Skip to content

Commit a5a03bc

Browse files
authored
ci: introduced shared mono-repo workflows (#12)
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
1 parent 6116edc commit a5a03bc

File tree

14 files changed

+131
-249
lines changed

14 files changed

+131
-249
lines changed

.github/workflows/auto-merge.yml

Lines changed: 9 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,15 @@
11
name: Dependabot auto-merge
2-
on: pull_request
32

43
permissions:
5-
contents: write
6-
pull-requests: write
4+
contents: read
5+
6+
on:
7+
pull_request:
78

89
jobs:
910
dependabot:
10-
runs-on: ubuntu-latest
11-
if: github.event.pull_request.user.login == 'dependabot[bot]'
12-
steps:
13-
- name: Dependabot metadata
14-
id: metadata
15-
uses: dependabot/fetch-metadata@v2
16-
17-
- name: Auto-approve all dependabot PRs
18-
run: gh pr review --approve "$PR_URL"
19-
env:
20-
PR_URL: ${{github.event.pull_request.html_url}}
21-
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
22-
23-
- name: Auto-merge dependabot PRs for development dependencies
24-
if: contains(steps.metadata.outputs.dependency-group, 'development-dependencies')
25-
run: gh pr merge --auto --rebase "$PR_URL"
26-
env:
27-
PR_URL: ${{github.event.pull_request.html_url}}
28-
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
29-
30-
- name: Auto-merge dependabot PRs for go-openapi patches
31-
if: contains(steps.metadata.outputs.dependency-group, 'go-openapi-dependencies') && (steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch')
32-
run: gh pr merge --auto --rebase "$PR_URL"
33-
env:
34-
PR_URL: ${{github.event.pull_request.html_url}}
35-
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
36-
37-
- name: Auto-merge dependabot PRs for golang.org updates
38-
if: contains(steps.metadata.outputs.dependency-group, 'golang-org-dependencies')
39-
run: gh pr merge --auto --rebase "$PR_URL"
40-
env:
41-
PR_URL: ${{github.event.pull_request.html_url}}
42-
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
43-
11+
permissions:
12+
contents: write
13+
pull-requests: write
14+
uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@e77a5bc724d0ab14dd086ee6e13153129ddfe3f9 # v0.2.2
15+
secrets: inherit

.github/workflows/bump-release.yml

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
name: Bump Release
2+
3+
permissions:
4+
contents: read
5+
6+
on:
7+
workflow_dispatch:
8+
inputs:
9+
bump-type:
10+
description: Type of bump (patch, minor, major)
11+
type: choice
12+
options:
13+
- patch
14+
- minor
15+
- major
16+
default: patch
17+
required: false
18+
tag-message-title:
19+
description: Tag message title to prepend to the release notes
20+
required: false
21+
type: string
22+
tag-message-body:
23+
description: |
24+
Tag message body to prepend to the release notes.
25+
(use "|" to replace end of line).
26+
required: false
27+
type: string
28+
29+
jobs:
30+
bump-release:
31+
permissions:
32+
contents: write
33+
uses: go-openapi/ci-workflows/.github/workflows/bump-release-monorepo.yml@e77a5bc724d0ab14dd086ee6e13153129ddfe3f9 # v0.2.2
34+
with:
35+
bump-type: ${{ inputs.bump-type }}
36+
tag-message-title: ${{ inputs.tag-message-title }}
37+
tag-message-body: ${{ inputs.tag-message-body }}
38+
secrets: inherit

.github/workflows/codeql.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: "CodeQL"
2+
3+
on:
4+
push:
5+
branches: [ "master" ]
6+
pull_request:
7+
branches: [ "master" ]
8+
paths-ignore: # remove this clause if CodeQL is a required check
9+
- '**/*.md'
10+
schedule:
11+
- cron: '39 19 * * 5'
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
codeql:
18+
permissions:
19+
contents: read
20+
security-events: write
21+
uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@e77a5bc724d0ab14dd086ee6e13153129ddfe3f9 # v0.2.2
22+
secrets: inherit

.github/workflows/contributors.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Contributors
2+
3+
on:
4+
schedule:
5+
- cron: '18 4 * * 6'
6+
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
contributors:
14+
permissions:
15+
pull-requests: write
16+
contents: write
17+
uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@e77a5bc724d0ab14dd086ee6e13153129ddfe3f9 # v0.2.2
18+
secrets: inherit

.github/workflows/go-test.yml

Lines changed: 3 additions & 207 deletions
Original file line numberDiff line numberDiff line change
@@ -1,221 +1,17 @@
11
name: go test
22

