Skip to content

Commit d175c6b

Browse files
vr-skivr-ski
authored
refactor workflows into reusable workflows (#29)
* refactor workflows into reusable workflows * add permissions for security scan * fix permissions issue * fix docs check if skipped * add names to jobs; add debug info * add !cancelled() to avoid skipping the job * test debug info * remove if condition for testing purposes * remove dependency on docs * add mock change to pyproject.toml * remove whole if condition * use timestamp for dev versions
1 parent 20a37fe commit d175c6b

7 files changed

Lines changed: 117 additions & 33 deletions

File tree

‎.github/workflows/main-workflow.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Main Workflow
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
workflow_dispatch:
9+
10+
jobs:
11+
ci:
12+
name: CI lint, type, test, build
13+
uses: ./.github/workflows/reusable-ci.yml
14+
15+
security:
16+
name: Security scans
17+
permissions:
18+
security-events: write
19+
actions: read
20+
contents: read
21+
packages: read
22+
uses: ./.github/workflows/reusable-security.yml
23+
24+
docs:
25+
name: Deploy Documentation
26+
permissions:
27+
contents: write
28+
pages: write
29+
id-token: write
30+
if: | # Only run docs if documentation files change
31+
contains(github.event.head_commit.modified, 'docs/') ||
32+
contains(github.event.head_commit.modified, 'README.md') ||
33+
contains(github.event.head_commit.modified, 'CONTRIBUTING.md') ||
34+
contains(github.event.head_commit.modified, 'mkdocs.yml')
35+
uses: ./.github/workflows/reusable-docs.yml
36+
37+
cd-dev:
38+
name: CD Dev Publishing
39+
needs: [ci, security, docs]
40+
if: ${{ !cancelled() }}
41+
uses: ./.github/workflows/reusable-cd-dev.yml
42+
secrets: inherit

.github/workflows/cd-dev.yml renamed to .github/workflows/reusable-cd-dev.yml

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
name: CD - Dev Publishing
22

33
on:
4-
push:
5-
branches: [ main ]
6-
workflow_dispatch:
4+
workflow_call:
5+
6+
env:
7+
TEST_PYPI_UPLOAD_URL: "https://test.pypi.org/legacy/"
8+
TEST_PYPI_INSTALL_URL: "https://test.pypi.org/simple/"
79

810
jobs:
911
publish-dev:
@@ -34,15 +36,16 @@ jobs:
3436
PATCH=0
3537
fi
3638
37-
DEV_VERSION="${MAJOR}.${MINOR}.${PATCH}.dev${{ github.run_number }}"
39+
TIMESTAMP=$(date +%Y%m%d%H%M%S)
40+
DEV_VERSION="${MAJOR}.${MINOR}.${PATCH}.dev${TIMESTAMP}"
3841
3942
echo "Dev version: $DEV_VERSION"
4043
echo "version=$DEV_VERSION" >> $GITHUB_OUTPUT
4144
4245
- name: Build and publish to TestPyPI
4346
uses: ./.github/actions/build-and-publish
4447
with:
45-
pypi-upload-url: 'https://test.pypi.org/legacy/'
46-
pypi-install-url: 'https://test.pypi.org/simple/'
48+
pypi-upload-url: ${{ env.TEST_PYPI_UPLOAD_URL }}
49+
pypi-install-url: ${{ env.TEST_PYPI_INSTALL_URL }}
4750
version-override: ${{ steps.version.outputs.version }}
4851
pypi-token: ${{ secrets.TEST_PYPI_API_TOKEN }}

.github/workflows/ci.yml renamed to .github/workflows/reusable-ci.yml

Lines changed: 25 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,11 @@
1-
name: Lint and Type Check
1+
name: Lint, Checks, Automated Tests, Build Test
22

33
on:
4-
push:
5-
branches: [ main ]
6-
pull_request:
7-
branches: [ main ]
8-
9-
# Define reusable steps as anchors
10-
defaults:
11-
run:
12-
shell: bash
4+
workflow_call:
5+
outputs:
6+
overall-success:
7+
description: "CI all checks passed"
8+
value: ${{ jobs.aggregate-results.outputs.overall-success }}
139

