|
| 1 | +# This file is synced with stordco/common-config-elixir. Any changes will be overwritten. |
| 2 | + |
1 | 3 | name: CI
|
2 | 4 |
|
3 | 5 | on:
|
| 6 | + merge_group: |
4 | 7 | pull_request:
|
5 | 8 | types:
|
6 | 9 | - opened
|
7 | 10 | - reopened
|
8 | 11 | - synchronize
|
9 |
| - merge_group: |
| 12 | + push: |
| 13 | + branches: |
| 14 | + - main |
| 15 | + - code-freeze/** |
10 | 16 | workflow_call:
|
11 | 17 | secrets:
|
| 18 | + CI_SERVICE_KEY: |
| 19 | + required: true |
12 | 20 | GH_PERSONAL_ACCESS_TOKEN:
|
13 | 21 | required: true
|
14 | 22 | HEX_API_KEY:
|
15 | 23 | required: true
|
16 | 24 | workflow_dispatch:
|
17 | 25 |
|
| 26 | +concurrency: |
| 27 | + group: ${{ github.head_ref || github.run_id }} |
| 28 | + cancel-in-progress: true |
| 29 | + |
18 | 30 | jobs:
|
| 31 | + Changed: |
| 32 | + name: Changed Files |
| 33 | + runs-on: ubuntu-latest |
| 34 | + |
| 35 | + outputs: |
| 36 | + database: ${{ steps.changed.outputs.database_any_changed }} |
| 37 | + docker: ${{ steps.changed.outputs.docker_any_changed }} |
| 38 | + elixir: ${{ steps.changed.outputs.elixir_any_changed }} |
| 39 | + helm: ${{ steps.changed.outputs.helm_any_changed }} |
| 40 | + |
| 41 | + steps: |
| 42 | + - name: Checkout |
| 43 | + uses: actions/checkout@v4 |
| 44 | + with: |
| 45 | + fetch-depth: 2 |
| 46 | + |
| 47 | + - id: changed |
| 48 | + name: Get Changed Files |
| 49 | + uses: tj-actions/changed-files@v44 |
| 50 | + with: |
| 51 | + files_yaml: | |
| 52 | + database: |
| 53 | + - '.github/workflows/ci.yaml' |
| 54 | + - 'priv/*repo/**' |
| 55 | + docker: |
| 56 | + - '.github/workflows/ci.yaml' |
| 57 | + - 'Dockerfile' |
| 58 | + documentation: |
| 59 | + - 'docs/**' |
| 60 | + - 'priv/documentation/**' |
| 61 | + - '**.ex' |
| 62 | + - '**.md' |
| 63 | + elixir: |
| 64 | + - '.github/workflows/ci.yaml' |
| 65 | + - '.tool-versions' |
| 66 | + - 'priv/**' |
| 67 | + - '**.ex' |
| 68 | + - '**.exs' |
| 69 | + - '**.heex' |
| 70 | + helm: |
| 71 | + - '.github/workflows/ci.yaml' |
| 72 | + - '.github/workflows/staging.yaml' |
| 73 | + - '.github/workflows/production.yaml' |
| 74 | + - 'helm/**' |
| 75 | +
|
19 | 76 | Credo:
|
| 77 | + if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }} |
| 78 | + needs: [Changed] |
20 | 79 | runs-on: ubuntu-latest
|
21 | 80 |
|
22 | 81 | steps:
|
23 | 82 | - name: Checkout
|
24 |
| - uses: actions/checkout@v3 |
| 83 | + uses: actions/checkout@v4 |
25 | 84 |
|
26 | 85 | - name: Setup Elixir
|
27 | 86 | uses: stordco/actions-elixir/setup@v1
|
28 | 87 | with:
|
29 | 88 | github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
30 | 89 | hex-token: ${{ secrets.HEX_API_KEY }}
|
| 90 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 91 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
31 | 92 |
|
32 | 93 | - name: Credo
|
33 |
| - run: mix credo |
| 94 | + run: mix credo --strict |
34 | 95 |
|
35 |
| - Deps: |
| 96 | + Dependencies: |
| 97 | + if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }} |
| 98 | + needs: [Changed] |
36 | 99 | runs-on: ubuntu-latest
|
37 | 100 |
|
| 101 | + env: |
| 102 | + MIX_ENV: test |
| 103 | + |
38 | 104 | steps:
|
39 | 105 | - name: Checkout
|
40 |
| - uses: actions/checkout@v3 |
| 106 | + uses: actions/checkout@v4 |
41 | 107 |
|
42 | 108 | - name: Setup Elixir
|
43 | 109 | uses: stordco/actions-elixir/setup@v1
|
44 | 110 | with:
|
45 | 111 | github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
46 | 112 | hex-token: ${{ secrets.HEX_API_KEY }}
|
| 113 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 114 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
47 | 115 |
|
48 | 116 | - name: Unused
|
49 | 117 | run: mix deps.unlock --check-unused
|
50 | 118 |
|
51 | 119 | Dialyzer:
|
| 120 | + if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }} |
| 121 | + needs: [Changed] |
52 | 122 | runs-on: ubuntu-latest
|
53 | 123 |
|
54 | 124 | steps:
|
55 | 125 | - name: Checkout
|
56 |
| - uses: actions/checkout@v3 |
| 126 | + uses: actions/checkout@v4 |
57 | 127 |
|
58 | 128 | - name: Setup Elixir
|
59 | 129 | uses: stordco/actions-elixir/setup@v1
|
60 | 130 | with:
|
61 | 131 | github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
62 | 132 | hex-token: ${{ secrets.HEX_API_KEY }}
|
| 133 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 134 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
