CI :: main #460
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| --- | |
| name: CI | |
| run-name: >- | |
| ${{github.workflow }} :: ${{ github.ref_name }} | |
| ${{ github.event.workflow_run.head_commit.message && format(' :: {0}', github.event.workflow_run.head_commit.message) || github.event.head_commit.message && format(' :: {0}', github.event.head_commit.message) || ''}} | |
| ${{ inputs.runner && inputs.runner != 'ubuntu-24.04' && format(' on {0}', inputs.runner) || '' }} | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - feature/* | |
| - bugfix/* | |
| pull_request: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| # Inputs are only available for workflow_dispatch - the default is not available for other type of triggers | |
| # https://dev.to/mrmike/github-action-handling-input-default-value-5f2g | |
| inputs: | |
| runner: | |
| description: 'Runner type' | |
| required: true | |
| default: 'ubuntu-24.04' | |
| type: choice | |
| options: | |
| - ubuntu-24.04 | |
| - matihost | |
| schedule: | |
| - cron: '27 20 * * 0' | |
| # https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token | |
| permissions: | |
| actions: read | |
| contents: read | |
| packages: write | |
| security-events: write | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| IMAGE_TAG: "${{ github.ref == 'refs/heads/main' && 'latest' || github.sha }}" | |
| jobs: | |
| sources: | |
| name: Checkout sources | |
| runs-on: ${{ inputs.runner || 'ubuntu-24.04' }} | |
| timeout-minutes: 5 | |
| container: | |
| image: maven:3-eclipse-temurin-21 | |
| outputs: | |
| GIT_COMMIT_HASH: ${{ steps.git_hash.outputs.GIT_COMMIT_HASH }} | |
| steps: | |
| - name: Checkout sources | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| # Workaround for https://github.com/actions/runner/issues/2033 | |
| - name: Set ownership | |
| run: | | |
| chown -R $(id -u):$(id -g) $PWD | |
| - name: Obtain git version | |
| id: git_hash | |
| run: | | |
| echo "GIT_COMMIT_HASH=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT | |
| - name: Cache workspace | |
| uses: actions/cache/save@v4 | |
| with: | |
| # avoid using github.workspace in caching? | |
| # so how effectivelly share source code between jobs? | |
| # https://github.com/actions/cache/blob/main/tips-and-workarounds.md#cross-os-cache | |
| # artifacts? | |
| # cleaning artifacts after workflow requires custom, non standard action: | |
| # https://github.com/marketplace/actions/delete-artifact | |
| path: ${{ github.workspace }} | |
| key: sources-${{ github.run_id }}-${{ github.run_attempt }} | |
| enableCrossOsArchive: true | |
| java: | |
| needs: sources | |
| runs-on: ${{ inputs.runner || 'ubuntu-24.04' }} | |
| timeout-minutes: 30 | |
| container: | |
| image: maven:3-eclipse-temurin-21 | |
| steps: | |
| - name: Download sources | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: ${{ github.workspace }} | |
| key: sources-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| enableCrossOsArchive: true | |
| - name: Cache local Maven repository | |
| uses: actions/cache@v4 | |
| with: | |
| # TODO reading from MAVEN_CONFIG env did not work here | |
| path: "/root/.m2/repository" | |
| key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-maven- | |
| # Do not use actions/setup-java@v3 cache option as it requires downloading java again, but container image contains java already | |
| # Use actions/cache to cache M2 repository manually instead | |
| # | |
| # - name: Set up JDK 21 | |
| # uses: actions/setup-java@v3 | |
| # with: | |
| # java-version: '21' | |