1410
jobs:
1511
ruff-check:
@@ -90,3 +86,22 @@ jobs:
9086

9187
- name: Installation dry run
9288
run: pip install dist/*.whl
89+
90+
aggregate-results:
91+
needs: [ruff-check, ruff-format, mypy, unit-tests, build-package ]
92+
runs-on: ubuntu-latest
93+
outputs:
94+
overall-success: ${{ steps.aggregate.outputs.overall-success }}
95+
steps:
96+
- name: Check if all jobs passed
97+
id: aggregate
98+
run: |
99+
if [[ "${{ needs.ruff-check.result }}" == "success" && \
100+
"${{ needs.ruff-format.result }}" == "success" && \
101+
"${{ needs.mypy.result }}" == "success" && \
102+
"${{ needs.unit-tests.result }}" == "success" && \
103+
"${{ needs.build-package.result }}" == "success" ]]; then
104+
echo "overall-success=true" >> $GITHUB_OUTPUT
105+
else
106+
echo "overall-success=false" >> $GITHUB_OUTPUT
107+
fi

.github/workflows/docs.yml renamed to .github/workflows/reusable-docs.yml

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,7 @@
11
name: Deploy Documentation
22

33
on:
4-
workflow_dispatch:
5-
push:
6-
branches: [ main ]
7-
paths:
8-
- 'docs/**'
9-
- 'mkdocs.yml'
10-
- 'README.md'
11-
- 'CONTRIBUTING.md'
12-
- '.github/workflows/docs.yml'
4+
workflow_call:
135

146
permissions:
157
contents: write

.github/workflows/security.yml renamed to .github/workflows/reusable-security.yml

Lines changed: 23 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,11 @@
11
name: Security Scan
22

33
on:
4-
schedule:
5-
# Run daily at 6 AM UTC
6-
- cron: '0 6 * * *'
7-
workflow_dispatch: # Allow manual triggers
8-
pull_request:
9-
branches: [ main ]
10-
push:
11-
branches: [ main ]
4+
workflow_call:
5+
outputs:
6+
overall-success:
7+
description: "Security all checks passed"
8+
value: ${{ jobs.aggregate-results.outputs.overall-success }}
129

1310
jobs:
1411
safety-scan:
@@ -75,3 +72,21 @@ jobs:
7572
uses: gitleaks/gitleaks-action@v2
7673
env:
7774
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
75+
76+
aggregate-results:
77+
needs: [safety-scan, bandit-scan, codeql-scan, secret-scan]
78+
runs-on: ubuntu-latest
79+
outputs:
80+
overall-success: ${{ steps.aggregate.outputs.overall-success }}
81+
steps:
82+
- name: Check if all jobs passed
83+
id: aggregate
84+
run: |
85+
if [[ "${{ needs.safety-scan.result }}" == "success" && \
86+
"${{ needs.bandit-scan.result }}" == "success" && \
87+
"${{ needs.codeql-scan.result }}" == "success" && \
88+
"${{ needs.secret-scan.result }}" == "success" ]]; then
89+
echo "overall-success=true" >> $GITHUB_OUTPUT
90+
else
91+
echo "overall-success=false" >> $GITHUB_OUTPUT
92+
fi

‎.github/workflows/schedule-security.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: Scheduled Security Scan
2+
3+
on:
4+
schedule:
5+
# Run daily at 6 AM UTC
6+
- cron: '0 6 * * *'
7+
workflow_dispatch: # Allow manual triggers
8+
9+
jobs:
10+
security:
11+
permissions:
12+
security-events: write
13+
actions: read
14+
contents: read
15+
packages: read
16+
uses: ./.github/workflows/reusable-security.yml

‎pyproject.toml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
requires = ["setuptools>=69.4.2", "wheel>=0.44.0", "setuptools-scm>=8.1.0"]
33
build-backend = "setuptools.build_meta"
44

5+
56
[tool.setuptools_scm]
67
write_to = "src/tftp_router_flasher/_version.py" # Create version file
78
version_scheme = "no-guess-dev" # Increment patch for dev

0 commit comments

Comments
 (0)