containers/.github/workflows/pull-request.yaml at main · home-operations/containers · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
---
# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
name: Pull Request

on:
  merge_group:
  pull_request:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  prepare:
    name: Prepare
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    outputs:
      changed-files: ${{ steps.changed-files.outputs.changed_files }}
    steps:
      - name: Get changed files
        uses: bjw-s-labs/action-changed-files@a9a36fb08ce06db9b02fbd8026cc2c0945eb9841 # v0.6.0
        id: changed-files
        with:
          path: apps
          include_only_directories: true
          max_depth: 1

  go-check:
    name: Go Compile & Vet
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Mise
        uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
        with:
          experimental: true
          install_args: --locked

      - name: Restore Go Modules
        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
        with:
          path: |
            ~/.cache/go-build
            ~/go/pkg/mod
          key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}

      - name: Compile tests
        run: go test -run='^$' ./...

      - name: Vet
        run: go vet ./...

  hadolint:
    name: Hadolint
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Mise
        uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
        with:
          experimental: true
          install_args: --locked

      - name: Hadolint
        run: git ls-files -z '*Dockerfile' | xargs -0 -r hadolint

  build:
    if: ${{ needs.prepare.outputs.changed-files != '[]' }}
    name: Build ${{ matrix.app }}
    needs:
      - prepare
    uses: $/.github/workflows/app-builder.yaml
    permissions:
      attestations: write
      contents: read
      id-token: write
      packages: write
    strategy:
      matrix:
        app: ${{ fromJSON(needs.prepare.outputs.changed-files) }}
      fail-fast: false
      max-parallel: 4
    with:
      app: ${{ matrix.app }}
      release: false

  workflow-lint:
    name: Workflow Lint
    runs-on: ubuntu-24.04
    permissions:
      contents: read
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Setup Mise
        uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
        with:
          install: false

      - name: Resolve linter versions
        id: tools
        run: |
          echo "actionlint=$(mise config get tools.actionlint)" >> "$GITHUB_OUTPUT"
          echo "zizmor=$(mise config get tools.zizmor)" >> "$GITHUB_OUTPUT"

      - name: Lint workflows
        uses: home-operations/.github/actions/workflow-lint@69cad1e407df8070dd9cfc3314551e473544014e # workflow-lint-v1.0.3
        with:
          actionlint-version: ${{ steps.tools.outputs.actionlint }}
          zizmor-version: ${{ steps.tools.outputs.zizmor }}

  status:
    if: ${{ !cancelled() }}
    name: Build Success
    needs:
      - build
      - go-check
      - hadolint
      - prepare
      - workflow-lint
    runs-on: ubuntu-24.04
    permissions: {}
    steps:
      # cancelled counts as failed: !cancelled() above still runs this job when
      # individual needs were cancelled but the run was not, and a required job
      # that never reached a verdict must not clear the merge gate.
      - name: Any jobs failed?
        if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
        run: |
          exit 1

      - name: All jobs passed or skipped?
        if: ${{ !(contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}
        run: |
          echo "All jobs passed or skipped" && echo "${{ toJSON(needs.*.result) }}"