Repository navigation

feat(tool-images): add a build runner image and GLPK and MariaDB Connector/C capabilities #38

	name: Pull Secret renewal

	# Runs the ARC role's App-sourced pull Secret renewal in a kind cluster (tests/pull_secret_renewal/run.sh): the role's rendered CronJob and RBAC, the renewer image built from this checkout, and a stand-in for GitHub's token endpoint. Only on changes that can affect the renewal.
	#
	# GitHub-hosted ubuntu-latest has Docker, kind and kubectl already.

	on:
	pull_request:
	paths:
	- roles/github_runner_arc/**
	- plugins/filter/**
	- scripts/renew-pull-secret.sh
	- pull-secret-renewer/**
	- tests/pull_secret_renewal/**
	- .github/workflows/pull-secret-renewal.yml
	workflow_dispatch:

	concurrency:
	group: pull-secret-renewal-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	renewal:
	name: Renewal in kind
	runs-on: ubuntu-latest
	timeout-minutes: 20
	steps:
	- uses: actions/checkout@v7

	- name: Install Ansible
	run: \|
	set -euo pipefail
	if ! python3 -m venv "${RUNNER_TEMP}/venv" 2>/dev/null; then
	sudo apt-get update -qq
	sudo apt-get install -y -qq python3-venv
	python3 -m venv "${RUNNER_TEMP}/venv"
	fi
	"${RUNNER_TEMP}/venv/bin/pip" install --quiet --prefer-binary ansible-core
	echo "${RUNNER_TEMP}/venv/bin" >> "$GITHUB_PATH"

	- name: Run the renewal test
	run: tests/pull_secret_renewal/run.sh