Skip to content

Commit 57a1fb9

Browse files
lukpuehlukpueh
committed
Restructure ci/cd workflows to make more robust (WIP)
Implements suggestion from theupdateframework#1961 Also adds permissions to CD workflow (creating releases requires contents: write) TODO: - proof-read - write commit message - PR Signed-off-by: Lukas Puehringer <[email protected]>
1 parent 72424a9 commit 57a1fb9

File tree

3 files changed

+109
-103
lines changed

3 files changed

+109
-103
lines changed

‎.github/workflows/_test.yml

+90
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
on:
2+
workflow_call:
3+
# Permissions inherited from caller workflow
4+
5+
6+
jobs:
7+
tests:
8+
name: Tests
9+
strategy:
10+
fail-fast: false
11+
# Run regular TUF tests on each OS/Python combination, plus special tests
12+
# (sslib master) and linters on Linux/Python3.x only.
13+
matrix:
14+
python-version: ["3.7", "3.8", "3.9", "3.10"]
15+
os: [ubuntu-latest, macos-latest, windows-latest]
16+
toxenv: [py]
17+
include:
18+
- python-version: 3.x
19+
os: ubuntu-latest
20+
toxenv: with-sslib-master
21+
experimental: true
22+
- python-version: 3.x
23+
os: ubuntu-latest
24+
toxenv: lint
25+
26+
env:
27+
# Set TOXENV env var to tell tox which testenv (see tox.ini) to use
28+
# NOTE: The Python 2.7 runner has two Python versions on the path (see
29+
# setup-python below), so we tell tox explicitly to use the 'py27'
30+
# testenv. For all other runners the toxenv configured above suffices.
31+
TOXENV: ${{ matrix.toxenv }}
32+
33+
runs-on: ${{ matrix.os }}
34+
35+
steps:
36+
- name: Checkout TUF
37+
uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748
38+
39+
- name: Set up Python ${{ matrix.python-version }}
40+
uses: actions/setup-python@98f2ad02fd48d057ee3b4d4f66525b231c3e52b6
41+
with:
42+
python-version: ${{ matrix.python-version }}
43+
cache: 'pip'
44+
cache-dependency-path: 'requirements*.txt'
45+
46+
- name: Install dependencies
47+
run: |
48+
python3 -m pip install --upgrade pip
49+
python3 -m pip install --upgrade tox coveralls
50+
51+
- name: Run tox (${{ env.TOXENV }})
52+
# See TOXENV environment variable for the testenv to be executed here
53+
run: tox
54+
55+
- name: Publish on coveralls.io
56+
# A failure to publish coverage results on coveralls should not
57+
# be a reason for a job failure.
58+
continue-on-error: true
59+
# TODO: Maybe make 'lint' a separate job instead of case handling here
60+
if: ${{ env.TOXENV != 'lint' }}
61+
env:
62+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
63+
COVERALLS_FLAG_NAME: ${{ runner.os }} / Python ${{ matrix.python-version }} / ${{ env.TOXENV }}
64+
COVERALLS_PARALLEL: true
65+
# Use cp workaround to publish coverage reports with relative paths
66+
# FIXME: Consider refactoring the tests to not require the test
67+
# aggregation script being invoked from the `tests` directory, so
68+
# that `.coverage` is written to and .coveragrc can also reside in
69+
# the project root directory as is the convention.
70+
run: |
71+
cp tests/.coverage .
72+
coveralls --service=github --rcfile=tests/.coveragerc
73+
74+
coveralls-fin:
75+
# Always run when all 'tests' jobs have finished even if they failed
76+
# TODO: Replace always() with a 'at least one job succeeded' expression
77+
if: always()
78+
needs: tests
79+
runs-on: ubuntu-latest
80+
container: python:3-slim
81+
steps:
82+
- name: Install dependencies
83+
run: |
84+
python3 -m pip install --upgrade pip
85+
python3 -m pip install --upgrade coveralls
86+
- name: Finalize publishing on coveralls.io
87+
continue-on-error: true
88+
env:
89+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
90+
run: coveralls --finish

‎.github/workflows/cd.yml

+16-15
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,22 @@
11
name: CD
22
concurrency: cd
33

4-
# Trigger workflow on any completed CI (see further checks below)
54
on:
6-
workflow_run:
7-
workflows: [CI]
8-
types: [completed]
5+
push:
6+
tags:
7+
- v*
8+
9+
permissions:
10+
contents: write
911

1012
jobs:
13+
test:
14+
uses: ./.github/workflows/_test.yml
15+
1116
build:
1217
name: Build
1318
runs-on: ubuntu-latest
14-
# Skip unless CI was successful and ran on release tag, a ref starting with 'v'.
15-
# NOTE: We assume CI does not trigger on branches that start with 'v' (see #1961)
16-
if: >-
17-
github.event.workflow_run.conclusion == 'success' &&
18-
startsWith(github.event.workflow_run.head_branch, 'v')
19+
needs: test
1920
outputs:
2021
release_id: ${{ steps.gh-release.outputs.id }}
2122
steps:
@@ -39,8 +40,8 @@ jobs:
3940
name: Publish GitHub release candiate
4041
uses: softprops/action-gh-release@1e07f4398721186383de40550babbdf2b84acfc5
4142
with:
42-
name: ${{ github.event.workflow_run.head_branch }}-rc
43-
tag_name: ${{ github.event.workflow_run.head_branch }}
43+
name: ${{ github.ref_name }}-rc
44+
tag_name: ${{ github.ref }}
4445
body: "Release waiting for review..."
4546
files: dist/*
4647

