rake_docker/.github/workflows/main.yaml at main · infrablocks/rake_docker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
name: Main
on:
  push:
    branches:
      - main

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Install tools
        uses: infrablocks/github-actions/asdf_install@v1
      - name: Check
        run: ./go library:check
      - name: Notify Slack
        if: ${{ !cancelled() }}
        continue-on-error: true
        run: ./go "slack:notify[${{ job.status }}]"
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Install tools
        uses: infrablocks/github-actions/asdf_install@v1
      - name: Test
        run: ./go test:unit
      - name: Notify Slack
        if: ${{ !cancelled() }}
        continue-on-error: true
        run: ./go "slack:notify[${{ job.status }}]"
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

  prerelease:
    needs: [check, test]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    # Job-level group (here and on release): a run awaiting release approval
    # holds the slot, and a workflow-level group would freeze all main CI for
    # the approval window. queue: max keeps every queued run; the default
    # cancels all but the newest.
    concurrency:
      group: main
      cancel-in-progress: false
      queue: max
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
      - name: Install tools
        uses: infrablocks/github-actions/asdf_install@v1
      - name: Install secrets tools
        run: ./scripts/ci/common/install-git-crypt.sh
      - name: Unlock git-crypt
        run: ./go git_crypt:unlock_with_encrypted_gpg_key
        env:
          ENCRYPTION_PASSPHRASE: ${{ secrets.ENCRYPTION_PASSPHRASE }}
      - name: Configure RubyGems credentials
        run: ./scripts/ci/common/configure-rubygems.sh
      - name: Set CI git author
        run: ./go repository:set_ci_author
      - name: Bump version
        run: ./go "version:bump[pre]"
      - name: Release
        run: ./go release
      - name: Push commits
        run: git push
      - name: Push tags
        run: git push --tags
      - name: Notify Slack of release hold
        continue-on-error: true
        run: ./go "slack:notify[success,on_hold]"
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
      - name: Notify Slack
        if: ${{ !cancelled() }}
        continue-on-error: true
        run: ./go "slack:notify[${{ job.status }}]"
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

  release:
    needs: [prerelease]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    environment: release
    concurrency:
      group: main
      cancel-in-progress: false
      queue: max
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
        with:
          ref: main
      - name: Pull latest main
        # Publishes main as of approval time, not the SHA that triggered the
        # run; --ff-only so a non-fast-forward fails loudly
        run: git pull --ff-only
      - name: Install tools
        uses: infrablocks/github-actions/asdf_install@v1
      - name: Install secrets tools
        run: ./scripts/ci/common/install-git-crypt.sh
      - name: Unlock git-crypt
        run: ./go git_crypt:unlock_with_encrypted_gpg_key
        env:
          ENCRYPTION_PASSPHRASE: ${{ secrets.ENCRYPTION_PASSPHRASE }}
      - name: Configure RubyGems credentials
        run: ./scripts/ci/common/configure-rubygems.sh
      - name: Set CI git author
        run: ./go repository:set_ci_author
      - name: Bump version
        run: ./go "version:bump[minor]"
      - name: Release
        run: ./go release
      - name: Push commits
        run: git push
      - name: Push tags
        run: git push --tags
      - name: Notify Slack
        if: ${{ !cancelled() }}
        continue-on-error: true
        run: ./go "slack:notify[${{ job.status }}]"
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}