rake_docker/.github/workflows/pr.yaml at main · infrablocks/rake_docker · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
name: Pull Request
on:
  pull_request:

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Install tools
        uses: infrablocks/github-actions/asdf_install@v1
      - name: Check
        run: ./go library:check
      - name: Notify Slack
        if: ${{ !cancelled() }}
        continue-on-error: true
        run: ./go "slack:notify[${{ job.status }}]"
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Install tools
        uses: infrablocks/github-actions/asdf_install@v1
      - name: Test
        run: ./go test:unit
      - name: Notify Slack
        if: ${{ !cancelled() }}
        continue-on-error: true
        run: ./go "slack:notify[${{ job.status }}]"
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

  build:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
      - name: Install tools
        uses: infrablocks/github-actions/asdf_install@v1
      - name: Build
        run: ./go library:build
      - name: Notify Slack
        if: ${{ !cancelled() }}
        continue-on-error: true
        run: ./go "slack:notify[${{ job.status }}]"
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

  prerelease:
    needs: [check, test, build]
    runs-on: ubuntu-latest
    timeout-minutes: 30
    # Same-repo human PRs only: fork and Dependabot PRs carry no secrets, so
    # git-crypt unlock / the RubyGems publish would fail. user.login is the
    # immutable PR author, not github.actor.
    if: >-
      github.event.pull_request.head.repo.full_name == github.repository &&
      github.event.pull_request.user.login != 'dependabot[bot]'
    # Queue per PR rather than cancel a mid-flight publish
    concurrency:
      group: pr-prerelease-${{ github.event.pull_request.number }}
      cancel-in-progress: false
    steps:
      - uses: actions/checkout@v4
      - name: Install tools
        uses: infrablocks/github-actions/asdf_install@v1
      - name: Install secrets tools
        run: ./scripts/ci/common/install-git-crypt.sh
      - name: Unlock git-crypt
        run: ./go git_crypt:unlock_with_encrypted_gpg_key
        env:
          ENCRYPTION_PASSPHRASE: ${{ secrets.ENCRYPTION_PASSPHRASE }}
      - name: Configure RubyGems credentials
        run: ./scripts/ci/common/configure-rubygems.sh
      - name: Publish prerelease
        # Facts via env, never interpolated
        run: ./go "prerelease:publish[$PR_NUMBER,$RUN_NUMBER,$RUN_ATTEMPT]"
        env:
          PR_NUMBER: ${{ github.event.pull_request.number }}
          RUN_NUMBER: ${{ github.run_number }}
          RUN_ATTEMPT: ${{ github.run_attempt }}
      - name: Notify Slack
        if: ${{ !cancelled() }}
        continue-on-error: true
        run: ./go "slack:notify[${{ job.status }}]"
        env:
          SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}

  merge-pull-request:
    needs: [check, test, build]
    runs-on: ubuntu-latest
    timeout-minutes: 10
    if: github.event.pull_request.user.login == 'dependabot[bot]'
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Merge pull request
        # --match-head-commit fails the merge if a commit landed after checks passed
        # [skip ci] stops the merge commit triggering a release build
        # PR title via env, never interpolated
        run: gh pr merge --merge --match-head-commit "$HEAD_SHA" "$PR_URL" --subject "$PR_TITLE [skip ci]"
        env:
          PR_URL: ${{ github.event.pull_request.html_url }}
          PR_TITLE: ${{ github.event.pull_request.title }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}