ci: use the shared org workflows for image builds, PR image cleanup, PR-title lint and actionlint by sleidig · Pull Request #261 · Aam-Digital/aam-services

sleidig · 2026-10-13T20:44:18Z

Part of Aam-Digital/internal#392: CI moves to the shared workflows of Aam-Digital/.github#1. They are called at @v1 (.github#1 is merged).

What

Backend image (aam-backend-service-build-and-publish.yml)

Built with the shared docker-image.yml, which builds every platform on a native runner: amd64 on ubuntu-latest, arm64 on ubuntu-24.04-arm, then merged by digest. This is the same approach as before.

Package stays ghcr.io/aam-digital/aam-services. Tags are unchanged:

Trigger	Tags	Platforms
release tag `aam-backend-service/<version>`	`<version>` (no `v`), `stable`, `latest`	amd64 + arm64
push to `main` (edge build)	`X.Y.Z-edge.N` (the last `aam-backend-service/X.Y.Z` with the patch number bumped, plus the commits since; shared `edge-version.yml`), plus `edge` and `main` while it is the newest commit	amd64 + arm64
pull request	`pr-<n>`	amd64 only (was both)

The aam-backend-service package has not been pushed since the switch to aam-services (ci(aam-backend-service): publish as aam-services, tags without "v", add stable #219), and nothing in the org references it. So it is not published to.
APPLICATION_VERSION (Sentry release): the version for releases, the edge version for main builds, the commit SHA for PRs.
main builds no longer just overwrite main: each has its own edge version tag. A newer push cancels an older main build (concurrency), and after each release the job prune-edge-images deletes the edge images of the finished cycle (the images edge, main, stable, latest point to are kept). main stays during the transition, until nothing follows it any more.
Sentry source bundles are preserved: the shared workflow's BUILD_SECRETS passes the sentry_auth_token BuildKit secret (from SENTRY_TOKEN) together with SENTRY_UPLOAD_SOURCES=true on every non-PR build (main and release tags). Pull requests, including forks, get neither and skip the upload, exactly as before. The upload itself cannot be tested before merge.
New behaviour from the shared workflow:
- Images replaced by a later push are no longer deleted by the build: they stay untagged until the shared image-cleanup.yml (on PR close and after releases) deletes untagged images older than 2 days (feat: shared CI workflows, release automation, Renovate presets and org defaults .github#1). This covers older pr-<n> pushes and the previous main image.
- The image carries provenance attestations (provenance: false is gone).
- Each image's cache gets its own scope.
- PRs from forks only build, they don't push.
test is unchanged.
publish now waits for the image build as well as for test. PR images are amd64 only, so the main build is the first arm64 build of a change. A release whose tag-push image would fail on arm64 is therefore not created.

PR image cleanup (pr-closed.yml): when a PR closes, the shared image-cleanup.yml deletes its pr-<n> image from aam-services. It first cancels any still-running PR build of aam-backend-service-build-and-publish.yml.

Module release (_module-release.yml, local reusable workflow)

The release steps that both build workflows had copied now live here, with inputs module, version-prefix and asset-artifact.
The version is still calculated with conventional_commits_next_version per module. The "no commits touch the module → no release" guard from chore(ci): skip release version calculation when a module has no new commits #227 stays.
Tags are unchanged:
- aam-backend-service/<version>, which ndb-setup reads from the release name.
- keycloak-third-party-authentication/v<version>, with the jar attached. keycloak-aam downloads the jar from there.
Release notes now start at the module's own previous tag (--notes-start-tag).

keycloak-third-party-authentication

Removed the undefined matrix.platform.
Removed the registry login, metadata and QEMU steps. They were unused, because the jar is exported locally and never pushed. It needs no packages: write any more.
Its build cache has its own scope.

Also in this PR

The shared pr-title-lint.yml and actionlint.yml.
renovate.json extends the org preset (the aam-services proposal from internal#392).
.github/ISSUE_TEMPLATE/ is removed in favour of the org defaults. Those were generalized from these templates, and the only lost detail is the backend-specific wording ("Backend version (image tag), enabled feature modules").

Required checks

The ruleset still requires build (linux/amd64, ubuntu-latest). That check stays "Expected — waiting" on this PR, because the job now reports as:

build / build (linux/amd64) (replaces it)
build / merge
build / build (linux/arm64), which runs on main and release tags only

test and CodeRabbit are unchanged. Update the ruleset when this is merged: require build / build (linux/amd64), and optionally build / merge. Never require build / build (linux/arm64): it doesn't run on PRs, so it would block every PR. actionlint / actionlint and pr-title / Validate PR title are new and could be made required.

Testing

actionlint 1.7.12 with shellcheck 0.11.0: clean.
renovate-config-validator --strict (Renovate 44.155.8): valid.
The PR image was checked against today's image (tags, labels, platforms), see the comments below. (The cleanup-replaced result there is outdated: that step was replaced by the PR-close sweep.)
Not testable before merge:
- the release path (_module-release.yml, main push and tag push);
- PR-title lint (pull_request_target runs from the base branch);
- the PR-closed cleanup.

