From 3c236a0867fb8d8f203b9e8664ebedce7496160f Mon Sep 17 00:00:00 2001 From: Ildar Minaev Date: Tue, 14 Jul 2026 12:30:11 +0400 Subject: [PATCH 1/2] fix(workflows): isolate Docker publication from bot builds (#419) * fix(workflows): isolate Docker publication from bot builds * fix(workflows): satisfy YAML lint rules --- .github/workflows/super-linter.yaml | 2 +- .../dev-docker-build-multiple-images.yml | 136 +++++++++++------- .../dev-docker-build-selective.yml | 91 ++++++++---- .../dev-docker-build-single-image.yml | 125 ++++++++++------ workflow-templates/dev-mvn-docker-build.yml | 135 +++++++++++------ workflow-templates/renovate-config-lint.yaml | 44 +++++- 6 files changed, 366 insertions(+), 167 deletions(-) diff --git a/.github/workflows/super-linter.yaml b/.github/workflows/super-linter.yaml index 7c79472..cd2b42d 100644 --- a/.github/workflows/super-linter.yaml +++ b/.github/workflows/super-linter.yaml @@ -48,7 +48,7 @@ jobs: fi - name: Lint Code Base - uses: super-linter/super-linter@9e863354e3ff62e0727d37183162c4a88873df41 #v8.6.0 + uses: super-linter/super-linter/slim@9e863354e3ff62e0727d37183162c4a88873df41 # v8.6.0 env: VALIDATE_ALL_CODEBASE: ${{ inputs.full_scan || false }} GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/workflow-templates/dev-docker-build-multiple-images.yml b/workflow-templates/dev-docker-build-multiple-images.yml index 6fb29cb..1444cd4 100644 --- a/workflow-templates/dev-docker-build-multiple-images.yml +++ b/workflow-templates/dev-docker-build-multiple-images.yml @@ -27,100 +27,132 @@ on: description: "Symbol to replace in tags" push: branches: - - '**' + - '**' paths-ignore: - - '.github/**' - - 'docs/**' - - 'CODE-OF-CONDUCT.md' - - 'CONTRIBUTING.md' - - 'LICENSE' - - 'README.md' - - 'SECURITY.md' + - '.github/**' + - 'docs/**' + - 'CODE-OF-CONDUCT.md' + - 'CONTRIBUTING.md' + - 'LICENSE' + - 'README.md' + - 'SECURITY.md' pull_request: branches: - - '**' + - '**' paths-ignore: - - '.github/**' - - 'docs/**' - - 'CODE-OF-CONDUCT.md' - - 'CONTRIBUTING.md' - - 'LICENSE' - - 'README.md' - - 'SECURITY.md' + - '.github/**' + - 'docs/**' + - 'CODE-OF-CONDUCT.md' + - 'CONTRIBUTING.md' + - 'LICENSE' + - 'README.md' + - 'SECURITY.md' permissions: contents: read +concurrency: + group: ${{ github.workflow_ref }}-${{ github.event_name }}-${{ github.ref_type == 'branch' && github.ref_name || github.sha }} + cancel-in-progress: false + env: CONFIG_FILE: '.qubership/docker.cfg' + DRY_RUN: >- + ${{ + inputs.dry-run || + github.event.sender.type == 'Bot' || + github.triggering_actor != github.actor || + (github.event_name == 'pull_request' && + (github.event.pull_request.head.repo.full_name != github.repository || + github.event.pull_request.user.type == 'Bot')) + }} jobs: load-config: runs-on: ubuntu-latest + timeout-minutes: 10 permissions: - packages: read + contents: read outputs: + dry-run: ${{ steps.policy.outputs.dry-run }} packages: ${{ steps.config.outputs.config }} + tags: ${{ steps.metadata.outputs.result }} steps: + - name: "Export publish policy" + id: policy + env: + VALUE: ${{ env.DRY_RUN }} + run: printf 'dry-run=%s\n' "$VALUE" >> "$GITHUB_OUTPUT" + - name: Checkout repository uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - name: Get Configuration File - uses: netcracker/qubership-workflow-hub/actions/docker-config-resolver@cabbb90e9471163cfac84bd50ff0296b2803b44c #v2.3.0 + uses: netcracker/qubership-workflow-hub/actions/docker-config-resolver@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 id: config with: file-path: "${{ env.CONFIG_FILE }}" + - name: "Create name" + uses: netcracker/qubership-workflow-hub/actions/metadata-action@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 + id: metadata + with: + default-template: "{{ref-name}}" + extra-tags: ${{ inputs.tags || '' }} + replace-symbol: ${{ inputs.replace-symbol || '_' }} + + - name: "Summary step" + env: + METADATA: ${{ steps.metadata.outputs.result }} + TAGS: ${{ steps.metadata.outputs.result }} + run: | + printf '**Metadata:** %s\n' "$METADATA" >> "$GITHUB_STEP_SUMMARY" + printf '**Tags:** %s\n' "$TAGS" >> "$GITHUB_STEP_SUMMARY" + docker-build: - name: "Build and Publish Docker Image" + name: "Docker Image Dry Run" + if: needs.load-config.outputs.dry-run == 'true' needs: load-config permissions: - packages: write contents: read runs-on: ubuntu-latest + timeout-minutes: 60 strategy: fail-fast: true matrix: component: ${{ fromJson(needs.load-config.outputs.packages) }} steps: - - name: "Checkout code" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false - - - name: "Create name" - uses: netcracker/qubership-workflow-hub/actions/metadata-action@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 - id: metadata + - name: "Build Docker Image" + uses: netcracker/qubership-workflow-hub/actions/docker-action@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 with: - default-template: "{{ref-name}}" - extra-tags: ${{ github.event.inputs.tags || '' }} - replace-symbol: ${{ github.event.inputs.replace-symbol || '_'}} - - - name: "Prepare tags" - id: prepare_tags - run: | - BASE_TAG="${{ steps.metadata.outputs.result }}" - EXTRA_TAG="${{ github.event.inputs.tags }}" - if [ -n "$EXTRA_TAG" ]; then - TAGS="${BASE_TAG}, ${EXTRA_TAG}" - else - TAGS="${BASE_TAG}" - fi - echo "tags=${TAGS}" >> $GITHUB_OUTPUT - - - name: "Summary step" - run: | - echo "**Metadata:** ${{ steps.metadata.outputs.result }}" >> $GITHUB_STEP_SUMMARY - echo "**Tags:** ${{ steps.prepare_tags.outputs.tags }}" >> $GITHUB_STEP_SUMMARY + component: ${{ toJson(matrix.component) }} + platforms: ${{ matrix.component.platforms }} + tags: ${{ needs.load-config.outputs.tags }} + dry-run: "true" + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + docker-publish: + name: "Docker Image Publish" + if: needs.load-config.outputs.dry-run == 'false' && github.triggering_actor == github.actor + needs: load-config + permissions: + contents: read + packages: write + runs-on: ubuntu-latest + timeout-minutes: 60 + strategy: + fail-fast: true + matrix: + component: ${{ fromJson(needs.load-config.outputs.packages) }} + steps: - name: "Build and Publish Docker Image" - uses: netcracker/qubership-workflow-hub/actions/docker-action@cabbb90e9471163cfac84bd50ff0296b2803b44c #v2.3.0 + uses: netcracker/qubership-workflow-hub/actions/docker-action@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 with: component: ${{ toJson(matrix.component) }} platforms: ${{ matrix.component.platforms }} - checkout: "false" - tags: ${{ steps.prepare_tags.outputs.tags }} - dry-run: ${{ github.event.inputs.dry-run || 'false' }} + tags: ${{ needs.load-config.outputs.tags }} + dry-run: "false" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/workflow-templates/dev-docker-build-selective.yml b/workflow-templates/dev-docker-build-selective.yml index 5ab89c6..08dd350 100644 --- a/workflow-templates/dev-docker-build-selective.yml +++ b/workflow-templates/dev-docker-build-selective.yml @@ -52,23 +52,40 @@ permissions: contents: read concurrency: - group: ${{ github.ref_type == 'branch' && format('build-branch-{0}', github.ref_name) || format('build-{0}', github.sha) }} - cancel-in-progress: true + group: ${{ github.workflow_ref }}-${{ github.event_name }}-${{ github.ref_type == 'branch' && github.ref_name || github.sha }} + cancel-in-progress: false env: CONFIG_FILE: '.qubership/docker.cfg' + DRY_RUN: >- + ${{ + inputs.dry-run || + github.event.sender.type == 'Bot' || + github.triggering_actor != github.actor || + (github.event_name == 'pull_request' && + (github.event.pull_request.head.repo.full_name != github.repository || + github.event.pull_request.user.type == 'Bot')) + }} jobs: prepare: name: "Prepare Images and Metadata" runs-on: ubuntu-latest + timeout-minutes: 15 outputs: + dry-run: ${{ steps.policy.outputs.dry-run }} packages: ${{ steps.config.outputs.config }} tags: "${{ steps.meta.outputs.result }}" steps: + - name: "Export publish policy" + id: policy + env: + VALUE: ${{ env.DRY_RUN }} + run: printf 'dry-run=%s\n' "$VALUE" >> "$GITHUB_OUTPUT" + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: - persist-credentials: true + persist-credentials: false fetch-depth: 0 - name: Changed Files @@ -81,38 +98,37 @@ jobs: - name: Load Components and Platforms run: | - if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then - components=$(jq -c '.components' ${CONFIG_FILE}) - fi + cp "$CONFIG_FILE" updated_config.json + if [[ "$GITHUB_EVENT_NAME" == "pull_request" || "$GITHUB_EVENT_NAME" == "push" ]]; then all_changed_files=$(jq -c '.' .github/outputs/all_changed_files.json) if [ "$all_changed_files" != "null" ]; then - components_file="${CONFIG_FILE}" - files_file=".github/outputs/all_changed_files.json" - - jq -c --argjson files "$(cat "$files_file")" ' - .components | - [ .[] | select( - . as $component | - any($files[]; - [ $component.changeset[] as $ch | startswith($ch) ] | any - ) + components_file="${CONFIG_FILE}" + files_file=".github/outputs/all_changed_files.json" + + jq -c --argjson files "$(cat "$files_file")" ' + .components | + [ .[] | select( + . as $component | + any($files[]; + [ $component.changeset[] as $ch | startswith($ch) ] | any ) - ] - ' "$components_file" > /tmp/filtered_components.json + ) + ] + ' "$components_file" > /tmp/filtered_components.json - jq '.components = input' ${CONFIG_FILE} /tmp/filtered_components.json > updated_config.json + jq '.components = input' "$CONFIG_FILE" /tmp/filtered_components.json > updated_config.json fi fi - name: Get Configuration File - uses: netcracker/qubership-workflow-hub/actions/docker-config-resolver@cabbb90e9471163cfac84bd50ff0296b2803b44c #v2.3.0 + uses: netcracker/qubership-workflow-hub/actions/docker-config-resolver@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 id: config with: file-path: "updated_config.json" - name: Create tags for images - uses: netcracker/qubership-workflow-hub/actions/metadata-action@cabbb90e9471163cfac84bd50ff0296b2803b44c #v2.3.0 + uses: netcracker/qubership-workflow-hub/actions/metadata-action@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 id: meta with: default-template: "{{ref-name}}" @@ -120,9 +136,36 @@ jobs: replace-symbol: ${{ github.event.inputs.replace-symbol || '_'}} build: - name: ${{ matrix.component.name }} Image Build + name: ${{ matrix.component.name }} Image Dry Run + if: needs.prepare.outputs.dry-run == 'true' + needs: [prepare] + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: read + strategy: + fail-fast: false + matrix: + component: ${{ fromJson(needs.prepare.outputs.packages) }} + steps: + - name: Docker + uses: netcracker/qubership-workflow-hub/actions/docker-action@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 + with: + ref: ${{ github.ref }} + dry-run: "true" + download-artifact: false + component: ${{ toJson(matrix.component) }} + platforms: ${{ matrix.component.platforms }} + tags: ${{ needs.prepare.outputs.tags }} + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + publish: + name: ${{ matrix.component.name }} Image Publish + if: needs.prepare.outputs.dry-run == 'false' && github.triggering_actor == github.actor needs: [prepare] runs-on: ubuntu-latest + timeout-minutes: 60 permissions: contents: read packages: write @@ -132,10 +175,10 @@ jobs: component: ${{ fromJson(needs.prepare.outputs.packages) }} steps: - name: Docker - uses: netcracker/qubership-workflow-hub/actions/docker-action@cabbb90e9471163cfac84bd50ff0296b2803b44c #v2.3.0 + uses: netcracker/qubership-workflow-hub/actions/docker-action@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 with: ref: ${{ github.ref }} - dry-run: ${{ github.event.inputs.dry-run || github.event_name == 'pull_request' }} + dry-run: "false" download-artifact: false component: ${{ toJson(matrix.component) }} platforms: ${{ matrix.component.platforms }} diff --git a/workflow-templates/dev-docker-build-single-image.yml b/workflow-templates/dev-docker-build-single-image.yml index 493ab3f..b4e6a2b 100644 --- a/workflow-templates/dev-docker-build-single-image.yml +++ b/workflow-templates/dev-docker-build-single-image.yml @@ -25,76 +25,111 @@ on: default: false push: branches: - - '**' + - '**' paths-ignore: - - '.github/**' - - 'docs/**' - - 'CODE-OF-CONDUCT.md' - - 'CONTRIBUTING.md' - - 'LICENSE' - - 'README.md' - - 'SECURITY.md' + - '.github/**' + - 'docs/**' + - 'CODE-OF-CONDUCT.md' + - 'CONTRIBUTING.md' + - 'LICENSE' + - 'README.md' + - 'SECURITY.md' pull_request: branches: - - '**' + - '**' paths-ignore: - - '.github/**' - - 'docs/**' - - 'CODE-OF-CONDUCT.md' - - 'CONTRIBUTING.md' - - 'LICENSE' - - 'README.md' - - 'SECURITY.md' + - '.github/**' + - 'docs/**' + - 'CODE-OF-CONDUCT.md' + - 'CONTRIBUTING.md' + - 'LICENSE' + - 'README.md' + - 'SECURITY.md' permissions: contents: read +concurrency: + group: ${{ github.workflow_ref }}-${{ github.event_name }}-${{ github.ref_type == 'branch' && github.ref_name || github.sha }} + cancel-in-progress: false + env: + DRY_RUN: >- + ${{ + inputs.dry-run || + github.event.sender.type == 'Bot' || + github.triggering_actor != github.actor || + (github.event_name == 'pull_request' && + (github.event.pull_request.head.repo.full_name != github.repository || + github.event.pull_request.user.type == 'Bot')) + }} PLATFORMS: linux/amd64,linux/arm64 jobs: - docker-build: - name: "Build and Publish Docker Image" + prepare: + name: "Prepare Docker Image" + runs-on: ubuntu-latest + timeout-minutes: 10 permissions: - packages: write contents: read outputs: - metadata: "${{ steps.metadata.outputs.result }}" - tags: "${{ steps.prepare_tags.outputs.tags }}" - runs-on: ubuntu-latest + dry-run: ${{ steps.policy.outputs.dry-run }} + tags: ${{ steps.metadata.outputs.result }} steps: - - name: "Checkout code" - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 - with: - persist-credentials: false + - name: "Export publish policy" + id: policy + env: + VALUE: ${{ env.DRY_RUN }} + run: printf 'dry-run=%s\n' "$VALUE" >> "$GITHUB_OUTPUT" - name: "Create name" uses: netcracker/qubership-workflow-hub/actions/metadata-action@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 id: metadata - - - name: "Prepare tags" - id: prepare_tags - run: | - BASE_TAG="${{ steps.metadata.outputs.result }}" - EXTRA_TAG="${{ github.event.inputs.tags }}" - if [ -n "$EXTRA_TAG" ]; then - TAGS="${BASE_TAG}, ${EXTRA_TAG}" - else - TAGS="${BASE_TAG}" - fi - echo "tags=${TAGS}" >> $GITHUB_OUTPUT + with: + extra-tags: ${{ inputs.tags || '' }} - name: "Summary step" + env: + METADATA: ${{ steps.metadata.outputs.result }} + TAGS: ${{ steps.metadata.outputs.result }} run: | - echo "**Metadata:** ${{ steps.metadata.outputs.result }}" >> $GITHUB_STEP_SUMMARY - echo "**Tags:** ${{ steps.prepare_tags.outputs.tags }}" >> $GITHUB_STEP_SUMMARY + printf '**Metadata:** %s\n' "$METADATA" >> "$GITHUB_STEP_SUMMARY" + printf '**Tags:** %s\n' "$TAGS" >> "$GITHUB_STEP_SUMMARY" + + docker-build: + name: "Docker Image Dry Run" + if: needs.prepare.outputs.dry-run == 'true' + needs: prepare + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: read + steps: + - name: "Build Docker Image" + uses: netcracker/qubership-workflow-hub/actions/docker-action@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 + with: + custom-image-name: ${{ inputs.custom-image-name || '' }} + platforms: ${{ env.PLATFORMS }} + tags: ${{ needs.prepare.outputs.tags }} + dry-run: "true" + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + docker-publish: + name: "Docker Image Publish" + if: needs.prepare.outputs.dry-run == 'false' && github.triggering_actor == github.actor + needs: prepare + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: read + packages: write + steps: - name: "Build and Publish Docker Image" - uses: netcracker/qubership-workflow-hub/actions/docker-action@cabbb90e9471163cfac84bd50ff0296b2803b44c #v2.3.0 + uses: netcracker/qubership-workflow-hub/actions/docker-action@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 with: - custom-image-name: ${{ github.event.inputs.custom-image-name || '' }} + custom-image-name: ${{ inputs.custom-image-name || '' }} platforms: ${{ env.PLATFORMS }} - checkout: "false" - tags: ${{ steps.prepare_tags.outputs.tags }} - dry-run: ${{ github.event.inputs.dry-run || 'false' }} + tags: ${{ needs.prepare.outputs.tags }} + dry-run: "false" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/workflow-templates/dev-mvn-docker-build.yml b/workflow-templates/dev-mvn-docker-build.yml index 141f7df..6998386 100644 --- a/workflow-templates/dev-mvn-docker-build.yml +++ b/workflow-templates/dev-mvn-docker-build.yml @@ -30,77 +30,130 @@ on: default: false push: branches: - - '**' + - '**' paths-ignore: - - '.github/**' - - 'docs/**' - - 'CODE-OF-CONDUCT.md' - - 'CONTRIBUTING.md' - - 'LICENSE' - - 'README.md' - - 'SECURITY.md' + - '.github/**' + - 'docs/**' + - 'CODE-OF-CONDUCT.md' + - 'CONTRIBUTING.md' + - 'LICENSE' + - 'README.md' + - 'SECURITY.md' pull_request: branches: - - '**' + - '**' paths-ignore: - - '.github/**' - - 'docs/**' - - 'CODE-OF-CONDUCT.md' - - 'CONTRIBUTING.md' - - 'LICENSE' - - 'README.md' - - 'SECURITY.md' + - '.github/**' + - 'docs/**' + - 'CODE-OF-CONDUCT.md' + - 'CONTRIBUTING.md' + - 'LICENSE' + - 'README.md' + - 'SECURITY.md' permissions: contents: read +concurrency: + group: ${{ github.workflow_ref }}-${{ github.event_name }}-${{ github.ref_type == 'branch' && github.ref_name || github.sha }} + cancel-in-progress: false + +env: + DRY_RUN: >- + ${{ + inputs.dry-run || + github.event.sender.type == 'Bot' || + github.triggering_actor != github.actor || + (github.event_name == 'pull_request' && + (github.event.pull_request.head.repo.full_name != github.repository || + github.event.pull_request.user.type == 'Bot')) + }} + PLATFORMS: linux/amd64,linux/arm64 + jobs: - dev-build: - name: "Maven Build and Docker Image Publish" + maven-build: + name: "Maven Build" runs-on: ubuntu-latest + timeout-minutes: 60 permissions: contents: read - packages: write + outputs: + dry-run: ${{ steps.policy.outputs.dry-run }} + tags: ${{ steps.metadata.outputs.result }} steps: + - name: "Export publish policy" + id: policy + env: + VALUE: ${{ env.DRY_RUN }} + run: printf 'dry-run=%s\n' "$VALUE" >> "$GITHUB_OUTPUT" + - name: "Checkout code" uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - name: "Maven build artifact" - uses: netcracker/qubership-workflow-hub/actions/maven-snapshot-deploy@cabbb90e9471163cfac84bd50ff0296b2803b44c #v2.3.0 + uses: netcracker/qubership-workflow-hub/actions/maven-snapshot-deploy@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 with: - maven-command: "${{ github.event.inputs.maven-command || '--batch-mode clean install -Dgpg.skip=true' }}" - java-version: ${{ github.event.inputs.java-version || '21' }} + maven-command: "${{ env.DRY_RUN == 'true' && '--batch-mode clean install -Dgpg.skip=true' || inputs.maven-command || '--batch-mode clean install -Dgpg.skip=true' }}" + java-version: ${{ inputs.java-version || '21' }} + upload-artifact: "true" + artifact-id: maven-build-output + maven-token: ${{ github.token }} - name: "Generate metadata" uses: netcracker/qubership-workflow-hub/actions/metadata-action@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 id: metadata - - - name: "Prepare tags" - id: prepare_tags - run: | - BASE_TAG="${{ steps.metadata.outputs.result }}" - EXTRA_TAG="${{ github.event.inputs.tags }}" - if [ -n "$EXTRA_TAG" ]; then - TAGS="${BASE_TAG}, ${EXTRA_TAG}" - else - TAGS="${BASE_TAG}" - fi - echo "tags=${TAGS}" >> $GITHUB_OUTPUT + with: + extra-tags: ${{ inputs.tags || '' }} - name: "Summary step" + env: + METADATA: ${{ steps.metadata.outputs.result }} + TAGS: ${{ steps.metadata.outputs.result }} run: | - echo "**Metadata:** ${{ steps.metadata.outputs.result }}" >> $GITHUB_STEP_SUMMARY - echo "**Tags:** ${{ steps.prepare_tags.outputs.tags }}" >> $GITHUB_STEP_SUMMARY + printf '**Metadata:** %s\n' "$METADATA" >> "$GITHUB_STEP_SUMMARY" + printf '**Tags:** %s\n' "$TAGS" >> "$GITHUB_STEP_SUMMARY" + docker-build: + name: "Docker Image Dry Run" + if: needs.maven-build.outputs.dry-run == 'true' + needs: maven-build + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: read + steps: + - name: "Build Docker Image" + uses: netcracker/qubership-workflow-hub/actions/docker-action@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 + with: + custom-image-name: ${{ inputs.custom-image-name || '' }} + platforms: ${{ env.PLATFORMS }} + download-artifact: "true" + download-artifact-name: maven-build-output + tags: ${{ needs.maven-build.outputs.tags }} + dry-run: "true" + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + docker-publish: + name: "Docker Image Publish" + if: needs.maven-build.outputs.dry-run == 'false' && github.triggering_actor == github.actor + needs: maven-build + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: read + packages: write + steps: - name: "Build and Publish Docker Image" - uses: netcracker/qubership-workflow-hub/actions/docker-action@cabbb90e9471163cfac84bd50ff0296b2803b44c #v2.3.0 + uses: netcracker/qubership-workflow-hub/actions/docker-action@cabbb90e9471163cfac84bd50ff0296b2803b44c # v2.3.0 with: - custom-image-name: ${{ github.event.inputs.custom-image-name || '' }} + custom-image-name: ${{ inputs.custom-image-name || '' }} platforms: ${{ env.PLATFORMS }} - checkout: "false" - tags: ${{ steps.prepare_tags.outputs.tags }} - dry-run: ${{ github.event.inputs.dry-run || 'false' }} + download-artifact: "true" + download-artifact-name: maven-build-output + tags: ${{ needs.maven-build.outputs.tags }} + dry-run: "false" env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/workflow-templates/renovate-config-lint.yaml