Skip to content

Commit c2aa325

Browse files
waybackarchiverwaybackarchiver
authored
Reusable workflows (#33)
* Migrate codeql workflow to reusable analysis workflow * Migrate linter and stale workflow to reusable workflow * Migrate release workflow to reusable workflow
1 parent 30404cb commit c2aa325

File tree

9 files changed

+271
-254
lines changed

9 files changed

+271
-254
lines changed

‎.github/workflows/analysis.yml‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
# Copyright 2020 Wayback Archiver. All rights reserved.
2+
# Use of this source code is governed by the GNU GPL v3
3+
# license that can be found in the LICENSE file.
4+
5+
name: "Analysis"
6+
7+
on:
8+
push:
9+
branches:
10+
- main
11+
- develop
12+
pull_request:
13+
branches: [ main ]
14+
schedule:
15+
- cron: '33 23 * * 4'
16+
17+
# Declare default permissions as read only.
18+
permissions: read-all
19+
20+
jobs:
21+
scorecards:
22+
name: Scorecards
23+
uses: wabarc/.github/.github/workflows/reusable-scorecards.yml@main
24+
if: |
25+
github.event_name == 'pull_request' ||
26+
github.ref == 'refs/heads/main'
27+
permissions:
28+
# Needed to upload the results to code-scanning dashboard.
29+
security-events: write
30+
# Used to receive a badge. (Upcoming feature)
31+
id-token: write
32+
actions: read
33+
contents: read
34+
35+
codeql:
36+
name: CodeQL
37+
permissions:
38+
security-events: write
39+
actions: read
40+
contents: read
41+
strategy:
42+
fail-fast: false
43+
matrix:
44+
language: [ 'go' ]
45+
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python' ]
46+
# Learn more:
47+
# https://docs.github.com/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
48+
uses: wabarc/.github/.github/workflows/reusable-codeql.yml@main
49+
with:
50+
language: ${{ matrix.language }}
51+
52+
nancy:
53+
name: Sonatype Nancy
54+
uses: wabarc/.github/.github/workflows/reusable-nancy.yml@main
55+
56+
semgrep:
57+
name: Semgrep Scan
58+
if: github.actor != 'dependabot[bot]'
59+
uses: wabarc/.github/.github/workflows/reusable-semgrep.yml@main
60+
permissions:
61+
# Needed to upload the results to code-scanning dashboard.
62+
security-events: write
63+
actions: read
64+
contents: read
65+
66+
fossa:
67+
if: github.event_name != 'pull_request'
68+
name: FOSSA
69+
uses: wabarc/.github/.github/workflows/reusable-fossa.yml@main
70+
secrets:
71+
fossa-apikey: ${{ secrets.FOSSA_APIKEY }}
72+
73+
dependency-review:
74+
name: Dependency Review
75+
uses: wabarc/.github/.github/workflows/reusable-dependency-review.yml@main
76+
77+
trivy:
78+
name: Trivy
79+
uses: wabarc/.github/.github/workflows/reusable-trivy.yml@main
80+
permissions:
81+
contents: read # for actions/checkout to fetch code
82+
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
83+
#actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
84+
with:
85+
scan-type: 'fs'
86+
sarif: 'filesystem.sarif'

‎.github/workflows/codeql-analysis.yml‎

Lines changed: 0 additions & 69 deletions
This file was deleted.

‎.github/workflows/linter.yml‎

Lines changed: 41 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,48 @@
1-
name: Lint
1+
# Copyright 2020 Wayback Archiver. All rights reserved.
2+
# Use of this source code is governed by the GNU GPL v3
3+
# license that can be found in the LICENSE file.
4+
#
5+
name: Linter
26

37
on:
48
push:
5-
branches: [ main ]
9+
branches:
10+
- '**'
611
pull_request:
7-
branches: [ main ]
12+
branches:
13+
- '**'
814
types: [ opened, synchronize, reopened ]
915

16+
permissions:
17+
contents: read
18+
1019
jobs:
11-
lint:
12-
runs-on: ubuntu-latest
13-
steps:
14-
- name: Checkout default branch
15-
uses: actions/checkout@v2
16-
17-
- name: Lint Code Base
18-
uses: github/super-linter@v4
19-
env:
20-
DEFAULT_BRANCH: 'main'
21-
VALIDATE_ALL_CODEBASE: false
22-
VALIDATE_JSON: false
23-
VALIDATE_ANSIBLE: false
24-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
20+
super-linter:
21+
name: Super Linter
22+
uses: wabarc/.github/.github/workflows/reusable-super-linter.yml@main
23+
24+
golangci:
25+
name: golangci-lint
26+
uses: wabarc/.github/.github/workflows/reusable-golangci.yml@main
27+
28+
shellcheck:
29+
name: ShellCheck
30+
uses: wabarc/.github/.github/workflows/reusable-shellcheck.yml@main
31+
32+
misspell:
33+
name: Misspell
34+
uses: wabarc/.github/.github/workflows/reusable-misspell.yml@main
35+
36+
alex:
37+
name: Alex
38+
uses: wabarc/.github/.github/workflows/reusable-alex.yml@main
39+
40+
urlcheck:
41+
name: URLCheck
42+
uses: wabarc/.github/.github/workflows/reusable-urlcheck.yml@main
43+
with:
44+
exclude-patterns: '.onion,https://github.com/,https://repo.wabarc.eu.org/,twitter.com'
45+
46+
goreportcard:
47+
name: Go Report Card
48+
uses: wabarc/.github/.github/workflows/reusable-goreportcard.yml@main

