|
| 1 | +# This file is synced with stordco/common-config-elixir. Any changes will be overwritten. |
| 2 | + |
1 | 3 | name: CI
|
2 | 4 |
|
3 | 5 | on:
|
| 6 | + merge_group: |
4 | 7 | pull_request:
|
5 | 8 | types:
|
6 | 9 | - opened
|
7 | 10 | - reopened
|
8 | 11 | - synchronize
|
9 |
| - merge_group: |
| 12 | + push: |
| 13 | + branches: |
| 14 | + - main |
| 15 | + - code-freeze/** |
10 | 16 | workflow_call:
|
11 | 17 | secrets:
|
| 18 | + CI_SERVICE_KEY: |
| 19 | + required: true |
12 | 20 | GH_PERSONAL_ACCESS_TOKEN:
|
13 | 21 | required: true
|
14 | 22 | HEX_API_KEY:
|
15 | 23 | required: true
|
16 | 24 | workflow_dispatch:
|
17 | 25 |
|
| 26 | +concurrency: |
| 27 | + group: ${{ github.head_ref || github.run_id }} |
| 28 | + cancel-in-progress: true |
| 29 | + |
18 | 30 | jobs:
|
| 31 | + Changed: |
| 32 | + name: Changed Files |
| 33 | + runs-on: ubuntu-latest |
| 34 | + |
| 35 | + outputs: |
| 36 | + database: ${{ steps.changed.outputs.database }} |
| 37 | + docker: ${{ steps.changed.outputs.docker }} |
| 38 | + # Note: temporarily disabling documentation/OpenAPI validation in CI until a long term solution is found |
| 39 | + # documentation: ${{ steps.changed.outputs.documentation }} |
| 40 | + elixir: ${{ steps.changed.outputs.elixir }} |
| 41 | + helm: ${{ steps.changed.outputs.helm }} |
| 42 | + |
| 43 | + steps: |
| 44 | + - name: Checkout |
| 45 | + uses: actions/checkout@v4 |
| 46 | + with: |
| 47 | + fetch-depth: 2 |
| 48 | + |
| 49 | + - id: changed |
| 50 | + name: Get Changed Files |
| 51 | + run: | |
| 52 | + # Using fetch-depth 2 above, we should always be able to get the full list of changes files: |
| 53 | + # - In a pull-request, GHA merges the PR branch into main |
| 54 | + # - When pushed to main, we always squash merge, so there is only one new commit |
| 55 | +
|
| 56 | + CHANGED_FILES=$(git diff --name-only HEAD^1 HEAD) |
| 57 | +
|
| 58 | + declare -A patterns |
| 59 | + patterns["database"]=".github/workflows/ci.yaml priv/.*repo/.*" |
| 60 | + patterns["docker"]=".github/workflows/ci.yaml Dockerfile" |
| 61 | + patterns["documentation"]="docs/.* priv/documentation/.* .*.ex .*.md" |
| 62 | + patterns["elixir"]=".github/workflows/ci.yaml .tool-versions priv/.* .*.ex .*.exs .*.heex" |
| 63 | + patterns["helm"]=".github/workflows/ci.yaml .github/workflows/staging.yaml .github/workflows/production.yaml helm/.*" |
| 64 | +
|
| 65 | + for filetype in ${!patterns[@]}; do |
| 66 | + found="false" |
| 67 | + echo "==> Checking: $filetype" |
| 68 | + for pattern in ${patterns[$filetype]}; do |
| 69 | + for changed_file in $CHANGED_FILES; do |
| 70 | + if [[ "$changed_file" =~ $pattern ]]; then |
| 71 | + echo "====> Found change: $changed_file" |
| 72 | + found="true" |
| 73 | + break |
| 74 | + fi |
| 75 | + done |
| 76 | + if [[ "$found" == "true" ]]; then |
| 77 | + break |
| 78 | + fi |
| 79 | + done |
| 80 | + echo "$filetype=$found" >> $GITHUB_OUTPUT |
| 81 | + done |
| 82 | +
|
19 | 83 | Credo:
|
| 84 | + if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }} |
| 85 | + needs: [Changed] |
20 | 86 | runs-on: ubuntu-latest
|
21 | 87 |
|
22 | 88 | steps:
|
23 | 89 | - name: Checkout
|
24 |
| - uses: actions/checkout@v3 |
| 90 | + uses: actions/checkout@v4 |
25 | 91 |
|
26 | 92 | - name: Setup Elixir
|
27 | 93 | uses: stordco/actions-elixir/setup@v1
|
28 | 94 | with:
|
29 | 95 | github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
30 | 96 | hex-token: ${{ secrets.HEX_API_KEY }}
|
| 97 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 98 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
31 | 99 |
|
32 | 100 | - name: Credo
|
33 |
| - run: mix credo |
| 101 | + run: mix credo --strict |
34 | 102 |
|
35 |
| - Deps: |
| 103 | + Dependencies: |
| 104 | + if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }} |
| 105 | + needs: [Changed] |
36 | 106 | runs-on: ubuntu-latest
|
37 | 107 |
|
| 108 | + env: |
| 109 | + MIX_ENV: test |
| 110 | + |
38 | 111 | steps:
|
39 | 112 | - name: Checkout
|
40 |
| - uses: actions/checkout@v3 |
| 113 | + uses: actions/checkout@v4 |
41 | 114 |
|
42 | 115 | - name: Setup Elixir
|
43 | 116 | uses: stordco/actions-elixir/setup@v1
|
44 | 117 | with:
|
45 | 118 | github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
46 | 119 | hex-token: ${{ secrets.HEX_API_KEY }}
|
| 120 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 121 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
47 | 122 |
|
48 | 123 | - name: Unused
|
49 | 124 | run: mix deps.unlock --check-unused
|
50 | 125 |
|
51 | 126 | Dialyzer:
|
| 127 | + if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }} |
| 128 | + needs: [Changed] |
52 | 129 | runs-on: ubuntu-latest
|
53 | 130 |
|
54 | 131 | steps:
|
55 | 132 | - name: Checkout
