terragrunt/.github/workflows/ci.yml at 8efbf1fe7bda58ae34be6d82d19c1e438ea92ff9 · gruntwork-io/terragrunt · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
name: CI

on:
  push:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  lint:
    uses: ./.github/workflows/lint.yml
    permissions:
      contents: read
    secrets: inherit

  precommit:
    uses: ./.github/workflows/precommit.yml
    permissions:
      contents: read
    secrets: inherit

  codespell:
    uses: ./.github/workflows/codespell.yml
    permissions:
      contents: read
    secrets: inherit

  go_mod_tidy_check:
    uses: ./.github/workflows/go-mod-tidy-check.yml
    permissions:
      contents: read
    secrets: inherit

  markdownlint:
    uses: ./.github/workflows/markdownlint.yml
    permissions:
      contents: read
    secrets: inherit

  install_script_test:
    uses: ./.github/workflows/install-script-test.yml
    permissions:
      contents: read
    secrets: inherit

  license_check:
    uses: ./.github/workflows/license-check.yml
    permissions:
      contents: read
    secrets: inherit

  fuzz:
    uses: ./.github/workflows/fuzz.yml
    permissions:
      contents: read
    secrets: inherit

  # Fast feedback: only gate on lint/precommit/go_mod_tidy. Other checks (codespell,
  # markdownlint, license_check, install_script_test) run in parallel and are enforced
  # by branch protection rules, not by job dependencies.
  base_tests:
    needs: [lint, precommit, go_mod_tidy_check]
    uses: ./.github/workflows/base-test.yml
    permissions:
      contents: read
      checks: write
    secrets: inherit

  build:
    needs: [lint, precommit, go_mod_tidy_check]
    uses: ./.github/workflows/build.yml
    permissions:
      contents: read
    secrets: inherit

  build_no_proxy:
    # Only run no_proxy builds on main branch to save CI time
    if: github.ref == 'refs/heads/main'
    needs: [lint, precommit, go_mod_tidy_check]
    uses: ./.github/workflows/build-no-proxy.yml
    permissions:
      contents: read
    secrets: inherit

  coverage_compare:
    needs: [base_tests]
    uses: ./.github/workflows/coverage-compare-main.yml
    permissions:
      contents: read
      actions: read
    secrets: inherit

  integration_tests:
    needs: [base_tests, build]
    uses: ./.github/workflows/integration-test.yml
    permissions:
      contents: read
      checks: write
    secrets: inherit

  oidc_integration_tests:
    needs: [base_tests, build]
    uses: ./.github/workflows/oidc-integration-test.yml
    permissions:
      id-token: write
      contents: read
      checks: write
    secrets: inherit