| # distribution: 'adopt' | |
| # cache: maven | |
| - name: Build Java source code | |
| working-directory: java | |
| run: mvn -s .mvn/settings.xml --show-version clean install | |
| - name: Archive app jars artifacts | |
| uses: actions/upload-artifact@v4 | |
| with: | |
| name: app-jars | |
| path: java/apps/**/target/*.jar | |
| retention-days: 2 | |
| - name: Cache java build sources | |
| uses: actions/cache/save@v4 | |
| with: | |
| path: ${{ github.workspace }}/java | |
| key: java-${{ github.run_id }}-${{ github.run_attempt }} | |
| enableCrossOsArchive: true | |
| java-image-mq-app: | |
| needs: java | |
| runs-on: ${{ inputs.runner || 'ubuntu-24.04' }} | |
| timeout-minutes: 30 | |
| container: | |
| image: quay.io/matihost/java-ci | |
| steps: | |
| - name: Download java build sources | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: ${{ github.workspace }}/java | |
| key: java-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| enableCrossOsArchive: true | |
| - name: Build Java mq client image | |
| working-directory: java/apps/mq/client | |
| env: | |
| container: "${{ inputs.runner == 'ubuntu-24.04' && 'docker' || 'kube' }}" | |
| REGISTRY: "${{ vars.REGISTRY || 'quay.io' }}" | |
| REGISTRY_USER: "${{ secrets.REGISTRY_USER }}" | |
| REGISTRY_PASSWORD: "${{ secrets.REGISTRY_PASSWORD }}" | |
| run: | | |
| mkdir -p /kaniko/.docker | |
| echo "{\"auths\":{\"${{ env.REGISTRY }}\":{\"username\":\"${{ env.REGISTRY_USER }}\",\"password\":\"${{ env.REGISTRY_PASSWORD }}\"}}}" > /kaniko/.docker/config.json | |
| /kaniko/executor -f ./Dockerfile -c "$(pwd)" --insecure --ignore-path=/var/mail --ignore-path=/var/spool/mail --push-retry 5 --skip-tls-verify --cache=false \ | |
| --use-new-run --snapshot-mode=redo \ | |
| --build-arg JAR_FILE=target/*.jar \ | |
| --destination="${{ env.REGISTRY }}/matihost/mq/basic-client:${{ env.IMAGE_TAG }}" | |
| java-image-cmdline: | |
| needs: java | |
| runs-on: ${{ inputs.runner || 'ubuntu-24.04' }} | |
| timeout-minutes: 30 | |
| container: | |
| image: quay.io/matihost/java-ci | |
| steps: | |
| - name: Download java build sources | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: ${{ github.workspace }}/java | |
| key: java-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| enableCrossOsArchive: true | |
| - name: Build Java command-line image | |
| working-directory: java/apps/command-line | |
| env: | |
| container: "${{ inputs.runner == 'ubuntu-24.04' && 'docker' || 'kube' }}" | |
| REGISTRY: "${{ vars.REGISTRY || 'quay.io' }}" | |
| REGISTRY_USER: "${{ secrets.REGISTRY_USER }}" | |
| REGISTRY_PASSWORD: "${{ secrets.REGISTRY_PASSWORD }}" | |
| run: | | |
| mkdir -p /kaniko/.docker | |
| echo "{\"auths\":{\"${{ env.REGISTRY }}\":{\"username\":\"${{ env.REGISTRY_USER }}\",\"password\":\"${{ env.REGISTRY_PASSWORD }}\"}}}" > /kaniko/.docker/config.json | |
| echo "Building Java commandline image" | |
| /kaniko/executor -f ./Dockerfile -c "$(pwd)" --insecure --ignore-path=/var/mail --ignore-path=/var/spool/mail --push-retry 5 --skip-tls-verify --cache=false \ | |
| --use-new-run --snapshot-mode=redo \ | |
| --build-arg JAR_FILE=target/*.jar \ | |
| --destination="${{ env.REGISTRY }}/matihost/commandline:${{ env.IMAGE_TAG }}" | |
| codeql-java: | |
| needs: sources | |
| runs-on: ${{ inputs.runner || 'ubuntu-24.04' }} | |
| timeout-minutes: 30 | |
| container: | |
| image: maven:3-eclipse-temurin-21 | |
| steps: | |
| - name: Download sources | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: ${{ github.workspace }} | |
| key: sources-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| enableCrossOsArchive: true | |