b/workflow-templates/renovate-config-lint.yaml index 98607b2..79d51f6 100644 --- a/workflow-templates/renovate-config-lint.yaml +++ b/workflow-templates/renovate-config-lint.yaml @@ -1,24 +1,60 @@ name: Validate Renovate Config on: + workflow_dispatch: {} push: paths: - renovate.json + - renovate.jsonc + - renovate.json5 + - .github/renovate.json + - .github/renovate.jsonc + - .github/renovate.json5 + - .gitlab/renovate.json + - .gitlab/renovate.jsonc + - .gitlab/renovate.json5 + - .renovaterc + - .renovaterc.json + - .renovaterc.jsonc + - .renovaterc.json5 + - package.json pull_request: paths: - renovate.json + - renovate.jsonc + - renovate.json5 + - .github/renovate.json + - .github/renovate.jsonc + - .github/renovate.json5 + - .gitlab/renovate.json + - .gitlab/renovate.jsonc + - .gitlab/renovate.json5 + - .renovaterc + - .renovaterc.json + - .renovaterc.jsonc + - .renovaterc.json5 + - package.json -permissions: read-all +permissions: + contents: read + +concurrency: + group: renovate-config-lint-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true jobs: validate-renovate-config: - name: Validate renovate.json + name: Validate Renovate configuration runs-on: ubuntu-latest + timeout-minutes: 10 steps: - name: Checkout sources uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - - name: Validate renovate.json - run: docker run --rm -v "$PWD":/work -w /work renovate/renovate:latest renovate-config-validator renovate.json + - name: Validate Renovate configuration + run: >- + docker run --rm -v "$PWD":/work -w /work + renovate/renovate:43.256.0@sha256:6658b0d04d9f09550a9802181a4cc21fd8ba5d83238018f710e847466f6a488c + renovate-config-validator --strict From c13686c8dc27971bfe57e318b499f43bb313c4a4 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 14 Jul 2026 08:32:13 +0000 Subject: [PATCH 2/2] chore(deps): bump netcracker/qubership-workflow-hub Bumps [netcracker/qubership-workflow-hub](https://github.com/netcracker/qubership-workflow-hub) from 2.3.1 to 2.4.0. - [Release notes](https://github.com/netcracker/qubership-workflow-hub/releases) - [Commits](https://github.com/netcracker/qubership-workflow-hub/compare/v2.3.1...v2.4.0) --- updated-dependencies: - dependency-name: netcracker/qubership-workflow-hub dependency-version: 2.4.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- workflow-templates/apm-packages-update.yml | 2 +- workflow-templates/maven-monorepo-component-release.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/workflow-templates/apm-packages-update.yml b/workflow-templates/apm-packages-update.yml index 1a35fe2..96320f1 100644 --- a/workflow-templates/apm-packages-update.yml +++ b/workflow-templates/apm-packages-update.yml @@ -71,7 +71,7 @@ jobs: persist-credentials: false - name: Run apm-packages-update action - uses: netcracker/qubership-workflow-hub/actions/apm-packages-update@v2.3.1 + uses: netcracker/qubership-workflow-hub/actions/apm-packages-update@v2.4.0 with: branch: ${{ env.BRANCH }} debug: ${{ env.DEBUG }} diff --git a/workflow-templates/maven-monorepo-component-release.yaml b/workflow-templates/maven-monorepo-component-release.yaml index 0b90c09..d2e29fd 100644 --- a/workflow-templates/maven-monorepo-component-release.yaml +++ b/workflow-templates/maven-monorepo-component-release.yaml @@ -53,7 +53,7 @@ jobs: - name: Release Component id: release - uses: netcracker/qubership-workflow-hub/actions/maven-monorepo-release@v2.3.1 + uses: netcracker/qubership-workflow-hub/actions/maven-monorepo-release@v2.4.0 with: component: ${{ inputs.component }} version-type: ${{ inputs.version-type }}