Skip to content

Commit 2f143c5

Browse files
rjaegersrjaegers
authored
ci: reduce duplication
1 parent 4508d51 commit 2f143c5

3 files changed

Lines changed: 62 additions & 78 deletions

File tree

‎.github/workflows/build-push-test.yml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
name: Build, Push & Test
3+
4+
on:
5+
workflow_call:
6+
7+
concurrency:
8+
group: ${{ github.ref }}-${{ github.workflow }}
9+
cancel-in-progress: true
10+
11+
permissions: {}
12+
13+
jobs:
14+
build-push-base:
15+
name: Build → Push → Test (🍨 base)
16+
uses: ./.github/workflows/wc-build-push-test.yml
17+
permissions: &build-push-test-permissions
18+
actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
19+
artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
20+
attestations: write # is needed by actions/attest-build-provenance to push attestations
21+
contents: write # is needed by anchore/sbom-action for artifact uploads
22+
id-token: write # is needed by actions/attest-build-provenance to obtain an OIDC token
23+
packages: write # is needed to push image manifest when using GitHub Container Registry
24+
pull-requests: write # is needed by marocchino/sticky-pull-request-comment to post comments
25+
with:
26+
dockerfile: .devcontainer/base/Dockerfile
27+
enable-edge-tag: ${{ github.event_name == 'merge_group' }}
28+
image-name: ${{ github.repository }}-base
29+
integration-test-file: test/base/integration-tests.bats
30+
integration-test-podman: true
31+
32+
build-push-flavors:
33+
name: Build → Push → Test (🍨 ${{ matrix.flavor }})
34+
needs: build-push-base
35+
strategy:
36+
matrix:
37+
flavor: [cpp, rust]
38+
uses: ./.github/workflows/wc-build-push-test.yml
39+
secrets:
40+
TEST_GITHUB_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
41+
TEST_GITHUB_USER: ${{ secrets.TEST_GITHUB_USER }}
42+
TEST_GITHUB_PASSWORD: ${{ secrets.TEST_GITHUB_PASSWORD }}
43+
TEST_GITHUB_TOTP_SECRET: ${{ secrets.TEST_GITHUB_TOTP_SECRET }}
44+
permissions: *build-push-test-permissions
45+
with:
46+
acceptance-test-path: ${{ (github.actor != 'dependabot[bot]' && matrix.flavor == 'cpp') && 'test/cpp/features' || '' }}
47+
acceptance-test-devcontainer-file: .devcontainer/${{ matrix.flavor }}-test/devcontainer.json
48+
build-args: |
49+
BASE_IMAGE=${{ needs.build-push-base.outputs.fully-qualified-image-name }}@${{ needs.build-push-base.outputs.digest }}
50+
devcontainer-metadata-file: .devcontainer/${{ matrix.flavor }}/devcontainer-metadata.json
51+
dockerfile: .devcontainer/${{ matrix.flavor }}/Dockerfile
52+
enable-edge-tag: ${{ github.event_name == 'merge_group' }}
53+
image-name: ${{ github.repository }}-${{ matrix.flavor }}
54+
integration-test-file: test/${{ matrix.flavor }}/integration-tests.bats
55+
integration-test-podman: true

‎.github/workflows/continuous-integration.yml‎

Lines changed: 3 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@ concurrency:
1313
permissions: {}
1414

1515
jobs:
16-
build-push-base:
17-
name: Build → Push → Test (🍨 base)
18-
uses: ./.github/workflows/wc-build-push-test.yml
16+
build-push-test:
17+
name: Build → Push → Test
18+
uses: ./.github/workflows/build-push-test.yml
1919
permissions:
2020
actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
2121
artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
@@ -24,43 +24,6 @@ jobs:
2424
id-token: write # is needed by actions/attest-build-provenance to obtain an OIDC token
2525
packages: write # is needed to push image manifest when using GitHub Container Registry
2626
pull-requests: write # is needed by marocchino/sticky-pull-request-comment to post comments
27-
with:
28-
dockerfile: .devcontainer/base/Dockerfile
29-
enable-edge-tag: ${{ github.event_name == 'merge_group' }}
30-
image-name: ${{ github.repository }}-base
31-
integration-test-file: test/base/integration-tests.bats
32-
33-
build-push-flavors:
34-
name: Build → Push → Test (🍨 ${{ matrix.flavor }})
35-
needs: build-push-base
36-
strategy:
37-
matrix:
38-
flavor: [cpp, rust]
39-
uses: ./.github/workflows/wc-build-push-test.yml
40-
secrets:
41-
TEST_GITHUB_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
42-
TEST_GITHUB_USER: ${{ secrets.TEST_GITHUB_USER }}
43-
TEST_GITHUB_PASSWORD: ${{ secrets.TEST_GITHUB_PASSWORD }}
44-
TEST_GITHUB_TOTP_SECRET: ${{ secrets.TEST_GITHUB_TOTP_SECRET }}
45-
permissions:
46-
actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
47-
artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
48-
attestations: write # is needed by actions/attest-build-provenance to push attestations
49-
contents: write # is needed by anchore/sbom-action for artifact uploads
50-
id-token: write # is needed by actions/attest-build-provenance to obtain an OIDC token
51-
packages: write # is needed to push image manifest when using GitHub Container Registry
52-
pull-requests: write # is needed by marocchino/sticky-pull-request-comment to post comments
53-
with:
54-
acceptance-test-path: ${{ (github.actor != 'dependabot[bot]' && matrix.flavor == 'cpp') && 'test/cpp/features' || '' }}
55-
acceptance-test-devcontainer-file: .devcontainer/${{ matrix.flavor }}-test/devcontainer.json
56-
build-args: |
57-
BASE_IMAGE=${{ needs.build-push-base.outputs.fully-qualified-image-name }}@${{ needs.build-push-base.outputs.digest }}
58-
devcontainer-metadata-file: .devcontainer/${{ matrix.flavor }}/devcontainer-metadata.json
59-
dockerfile: .devcontainer/${{ matrix.flavor }}/Dockerfile
60-
enable-edge-tag: ${{ github.event_name == 'merge_group' }}
61-
image-name: ${{ github.repository }}-${{ matrix.flavor }}
62-
integration-test-file: test/${{ matrix.flavor }}/integration-tests.bats
63-
integration-test-podman: true
6427

