297 lines
11 KiB
YAML
297 lines
11 KiB
YAML
name: CI
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened, synchronize]
|
|
workflow_dispatch:
|
|
|
|
env:
|
|
PIP_BREAK_SYSTEM_PACKAGES: "1"
|
|
PYTHONPATH: src
|
|
CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
|
|
CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
|
|
|
|
jobs:
|
|
# Single validation job that merges: quality, detect-changes,
|
|
# release-dry-run, pre-merge-check, pr-review, and discover-runners.
|
|
# Uses ci-full image (has git-cliff for release-dry-run).
|
|
# Saves ~5x checkout+setup overhead vs 6 separate jobs.
|
|
validate:
|
|
runs-on: docker
|
|
container:
|
|
image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
|
|
credentials:
|
|
username: ${{ vars.CI_GITEA_USERNAME }}
|
|
password: ${{ secrets.CI_GITEA_API_TOKEN }}
|
|
timeout-minutes: 15
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
outputs:
|
|
ansible-changed: ${{ steps.detect.outputs.ansible-changed }}
|
|
user-facing-changed: ${{ steps.detect.outputs.user-facing-changed }}
|
|
runner-count: ${{ steps.discover-runners.outputs.runner-count }}
|
|
runner-indices: ${{ steps.discover-runners.outputs.runner-indices }}
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
- uses: ./.gitea/actions/setup-env
|
|
with:
|
|
extras: "ci,lint"
|
|
- uses: ./.gitea/actions/quality-checks
|
|
with:
|
|
package: grm
|
|
test-speed-max: "4"
|
|
translations-file: src/grm/translations.json
|
|
- name: Workflow dry-run validation
|
|
run: |
|
|
. .venv/bin/activate 2>/dev/null || true
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
# Best-effort: only runs if act_runner is installed
|
|
if command -v act_runner >/dev/null 2>&1; then
|
|
make workflow-dryrun
|
|
else
|
|
echo "act_runner not found — skipping workflow dry-run (static lint still passed)"
|
|
fi
|
|
# --- detect-changes step ---
|
|
- name: Detect changed paths
|
|
id: detect
|
|
env:
|
|
DEVX_TASK_PREFIX: GRM
|
|
run: |
|
|
. .venv/bin/activate 2>/dev/null || true
|
|
python3 -m devx.ci.classify_changes \
|
|
--base "origin/master" \
|
|
--head "${{ github.event.pull_request.head.sha || github.sha }}" \
|
|
--github-output
|
|
# --- validate-pr + pr-review steps (PR only) ---
|
|
- name: Validate auto-merge preconditions
|
|
if: github.event_name == 'pull_request'
|
|
env:
|
|
VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
|
|
DEVX_TASK_PREFIX: GRM
|
|
DEVX_VIKUNJA_PROJECT_ID: 6
|
|
HEAD_REF: ${{ github.head_ref }}
|
|
PR_TITLE: ${{ github.event.pull_request.title }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
PR_NUMBER: ${{ github.event.number }}
|
|
run: |
|
|
. .venv/bin/activate 2>/dev/null || true
|
|
python3 -m devx.ci.check_auto_merge_ready \
|
|
--branch "$HEAD_REF" \
|
|
--pr-title "$PR_TITLE" \
|
|
--repo "$REPOSITORY" \
|
|
--pr-number "$PR_NUMBER"
|
|
- name: Run automated PR review
|
|
if: github.event_name == 'pull_request'
|
|
run: |
|
|
. .venv/bin/activate 2>/dev/null || true
|
|
set -euo pipefail
|
|
python3 -m devx.ci.pr_review \
|
|
"${{ github.event.number }}" \
|
|
"${{ github.repository }}"
|
|
# --- release-dry-run step (conditional) ---
|
|
- name: Release dry-run validation
|
|
if: steps.detect.outputs.user-facing-changed == 'true'
|
|
env:
|
|
DEVX_VERSION_FILE: src/grm/__init__.py
