Skip to content

Commit 3243111

Browse files
sidpalassidpalas
committed
split workflows
1 parent 97b9815 commit 3243111

5 files changed

Lines changed: 139 additions & 32 deletions

‎.github/workflows/04-advanced-features--02-artifacts.yaml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
name: Artifacts
2+
on:
3+
workflow_dispatch:
4+
5+
jobs:
6+
# ──────────────────────────────────────────────
7+
# 1) Artifact round-trip
8+
# ──────────────────────────────────────────────
9+
artifact-producer:
10+
name: Produce artifact
11+
runs-on: ubuntu-24.04
12+
steps:
13+
- name: Create artifact file
14+
run: |
15+
echo "This will be stored as an artifact!" > artifact.txt
16+
echo "Generated by job-artifact-producer on $(date)" >> artifact.txt
17+
18+
- name: Upload artifact
19+
uses: actions/upload-artifact@v4
20+
with:
21+
name: example-artifact
22+
path: artifact.txt
23+
24+
artifact-consumer:
25+
name: Consume artifact
26+
runs-on: ubuntu-24.04
27+
needs: job-artifact-producer
28+
steps:
29+
- name: Download artifact
30+
uses: actions/download-artifact@v4
31+
with:
32+
name: example-artifact
33+
34+
- name: Cat artifact file
35+
run: cat artifact.txt

.github/workflows/04-advanced-features--02-data-persistence.yaml renamed to .github/workflows/04-advanced-features--03-caching.yaml

Lines changed: 1 addition & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,8 @@
1-
name: Artifacts and Caching
1+
name: Caching
22
on:
33
workflow_dispatch:
44

55
jobs:
6-
# ──────────────────────────────────────────────
7-
# 1) Artifact round-trip
8-
# ──────────────────────────────────────────────
9-
artifact-producer:
10-
name: Produce artifact
11-
runs-on: ubuntu-24.04
12-
steps:
13-
- name: Create artifact file
14-
run: |
15-
echo "This will be stored as an artifact!" > artifact.txt
16-
echo "Generated by job-artifact-producer on $(date)" >> artifact.txt
17-
18-
- name: Upload artifact
19-
uses: actions/upload-artifact@v4
20-
with:
21-
name: example-artifact
22-
path: artifact.txt
23-
24-
artifact-consumer:
25-
name: Consume artifact
26-
runs-on: ubuntu-24.04
27-
needs: job-artifact-producer
28-
steps:
29-
- name: Download artifact
30-
uses: actions/download-artifact@v4
31-
with:
32-
name: example-artifact
33-
34-
- name: Cat artifact file
35-
run: cat artifact.txt
36-
376
# ──────────────────────────────────────────────
387
# 2) Generic cache with actions/cache
398
# ──────────────────────────────────────────────

.github/workflows/04-advanced-features--04-auth-and-permissions.yaml renamed to .github/workflows/04-advanced-features--04-github-permissions.yaml

File renamed without changes.

‎.github/workflows/04-advanced-features--05-third-party-auth.yaml‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
name: Permissions
2+
on:
3+
workflow_dispatch:
4+
5+
# Permissions can be defined at the workflow or job level
6+
# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
7+
################
8+
# Full Set
9+
################
10+
# permissions:
11+
# actions: read|write|none
12+
# attestations: read|write|none
13+
# checks: read|write|none
14+
# contents: read|write|none
15+
# deployments: read|write|none
16+
# id-token: write|none
17+
# issues: read|write|none
18+
# models: read|none
19+
# discussions: read|write|none
20+
# packages: read|write|none
21+
# pages: read|write|none
22+
# pull-requests: read|write|none
23+
# security-events: read|write|none
24+
# statuses: read|write|none
25+
################
26+
27+
################
28+
# Default (everything unspecified is "none")
29+
################
30+
# permissions:
31+
# contents: read
32+
# packages: read
33+
################
34+
35+
jobs:
36+
read-only-pr:
37+
runs-on: ubuntu-24.04
38+
permissions:
39+
pull-requests: read # Can read PR data only
40+
continue-on-error: true # Avoids failing entire workflow
41+
steps:
42+
- uses: actions/checkout@v4
43+
44+
- name: Install GitHub CLI
45+
run: |
46+
sudo apt-get update -qq
47+
sudo apt-get install -y gh
48+
49+
- name: List the first 5 open PRs (allowed)
50+
run: gh pr list --limit 5
51+
env:
52+
GH_TOKEN: ${{ github.token }}
53+
54+
- name: Attempt to add a label (expected to fail)
55+
env:
56+
GH_TOKEN: ${{ github.token }}
57+
run: |
58+
gh pr edit 1 --add-label "documentation"
59+
60+
- name: Confirm the failure
61+
if: failure()
62+
run: echo "✅ Write operation was blocked as expected – token is read-only."
63+
64+
read-write-pr:
65+
runs-on: ubuntu-24.04
66+
permissions:
67+
pull-requests: write
68+
steps:
69+
- uses: actions/checkout@v4
70+
71+
- name: Install GitHub CLI
72+
run: |
73+
sudo apt-get update -qq
74+
sudo apt-get install -y gh
75+
76+
- name: Attempt to add a label (expected to succeed)
77+
env:
78+
GH_TOKEN: ${{ github.token }}
79+
run: |
80+
gh pr edit 1 --add-label "documentation"
81+
82+
# ❌ PLEASE DO NOT USE THIS APPROACH!
83+
auth-to-aws-static:
84+
runs-on: ubuntu-24.04
85+
steps:
86+
- name: "Configure AWS Credentials using static key"
87+
uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
88+
with:
89+
aws-region: us-east-2
90+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
91+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
92+
93+
# ✅ PLEASE USE THIS APPROACH INSTEAD!
94+
auth-to-aws-oidc:
95+
runs-on: ubuntu-24.04
96+
permissions:
97+
id-token: write # This is required for requesting the JWT for OIDC auth to AWS
98+
steps:
99+
- name: "Configure AWS Credentials - Action for GitHub Actions"
100+
uses: aws-actions/configure-aws-credentials@b47578312673ae6fa5b5096b330d9fbac3d116df # v4.2.1
101+
with:
102+
aws-region: us-east-2
103+
role-to-assume: arn:aws:iam::917774925227:role/github-actions-role

.github/workflows/04-advanced-features--03-matrix-and-conditionals.yaml renamed to .github/workflows/04-advanced-features--06-matrix-and-conditionals.yaml

File renamed without changes.

0 commit comments

Comments
 (0)