Skip to content

Commit 236d975

Browse files
authored
ci: upgraded shared workflows (fixes mono-repo releases) (#173)
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
1 parent fd4d373 commit 236d975

12 files changed

Lines changed: 133 additions & 319 deletions

.github/workflows/auto-merge.yml

Lines changed: 9 additions & 37 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,15 @@
11
name: Dependabot auto-merge
2-
on: pull_request
32

43
permissions:
5-
contents: write
6-
pull-requests: write
4+
contents: read
5+
6+
on:
7+
pull_request:
78

89
jobs:
910
dependabot:
10-
runs-on: ubuntu-latest
11-
if: github.event.pull_request.user.login == 'dependabot[bot]'
12-
steps:
13-
- name: Dependabot metadata
14-
id: metadata
15-
uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
16-
17-
- name: Auto-approve all dependabot PRs
18-
run: gh pr review --approve "$PR_URL"
19-
env:
20-
PR_URL: ${{github.event.pull_request.html_url}}
21-
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
22-
23-
- name: Auto-merge dependabot PRs for development dependencies
24-
if: contains(steps.metadata.outputs.dependency-group, 'development-dependencies')
25-
run: gh pr merge --auto --rebase "$PR_URL"
26-
env:
27-
PR_URL: ${{github.event.pull_request.html_url}}
28-
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
29-
30-
- name: Auto-merge dependabot PRs for go-openapi patches
31-
if: contains(steps.metadata.outputs.dependency-group, 'go-openapi-dependencies') && (steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch')
32-
run: gh pr merge --auto --rebase "$PR_URL"
33-
env:
34-
PR_URL: ${{github.event.pull_request.html_url}}
35-
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
36-
37-
- name: Auto-merge dependabot PRs for golang.org updates
38-
if: contains(steps.metadata.outputs.dependency-group, 'golang-org-dependencies')
39-
run: gh pr merge --auto --rebase "$PR_URL"
40-
env:
41-
PR_URL: ${{github.event.pull_request.html_url}}
42-
GH_TOKEN: ${{secrets.GITHUB_TOKEN}}
43-
11+
permissions:
12+
contents: write
13+
pull-requests: write
14+
uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@565504edebe3ab7f7b4cbafc8d6f401b82e91c4c # v0.2.8
15+
secrets: inherit

.github/workflows/bump-release.yml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
name: Bump Release
2+
3+
permissions:
4+
contents: read
5+
6+
7+
on:
8+
workflow_dispatch:
9+
inputs:
10+
bump-type:
11+
description: Type of bump (patch, minor, major)
12+
type: choice
13+
options:
14+
- patch
15+
- minor
16+
- major
17+
default: patch
18+
required: false
19+
tag-message-title:
20+
description: Tag message title to prepend to the release notes
21+
required: false
22+
type: string
23+
tag-message-body:
24+
description: |
25+
Tag message body to prepend to the release notes.
26+
(use "|" to replace end of line).
27+
required: false
28+
type: string
29+
30+
jobs:
31+
bump-release:
32+
permissions:
33+
contents: write
34+
pull-requests: write
35+
uses: go-openapi/ci-workflows/.github/workflows/bump-release-monorepo.yml@565504edebe3ab7f7b4cbafc8d6f401b82e91c4c # v0.2.8
36+
with:
37+
bump-type: ${{ inputs.bump-type }}
38+
tag-message-title: ${{ inputs.tag-message-title }}
39+
tag-message-body: ${{ inputs.tag-message-body }}
40+
secrets: inherit

.github/workflows/codeql.yml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: "CodeQL"
2+
3+
on:
4+
push:
5+
branches: [ "master" ]
6+
pull_request:
7+
branches: [ "master" ]
8+
paths-ignore: # remove this clause if CodeQL is a required check
9+
- '**/*.md'
10+
schedule:
11+
- cron: '39 19 * * 5'
12+
13+
permissions:
14+
contents: read
15+
16+
jobs:
17+
codeql:
18+
permissions:
19+
contents: read
20+
security-events: write
21+
uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@565504edebe3ab7f7b4cbafc8d6f401b82e91c4c # v0.2.8
22+
secrets: inherit

.github/workflows/contributors.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: Contributors
2+
3+
on:
4+
schedule:
5+
- cron: '18 4 * * 6'
6+
7+
workflow_dispatch:
8+
9+
permissions:
10+
contents: read
11+
12+
jobs:
13+
contributors:
14+
permissions:
15+
pull-requests: write
16+
contents: write
17+
uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@565504edebe3ab7f7b4cbafc8d6f401b82e91c4c # v0.2.8
18+
secrets: inherit

.github/workflows/go-test.yml

Lines changed: 5 additions & 197 deletions
Original file line numberDiff line numberDiff line change
@@ -1,211 +1,19 @@
11
name: go test
22