| - name: Cache local Maven repository | |
| uses: actions/cache@v4 | |
| with: | |
| path: "/root/.m2/repository" | |
| key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }} | |
| restore-keys: | | |
| ${{ runner.os }}-maven- | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: java | |
| queries: security-extended,security-and-quality | |
| - name: Build Java source code | |
| working-directory: java | |
| run: mvn -s .mvn/settings.xml --show-version clean install | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:java" | |
| codeql-go: | |
| needs: sources | |
| runs-on: ${{ inputs.runner || 'ubuntu-24.04' }} | |
| timeout-minutes: 30 | |
| container: golang:1.22 | |
| env: | |
| GO_CACHE: /go | |
| steps: | |
| - name: Download sources | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: ${{ github.workspace }} | |
| key: sources-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| - name: Set up cache | |
| uses: actions/cache@v4 | |
| with: | |
| path: |- | |
| /go | |
| key: "${{ runner.os }}-gopath" | |
| # https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/running-codeql-code-scanning-in-a-container | |
| - name: Install CodeQL dependencies | |
| run: apt update && apt -y install file | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: go | |
| queries: security-extended,security-and-quality | |
| - name: Build Go source code | |
| working-directory: go/learning | |
| run: go build -buildvcs=false -mod=mod -o . ./... && go test ./pkg/language && ./language | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:go" | |
| codeql-python: | |
| needs: sources | |
| runs-on: ${{ inputs.runner || 'ubuntu-24.04' }} | |
| timeout-minutes: 30 | |
| container: | |
| image: quay.io/matihost/ansible:root | |
| steps: | |
| - name: Download sources | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: ${{ github.workspace }} | |
| key: sources-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| - name: Initialize CodeQL | |
| uses: github/codeql-action/init@v3 | |
| with: | |
| languages: python | |
| queries: security-extended,security-and-quality | |
| - name: Build Python exchange-rate app | |
| run: |- | |
| make init | |
| make build | |
| make tests | |
| # make install | |
| # TODO github overrides HOME with /home/github - so if venv is stored in original HOME dir it has to be defined explicitely | |
| /root/.venv/user/bin/pip3 install --force-reinstall . | |
| exchange-rate | |
| working-directory: python/apps/exchange-rate | |
| - name: Run Ruff | |
| run: ruff check --output-format=github . | |
| - name: Perform CodeQL Analysis | |
| uses: github/codeql-action/analyze@v3 | |
| with: | |
| category: "/language:python" | |
| ansible: | |
| needs: sources | |
| runs-on: ${{ inputs.runner || 'ubuntu-24.04' }} | |
| timeout-minutes: 30 | |
| container: | |
| image: quay.io/matihost/ansible:root | |
| steps: | |
| - name: Download sources | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: ${{ github.workspace }} | |
| key: sources-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| - name: Run Ansible dictionaries playbook | |
| run: |- | |
| make dictionaries.yaml | |
| working-directory: ansible/learning | |
| rust: | |
| needs: sources | |
| runs-on: ${{ inputs.runner || 'ubuntu-24.04' }} | |
| timeout-minutes: 30 | |
| container: | |
| image: rust | |
| steps: | |
| - name: Download sources | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: ${{ github.workspace }} | |
| key: sources-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| - name: Build rust | |