33
permissions:
4-
contents: read
54
pull-requests: read
5+
contents: read
66

77
on:
88
push:
9-
tags:
10-
- v*
119
branches:
1210
- master
1311

1412
pull_request:
1513

1614
jobs:
17-
lint:
18-
name: Go lint mono-repo
19-
runs-on: ubuntu-latest
20-
steps:
21-
-
22-
uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
23-
with:
24-
fetch-depth: '0'
25-
-
26-
uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
27-
with:
28-
go-version: stable
29-
check-latest: true
30-
cache: true
31-
cache-dependency-path: '**/go.sum'
32-
-
33-
name: Install golangci-lint
34-
uses: golangci/golangci-lint-action@0a35821d5c230e903fcfe077583637dea1b27b47 # v9.0.0
35-
with:
36-
version: latest
37-
skip-cache: true
38-
install-only: true
39-
-
40-
name: Lint multiple modules
41-
# golangci-lint doesn't support go.work to lint multiple modules in one single pass
42-
run: |
43-
set -euxo pipefail
44-
45-
git fetch origin master
46-
git show --no-patch --oneline origin/master
47-
48-
while read module_location ; do
49-
pushd "${module_location}"
50-
golangci-lint run --new-from-rev origin/master
51-
popd
52-
done < <(go list -f '{{.Dir}}' -m)
53-
54-
module-test:
55-
name: Unit tests
56-
runs-on: ${{ matrix.os }}
57-
needs: [ lint ]
58-
59-
strategy:
60-
matrix:
61-
os: [ ubuntu-latest, macos-latest, windows-latest ]
62-
go_version: ['oldstable', 'stable' ]
63-
env:
64-
TEST_REPORT: 'all_modules.report.${{ matrix.os }}.${{ matrix.go_version }}.json'
65-
66-
steps:
67-
- uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
68-
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
69-
with:
70-
go-version: '${{ matrix.go_version }}'
71-
check-latest: true
72-
cache: true
73-
cache-dependency-path: '**/go.sum'
74-
75-
- name: Ensure TMP is created on windows runners
76-
# On windows, tests require testing.TempDir to reside on the same drive as the code.
77-
# TMP is used by os.TempDir() to determine the location of temporary files.
78-
if: ${{ runner.os == 'Windows' }}
79-
shell: bash
80-
run: |
81-
TMP="${{ github.workspace }}\..\tmp"
82-
mkdir -p ${TMP}
83-
echo "TMP=${TMP}" >> "${GITHUB_ENV}"
84-
85-
- name: Run unit tests on all modules in this repo
86-
shell: bash
87-
env:
88-
# *.coverage.* pattern is automatically detected by codecov
89-
COVER_PROFILE: 'all_modules.coverage.${{ matrix.os }}.${{ matrix.go_version }}.out'
90-
run: |
91-
# when go1.25 becomes the oldstable, we may replace this bash with "go test work"
92-
declare -a ALL_MODULES
93-
BASH_MAJOR=$(echo $BASH_VERSION|cut -d'.' -f1)
94-
if [[ "${BASH_MAJOR}" -ge 4 ]] ; then
95-
mapfile ALL_MODULES < <(go list -f '{{.Dir}}/...' -m)
96-
else
97-
# for older bash versions, e.g. on macOS runner. This fallback will eventually disappear.
98-
while read line ; do
99-
ALL_MODULES+=("${line}")
100-
done < <(go list -f '{{.Dir}}/...' -m)
101-
fi
102-
echo "::notice title=Modules found::${ALL_MODULES[@]}"
103-
104-
# with go.work file enabled, go test recognizes sub-modules and collects all packages to be covered
105-
# without specifying -coverpkg.
106-
go test -race -coverprofile="${COVER_PROFILE}" -covermode=atomic -json ${ALL_MODULES[@]}|tee -a "${TEST_REPORT}"
107-
108-
- name: Upload coverage to codecov
109-
if: ${{ success() }} # we do this only if all previous steps succeeded
110-
uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
111-
with:
112-
name: Multi modules aggregated coverage
113-
flags: '${{ matrix.go_version }}-${{ matrix.os }}'
114-
fail_ci_if_error: false
115-
verbose: false
116-
117-
- name: Upload JSON test Results
118-
if: always()
119-
uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
120-
with:
121-
name: 'all_modules.report.${{ matrix.os }}.${{ matrix.go_version }}'
122-
path: ${{ env.TEST_REPORT }}
123-
12415
test:
125-
needs: [ module-test ]
126-
name: Test
127-
runs-on: ubuntu-latest
128-
steps:
129-
- name: Tests complete
130-
run: |
131-
echo "::notice title=Success::All tests completed"
132-
133-
collect-reports:
134-
if: always()
135-
needs: [ module-test ]
136-
name: Collect and merge test reports
137-
runs-on: ubuntu-latest
138-
steps:
139-
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
140-
with:
141-
go-version: stable
142-
check-latest: true
143-
cache: true
144-
145-
- name: Download all JSON artifacts
146-
uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
147-
with:
148-
run-id: "${{ github.run_id }}"
149-