63 | 135 |
|
64 | 136 | - name: Dialyzer
|
65 | 137 | run: mix dialyzer --format github
|
66 | 138 |
|
67 |
| - Docs: |
| 139 | + Documentation: |
| 140 | + if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.documentation == 'true' }} |
| 141 | + needs: [Changed] |
68 | 142 | runs-on: ubuntu-latest
|
69 | 143 |
|
70 | 144 | steps:
|
71 | 145 | - name: Checkout
|
72 |
| - uses: actions/checkout@v3 |
| 146 | + uses: actions/checkout@v4 |
73 | 147 |
|
74 | 148 | - name: Setup Elixir
|
75 | 149 | uses: stordco/actions-elixir/setup@v1
|
76 | 150 | with:
|
77 | 151 | github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
78 | 152 | hex-token: ${{ secrets.HEX_API_KEY }}
|
| 153 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 154 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
79 | 155 |
|
80 | 156 | - name: Docs
|
81 | 157 | run: mix docs
|
82 | 158 |
|
83 | 159 | Format:
|
| 160 | + if: ${{ !startsWith(github.head_ref, 'release-please--branches') && needs.Changed.outputs.elixir == 'true' }} |
| 161 | + needs: [Changed] |
84 | 162 | runs-on: ubuntu-latest
|
85 | 163 |
|
86 | 164 | steps:
|
87 | 165 | - name: Checkout
|
88 |
| - uses: actions/checkout@v3 |
| 166 | + uses: actions/checkout@v4 |
89 | 167 |
|
90 | 168 | - name: Setup Elixir
|
91 | 169 | uses: stordco/actions-elixir/setup@v1
|
92 | 170 | with:
|
93 | 171 | github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
94 | 172 | hex-token: ${{ secrets.HEX_API_KEY }}
|
| 173 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 174 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
95 | 175 |
|
96 | 176 | - name: Format
|
97 | 177 | run: mix format --check-formatted
|
98 | 178 |
|
99 | 179 | Test:
|
| 180 | + name: Test (Elixir ${{ matrix.versions.elixir }} OTP ${{ matrix.versions.otp }}) |
| 181 | + |
100 | 182 | runs-on: ubuntu-latest
|
101 | 183 |
|
102 | 184 | env:
|
103 |
| - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
104 | 185 | MIX_ENV: test
|
105 | 186 |
|
| 187 | + |
106 | 188 | steps:
|
107 | 189 | - name: Checkout
|
108 |
| - uses: actions/checkout@v3 |
| 190 | + uses: actions/checkout@v4 |
109 | 191 |
|
110 | 192 | - name: Setup Elixir
|
111 | 193 | uses: stordco/actions-elixir/setup@v1
|
112 | 194 | with:
|
| 195 | + elixir-version: ${{ matrix.versions.elixir }} |
113 | 196 | github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }}
|
114 | 197 | hex-token: ${{ secrets.HEX_API_KEY }}
|
| 198 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 199 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
| 200 | + otp-version: ${{ matrix.versions.otp }} |
115 | 201 |
|
116 | 202 | - name: Compile
|
117 | 203 | run: mix compile --warnings-as-errors
|
118 | 204 |
|
119 | 205 | - name: Test
|
120 |
| - run: mix test |
| 206 | + run: mix coveralls.github |
| 207 | + env: |
| 208 | + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
| 209 | + |
| 210 | + strategy: |
| 211 | + fail-fast: false |
| 212 | + matrix: |
| 213 | + versions: |
| 214 | + - elixir: 1.13 |
| 215 | + otp: 25 |
| 216 | + - elixir: 1.14 |
| 217 | + otp: 25 |
| 218 | + - elixir: 1.15 |
| 219 | + otp: 26 |
| 220 | + |
| 221 | + Trivy_Filesystem: |
| 222 | + if: ${{ !startsWith(github.head_ref, 'release-please--branches') }} |
| 223 | + name: Trivy Filesystem Scan |
| 224 | + runs-on: ubuntu-latest |
| 225 | + |
| 226 | + permissions: |
| 227 | + contents: read |
| 228 | + id-token: write |
| 229 | + pull-requests: write |
| 230 | + |
| 231 | + steps: |
| 232 | + - name: Checkout |
| 233 | + uses: actions/checkout@v4 |
| 234 | + |
| 235 | + - name: Setup Elixir |
| 236 | + uses: stordco/actions-elixir/setup@v1 |
| 237 | + with: |
| 238 | + github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }} |
| 239 | + hex-token: ${{ secrets.HEX_API_KEY }} |
| 240 | + oban-fingerprint: ${{ secrets.OBAN_KEY_FINGERPRINT }} |
| 241 | + oban-token: ${{ secrets.OBAN_LICENSE_KEY }} |
| 242 | + |
| 243 | + - name: Trivy Scan |
| 244 | + uses: stordco/actions-trivy@v1 |
| 245 | + with: |
| 246 | + github-token: ${{ secrets.GH_PERSONAL_ACCESS_TOKEN }} |
| 247 | + scan-type: fs |
| 248 | + slack-bot-token: ${{ secrets.SLACK_BOT_TOKEN }} |
| 249 | + slack-channel-id: ${{ secrets.SLACK_SECURITY_ALERTS }} |
| 250 | + update-db: false |
| 251 | + |
0 commit comments