|
|
DEVX_TASK_PREFIX: GRM
|
|
run: |
|
|
. .venv/bin/activate 2>/dev/null || true
|
|
export PATH="$HOME/.local/bin:$PATH"
|
|
python3 -m devx.ci.release --dry-run
|
|
# --- discover-runners step (conditional on ansible-changed) ---
|
|
- name: Discover available molecule runners
|
|
id: discover-runners
|
|
if: steps.detect.outputs.ansible-changed == 'true'
|
|
env:
|
|
MOLECULE_RUNNERS: ${{ vars.MOLECULE_RUNNERS }}
|
|
run: |
|
|
. .venv/bin/activate 2>/dev/null || true
|
|
python3 -m devx.molecule.discover_runners \
|
|
--owner "${{ github.repository_owner }}" \
|
|
--repo "${{ github.event.repository.name }}" \
|
|
--github-output
|
|
- uses: ./.gitea/actions/notify-failure
|
|
with:
|
|
workflow: "ci/validate"
|
|
|
|
molecule-tests:
|
|
needs: [validate]
|
|
if: needs.validate.outputs.ansible-changed == 'true'
|
|
runs-on: docker
|
|
container:
|
|
image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
|
|
credentials:
|
|
username: ${{ vars.CI_GITEA_USERNAME }}
|
|
password: ${{ secrets.CI_GITEA_API_TOKEN }}
|
|
timeout-minutes: 15
|
|
strategy:
|
|
fail-fast: false
|
|
max-parallel: 4
|
|
matrix:
|
|
runner-index: [1, 2, 3, 4]
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- name: Set up environment
|
|
env:
|
|
CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
|
|
CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
|
|
run: make setup-image EXTRAS=ci,molecule
|
|
- name: Install Ansible collections
|
|
run: |
|
|
. .venv/bin/activate 2>/dev/null || true
|
|
python3 -m devx.tools.setup --skip-install --no-pre-commit --no-tea-login
|
|
- name: Discover assigned test pairs
|
|
env:
|
|
RUNNER_INDEX: ${{ matrix.runner-index }}
|
|
MAX_RUNNERS: 4
|
|
run: |
|
|
. .venv/bin/activate 2>/dev/null || true
|
|
python3 -m devx.molecule.distribute_molecule \
|
|
--runner-index "$RUNNER_INDEX" \
|
|
--max-runners "$MAX_RUNNERS" \
|
|
--github-env
|
|
- name: Prune stale Docker data
|
|
id: prune
|
|
if: env.SKIP != 'true'
|
|
run: |
|
|
docker system prune -af --volumes 2>/dev/null || true
|
|
disk_pct=$(df -P / | awk 'NR==2 {gsub(/%/, "", $5); print $5}')
|
|
echo "Disk usage after prune: ${disk_pct}%"
|
|
if [ "$disk_pct" -ge 85 ]; then
|
|
echo "should-run=false" >> "$GITHUB_OUTPUT"
|
|
echo "::warning::Disk usage at ${disk_pct}% after prune — skipping molecule tests to avoid ENOSPC failures"
|
|
else
|
|
echo "should-run=true" >> "$GITHUB_OUTPUT"
|
|
fi
|
|
- name: Run molecule tests
|
|
if: env.SKIP != 'true' && steps.prune.outputs.should-run != 'false'
|
|
shell: bash
|
|
env:
|
|
CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
|
|
CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
|
|
DOCKER_HOST: unix:///var/run/docker.sock
|
|
ANSIBLE_INJECT_INVOCATION: "1"
|
|
run: |
|
|
. .venv/bin/activate 2>/dev/null || true
|
|
if [ -z "$TEST_PAIRS" ]; then exit 0; fi
|
|
if ! python3 -c "import docker; docker.from_env().ping()" 2>/dev/null; then
|
|
echo "Docker not available in CI container — skipping molecule tests"
|
|
exit 0
|
|
fi
|
|
_TOKEN="$CI_GITEA_API_TOKEN"; [ -z "$_TOKEN" ] && _TOKEN="$CI_GITEA_TOKEN"
|
|
[ -z "$_TOKEN" ] && { echo "Gitea API token not set — skipping Docker login"; exit 0; }
|
|
echo "$_TOKEN" | docker login git.oblachno.oblachno.fyi -u "$CI_GITEA_USERNAME" --password-stdin
