github-workflows/.github/workflows/deploy-validate.yml at main · JorisJonkers-dev/github-workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
name: Deploy Validate

on:
  workflow_call:
    inputs:
      deploy-dir:
        description: Path to the deploy/ directory inside the service repository.
        required: false
        type: string
        default: deploy
      schema-version:
        description: Exact npm version of @jorisjonkers-dev/deploy-config-schema.
        required: true
        type: string
      image-lock-path:
        description: Path to images.lock.json (relative to service repo root).
        required: false
        type: string
        default: deploy/images.lock.json
      context-ref:
        description: OCI digest ref for the cluster-deploy-context-public package.
        required: true
        type: string
      environments:
        description: Comma-separated list of target environment names.
        required: false
        type: string
        default: production
      comment:
        description: Post (or update) a sticky Deploy Preview PR comment when true.
        required: false
        type: boolean
        default: true
    outputs:
      preview-summary-artifact:
        description: Artifact name containing the rendered deploy-preview-summary.md.
        value: ${{ jobs.validate.outputs.preview-summary-artifact }}
      gate-summary-artifact:
        description: Artifact name containing the SC-4 gate-summary.json.
        value: ${{ jobs.validate.outputs.gate-summary-artifact }}

permissions:
  contents: read
  packages: read
  pull-requests: write

jobs:
  validate:
    name: Deploy Validate
    runs-on: ubuntu-latest
    timeout-minutes: 30
    outputs:
      preview-summary-artifact: deploy-preview-summary
      gate-summary-artifact: gate-summary-deploy-validate

    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      # Checkout github-workflows at this workflow file's own released version.
      # github.job_workflow_sha is empty inside a reusable workflow, which made
      # actions/checkout silently fall back to the default branch, so every
      # consumer ran main regardless of the tag it pinned. release-please keeps
      # the literal below in step with the tag this file ships in.
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          repository: JorisJonkers-dev/github-workflows
          ref: v0.35.0 # x-release-please-version
          path: .github-workflows
          persist-credentials: false

      - name: Render and preview deployment
        uses: ./.github-workflows/actions/deploy-preview
        with:
          deploy-dir: ${{ inputs.deploy-dir }}
          schema-version: ${{ inputs.schema-version }}
          image-lock-path: ${{ inputs.image-lock-path }}
          context-ref: ${{ inputs.context-ref }}
          environments: ${{ inputs.environments }}
          comment: ${{ inputs.comment }}

      # Always upload both artifacts so downstream consumers can rely on them (SC-4)
      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: gate-summary-deploy-validate
          path: gate-summary.json

      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        if: always()
        with:
          name: deploy-preview-summary
          path: deploy-preview-summary.md