pattern: "all_modules.report.*"
150-
# artifacts resolve as folders
151-
path: reports/
152-
153-
- name: Convert test reports to a merged JUnit XML
154-
# NOTE: codecov test reports only support JUnit format at this moment. See https://docs.codecov.com/docs/test-analytics.
155-
# Ideally, codecov improve a bit their platform, so we may only need a single pass to CTRF format.
156-
#
157-
# As a contemplated alternative, we could use gotestsum above to produce the JUnit XML directly.
158-
run: |
159-
go install github.com/jstemmer/go-junit-report/v2@latest
160-
cat reports/*/*.json | go-junit-report -parser gojson -out=reports/junit_report.xml
161-
162-
- name: Upload test results to Codecov
163-
if: always()
164-
uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
165-
with:
166-
files: '**/junit_report.xml'
167-
report_type: 'test_results'
168-
fail_ci_if_error: false
169-
handle_no_reports_found: true
170-
verbose: true
171-
172-
- name: Convert test reports to CTRF JSON
173-
run: |
174-
go install github.com/ctrf-io/go-ctrf-json-reporter/cmd/go-ctrf-json-reporter@v0.0.10
175-
176-
appName="swag"
177-
buildNumber="${{ github.run_id }}"
178-
appVersion="${{ github.event.pull_request.head.sha }}"
179-
180-
while read report ; do
181-
echo "::notice::converting report: ${report}"
182-
#TEST_REPORT: 'all_modules.report.${{ matrix.os }}.${{ matrix.go_version }}.json'
183-
reformated=$(echo "${report##*/}"|sed -E 's/(go)([[:digit:]]+)\.([[:digit:]]+)/\1\2\3/') # e.g. go1.24 becomes go124
184-
mapfile -d'.' -t -s 2 -n 2 split < <(echo $reformated) # skip the first 2 parts, stop on 2 more parts
185-
osPlatform="${split[0]}"
186-
osRelease="${split[1]}"
187-
188-
go-ctrf-json-reporter \
189-
-verbose \
190-
-appName "${appName}" \
191-
-appVersion "${appVersion}" \
192-
-buildNumber "${buildNumber}" \
193-
-osPlatform "${osPlatform}" \
194-
-osRelease "${osRelease}" \
195-
-output "./reports/ctrf_report_${osPlatform}_${osRelease}.json" \
196-
-quiet < "${report}"
197-
done < <(find reports -name \*.json)
198-
199-
# NOTE: at this moment, we don't upload CTRF reports as artifacts.
200-
# Some of the CTRF reports are therefore not available (flaky tests, history, ...).
201-
#
202-
# See https://github.com/ctrf-io/github-test-reporter?tab=readme-ov-file#report-showcase
203-
# for more reporting possibilities. At the moment, we keep it simple, as most advanced features
204-
# require a github token (thus adding the complexity of a separate workflow starting on pull_request_target).
205-
#
206-
# For the moment, we are contented with these simple reports. This is an opportunity to compare the insight they
207-
# provide as compared to what is uploaded to codecov.
208-
#
209-
# Codecov analytics are pretty poor at this moment. On the other hand, they manage the bot that pushes back
210-
# PR comments.
211-
#
212-
# They also handle the storage of past test reports, so as to assess flaky tests.
213-
- name: Publish Test Summary Results
214-
uses: ctrf-io/github-test-reporter@024bc4b64d997ca9da86833c6b9548c55c620e40 # v1.0.26
215-
with:
216-
report-path: 'reports/ctrf_report_*.json'
217-
use-suite-name: true
218-
summary-report: true # post a report to the github actions summary
219-
github-report: true
220-
failed-folded-report: true
221-
16+
uses: go-openapi/ci-workflows/.github/workflows/go-test-monorepo.yml@e77a5bc724d0ab14dd086ee6e13153129ddfe3f9 # v0.2.2
17+
secrets: inherit

.github/workflows/scanner.yml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Vulnerability scans
2+
3+
on:
4+
branch_protection_rule:
5+
push:
6+
branches: [ "master" ]
7+
schedule:
8+
- cron: '18 4 * * 3'
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
scanners:
15+
permissions:
16+
contents: read
17+
security-events: write
18+
uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@e77a5bc724d0ab14dd086ee6e13153129ddfe3f9 # V0.1.1
19+
secrets: inherit

.github/workflows/tag-release.yml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: Release on tag
2+
3+
permissions:
4+
contents: read
5+
6+
on:
7+
push:
8+
tags:
9+
- v[0-9]+*
10+
11+
jobs:
12+
gh-release:
13+
name: Create release
14+
permissions:
15+
contents: write
16+
uses: go-openapi/ci-workflows/.github/workflows/release.yml@e77a5bc724d0ab14dd086ee6e13153129ddfe3f9 # v0.2.2
17+
with:
18+
tag: ${{ github.ref_name }}
19+
is-monorepo: true
20+
secrets: inherit

0 commit comments

Comments
 (0)