ci: unify planning stage across publish and test workflows #81
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-FileCopyrightText: 2026 Travis Lyons | |
| # SPDX-License-Identifier: MIT | |
| name: CI | |
| on: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| concurrency: | |
| group: package-pipeline-${{ github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| lint: | |
| name: Lint | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4 | |
| - name: Check shell scripts | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| mapfile -t shell_scripts < <(git ls-files -- '*.sh') | |
| if (( ${#shell_scripts[@]} == 0 )); then | |
| echo 'No tracked shell scripts found' >&2 | |
| exit 1 | |
| fi | |
| shellcheck --shell=bash "${shell_scripts[@]}" | |
| - name: Check GitHub Actions workflows | |
| run: actionlint | |
| discover: | |
| name: Discover packages | |
| runs-on: ubuntu-latest | |
| outputs: | |
| packages: ${{ steps.plan.outputs.packages }} | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| - id: plan | |
| uses: ./.github/actions/discover-packages | |
| with: | |
| base-sha: ${{ github.event.pull_request.base.sha }} | |
| head-sha: ${{ github.event.pull_request.head.sha }} | |
| # Shared inputs that change how every package is checked or built, so | |
| # a change to one has to be validated against the full matrix. | |
| # create.sh only scaffolds new packages and is intentionally omitted. | |
| full-rebuild-paths: | | |
| build.sh | |
| lint.sh | |
| .github/workflows/test-packages.yml | |
| .github/actions/discover-packages/* | |
| build: | |
| name: Check and build packages | |
| needs: discover | |
| if: >- | |
| needs.discover.outputs.packages != '[]' | |
| strategy: | |
| fail-fast: false | |
| max-parallel: 4 | |
| matrix: | |
| package: ${{ fromJSON(needs.discover.outputs.packages) }} | |
| runs-on: ubuntu-latest | |
| container: | |
| image: archlinux:base-devel@sha256:ee205c220399524a683cf495d411691b921baed8ab47cdc6d732efa782fae484 | |
| options: --privileged | |
| steps: | |
| - name: Install tools | |
| shell: bash | |
| run: | | |
| pacman -Syu --noconfirm --needed devtools git namcap sudo | |
| systemd-machine-id-setup | |
| printf '%s\n' '#!/bin/bash' 'exec /usr/bin/systemd-nspawn --keep-unit "$@"' > /usr/local/bin/systemd-nspawn | |
| chmod 0755 /usr/local/bin/systemd-nspawn | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Configure build user | |
| shell: bash | |
| run: | | |
| useradd --create-home builder | |
| printf 'builder ALL=(ALL) NOPASSWD: ALL\n' > /etc/sudoers.d/builder | |
| chmod 0440 /etc/sudoers.d/builder | |
| chown -R builder:builder "$GITHUB_WORKSPACE" | |
| - name: Check package metadata | |
| env: | |
| PACKAGE: ${{ matrix.package }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| cd "$GITHUB_WORKSPACE/$PACKAGE" | |
| namcap PKGBUILD | |
| sudo --user=builder --set-home bash -c 'makepkg --printsrcinfo > .SRCINFO.generated' | |
| diff --unified .SRCINFO .SRCINFO.generated | |
| rm .SRCINFO.generated | |
| - name: Build package | |
| env: | |
| PACKAGE: ${{ matrix.package }} | |
| run: | | |
| sudo --user=builder --set-home "$GITHUB_WORKSPACE/build.sh" "$PACKAGE" | |
| - name: Validate package archive | |
| env: | |
| PACKAGE: ${{ matrix.package }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| mapfile -t archives < <(find "$GITHUB_WORKSPACE/$PACKAGE" -type f -name '*.pkg.tar.zst' -print) | |
| if (( ${#archives[@]} == 0 )); then | |
| echo 'No package archives were built' >&2 | |
| exit 1 | |
| fi | |
| namcap "${archives[@]}" | |
| ci: | |
| name: CI | |
| needs: [lint, discover, build] | |
| if: ${{ always() }} | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Require successful CI checks | |
| env: | |
| DISCOVERED_PACKAGES: ${{ needs.discover.outputs.packages }} | |
| LINT_RESULT: ${{ needs.lint.result }} | |
| DISCOVER_RESULT: ${{ needs.discover.result }} | |
| BUILD_RESULT: ${{ needs.build.result }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| if [[ "$LINT_RESULT" != success ]]; then | |
| echo "Lint checks did not succeed: $LINT_RESULT" >&2 | |
| exit 1 | |
| fi | |
| if [[ "$DISCOVER_RESULT" != success ]]; then | |
| echo "Package discovery did not succeed: $DISCOVER_RESULT" >&2 | |
| exit 1 | |
| fi | |
| if [[ "$DISCOVERED_PACKAGES" == '[]' ]]; then | |
| echo 'No package changes require a build.' | |
| exit 0 | |
| fi | |
| if [[ "$BUILD_RESULT" != success ]]; then | |
| echo "Package checks did not succeed: build:$BUILD_RESULT" >&2 | |
| exit 1 | |
| fi |