33
permissions:
4-
contents: read
54
pull-requests: read
5+
contents: read
66

77
on:
88
push:
9-
tags:
10-
- v*
119
branches:
1210
- master
1311

1412
pull_request:
1513

1614
jobs:
17-
lint:
18-
name: Go lint mono-repo
19-
runs-on: ubuntu-latest
20-
steps:
21-
-
22-
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
23-
with:
24-
fetch-depth: '0'
25-
-
26-
uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
27-
with:
28-
go-version: stable
29-
check-latest: true
30-
cache: true
31-
cache-dependency-path: '**/go.sum'
32-
-
33-
name: Install golangci-lint
34-
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
35-
with:
36-
version: latest
37-
skip-cache: true
38-
install-only: true
39-
-
40-
name: Lint multiple modules
41-
# golangci-lint doesn't support go.work to lint multiple modules in one single pass
42-
run: |
43-
set -euxo pipefail
44-
45-
git fetch origin master
46-
git show --no-patch --oneline origin/master
47-
48-
while read module_location ; do
49-
pushd "${module_location}"
50-
golangci-lint run --new-from-rev origin/master
51-
popd
52-
done < <(go list -f '{{.Dir}}' -m)
53-
54-
module-test:
55-
name: Unit tests
56-
runs-on: ${{ matrix.os }}
57-
needs: [ lint ]
58-
59-
strategy:
60-
matrix:
61-
os: [ ubuntu-latest, macos-latest, windows-latest ]
62-
go_version: ['oldstable', 'stable' ]
63-
env:
64-
TEST_REPORT: 'all_modules.report.${{ matrix.os }}.${{ matrix.go_version }}.json'
65-
66-
steps:
67-
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
68-
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
69-
with:
70-
go-version: '${{ matrix.go_version }}'
71-
check-latest: true
72-
cache: true
73-
cache-dependency-path: '**/go.sum'
74-
75-
- name: Run unit tests on all modules in this repo
76-
shell: bash
77-
env:
78-
# *.coverage.* pattern is automatically detected by codecov
79-
COVER_PROFILE: 'all_modules.coverage.${{ matrix.os }}.${{ matrix.go_version }}.out'
80-
run: |
81-
# when go1.25 becomes the oldstable, we may replace this bash with "go test work"
82-
declare -a ALL_MODULES
83-
BASH_MAJOR=$(echo $BASH_VERSION|cut -d'.' -f1)
84-
if [[ "${BASH_MAJOR}" -ge 4 ]] ; then
85-
mapfile ALL_MODULES < <(go list -f '{{.Dir}}/...' -m)
86-
else
87-
# for older bash versions, e.g. on macOS runner. This fallback will eventually disappear.
88-
while read line ; do
89-
ALL_MODULES+=("${line}")
90-
done < <(go list -f '{{.Dir}}/...' -m)
91-
fi
92-
echo "::notice title=Modules found::${ALL_MODULES[@]}"
93-
94-
# with go.work file enabled, go test recognizes sub-modules and collects all packages to be covered
95-
# without specifying -coverpkg.
96-
go test -race -coverprofile="${COVER_PROFILE}" -covermode=atomic -json ${ALL_MODULES[@]}|tee -a "${TEST_REPORT}"
97-
98-
- name: Upload coverage to codecov
99-
if: ${{ success() }} # we do this only if all previous steps succeeded
100-
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
101-
with:
102-
name: Multi modules aggregated coverage
103-
flags: '${{ matrix.go_version }}-${{ matrix.os }}'
104-
fail_ci_if_error: false
105-
verbose: false
106-
107-
- name: Upload JSON test Results
108-
if: always()
109-
uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
110-
with:
111-
name: 'all_modules.report.${{ matrix.os }}.${{ matrix.go_version }}'
112-
path: ${{ env.TEST_REPORT }}
113-
11415
test:
115-
needs: [ module-test ]
116-
name: Test
117-
runs-on: ubuntu-latest
118-
steps:
119-
- name: Tests complete
120-
run: |
121-
echo "::notice title=Success::All tests completed"
122-
123-
collect-reports:
124-
if: always()
125-
needs: [ module-test ]
126-
name: Collect and merge test reports
127-
runs-on: ubuntu-latest
128-
steps:
129-
- uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
130-
with:
131-
go-version: stable
132-
check-latest: true
133-
cache: true
134-
135-
- name: Download all JSON artifacts
136-
uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
137-
with:
138-
run-id: "${{ github.run_id }}"
139-
pattern: "all_modules.report.*"
140-
# artifacts resolve as folders
141-
path: reports/
142-
143-
- name: Convert test reports to a merged JUnit XML
144-
# NOTE: codecov test reports only support JUnit format at this moment. See https://docs.codecov.com/docs/test-analytics.
145-
# Ideally, codecov improve a bit their platform, so we may only need a single pass to CTRF format.
146-