6528
dependency-review:
6629
name: 🔍 Dependency Review

‎.github/workflows/release-build.yml‎

Lines changed: 4 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,9 @@ concurrency:
1313
permissions: {}
1414

1515
jobs:
16-
build-push-base:
17-
name: Build → Push → Test (🍨 base)
18-
uses: ./.github/workflows/wc-build-push-test.yml
16+
build-push-test:
17+
name: Build → Push → Test
18+
uses: ./.github/workflows/build-push-test.yml
1919
permissions:
2020
actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
2121
artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
@@ -24,40 +24,6 @@ jobs:
2424
id-token: write # is needed by actions/attest-build-provenance to obtain an OIDC token
2525
packages: write # is needed to push image manifest when using GitHub Container Registry
2626
pull-requests: write # is needed by marocchino/sticky-pull-request-comment to post comments
27-
with:
28-
dockerfile: .devcontainer/base/Dockerfile
29-
image-name: ${{ github.repository }}-base
30-
integration-test-file: test/base/integration-tests.bats
31-
32-
build-push-flavors:
33-
name: Build → Push → Test (🍨 ${{ matrix.flavor }})
34-
needs: build-push-base
35-
strategy:
36-
matrix:
37-
flavor: [cpp, rust]
38-
uses: ./.github/workflows/wc-build-push-test.yml
39-
secrets:
40-
TEST_GITHUB_TOKEN: ${{ secrets.TEST_GITHUB_TOKEN }}
41-
TEST_GITHUB_USER: ${{ secrets.TEST_GITHUB_USER }}
42-
TEST_GITHUB_PASSWORD: ${{ secrets.TEST_GITHUB_PASSWORD }}
43-
TEST_GITHUB_TOTP_SECRET: ${{ secrets.TEST_GITHUB_TOTP_SECRET }}
44-
permissions:
45-
actions: read # is needed by anchore/sbom-action to find workflow artifacts when attaching release assets
46-
artifact-metadata: write # is needed by actions/attest-build-provenance to write artifact metadata
47-
attestations: write # is needed by actions/attest-build-provenance to push attestations
48-
contents: write # is needed by anchore/sbom-action for artifact uploads
49-
id-token: write # is needed by actions/attest-build-provenance to obtain an OIDC token
50-
packages: write # is needed to push image manifest when using GitHub Container Registry
51-
pull-requests: write # is needed by marocchino/sticky-pull-request-comment to post comments
52-
with:
53-
build-args: |
54-
BASE_IMAGE=${{ needs.build-push-base.outputs.fully-qualified-image-name }}@${{ needs.build-push-base.outputs.digest }}
55-
devcontainer-metadata-file: .devcontainer/${{ matrix.flavor }}/devcontainer-metadata.json
56-
dockerfile: .devcontainer/${{ matrix.flavor }}/Dockerfile
57-
image-name: ${{ github.repository }}-${{ matrix.flavor }}
58-
integration-test-file: test/${{ matrix.flavor }}/integration-tests.bats
59-
acceptance-test-path: ${{ matrix.flavor == 'cpp' && 'test/cpp/features' || '' }}
60-
test-devcontainer-file: ${{ matrix.flavor == 'cpp' && '.devcontainer/cpp-test/devcontainer.json' || '' }}
6127

6228
apply-release-notes-template:
6329
name: 📝 Apply Release Template
@@ -96,7 +62,7 @@ jobs:
9662
# Please note that this is an overly broad scope, but GitHub does not
9763
# currently provide a more fine-grained permission for release modification.
9864
contents: write # is needed to modify a release
99-
needs: [build-push-base, build-push-flavors, apply-release-notes-template]
65+
needs: [build-push-test, apply-release-notes-template]
10066
env:
10167
CONTAINER_FLAVOR: ${{ matrix.flavor }}
10268
REF_NAME: ${{ github.ref_name }}

0 commit comments

Comments
 (0)