Skip to content

Commit 62ed33e

Browse files
nicholas-fedornicholas-fedor
committed
ci: optimize CI/CD pipelines and workflows
- Refactor workflows to use composite actions for reusability - Integrate security checks into PR pipeline - Optimize cache handling and trigger conditions - Update permissions and runner configurations - Parallelize release post-build tasks - Resolve SBOM upload warnings and Windows runner notices
1 parent f975ad8 commit 62ed33e

File tree

16 files changed

+182
-72
lines changed

16 files changed

+182
-72
lines changed

‎.github/actions/actionlint/action.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: "Actionlint"
2+
description: "Lint GitHub Actions workflows"
3+
4+
runs:
5+
using: "composite"
6+
steps:
7+
- name: Download actionlint
8+
id: get_actionlint
9+
run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
10+
shell: bash
11+
- name: Check workflow files
12+
run: ${{ steps.get_actionlint.outputs.executable }} -color
13+
shell: bash

‎.github/actions/checkout/action.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
name: "Checkout"
2+
description: "Checkout repository code"
3+
4+
inputs:
5+
fetch-depth:
6+
description: "Number of commits to fetch"
7+
required: false
8+
default: "1"
9+
10+
runs:
11+
using: "composite"
12+
steps:
13+
- uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
14+
with:
15+
fetch-depth: ${{ inputs.fetch-depth }}

‎.github/actions/clean-cache/action.yml‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
name: "Clean Cache"
2+
description: "Clean GitHub Actions cache for a PR branch"
3+
4+
runs:
5+
using: "composite"
6+
steps:
7+
- name: Clean cache
8+
run: |
9+
echo "Fetching list of cache key"
10+
cacheKeysForPR=$(gh cache list --ref "$BRANCH" --limit 100 --json id --jq '.[].id')
11+
12+
## Setting this to not fail the workflow while deleting cache keys.
13+
set +e
14+
echo "Deleting caches..."
15+
for cacheKey in $cacheKeysForPR
16+
do
17+
gh cache delete "$cacheKey"
18+
done
19+
echo "Done"
20+
shell: bash
21+
env:
22+
GH_TOKEN: ${{ inputs.gh-token }}
23+
GH_REPO: ${{ inputs.gh-repo }}
24+
BRANCH: ${{ inputs.branch }}

‎.github/actions/docker-login/action.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: "Docker Login"
2+
description: "Login to Docker registries"
3+
4+
runs:
5+
using: "composite"
6+
steps:
7+
- name: Login to Docker Hub
8+
uses: docker/login-action@5b7b28b1cc417bbd34cd8c225a957c9ce9adf7f2
9+
with:
10+
username: ${{ inputs.dockerhub-username }}
11+
password: ${{ inputs.dockerhub-token }}
12+
- name: Login to GHCR
13+
uses: docker/login-action@5b7b28b1cc417bbd34cd8c225a957c9ce9adf7f2
14+
with:
15+
registry: ghcr.io
16+
username: ${{ inputs.ghcr-username }}
17+
password: ${{ inputs.ghcr-token }}
18+
19+
inputs:
20+
dockerhub-username:
21+
description: "Docker Hub username"
22+
required: true
23+
dockerhub-token:
24+
description: "Docker Hub token"
25+
required: true
26+
ghcr-username:
27+
description: "GHCR username"
28+
required: true
29+
ghcr-token:
30+
description: "GHCR token"
31+
required: true

‎.github/actions/gosec/action.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
name: "Golang Security Checker"
2+
description: "Run Gosec security scanner and upload SARIF report"
3+
4+
runs:
5+
using: "composite"
6+
steps:
7+
- name: Checkout Source
8+
uses: ./.github/actions/checkout
9+
- name: Run Gosec Security Scanner
10+
uses: securego/gosec@506407e7dfe6979d514d362f0b2d2ea77f49f5c8
11+
with:
12+
args: "-no-fail -fmt sarif -out results.sarif -tests ./..."
13+
- name: Upload SARIF file
14+
uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3
15+
with:
16+
sarif_file: results.sarif