| run: make build | |
| working-directory: rust/guessing_game | |
| image-build-on-gcp-artifact-registry: | |
| needs: sources | |
| runs-on: ${{ inputs.runner || 'ubuntu-24.04' }} | |
| if: ((inputs.runner || 'ubuntu-24.04') != 'ubuntu-24.04') && vars.GCP_PROJECT | |
| timeout-minutes: 30 | |
| container: | |
| image: quay.io/matihost/java-ci | |
| steps: | |
| - name: Download sources | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: ${{ github.workspace }} | |
| key: sources-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| enableCrossOsArchive: true | |
| - name: Build Ansible image in GKE hosted runner | |
| working-directory: k8s/images/ansible | |
| env: | |
| container: "kube" | |
| GCP_PROJECT: "${{ vars.GCP_PROJECT }}" | |
| GIT_COMMIT_HASH: "${{ needs.sources.outputs.GIT_COMMIT_HASH }}" | |
| run: | | |
| # remove ignore-path when fixed https://github.com/GoogleContainerTools/kaniko/issues/2214 | |
| /kaniko/executor -f ./Dockerfile -c "$(pwd)" --insecure --skip-tls-verify --cache=true --ignore-path=/var/mail --ignore-path=/var/spool/mail \ | |
| --destination="gcr.io/${{ env.GCP_PROJECT }}/ansible:${{ env.GIT_COMMIT_HASH }}" | |
| image-build-generic-registry: | |
| needs: sources | |
| runs-on: ${{ inputs.runner || 'ubuntu-24.04' }} | |
| if: vars.REGISTRY | |
| timeout-minutes: 30 | |
| container: | |
| image: quay.io/matihost/java-ci | |
| steps: | |
| - name: Download sources | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: ${{ github.workspace }} | |
| key: sources-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| enableCrossOsArchive: true | |
| - name: Build Ansible image on GH hosted runner with deployment to generic image registry | |
| working-directory: k8s/images/ansible | |
| env: | |
| container: "docker" | |
| REGISTRY: "${{ vars.REGISTRY || 'quay.io' }}" | |
| REGISTRY_USER: "${{ secrets.REGISTRY_USER }}" | |
| REGISTRY_PASSWORD: "${{ secrets.REGISTRY_PASSWORD }}" | |
| run: | | |
| mkdir -p /kaniko/.docker | |
| echo "{\"auths\":{\"${{ env.REGISTRY }}\":{\"username\":\"${{ env.REGISTRY_USER }}\",\"password\":\"${{ env.REGISTRY_PASSWORD }}\"}}}" > /kaniko/.docker/config.json | |
| /kaniko/executor -f ./Dockerfile -c "$(pwd)" --insecure --push-retry 5 - --skip-tls-verify --cache=true --ignore-path=/var/mail --ignore-path=/var/spool/mail \ | |
| --destination="${{ env.REGISTRY }}/matihost/ansible:${{ env.IMAGE_TAG }}" | |
| image-build-ghcr: | |
| needs: sources | |
| runs-on: ${{ inputs.runner || 'ubuntu-24.04' }} | |
| timeout-minutes: 30 | |
| container: | |
| image: quay.io/matihost/java-ci | |
| steps: | |
| - name: Download sources | |
| uses: actions/cache/restore@v4 | |
| with: | |
| path: ${{ github.workspace }} | |
| key: sources-${{ github.run_id }}-${{ github.run_attempt }} | |
| fail-on-cache-miss: true | |
| enableCrossOsArchive: true | |
| - name: Build Ansible image on GH hosted runner with deployment to GH Packages | |
| working-directory: k8s/images/ansible | |
| env: | |
| container: "${{ inputs.runner == 'ubuntu-24.04' && 'docker' || 'kube' }}" | |
| run: | | |
| mkdir -p /kaniko/.docker | |
| AUTH=$(echo -n ${{ github.actor }}:${{ secrets.GITHUB_TOKEN }} | base64) | |
| echo "{\"auths\": {\"ghcr.io\": {\"auth\": \"${AUTH}\"}}}" > /kaniko/.docker/config.json | |
| /kaniko/executor -c "$(pwd)" \ | |
| -f ./Dockerfile \ | |
| --destination="ghcr.io/${{ github.repository }}/ansible:${{ env.IMAGE_TAG }}" \ | |
| --insecure --skip-tls-verify --cache=true --ignore-path=/var/mail --ignore-path=/var/spool/mail \ | |
| --push-retry 5 |