terragrunt/.github/workflows/ci.yml at f1025400b8ad4526d4a24bda8464e42e7577e953 · gruntwork-io/terragrunt · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
name: CI

on:
  push:

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}

jobs:
  lint:
    uses: ./.github/workflows/lint.yml
    permissions:
      contents: read
    secrets: inherit

  precommit:
    uses: ./.github/workflows/precommit.yml
    permissions:
      contents: read
    secrets: inherit

  codespell:
    uses: ./.github/workflows/codespell.yml
    permissions:
      contents: read
    secrets: inherit

  go_mod_tidy_check:
    uses: ./.github/workflows/go-mod-tidy-check.yml
    permissions:
      contents: read
    secrets: inherit

  markdownlint:
    uses: ./.github/workflows/markdownlint.yml
    permissions:
      contents: read
    secrets: inherit

  install_script_test:
    uses: ./.github/workflows/install-script-test.yml
    permissions:
      contents: read
    secrets: inherit

  license_check:
    uses: ./.github/workflows/license-check.yml
    permissions:
      contents: read
    secrets: inherit

  fuzz:
    uses: ./.github/workflows/fuzz.yml
    permissions:
      contents: read
    secrets: inherit

  # Fast feedback: only gate on lint/precommit/go_mod_tidy. Other checks (codespell,
  # markdownlint, license_check, install_script_test) run in parallel and are enforced
  # by branch protection rules, not by job dependencies.
  base_tests:
    needs: [lint, precommit, go_mod_tidy_check]
    uses: ./.github/workflows/base-test.yml
    permissions:
      contents: read
      checks: write
    secrets: inherit

  build:
    needs: [lint, precommit, go_mod_tidy_check]
    uses: ./.github/workflows/build.yml
    with:
      version: ${{ github.ref == 'refs/heads/main' && format('tip-{0}', github.sha) || '' }}
    permissions:
      contents: read
    secrets: inherit

  tip_build:
    needs: [build]
    if: github.ref == 'refs/heads/main'
    uses: ./.github/workflows/upload-tip-build.yml
    with:
      prefix: tip
    permissions:
      contents: read
      id-token: write
      actions: read
    secrets:
      TIP_BUILD_ROLE_ARN: ${{ secrets.TIP_BUILD_ROLE_ARN }}
      TIP_BUILD_BUCKET: ${{ secrets.TIP_BUILD_BUCKET }}
      SIGNING_GPG_PRIVATE_KEY: ${{ secrets.SIGNING_GPG_PRIVATE_KEY }}
      SIGNING_GPG_PASSPHRASE: ${{ secrets.SIGNING_GPG_PASSPHRASE }}

  notify_issues:
    needs: [tip_build]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-slim
    permissions:
      contents: read
      issues: write
      pull-requests: read
    steps:
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
        with:
          sparse-checkout: .github/scripts

      - name: Notify issues about tip build
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
        with:
          script: |
            const notify = require('./.github/scripts/tip-build-notify-issues.js');
            await notify({ github, context, core });

  build_no_proxy:
    # Only run no_proxy builds on main branch to save CI time
    if: github.ref == 'refs/heads/main'
    needs: [lint, precommit, go_mod_tidy_check]
    uses: ./.github/workflows/build-no-proxy.yml
    permissions:
      contents: read
    secrets: inherit

  coverage_compare:
    needs: [base_tests]
    uses: ./.github/workflows/coverage-compare-main.yml
    permissions:
      contents: read
      actions: read
    secrets: inherit

  integration_tests:
    needs: [base_tests, build]
    uses: ./.github/workflows/integration-test.yml
    permissions:
      contents: read
      checks: write
    secrets: inherit

  oidc_integration_tests:
    needs: [base_tests, build]
    uses: ./.github/workflows/oidc-integration-test.yml
    permissions:
      id-token: write
      contents: read
      checks: write
    secrets: inherit