manual-update-version.yml
33+
uses: ./.github/workflows/reusable-manual-release-create.yml
3434
with:
3535
runs-on: ubuntu-24.04-arm
3636
task-version: 3.x

.github/workflows/reusable-auto-create-pull-request.yml renamed to .github/workflows/reusable-auto-pull-request-create.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: (Reusable - Auto) Create Pull Request
1+
name: (Reusable - Auto) Pull Request Create
22

33
on:
44
workflow_call:

.github/workflows/reusable-cron-check-dependencies.yml renamed to .github/workflows/reusable-cron-dependency-update.yml

Lines changed: 18 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: (Reusable - Cron) Check dependencies
1+
name: (Cron) Dependency Update
22

33
on:
44
workflow_call:
@@ -38,7 +38,7 @@ permissions:
3838
issues: read
3939

4040
jobs:
41-
dependency-check:
41+
dependency-update:
4242
name: Weekly health scan
4343
runs-on: ${{ inputs.runs-on }}
4444
steps:
@@ -70,31 +70,16 @@ jobs:
7070
echo "REPORT_FILE=$REPORT_FILE" >> "$GITHUB_ENV"
7171
echo "HAS_FINDINGS=false" >> "$GITHUB_ENV"
7272
73-
- name: Run lint
74-
id: lint
75-
if: inputs.enable-lint
76-
continue-on-error: true
77-
run: task lint
78-
79-
- name: Record lint findings
80-
if: inputs.enable-lint && steps.lint.outcome != 'success'
81-
run: |
82-
echo "- lint failed: \`task lint\`" >> "$REPORT_FILE"
83-
echo "HAS_FINDINGS=true" >> "$GITHUB_ENV"
84-
85-
- name: Run dependency checks
73+
- name: Run dependency update task
8674
id: deps
8775
continue-on-error: true
8876
run: |
8977
set +e
90-
if task --list | grep -q "deps:check"; then
91-
task deps:check
92-
rc=$?
93-
elif task --list | grep -q "update-versions"; then
94-
task update-versions
78+
if task --list | grep -q "dependency:update"; then
79+
task dependency:update
9580
rc=$?
9681
else
97-
echo "No dedicated dependency-check task found"
82+
echo "No dedicated dependency update task found (missing task: dependency:update)"
9883
rc=3
9984
fi
10085
set -e
@@ -106,6 +91,18 @@ jobs:
10691
echo "- dependency checks reported updates or failed" >> "$REPORT_FILE"
10792
echo "HAS_FINDINGS=true" >> "$GITHUB_ENV"
10893
94+
- name: Run lint
95+
id: lint
96+
if: inputs.enable-lint
97+
continue-on-error: true
98+
run: task lint
99+
100+
- name: Record lint findings
101+
if: inputs.enable-lint && steps.lint.outcome != 'success'
102+
run: |
103+
echo "- lint failed: \`task lint\`" >> "$REPORT_FILE"
104+
echo "HAS_FINDINGS=true" >> "$GITHUB_ENV"
105+
109106
- name: Install Docker Buildx
110107
if: inputs.profile == 'actions' || inputs.profile == 'dockerized'
111108
uses: docker/setup-buildx-action@v4

.github/workflows/reusable-manual-update-version.yml renamed to .github/workflows/reusable-manual-release-create.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: (Reusable - Manual) Update Version
1+
name: (Reusable - Manual) Release Create
22

33
on:
44
workflow_call:

‎Taskfile.cicd.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -115,6 +115,14 @@ tasks:
115115
cmds:
116116
- echo "{{.VERSION}}"
117117

118+
dependency:update:
119+
desc: Check main dependency not covered by dependabot
120+
cmds:
121+
- |
122+
echo "ℹ️ No dedicated dependency updater configured for this repository."
123+
echo "ℹ️ Dependabot handles GitHub Actions and package metadata updates."
124+
echo "ℹ️ Keeping dependency checks as a safe no-op for now."
125+
118126
version:set:
119127
desc: Validate version
120128
cmds:

‎templates/actions/taskfiles/Taskfile.cicd.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,14 @@ tasks:
9595
cmds:
9696
- echo "{{.VERSION}}"
9797

98+
dependency:update:
99+
desc: Check main dependency not covered by dependabot
100+
cmds:
101+
- |
102+
echo "ℹ️ No dedicated dependency updater configured for this repository profile."
103+
echo "ℹ️ Dependabot handles GitHub Actions and package metadata updates."
104+
echo "ℹ️ Docker builds still validate runtime dependencies during CI."
105+
98106
version:set:
99107
desc: Update version in README.md and action.yml
100108
cmds:

‎templates/actions/taskfiles/Taskfile.scripts.yml‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
version: '3'
2+
3+
silent: true
4+
5+
tasks:
6+
help:
7+
desc: Detailed help
8+
cmds:
9+
- |
10+
echo "Tasks:"
11+
task --list
12+
13+
lint:actionlint:
14+
desc: Lint GitHub Actions workflows with actionlint
15+
cmds:
16+
- |
17+
echo "▶️ Running actionlint..."
18+
set +e
19+
docker run --rm -i -v "$PWD:/work" -w /work rhysd/actionlint:latest -color
20+
rc=$?
21+
set -e
22+
if [ "$rc" -eq 0 ]; then
23+
echo "✅ actionlint passed"
24+
else
25+
echo "❌ actionlint failed"
26+
exit $rc
27+
fi
28+
29+
lint:hadolint:
30+
desc: Lint Dockerfile with hadolint
31+
cmds:
32+
- |
33+
echo "▶️ Running hadolint..."
34+
set +e
35+
docker run --rm -i -v "$PWD:/work" -w /work hadolint/hadolint:latest-debian < Dockerfile
36+
rc=$?
37+
set -e
38+
if [ "$rc" -eq 0 ]; then
39+
echo "✅ hadolint passed"
40+
else
41+
echo "❌ hadolint failed"
42+
exit $rc
43+
fi
44+
45+
lint:shellcheck:
46+
desc: Lint shell scripts with shellcheck
47+
cmds:
48+
- |
49+
echo "▶️ Running shellcheck..."
50+
set +e
51+
docker run --rm -i -v "$PWD:/work" -w /work koalaman/shellcheck:stable -x -S style entrypoint.sh
52+
rc=$?
53+
set -e
54+
if [ "$rc" -eq 0 ]; then
55+
echo "✅ shellcheck passed"
56+
else
57+
echo "❌ shellcheck failed"
58+
exit $rc
59+
fi
60+
61+
lint:yamllint:
62+
desc: Lint YAML files with yamllint
63+
cmds:
64+
- |
65+
echo "▶️ Running yamllint..."
66+
set +e
67+
docker run --rm -i -v "$PWD:/work" -w /work cytopia/yamllint -c .yamllint.yml .
68+
rc=$?
69+
set -e
70+
if [ "$rc" -eq 0 ]; then
71+
echo "✅ yamllint passed"
72+
else
73+
echo "❌ yamllint failed"
74+
exit $rc
75+
fi
76+
77+
git:get-pr-template:
78+
desc: Get pull request template
79+
cmds:
80+
- mkdir -p .tmp
81+
- curl -LsS https://raw.githubusercontent.com/devops-infra/.github/refs/tags/v1/PULL_REQUEST_TEMPLATE.md -o .tmp/PULL_REQUEST_TEMPLATE.md
82+
83+
git:set-config:
84+
desc: Set git user config
85+
cmds:
86+
- git config user.name "github-actions[bot]"
87+
- git config user.email "github-actions[bot]@users.noreply.github.com"
88+
89+
scripts:dependency:update:
90+
desc: Update Alpine apk package constraints in Dockerfile
91+
cmds:
92+
- |
93+
set -eu
94+
if [ ! -f Dockerfile ]; then
95+
echo "ℹ️ Dockerfile not found; nothing to update"
96+
exit 0
97+
fi
98+
99+
base_image="$(sed -nE 's/^FROM[[:space:]]+([^[:space:]]+).*/\1/p' Dockerfile | head -1)"
100+
if [ -z "$base_image" ]; then
101+
echo "ℹ️ Could not resolve base image; nothing to update"
102+
exit 0
103+
fi
104+
105+
case "$base_image" in
106+
alpine:*|alpine)
107+
:
108+
;;
109+
*)
110+
echo "ℹ️ Base image is '$base_image', not Alpine; nothing to update"
111+
exit 0
112+
;;
113+
esac
114+
115+
normalize_minor() {
116+
version="$1"
117+
printf '%s' "$version" | awk -F. '{print $1 "." $2}'
118+
}
119+
120+
list_file=".tmp/dependency-update-apk-list.txt"
121+
mkdir -p .tmp
122+
123+
sed -nE 's/^\s*([a-zA-Z0-9+_.-]+)=~=?([0-9]+\.[0-9]+).*$/\1 \2/p' Dockerfile > "$list_file"
124+
if [ ! -s "$list_file" ]; then
125+
echo "ℹ️ No pinned apk constraints (~=) found in Dockerfile"
126+
exit 0
127+
fi
128+
129+
updated=0
130+
while read -r pkg current_minor; do
131+
[ -n "$pkg" ] || continue
132+
latest_full="$(docker run --rm "$base_image" sh -lc "apk update >/dev/null && apk list --all '$pkg' 2>/dev/null | head -1 | awk -F'[- ]' '{print \\$2}'")"
133+
if [ -z "$latest_full" ]; then
134+
echo "⚠️ Could not resolve latest version for $pkg; skipping"
135+
continue
136+
fi
137+
latest_minor="$(normalize_minor "$latest_full")"
138+
if [ "$latest_minor" = "$current_minor" ]; then
139+
echo "✅ $pkg already up to date at $current_minor"
140+
continue
141+
fi
142+
echo "⬆️ $pkg: $current_minor -> $latest_minor"
143+
{{.SED}} -i "s#\<$pkg\>=~=$current_minor#$pkg~=$latest_minor#g" Dockerfile
144+
{{.SED}} -i "s#\<$pkg\>~=$current_minor#$pkg~=$latest_minor#g" Dockerfile
145+
updated=1
146+
done < "$list_file"
147+
148+
if [ "$updated" -eq 0 ]; then
149+
echo "ℹ️ No apk dependency updates were required"
150+
fi

0 commit comments

Comments
 (0)