|
|
# Run each molecule test pair sequentially.
|
|
# Pairs are 4-part: scenario|platform_name|platform_image|platform_command
|
|
# Spaces in platform_command are encoded as __SPACE__.
|
|
role_dir="ansible/roles/gitea_runner"
|
|
# shellcheck disable=SC2086 # intentional word splitting for pair list
|
|
for pair in $TEST_PAIRS; do
|
|
IFS='|' read -r scenario platform_name platform_image platform_command <<< "$pair"
|
|
platform_command="${platform_command//__SPACE__/ }"
|
|
export MOLECULE_PLATFORM_NAME="$platform_name"
|
|
export MOLECULE_PLATFORM_IMAGE="$platform_image"
|
|
if [ -n "$platform_command" ]; then
|
|
export MOLECULE_PLATFORM_COMMAND="$platform_command"
|
|
else
|
|
unset MOLECULE_PLATFORM_COMMAND
|
|
fi
|
|
export ANSIBLE_ALLOW_BROKEN_CONDITIONALS=true
|
|
echo "--- Running: $scenario on $platform_name ---"
|
|
pushd "$role_dir" >/dev/null
|
|
if [ "$scenario" = "default" ]; then
|
|
molecule test || {
|
|
echo "FAILED: $pair — running molecule destroy"
|
|
molecule destroy 2>/dev/null || true
|
|
popd >/dev/null
|
|
exit 1
|
|
}
|
|
else
|
|
molecule test -s "$scenario" || {
|
|
echo "FAILED: $pair — running molecule destroy"
|
|
molecule destroy -s "$scenario" 2>/dev/null || true
|
|
popd >/dev/null
|
|
exit 1
|
|
}
|
|
fi
|
|
popd >/dev/null
|
|
echo "PASSED: $pair"
|
|
docker system prune -af --volumes 2>/dev/null || true
|
|
done
|
|
echo "All molecule tests passed."
|
|
|
|
auto-merge:
|
|
# Auto-merge runs after validate passes. molecule-tests is NOT in needs
|
|
# because Gitea Actions skips dependent jobs of skipped jobs without
|
|
# evaluating if: conditions — having molecule-tests in needs would
|
|
# cascade the skip to auto-merge when ansible-changed=false.
|
|
needs: [validate]
|
|
if: >-
|
|
always() &&
|
|
github.event_name == 'pull_request' &&
|
|
needs.validate.result == 'success'
|
|
runs-on: docker
|
|
container:
|
|
image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
|
|
credentials:
|
|
username: ${{ vars.CI_GITEA_USERNAME }}
|
|
password: ${{ secrets.CI_GITEA_API_TOKEN }}
|
|
timeout-minutes: 10
|
|
defaults:
|
|
run:
|
|
shell: bash
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0
|
|
token: ${{ secrets.CI_GITEA_API_TOKEN }}
|
|
- uses: ./.gitea/actions/setup-env
|
|
with:
|
|
extras: "ci"
|
|
- name: Post approval review
|
|
env:
|
|
REVIEWER_GITEA_API_TOKEN: ${{ secrets.REVIEWER_GITEA_API_TOKEN }}
|
|
PR_NUMBER: ${{ github.event.number }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
run: |
|
|
. .venv/bin/activate 2>/dev/null || true
|
|
python3 -m devx.ci.pr_review \
|
|
"$PR_NUMBER" \
|
|
"$REPOSITORY" \
|
|
--event APPROVE \
|
|
--checklist-confirmed \
|
|
--checklist-categories 1,2,3,4,5,6,7,8,9,10,11,12,13 \
|
|
--body "Auto-approved: all CI checks passed (validate, molecule-tests)."
|
|
- name: Wait for molecule tests to complete
|
|
if: needs.validate.outputs.ansible-changed == 'true'
|
|
env:
|
|
CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
|
|
run: |
|
|
. .venv/bin/activate 2>/dev/null || true
|
|
python3 -m devx.ci.wait_for_checks \
|
|
--job-name "molecule-tests" \
|
|
--repo "${{ github.repository }}" \
|
|
--timeout 1200 \
|
|
--poll-interval 10 \
|
|
--no-require-success
|
|
- name: Squash merge with task ID
|
|
env:
|
|
CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
|
|
VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
|
|
DEVX_TASK_PREFIX: GRM
|
|
DEVX_VIKUNJA_PROJECT_ID: 6
|
|
HEAD_REF: ${{ github.head_ref }}
|
|
PR_TITLE: ${{ github.event.pull_request.title }}
|
|
REPOSITORY: ${{ github.repository }}
|
|
PR_NUMBER: ${{ github.event.number }}
|
|
run: |
|
|
. .venv/bin/activate 2>/dev/null || true
|
|
python3 -m devx.ci.auto_merge \
|
|
"$HEAD_REF" \
|
|
"$PR_TITLE" \
|
|
"$REPOSITORY" \
|
|
"$PR_NUMBER"
|