ci: Improvements

* Prevent notification on cancelled workflows
* Update failure condition to check job results
* Add missing job dependencies to notify job
* Validate required jobs in finished job
* Fix detect-changes globs to cover subdirectory Rust sources
* Match dependency versions across templates
* Guard publish/provenance jobs with stackabletech owner check
* Fix daily security workflow

Author: Saul-STFC

.github/workflows/generate_prs.yml

@@ -53,7 +53,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: cachix/install-nix-action@fd24c48048070c1be9acd18c9d369a83f0fe94d7 # v31.8.1
+      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
       - name: Install Ansible
         env:
           DEBIAN_FRONTEND: noninteractive
@@ -78,15 +78,14 @@ jobs:
       - name: Install jinja2
         run: pip install -r requirements.txt
 
-      # Create commit message and run the playbook
+      # Create commit message depending on whether this is run manually or due to a scheduled run
       - name: Run playbook
         env:
           CUSTOM_PR_TITLE: ${{ inputs.custom-pr-title }}
           GH_ACCESS_TOKEN: ${{ secrets.gh_access_token }}
           REPOSITORY: ${{ matrix.repository }}
-          DRY_RUN_FLAGS: ${{ (github.event_name != 'schedule' && inputs.dry-run != false) && '--tags=local' || '' }}
-          # Safely pass inputs/context via environment variables to prevent injection
-          INPUT_MESSAGE: ${{ github.event.inputs.message }}
+          DRY_RUN_FLAGS: ${{ inputs.dry-run && '--tags=local' || '' }}
+          INPUT_MESSAGE: ${{ inputs.message }}
           SENDER_LOGIN: ${{ github.event.sender.login }}
           EVENT_NAME: ${{ github.event_name }}
         run: |
@@ -98,7 +97,7 @@ jobs:
             REASON="$INPUT_MESSAGE"
           fi
 
-          # Encode parameters safely using jq, without serializing the GH_ACCESS_TOKEN
+          # Encode parameters using jq, without serializing the GH_ACCESS_TOKEN
           jq -n \
             --arg commit_hash "$GITHUB_SHA" \
             --arg author "$AUTHOR" \
@@ -109,4 +108,6 @@ jobs:
             '{commit_hash: $commit_hash, author: $author, reason: $reason, custom_pr_title: $custom_pr_title, base_dir: $base_dir, shard_repositories: [$repository]} | with_entries(select(.value != null and .value != ""))' > vars.json
 
           # Run the Ansible playbook. The token is read directly from the GH_ACCESS_TOKEN environment variable.
+          # $DRY_RUN_FLAGS is intentionally unquoted (empty or one fixed flag)
+          # shellcheck disable=SC2086
           ansible-playbook playbook/playbook.yaml --extra-vars "@vars.json" $DRY_RUN_FLAGS

template/.github/workflows/build.yaml.j2

@@ -59,8 +59,9 @@ jobs:
             - 'deploy/**'
             - '.cargo/**'
             - 'docker/**'
-            - 'Cargo.*'
-            - '*.rs'
+            - '**/Cargo.toml'
+            - 'Cargo.lock'
+            - '**/*.rs'
     outputs:
       detected: ${{ steps.check.outputs.detected }}
 
@@ -75,7 +76,7 @@ jobs:
       RUSTC_BOOTSTRAP: 1
     steps:
       - name: Install host dependencies
-        uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
           packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
           version: ubuntu-latest
@@ -95,17 +96,19 @@ jobs:
         with:
           cache-all-crates: "true"
           key: udeps
-          lookup-only: ${{ github.event_name == 'pull_request' }}
 
       - name: Install cargo-udeps
-        uses: stackabletech/cargo-install-action@8f7dbbcd2ebe22717efc132d0dd61e80841994b9 # cargo-udeps
+        uses: stackabletech/cargo-install-action@e3e2dcf8d0f0e5bdbc619bf6ee7560dd68152d3c # cargo-udeps
 
       - name: Run cargo-udeps
         run: cargo udeps --workspace --all-targets
 
   build-container-image:
     name: Build/Publish ${{ matrix.runner.arch }} Image
-    if: (github.event_name != 'merge_group') && needs.detect-changes.outputs.detected == 'true'
+    if: |
+      github.repository_owner == 'stackabletech'
+      && (github.event_name != 'merge_group')
+      && needs.detect-changes.outputs.detected == 'true'
     needs: [detect-changes]
     permissions:
       contents: read
@@ -120,23 +123,12 @@ jobs:
     outputs:
       operator-version: ${{ steps.version.outputs.OPERATOR_VERSION }}
     steps:
-      # Use cached apt packages on PRs.
-      # For merges to main and releases, bypass the cache and install fresh package to ensure we have the absolute latest versions.
       - name: Install host dependencies
-        if: github.event_name == 'pull_request'
-        uses: awalsh128/cache-apt-pkgs-action@2c09a5e66da6c8016428a2172bd76e5e4f14bb17 # v1.5.3
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
           packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
           version: ${{ matrix.runner.name }}
 
-      - name: Install host dependencies (no cache)
-        if: github.event_name != 'pull_request'
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y protobuf-compiler krb5-user libkrb5-dev \
-            libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
-
-
       - name: Checkout Repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
@@ -173,7 +165,7 @@ jobs:
           echo "OPERATOR_VERSION=$NEW_VERSION" | tee -a "$GITHUB_OUTPUT"
 