‎.github/workflows/release.yml‎

Lines changed: 21 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ on:
55
tags:
66
- 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
77

8+
permissions:
9+
contents: read
10+
811
jobs:
912
build:
1013
name: Build
@@ -52,97 +55,24 @@ jobs:
5255
- os: dragonfly
5356
arch: 386
5457
fail-fast: false
55-
runs-on: ubuntu-latest
56-
env:
57-
GOOS: ${{ matrix.os }}
58-
GOARCH: ${{ matrix.arch }}
59-
GOARM: ${{ matrix.arm }}
60-
GOMIPS: ${{ matrix.mips }}
61-
GOMIPS64: ${{ matrix.mips64 }}
62-
GOMIPSLE: ${{ matrix.mipsle }}
63-
steps:
64-
- name: Check out code into the Go module directory
65-
uses: actions/checkout@v2
66-
67-
- name: List checked-out code
68-
run: ls -al
69-
70-
- name: Set up Go 1.x
71-
uses: actions/setup-go@v2
72-
with:
73-
go-version: ^1.16
74-
75-
- name: Build fat binary
76-
id: builder
77-
run: |
78-
ARGS="${GOOS}-${GOARCH}"
79-
if [[ -n "${GOARM}" ]]; then
80-
ARGS="${ARGS}v${GOARM}"
81-
elif [[ -n "${GOMIPS}" ]]; then
82-
ARGS="${ARGS}-${GOMIPS}"
83-
elif [[ -n "${GOMIPS64}" ]]; then
84-
ARGS="${ARGS}-${GOMIPS64}"
85-
elif [[ -n "${GOMIPSLE}" ]]; then
86-
ARGS="${ARGS}-${GOMIPSLE}"
87-
fi
88-
make ${ARGS}
89-
echo "args=${ARGS}" >> $GITHUB_OUTPUT
90-
91-
- name: Archive binary
92-
run: make TARGET=${{ steps.builder.outputs.args }} releases
93-
94-
- name: Upload archived binary
95-
uses: actions/upload-artifact@v2
96-
with:
97-
name: archive-is
98-
path: build/package/archive.is*
99-
100-
checksum:
101-
name: Get archived packages checksum
102-
runs-on: ubuntu-latest
103-
needs: [ build ]
104-
outputs:
105-
digest: ${{ steps.digest.outputs.result }}
106-
steps:
107-
- name: Download math result from build job
108-
uses: actions/download-artifact@v2
109-
with:
110-
name: archive-is
111-
path: .
112-
113-
- name: Create all binary digest
114-
id: digest
115-
run: |
116-
digest=$(find archive.is* -type f -exec sha256sum {} +)
117-
digest="${digest//$'%'/%25}"
118-
digest="${digest//$'\n'/%0A}"
119-
echo "result=${digest}" >> $GITHUB_OUTPUT
58+
uses: wabarc/.github/.github/workflows/reusable-builder-go.yml@main
59+
with:
60+
product: archive.is
61+
release: true
62+
go-version: '^1.20'
63+
go-os: ${{ matrix.os }}
64+
go-arch: ${{ matrix.arch }}
65+
go-arm: ${{ matrix.arm }}
66+
go-mips: ${{ matrix.mips }}
67+
go-mips64: ${{ matrix.mips64 }}
68+
go-mipsle: ${{ matrix.mipsle }}
69+
artifact-path: build/package/archive.is*
12070

12171
release:
12272
name: Create and upload release
123-
runs-on: ubuntu-latest
124-
needs: [build, checksum]
125-
steps:
126-
- name: Download math result from build and checksum jobs
127-
uses: actions/download-artifact@v2
128-
with:
129-
name: archive-is
130-
path: archive-is # Put files to archive.is directory
131-
132-
- name: Create Release
133-
uses: softprops/action-gh-release@v1
134-
if: startsWith(github.ref, 'refs/tags/')
135-
env:
136-
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # This token is provided by Actions, you do not need to create your own token
137-
with:
138-
body: |
139-
See [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/${{ github.sha }}/CHANGELOG.md).
140-
141-
**Digests in this release:**
142-
143-
```
144-
${{ needs.checksum.outputs.digest }}
145-
```
146-
draft: true
147-
files: |
148-
archive-is/*
73+
needs: [ build ]
74+
permissions:
75+
contents: write
76+
uses: wabarc/.github/.github/workflows/reusable-releaser-go.yml@main
77+
with:
78+
product: archive.is

‎.github/workflows/stale.yml‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
1+
# Copyright 2020 Wayback Archiver. All rights reserved.
2+
# Use of this source code is governed by the GNU GPL v3
3+
# license that can be found in the LICENSE file.
4+
#
15
name: Stale
26

37
on:
48
schedule:
59
- cron: "0 3 * * 6"
10+
workflow_dispatch:
11+
12+
permissions:
13+
issues: write
14+
pull-requests: write
615

716
jobs:
817
stale:
918
name: Stale
10-
runs-on: ubuntu-latest
11-
steps:
12-
- name: Mark stale issues and pull requests
13-
uses: actions/stale@v4
14-
with:
15-
repo-token: ${{ github.token }}
16-
stale-issue-message: "This issue is stale because it has been open 120 days with no activity. Remove stale label or comment or this will be closed in 5 days"
17-
stale-pr-message: 'It has been open 120 days with no activity. Remove stale label or comment or this will be closed in 5 days'
18-
days-before-stale: 120
19-
days-before-close: 5
19+
uses: wabarc/.github/.github/workflows/reusable-stale.yml@main

0 commit comments

Comments
 (0)