#
147-
# As a contemplated alternative, we could use gotestsum above to produce the JUnit XML directly.
148-
run: |
149-
go install github.com/jstemmer/go-junit-report/v2@latest
150-
cat reports/*/*.json | go-junit-report -parser gojson -out=reports/junit_report.xml
151-
152-
- name: Upload test results to Codecov
153-
if: always()
154-
uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
155-
with:
156-
files: '**/junit_report.xml'
157-
report_type: 'test_results'
158-
fail_ci_if_error: false
159-
handle_no_reports_found: true
160-
verbose: true
161-
162-
- name: Convert test reports to CTRF JSON
163-
run: |
164-
go install github.com/ctrf-io/go-ctrf-json-reporter/cmd/go-ctrf-json-reporter@v0.0.10
165-
166-
appName="swag"
167-
buildNumber="${{ github.run_id }}"
168-
appVersion="${{ github.event.pull_request.head.sha }}"
169-
170-
while read report ; do
171-
echo "::notice::converting report: ${report}"
172-
#TEST_REPORT: 'all_modules.report.${{ matrix.os }}.${{ matrix.go_version }}.json'
173-
reformated=$(echo "${report##*/}"|sed -E 's/(go)([[:digit:]]+)\.([[:digit:]]+)/\1\2\3/') # e.g. go1.24 becomes go124
174-
mapfile -d'.' -t -s 2 -n 2 split < <(echo $reformated) # skip the first 2 parts, stop on 2 more parts
175-
osPlatform="${split[0]}"
176-
osRelease="${split[1]}"
177-
178-
go-ctrf-json-reporter \
179-
-verbose \
180-
-appName "${appName}" \
181-
-appVersion "${appVersion}" \
182-
-buildNumber "${buildNumber}" \
183-
-osPlatform "${osPlatform}" \
184-
-osRelease "${osRelease}" \
185-
-output "./reports/ctrf_report_${osPlatform}_${osRelease}.json" \
186-
-quiet < "${report}"
187-
done < <(find reports -name \*.json)
188-
189-
# NOTE: at this moment, we don't upload CTRF reports as artifacts.
190-
# Some of the CTRF reports are therefore not available (flaky tests, history, ...).
191-
#
192-
# See https://github.com/ctrf-io/github-test-reporter?tab=readme-ov-file#report-showcase
193-
# for more reporting possibilities. At the moment, we keep it simple, as most advanced features
194-
# require a github token (thus adding the complexity of a separate workflow starting on pull_request_target).
195-
#
196-
# For the moment, we are contented with these simple reports. This is an opportunity to compare the insight they
197-
# provide as compared to what is uploaded to codecov.
198-
#
199-
# Codecov analytics are pretty poor at this moment. On the other hand, they manage the bot that pushes back
200-
# PR comments.
201-
#
202-
# They also handle the storage of past test reports, so as to assess flaky tests.
203-
- name: Publish Test Summary Results
204-
uses: ctrf-io/github-test-reporter@024bc4b64d997ca9da86833c6b9548c55c620e40 # v1.0.26
205-
with:
206-
report-path: 'reports/ctrf_report_*.json'
207-
use-suite-name: true
208-
summary-report: true # post a report to the github actions summary
209-
github-report: true
210-
failed-folded-report: true
211-
16+
uses: go-openapi/ci-workflows/.github/workflows/go-test-monorepo.yml@565504edebe3ab7f7b4cbafc8d6f401b82e91c4c # v0.2.8
17+
with:
18+
extra-flags: '-tags testcgo,testcolorized' # (1) this is to trigger extra tests in spew, (2) this is to enable integration test for colorized output
19+
secrets: inherit

.github/workflows/scanner.yml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: Vulnerability scans
2+
3+
on:
4+
branch_protection_rule:
5+
push:
6+
branches: ["master"]
7+
schedule:
8+
- cron: "18 4 * * 3"
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
scanners:
15+
permissions:
16+
contents: read
17+
security-events: write
18+
uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@565504edebe3ab7f7b4cbafc8d6f401b82e91c4c # v0.2.8
19+
secrets: inherit

.github/workflows/tag-release.yml

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: Release on tag
2+
3+
permissions:
4+
contents: read
5+
6+
on:
7+
push:
8+
tags:
9+
- v[0-9]+*
10+
11+
jobs:
12+
gh-release:
13+
name: Create release
14+
permissions:
15+
contents: write
16+
uses: go-openapi/ci-workflows/.github/workflows/release.yml@565504edebe3ab7f7b4cbafc8d6f401b82e91c4c # v0.2.8
17+
with:
18+
tag: ${{ github.ref_name }}
19+
is-monorepo: true
20+
secrets: inherit

hack/.gitkeep

Whitespace-only changes.

0 commit comments

Comments
 (0)