       - name: Install Nix
-        uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31.5.2
+        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
 
       - name: Install Rust ${{ env.RUST_TOOLCHAIN_VERSION }} Toolchain
         shell: bash
@@ -213,7 +205,8 @@ jobs:
   publish-index-manifest:
     name: Publish/Sign ${{ needs.build-container-image.outputs.operator-version }} Index
     if: |
-      (github.event_name != 'merge_group')
+      github.repository_owner == 'stackabletech'
+      && (github.event_name != 'merge_group')
       && needs.detect-changes.outputs.detected == 'true'
       && !github.event.pull_request.head.repo.fork
     needs:
@@ -259,7 +252,8 @@ jobs:
   provenance-oci:
     name: Generate Provenance for ${{ needs.build-container-image.outputs.operator-version }} (oci.stackable.tech)
     if: |
-      (github.event_name != 'merge_group')
+      github.repository_owner == 'stackabletech'
+      && (github.event_name != 'merge_group')
       && needs.detect-changes.outputs.detected == 'true'
       && !github.event.pull_request.head.repo.fork
     needs:
@@ -286,7 +280,8 @@ jobs:
   provenance-quay:
     name: Generate Provenance for ${{ needs.build-container-image.outputs.operator-version }} (quay.io)
     if: |
-      (github.event_name != 'merge_group')
+      github.repository_owner == 'stackabletech'
+      && (github.event_name != 'merge_group')
       && needs.detect-changes.outputs.detected == 'true'
       && !github.event.pull_request.head.repo.fork
     needs:
@@ -313,7 +308,8 @@ jobs:
   publish-helm-chart:
     name: Package/Publish ${{ needs.build-container-image.outputs.operator-version }} Helm Chart
     if: |
-      (github.event_name != 'merge_group')
+      github.repository_owner == 'stackabletech'
+      && (github.event_name != 'merge_group')
       && needs.detect-changes.outputs.detected == 'true'
       && !github.event.pull_request.head.repo.fork
     needs:
@@ -358,7 +354,8 @@ jobs:
   openshift-preflight-check:
     name: Run OpenShift Preflight Check for ${{ needs.build-container-image.outputs.operator-version }}-${{ matrix.arch }}
     if: |
-      (github.event_name != 'merge_group')
+      github.repository_owner == 'stackabletech'
+      && (github.event_name != 'merge_group')
       && needs.detect-changes.outputs.detected == 'true'
       && !github.event.pull_request.head.repo.fork
     needs:
@@ -392,28 +389,45 @@ jobs:
     # WARNING: Do not change the name unless you will also be changing the
     # Required Checks (in branch protections) in GitHub settings.
     name: Finished Build and Publish
+    if: always()
     needs:
+      - detect-changes
       - cargo-udeps
+      - build-container-image
+      - publish-index-manifest
       - openshift-preflight-check
       - publish-helm-chart
+      - provenance-oci
+      - provenance-quay
     runs-on: ubuntu-latest
     steps:
-      - run: echo "We are done here"
+      - name: Fail if a required job failed or was cancelled
+        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
+        run: |
+          echo "One or more required jobs failed or were cancelled."
+          exit 1
+
+      - name: Finished
+        run: echo "All required jobs succeeded or were intentionally skipped."
 
   notify:
     name: Failure Notification
     if: |
-      (failure() || github.run_attempt > 1)
+      !cancelled()
+      && github.repository_owner == 'stackabletech'
+      && (contains(needs.*.result, 'failure') || github.run_attempt > 1)
       && github.event_name != 'merge_group'
       && needs.detect-changes.outputs.detected == 'true'
       && !github.event.pull_request.head.repo.fork
     needs:
       - detect-changes
+      - cargo-udeps
       - build-container-image
       - publish-index-manifest
       - provenance-oci
       - provenance-quay
       - publish-helm-chart
+      - openshift-preflight-check
       - finished
     runs-on: ubuntu-latest
     steps:

template/.github/workflows/general_daily_security.yml

@@ -18,11 +18,15 @@ jobs:
     permissions:
       contents: read
       checks: write
-      issues: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
+        # Build against stable because cargo-audit sometimes depends on things
+        # that require a newer Rust version than our pinned toolchain. This does
+        # not influence the result, so it should be safe.
+        env:
+          RUSTUP_TOOLCHAIN: stable
         with:
           token: ${{ secrets.GITHUB_TOKEN }}

template/.github/workflows/integration-test.yml

@@ -16,7 +16,7 @@ on:
           - custom
       test-mode-input:
         description: |
-          The profile or the runner used. Eg: `smoke-latest` or `amd64` (see test/interu.yaml)
+          The profile or the runner used. Eg: `smoke-latest` or `amd64` (see tests/interu.yaml)
         required: true
       test-suite:
         description: Name of the test-suite. Only used if test-mode is `custom`

template/.github/workflows/pr_prek.yaml.j2

@@ -21,7 +21,7 @@ jobs:
       contents: read
     steps:
       - name: Install host dependencies
-        uses: awalsh128/cache-apt-pkgs-action@acb598e5ddbc6f68a970c5da0688d2f3a9f04d05 # v1.6.0
+        uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # v1.6.3
         with:
           packages: protobuf-compiler krb5-user libkrb5-dev libclang-dev liblzma-dev libssl-dev pkg-config apt-transport-https
           version: ubuntu-latest