@@ -69,6 +70,7 @@ jobs:
6970
uses: pypa/gh-action-pypi-publish@717ba43cfbb0387f6ce311b169a825772f54d295
7071
with:
7172
user: __token__
73+
repository_url: https://test.pypi.org/legacy/
7274
password: ${{ secrets.PYPI_API_TOKEN }}
7375

7476
- name: Finalize GitHub release
@@ -79,9 +81,8 @@ jobs:
7981
owner: context.repo.owner,
8082
repo: context.repo.repo,
8183
release_id: '${{ needs.build.outputs.release_id }}',
82-
name: '${{ github.event.workflow_run.head_branch }}',
84+
name: '${{ github.ref_name }}',
8385
body: 'See [CHANGELOG.md](https://github.com/' +
84-
context.repo.owner + '/' + context.repo.repo + '/blob/' +
85-
'${{ github.event.workflow_run.head_branch }}'+
86-
'/docs/CHANGELOG.md) for details.'
86+
context.repo.owner + '/' + context.repo.repo +
87+
'/blob/${{ github.ref_name }}/docs/CHANGELOG.md) for details.'
8788
})

‎.github/workflows/ci.yml

+3-88
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,9 @@
11
name: CI
22

33
on:
4-
# NOTE: CD relies on this configuration (see #1961)
54
push:
65
branches:
7-
- develop
8-
tags:
9-
- v*
6+
- robust-ci-cd
107

118
pull_request:
129
workflow_dispatch:
@@ -15,87 +12,5 @@ permissions:
1512
contents: read
1613

1714
jobs:
18-
tests:
19-
name: Tests
20-
strategy:
21-
fail-fast: false
22-
# Run regular TUF tests on each OS/Python combination, plus special tests
23-
# (sslib master) and linters on Linux/Python3.x only.
24-
matrix:
25-
python-version: ["3.7", "3.8", "3.9", "3.10"]
26-
os: [ubuntu-latest, macos-latest, windows-latest]
27-
toxenv: [py]
28-
include:
29-
- python-version: 3.x
30-
os: ubuntu-latest
31-
toxenv: with-sslib-master
32-
experimental: true
33-
- python-version: 3.x
34-
os: ubuntu-latest
35-
toxenv: lint
36-
37-
env:
38-
# Set TOXENV env var to tell tox which testenv (see tox.ini) to use
39-
# NOTE: The Python 2.7 runner has two Python versions on the path (see
40-
# setup-python below), so we tell tox explicitly to use the 'py27'
41-
# testenv. For all other runners the toxenv configured above suffices.
42-
TOXENV: ${{ matrix.toxenv }}
43-
44-
runs-on: ${{ matrix.os }}
45-
46-
steps:
47-
- name: Checkout TUF
48-
uses: actions/checkout@dcd71f646680f2efd8db4afa5ad64fdcba30e748
49-
50-
- name: Set up Python ${{ matrix.python-version }}
51-
uses: actions/setup-python@98f2ad02fd48d057ee3b4d4f66525b231c3e52b6
52-
with:
53-
python-version: ${{ matrix.python-version }}
54-
cache: 'pip'
55-
cache-dependency-path: 'requirements*.txt'
56-
57-
- name: Install dependencies
58-
run: |
59-
python3 -m pip install --upgrade pip
60-
python3 -m pip install --upgrade tox coveralls
61-
62-
- name: Run tox (${{ env.TOXENV }})
63-
# See TOXENV environment variable for the testenv to be executed here
64-
run: tox
65-
66-
- name: Publish on coveralls.io
67-
# A failure to publish coverage results on coveralls should not
68-
# be a reason for a job failure.
69-
continue-on-error: true
70-
# TODO: Maybe make 'lint' a separate job instead of case handling here
71-
if: ${{ env.TOXENV != 'lint' }}
72-
env:
73-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
74-
COVERALLS_FLAG_NAME: ${{ runner.os }} / Python ${{ matrix.python-version }} / ${{ env.TOXENV }}
75-
COVERALLS_PARALLEL: true
76-
# Use cp workaround to publish coverage reports with relative paths
77-
# FIXME: Consider refactoring the tests to not require the test
78-
# aggregation script being invoked from the `tests` directory, so
79-
# that `.coverage` is written to and .coveragrc can also reside in
80-
# the project root directory as is the convention.
81-
run: |
82-
cp tests/.coverage .
83-
coveralls --service=github --rcfile=tests/.coveragerc
84-
85-
coveralls-fin:
86-
# Always run when all 'tests' jobs have finished even if they failed
87-
# TODO: Replace always() with a 'at least one job succeeded' expression
88-
if: always()
89-
needs: tests
90-
runs-on: ubuntu-latest
91-
container: python:3-slim
92-
steps:
93-
- name: Install dependencies
94-
run: |
95-
python3 -m pip install --upgrade pip
96-
python3 -m pip install --upgrade coveralls
97-
- name: Finalize publishing on coveralls.io
98-
continue-on-error: true
99-
env:
100-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
101-
run: coveralls --finish
15+
test:
16+
uses: ./.github/workflows/_test.yml

0 commit comments

Comments
 (0)