🤖 Generated with Claude Code

…module release - aam-backend-service: build the image with the shared docker-image workflow on native runners (amd64 + arm64), same tags as before (`<version>`, `stable`, `latest` for releases, `main`, `pr-<n>`); PR images are linux/amd64 only. Replaced images are deleted right away. - PR closed: delete the PR's `pr-<n>` image with the shared pr-image-cleanup workflow. - Both modules create their release with one local reusable workflow `_module-release.yml` (conventional_commits_next_version per module, with the guard for modules without new commits). - keycloak-third-party-authentication: drop the undefined `matrix.platform` and the unused registry login/metadata, scope its build cache. Refs Aam-Digital/internal#392 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Refs Aam-Digital/internal#392 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Keeps the repo-specific managers and the jvm-toolchain, keycloak and carbone rules. Refs Aam-Digital/internal#392 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

The templates now live in Aam-Digital/.github (generalized from these); GitHub only uses the org defaults for repositories without their own .github/ISSUE_TEMPLATE folder. Refs Aam-Digital/internal#392 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

coderabbitai · 2026-10-13T20:44:30Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: Aam-Digital/aam-services/.coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 54bf5194-1e62-4457-b962-4fac21e35286

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

sleidig · 2026-10-13T20:54:46Z

Verification of the PR image

pr-261 compared with today's images (2.3.0, main, pr-259), read via the registry API:

	today	this PR
package	`ghcr.io/aam-digital/aam-services`	same
index	OCI index, linux/amd64 + linux/arm64	OCI index, linux/amd64 only (PR builds stay basic), plus an `unknown/unknown` provenance attestation
OCI labels	title, description, licenses, source, url, revision, created, version (`pr-<n>`)	identical set and values
`APPLICATION_VERSION`	commit SHA (PRs/main), version (releases)	commit SHA
config `created`	`1970-01-01` (`SOURCE_DATE_EPOCH=0`)	build time (the shared workflow does not set `SOURCE_DATE_EPOCH`)

Release (<version>, stable, latest, both platforms) and main builds go through the same path with different image-config outputs. They cannot run before merge.

cleanup-replaced: I re-ran the PR build job, which pushed a new pr-261 image. The merge job's "Delete replaced images" step then removed the old image and both of its children:

ghcr.io/aam-digital/aam-services (new image: sha256:19474ad71485…):
  deleted image sha256:f1db375a73d3… (package version 1381505742)
  deleted child manifest sha256:9d4100a4cbec… (package version 1381505650)
  deleted child manifest sha256:536b0e0cad6d… (package version 1381505701)

The package now holds only the new pr-261 index and its 2 children for this PR. The per-platform digest push was kept, because it is part of the new index.

…th platforms PR images are linux/amd64 only, so the main build is the first arm64 build of a change. Refs Aam-Digital/internal#392 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Refs Aam-Digital/internal#392 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

sleidig · 2026-10-14T05:53:45Z

Second-commit check (push a81fcf4, the publish gate): the merge job's "Delete replaced images" deleted the previous pr-261 index and both of its children. The package then held only the new pr-261 index and its 2 children for this PR. Later commits add permissions: {} to _module-release.yml (every caller and the called workflow now has a top-level permissions).

…BUILD_SECRETS Same as before the move: release and main builds get SENTRY_UPLOAD_SOURCES=true and the sentry_auth_token build secret, pull requests (including forks) neither. Refs Aam-Digital/internal#392 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

The shared docker-image workflow no longer deletes replaced images itself; pr-image-cleanup now deletes untagged images older than 2 days (Aam-Digital/.github#1). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…prereleases Uses the shared edge-version workflow (Aam-Digital/.github#1): version <last release, patch + 1>-edge.<commits since>, tagged `edge` too while it is the newest commit. Edge images of a finished cycle are pruned after the next full release. The shared release workflow no longer takes `type`. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

…ombined image-cleanup.yml) - image-prune.yml and pr-image-cleanup.yml are now one image-cleanup.yml (`tags` instead of `tag-patterns`; callers grant `actions: write` too). - docker-image.yml builds every platform on a native runner: check names are now `<job> / build (<platform>)` and `<job> / merge`, and the `native-runners` input is gone. - The `org.opencontainers.image.version` label of PR images is set by the shared workflow from the first tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Aam-Digital/.github#1 is merged and tagged `v1`; its branch is deleted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

sleidig and others added 4 commits October 13, 2026 22:43

ci: lint PR titles and workflows with the shared org workflows

662f49e

Refs Aam-Digital/internal#392 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

chore(renovate): extend the shared org preset

60e202d

Keeps the repo-specific managers and the jvm-toolchain, keycloak and carbone rules. Refs Aam-Digital/internal#392 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

sleidig and others added 2 commits October 13, 2026 22:56

ci: release aam-backend-service only after the main image built on bo…

a81fcf4

…th platforms PR images are linux/amd64 only, so the main build is the first arm64 build of a change. Refs Aam-Digital/internal#392 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

ci: set top-level permissions on the module release workflow

a6fe274

Refs Aam-Digital/internal#392 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

sleidig and others added 5 commits October 14, 2026 08:04

ci: call the shared workflows at @v1

05a2386

Aam-Digital/.github#1 is merged and tagged `v1`; its branch is deleted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

sleidig merged commit 9a9cd6a into main Oct 20, 2026
16 checks passed

sleidig deleted the ci/shared-workflows branch October 20, 2026 09:48

sleidig mentioned this pull request Oct 20, 2026

docs(agents): point to the organisation's issue templates #266

Merged

Navigation Menu

Repository navigation

ci: use the shared org workflows for image builds, PR image cleanup, PR-title lint and actionlint - #261

ci: use the shared org workflows for image builds, PR image cleanup, PR-title lint and actionlint#261
sleidig merged 11 commits into
mainfrom
ci/shared-workflows

sleidig commented Oct 13, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading

Review skipped

Uh oh!

sleidig commented Oct 13, 2026

Uh oh!

sleidig commented Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

sleidig commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Required checks

Testing

Uh oh!

coderabbitai Bot commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

sleidig commented Oct 13, 2026

Verification of the PR image

Uh oh!

sleidig commented Oct 14, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

sleidig commented Oct 13, 2026 •

edited

Loading

coderabbitai Bot commented Oct 13, 2026 •

edited

Loading