‎.github/actions/govulncheck/action.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: "govulncheck"
2+
description: "Run govulncheck vulnerability scanner and upload SARIF report"
3+
4+
inputs:
5+
go-version:
6+
description: "Go version to use"
7+
required: false
8+
default: "1.25.x"
9+
10+
runs:
11+
using: "composite"
12+
steps:
13+
- id: govulncheck
14+
uses: nicholas-fedor/govulncheck-action@1e9ef2cbd93abefcc8605e05f8c212aa90181f6f
15+
with:
16+
output-format: sarif
17+
output-file: results.sarif
18+
go-version-input: ${{ inputs.go-version }}
19+
- name: Upload SARIF file
20+
uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3
21+
with:
22+
sarif_file: results.sarif

‎.github/workflows/build.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ jobs:
105105
with:
106106
name: ${{ inputs.build-type }}-binary-sboms
107107
path: dist/*.sbom
108-
if-no-files-found: warn
108+
if-no-files-found: ignore
109109

110110
- name: Generate artifact attestation # Generate attestations for prod builds.
111111
if: ${{ !inputs.dry-run && inputs.build-type == 'prod' }}

‎.github/workflows/clean-cache.yaml‎

Lines changed: 6 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -11,22 +11,11 @@ permissions:
1111

1212
jobs:
1313
cleanup:
14+
if: github.event.pull_request.merged
1415
runs-on: ubuntu-latest
1516
steps:
16-
- name: Cleanup
17-
run: |
18-
echo "Fetching list of cache key"
19-
cacheKeysForPR=$(gh cache list --ref "$BRANCH" --limit 100 --json id --jq '.[].id')
20-
21-
## Setting this to not fail the workflow while deleting cache keys.
22-
set +e
23-
echo "Deleting caches..."
24-
for cacheKey in $cacheKeysForPR
25-
do
26-
gh cache delete "$cacheKey"
27-
done
28-
echo "Done"
29-
env:
30-
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
31-
GH_REPO: ${{ github.repository }}
32-
BRANCH: refs/pull/${{ github.event.pull_request.number }}/merge
17+
- uses: ./.github/actions/clean-cache
18+
with:
19+
gh-token: ${{ secrets.GITHUB_TOKEN }}
20+
gh-repo: ${{ github.repository }}
21+
branch: refs/pull/${{ github.event.pull_request.number }}/merge

‎.github/workflows/create-manifests.yaml‎

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -29,20 +29,13 @@ jobs:
2929
uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
3030
with:
3131
fetch-depth: 0
32-
33-
- name: Login to Docker Hub
34-
uses: docker/login-action@5b7b28b1cc417bbd34cd8c225a957c9ce9adf7f2
35-
with:
36-
username: ${{ secrets.DOCKERHUB_USERNAME }}
37-
password: ${{ secrets.DOCKERHUB_TOKEN }}
38-
39-
- name: Login to GHCR
40-
uses: docker/login-action@5b7b28b1cc417bbd34cd8c225a957c9ce9adf7f2
32+
- name: Login to registries
33+
uses: ./.github/actions/docker-login
4134
with:
42-
registry: ghcr.io
43-
username: ${{ github.actor }}
44-
password: ${{ github.token }}
45-
35+
dockerhub-username: ${{ secrets.DOCKERHUB_USERNAME }}
36+
dockerhub-token: ${{ secrets.DOCKERHUB_TOKEN }}
37+
ghcr-username: ${{ github.actor }}
38+
ghcr-token: ${{ github.token }}
4639
- name: Create Docker manifests for dev
4740
if: ${{ inputs.build-type == 'dev' }}
4841
run: |
@@ -58,7 +51,6 @@ jobs:
5851
ghcr.io/nicholas-fedor/shoutrrr:armhf-dev \
5952
ghcr.io/nicholas-fedor/shoutrrr:arm64v8-dev \
6053
ghcr.io/nicholas-fedor/shoutrrr:riscv64-dev
61-
6254
- name: Create Docker manifests for prod
6355
if: ${{ inputs.build-type == 'prod' }}
6456
run: |

‎.github/workflows/lint-gh.yaml‎

Lines changed: 3 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,6 @@ jobs:
1919
runs-on: ubuntu-latest
2020
steps:
2121
- name: Checkout
22-
uses: actions/checkout@ff7abcd0c3c05ccf6adc123a8cd1fd4fb30fb493
23-
24-
- name: Download actionlint
25-
id: get_actionlint
26-
run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
27-
shell: bash
28-
29-
- name: Check workflow files
30-
run: ${{ steps.get_actionlint.outputs.executable }} -color
31-
shell: bash
22+
uses: ./.github/actions/checkout
23+
- name: Run actionlint
24+
uses: ./.github/actions/actionlint

0 commit comments

Comments
 (0)