Merge pull request #839 from ptr727/dependabot/github_actions/main/ac… #326
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Test pull request action | |
| # CI for every branch. Runs on push so the reusable tasks resolve from the pushed head: a PR that edits a | |
| # workflow tests its own copy. validate (unit tests + lint) and smoke-build run on every push with no paths | |
| # filter, so a reusable-workflow change is always exercised. The aggregator below is the ruleset required | |
| # status check, produced here on the head SHA. CI never publishes (the publisher runs on schedule/dispatch). | |
| # | |
| # There is deliberately no pull_request trigger: a fork PR cannot push to this repo, so it produces no run | |
| # and cannot satisfy the required check. A maintainer lands such a contribution on an in-repo branch (which | |
| # pushes, and so validates) before merging. This is the documented exception (see WORKFLOW.md). | |
| on: | |
| # All branches, but not tags: release tags must not re-run CI. | |
| push: | |
| branches: ['**'] | |
| workflow_dispatch: | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| # `!github.event.deleted` skips a branch-deletion push (github.sha is all-zeros, so checkout/build fail). | |
| # The same unit-test + lint gate the publisher runs, so the PR gate and the publish gate are identical. | |
| validate: | |
| name: Validate job | |
| if: ${{ !github.event.deleted }} | |
| uses: ./.github/workflows/validate-task.yml | |
| # Thread CODECOV_TOKEN through so the unit-test job can upload coverage. | |
| secrets: inherit | |
| # Build and pack both targets (executable + Docker) to prove they ship, publishing nothing. Docker smoke is | |
| # amd64-only and seeds from the branch-scoped cache, so it stays fast. | |
| smoke-build: | |
| name: Smoke build job | |
| if: ${{ !github.event.deleted }} | |
| uses: ./.github/workflows/build-release-task.yml | |
| secrets: inherit | |
| with: | |
| smoke: true | |
| # Never publish from CI. | |
| github: false | |
| dockerhub: false | |
| branch: ${{ github.ref_name }} | |
| # Single required status check. Its name is the ruleset-bound context in repo-config/ruleset-*.json. Do | |
| # not rename it without updating those in lockstep. Must succeed, not merely not-fail. Skips on a branch | |
| # deletion (when validate/smoke-build also skip), so the deletion push does not fail this required check. | |
| check-workflow-status: | |
| name: Check pull request workflow status job | |
| runs-on: ubuntu-latest | |
| needs: [validate, smoke-build] | |
| if: ${{ always() && !github.event.deleted }} | |
| steps: | |
| - name: Check workflow results step | |
| run: | | |
| set -euo pipefail | |
| for result in "validate:${{ needs.validate.result }}" "smoke-build:${{ needs.smoke-build.result }}"; do | |
| name="${result%%:*}" | |
| value="${result#*:}" | |
| if [[ "$value" != "success" ]]; then | |
| echo "::error::Job '$name' did not succeed ($value)." | |
| exit 1 | |
| fi | |
| done |