|
56 |
| - uses: actions/checkout@v3 |
| 133 | + uses: actions/checkout@v4 |
57 | 134 |
|
58 | 135 | - name: Setup Elixir
|
59 | 136 | uses: stordco/actions-elixir/setup@v1
|
60 | 137 | with:
|
61 | 138 | github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
62 | 139 | hex-token: ${{ secrets.HEX_API_KEY }}
|
| 140 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 141 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
63 | 142 |
|
64 | 143 | - name: Dialyzer
|
65 | 144 | run: mix dialyzer --format github
|
66 | 145 |
|
67 |
| - Docs: |
| 146 | + Documentation: |
| 147 | + if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.documentation == 'true' }} |
| 148 | + needs: [Changed] |
68 | 149 | runs-on: ubuntu-latest
|
69 | 150 |
|
| 151 | + env: |
| 152 | + MIX_ENV: test |
| 153 | + |
70 | 154 | steps:
|
71 | 155 | - name: Checkout
|
72 |
| - uses: actions/checkout@v3 |
| 156 | + uses: actions/checkout@v4 |
73 | 157 |
|
74 | 158 | - name: Setup Elixir
|
75 | 159 | uses: stordco/actions-elixir/setup@v1
|
76 | 160 | with:
|
77 | 161 | github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
78 | 162 | hex-token: ${{ secrets.HEX_API_KEY }}
|
| 163 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 164 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
79 | 165 |
|
80 | 166 | - name: Docs
|
81 | 167 | run: mix docs
|
82 | 168 |
|
83 | 169 | Format:
|
| 170 | + if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }} |
| 171 | + needs: [Changed] |
84 | 172 | runs-on: ubuntu-latest
|
85 | 173 |
|
86 | 174 | steps:
|
87 | 175 | - name: Checkout
|
88 |
| - uses: actions/checkout@v3 |
| 176 | + uses: actions/checkout@v4 |
89 | 177 |
|
90 | 178 | - name: Setup Elixir
|
91 | 179 | uses: stordco/actions-elixir/setup@v1
|
92 | 180 | with:
|
93 | 181 | github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
94 | 182 | hex-token: ${{ secrets.HEX_API_KEY }}
|
| 183 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 184 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
95 | 185 |
|
96 | 186 | - name: Format
|
97 | 187 | run: mix format --check-formatted
|
98 | 188 |
|
99 | 189 | Test:
|
| 190 | + name: Test (Elixir ${{ matrix.versions.elixir }} OTP ${{ matrix.versions.otp }}) |
| 191 | + |
100 | 192 | runs-on: ubuntu-latest
|
101 | 193 |
|
102 | 194 | env:
|
103 |
| - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
104 | 195 | MIX_ENV: test
|
105 | 196 |
|
| 197 | + |
106 | 198 | steps:
|
107 | 199 | - name: Checkout
|
108 |
| - uses: actions/checkout@v3 |
| 200 | + uses: actions/checkout@v4 |
109 | 201 |
|
110 | 202 | - name: Setup Elixir
|
111 | 203 | uses: stordco/actions-elixir/setup@v1
|
112 | 204 | with:
|
| 205 | + elixir-version: ${{ matrix.versions.elixir }} |
113 | 206 | github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
114 | 207 | hex-token: ${{ secrets.HEX_API_KEY }}
|
| 208 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 209 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
| 210 | + otp-version: ${{ matrix.versions.otp }} |
115 | 211 |
|
116 | 212 | - name: Compile
|
117 | 213 | run: mix compile --warnings-as-errors
|
118 | 214 |
|
119 | 215 | - name: Test
|
120 |
| - run: mix test |
| 216 | + run: mix coveralls.github --warnings-as-errors |
| 217 | + env: |
| 218 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 219 | + |
| 220 | + strategy: |
| 221 | + fail-fast: false |
| 222 | + matrix: |
| 223 | + versions: |
| 224 | + - elixir: 1.13 |
| 225 | + otp: 25 |
| 226 | + - elixir: 1.14 |
| 227 | + otp: 25 |
| 228 | + - elixir: 1.15 |
| 229 | + otp: 26 |
| 230 | + |
| 231 | + Trivy_Filesystem: |
| 232 | + if: ${{ !startsWith(github.head_ref, 'release-please--branches') }} |
| 233 | + name: Trivy Filesystem Scan |
| 234 | + runs-on: ubuntu-latest |
| 235 | + |
| 236 | + permissions: |
| 237 | + contents: read |
| 238 | + id-token: write |
| 239 | + pull-requests: write |
| 240 | + |
| 241 | + steps: |
| 242 | + - name: Checkout |
| 243 | + uses: actions/checkout@v4 |
| 244 | + |
| 245 | + - name: Setup Elixir |
| 246 | + uses: stordco/actions-elixir/setup@v1 |
| 247 | + with: |
| 248 | + github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }} |
| 249 | + hex-token: ${{ secrets.HEX_API_KEY }} |
| 250 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 251 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
| 252 | + |
| 253 | + - name: Trivy Scan |
| 254 | + uses: stordco/actions-trivy@v1 |
| 255 | + with: |
| 256 | + github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }} |
| 257 | + scan-type: fs |
| 258 | + slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }} |
| 259 | + slack-channel-id: ${{ secrets.SLACK_SECURITY_ALERTS }} |
| 260 | + update-db: false |
| 261 | + |
0 commit comments