github-workflows/.github/workflows/gitops-ci.yml at main · JorisJonkers-dev/github-workflows · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
name: GitOps CI

on:
  workflow_call:
    inputs:
      overlay-paths:
        description: Newline- or comma-separated kustomize overlay paths to render and validate.
        required: true
        type: string
      platform-config-paths:
        description: Newline- or comma-separated platform config globs to validate.
        required: false
        type: string
        default: |-
          inventory/**/*.yaml
          inventory/**/*.yml
      deploy-config-command:
        description: Optional command that writes deploy-config JSON to DEPLOY_CONFIG_OUT.
        required: false
        type: string
        default: ''
      deploy-config-targets:
        description: Optional newline-separated adapter=relative/committed/path.yaml render drift targets.
        required: false
        type: string
        default: ''
      system-tests-command:
        description: Optional caller-owned system test command.
        required: false
        type: string
        default: ''
    secrets:
      packages-token:
        description: GitHub Packages token used for deploy-config-schema package resolution.
        required: false

permissions:
  contents: read
  packages: read

jobs:
  gitops:
    name: GitOps CI
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - uses: actions/checkout@v7

      - name: Resolve workflow ref
        id: workflow-ref
        shell: bash
        env:
          WORKFLOW_REF: ${{ github.workflow_ref }}
        run: |
          set -euo pipefail

          ref="${WORKFLOW_REF#*@}"
          if [ -z "$ref" ] || [ "$ref" = "$WORKFLOW_REF" ]; then
            echo "::error::Unable to resolve reusable workflow ref from $WORKFLOW_REF"
            exit 1
          fi

          printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT"

      - uses: actions/checkout@v7
        with:
          repository: JorisJonkers-dev/github-workflows
          ref: v0.36.0 # x-release-please-version
          path: .github-workflows
          persist-credentials: false

      - name: Validate platform config
        uses: ./.github-workflows/actions/platform-config-validate
        with:
          config-paths: ${{ inputs.platform-config-paths }}
          schema-kind: auto
          node-auth-token: ${{ secrets.packages-token || github.token }}

      - name: Validate Flux render
        uses: ./.github-workflows/actions/flux-render-validate
        with:
          overlay-paths: ${{ inputs.overlay-paths }}

      - name: Check deploy config render drift
        if: ${{ inputs.deploy-config-command != '' && inputs.deploy-config-targets != '' }}
        uses: ./.github-workflows/actions/deploy-config-render-drift
        with:
          deploy-config-command: ${{ inputs.deploy-config-command }}
          targets: ${{ inputs.deploy-config-targets }}
          node-auth-token: ${{ secrets.packages-token || github.token }}

      - name: Run system tests
        if: ${{ inputs.system-tests-command != '' }}
        env:
          SYSTEM_TESTS_COMMAND: ${{ inputs.system-tests-command }}
        run: bash -euo pipefail -c "$SYSTEM_TESTS_COMMAND"