Skip to content

Commit fd45cda

Browse files
WuodanWuodan
committed
chore(ci): add test and release workflows
1 parent b78c9a9 commit fd45cda

5 files changed

Lines changed: 211 additions & 14 deletions

File tree

‎.github/workflows/ci_lint.yml‎

Lines changed: 16 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,8 @@
11
name: "CI: lint"
22

3-
"on":
3+
on:
44
workflow_call:
55
workflow_dispatch:
6-
push:
7-
branches:
8-
- main
9-
10-
concurrency:
11-
group: >-
12-
${{ github.workflow }}-${{ github.ref }}${{
13-
github.event_name == 'workflow_dispatch' && '-manual-' || ''
14-
}}${{
15-
github.event_name == 'workflow_dispatch' && github.run_id || ''
16-
}}
17-
cancel-in-progress: true
186

197
permissions:
208
contents: read
@@ -28,7 +16,6 @@ jobs:
2816
- name: Checkout
2917
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
3018
with:
31-
token: ${{ secrets.PAT || github.token }}
3219
fetch-depth: 0
3320
persist-credentials: false
3421

@@ -52,3 +39,18 @@ jobs:
5239
MEGALINTER_USER: ${{ env.MEGALINTER_USER }}
5340
# shfmt shall prefer 2 spaces to indent not tabs
5441
BASH_SHFMT_ARGUMENTS: -indent 2 -case-indent
42+
43+
ensure-immutable-actions:
44+
name: Run ensure-immutable-actions
45+
runs-on: ubuntu-latest
46+
steps:
47+
- name: Checkout
48+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
49+
with:
50+
persist-credentials: false
51+
52+
- name: Ensure workflow actions use immutable refs
53+
uses: joshjohanning/ensure-immutable-actions@9f5dad6bb6148bd29ff0d874de6a8cc70af08fa9 # v2.6.2
54+
with:
55+
include-first-party: "true"
56+
write-job-summary: "on-failure-only"

‎.github/workflows/ci_publish-image.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
name: "CI: publish image"
2+
3+
on:
4+
workflow_call:
5+
6+
permissions:
7+
contents: read
8+
packages: write
9+
id-token: write
10+
11+
jobs:
12+
publish-image:
13+
name: Publish OCI image
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout
17+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
18+
with:
19+
persist-credentials: false
20+
21+
- name: Install Cosign
22+
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
23+
24+
- name: Set up Docker Buildx
25+
uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
26+
27+
- name: Log in to GHCR
28+
uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
29+
with:
30+
registry: ghcr.io
31+
username: ${{ github.actor }}
32+
password: ${{ github.token }}
33+
34+
- name: Build and push image
35+
id: build-push
36+
uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
37+
with:
38+
context: .
39+
file: ./Dockerfile
40+
push: true
41+
provenance: mode=max
42+
tags: |
43+
ghcr.io/${{ github.repository }}:${{ github.ref_name }}
44+
ghcr.io/${{ github.repository }}:latest
45+
46+
- name: Sign image
47+
env:
48+
IMAGE_DIGEST: ${{ steps.build-push.outputs.digest }}
49+
run: |
50+
set -euo pipefail
51+
cosign sign --yes "ghcr.io/${GITHUB_REPOSITORY}@${IMAGE_DIGEST}"

‎.github/workflows/ci_release.yml‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
name: "CI: Release"
2+
3+
on:
4+
push:
5+
tags:
6+
- "v*.*.*"
7+
8+
permissions:
9+
contents: read
10+
11+
jobs:
12+
validation:
13+
uses: ./.github/workflows/ci_validation.yml
14+
15+
verify-release-refs:
16+
name: Verify release references
17+
if: startsWith(github.ref, 'refs/tags/')
18+
runs-on: ubuntu-latest
19+
steps:
20+
- name: Checkout
21+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
22+
with:
23+
persist-credentials: false
24+
25+
- name: Verify release tag points to main
26+
run: |
27+
set -euo pipefail
28+
git fetch origin main:refs/remotes/origin/main
29+
if ! git merge-base --is-ancestor "$GITHUB_SHA" "origin/main"; then
30+
echo "Release tag ${GITHUB_REF_NAME} must point to a commit on origin/main." >&2
31+
exit 1
32+
fi
33+
34+
- name: Verify image refs use current release
35+
run: |
36+
set -euo pipefail
37+
if grep -RInP "ghcr\.io/${GITHUB_REPOSITORY,,}:v(?!${GITHUB_REF_NAME#v}\b)\S*" .
38+
then
39+
echo "Found image refs not pinned to ${GITHUB_REF_NAME}" >&2
40+
exit 1
41+
fi
42+
43+
- name: Verify changelog contains the release version
44+
run: |
45+
set -euo pipefail
46+
if ! grep -q "^## \\[${GITHUB_REF_NAME}\\] - " CHANGELOG.md; then
47+
echo "CHANGELOG.md must contain a release heading for ${GITHUB_REF_NAME}." >&2
48+
exit 1
49+
fi
50+
51+
publish-image:
52+
needs:
53+
- validation
54+
- verify-release-refs
55+
uses: ./.github/workflows/ci_publish-image.yml
56+
permissions:
57+
contents: read
58+
packages: write
59+
id-token: write
60+
61+
release:
62+
name: Publish GitHub release
63+
needs:
64+
- validation
65+
- verify-release-refs
66+
- publish-image
67+
if: startsWith(github.ref, 'refs/tags/')
68+
runs-on: ubuntu-latest
69+
permissions:
70+
actions: write
71+
contents: write
72+
steps:
73+
- name: Checkout
74+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
75+
with:
76+
persist-credentials: false
77+
78+
- name: Install Cosign
79+
uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
80+
81+
- name: Keyless-sign container-host-user
82+
run: |
83+
set -euo pipefail
84+
cosign sign-blob --yes \
85+
--bundle ${{ runner.temp }}/container-host-user.sigstore.json \
86+
bin/container-host-user
87+
88+
- name: Create GitHub release
89+
env:
90+
GH_TOKEN: ${{ github.token }}
91+
run: |
92+
set -euo pipefail
93+
gh release create "${GITHUB_REF_NAME}" \
94+
--title "Release ${GITHUB_REF_NAME}" \
95+
--generate-notes \
96+
bin/container-host-user \
97+
"${RUNNER_TEMP}/container-host-user.sigstore.json"

‎.github/workflows/ci_test.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: "CI: test"
2+
3+
on:
4+
workflow_call:
5+
workflow_dispatch:
6+
7+
permissions:
8+
contents: read
9+
10+
jobs:
11+
test:
12+
name: Run tests
13+
runs-on: ubuntu-latest
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
17+
with:
18+
persist-credentials: false
19+
20+
- name: Set up Bats
21+
uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43 # 4.0.0
22+
23+
- name: Run tests
24+
run: ./tests/run.sh

‎.github/workflows/ci_validation.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: "CI: validation"
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches:
7+
- main
8+
workflow_call:
9+
workflow_dispatch:
10+
11+
concurrency:
12+
group: validation-${{ github.event.pull_request.head.ref || github.ref_name }}
13+
cancel-in-progress: true
14+
15+
permissions:
16+
contents: read
17+
18+
jobs:
19+
lint:
20+
uses: ./.github/workflows/ci_lint.yml
21+
22+
test:
23+
uses: ./.github/workflows/ci_test.yml

0 commit comments

Comments
 (0)