Repository navigation
ci!: keep only the image, deploy and release workflows - #8
Merged
Merged
Conversation
This was referenced Nov 6, 2026
Contributor
Author
|
Pushed 8514790: the deploy is now the last job of the CI run, so |
just lint and CI now run the same script, so a wrong input name in a template fails on a laptop too.
The shared workflows carried the needs of single repos as inputs, such as a ClickHouse server for the tests of nebula. A repo now spells out its check job from a template and runs just ci, and keeps its own needs in its own ci.yml. Only the workflows that hold production credentials or set a naming contract stay shared. deploy-ecs.yml checks the deploy label by itself when a workflow_run event starts it. release.yml fails unless the tagged commit passed ci-ok, and uses goreleaser when the repo has a .goreleaser.yaml. BREAKING CHANGE: go.yml, python.yml and terraform.yml are removed, and image.yml, deploy-ecs.yml and release.yml lose inputs. Callers of @v1 keep working. Move a repo with the templates and call @v2.
The download script refuses a directory that does not exist.
A deploy no longer waits for an image. The deploy job of ci.yml runs after the image job of the same push, and deploy-ecs.yml checks the deploy label of the merged pull request when a push calls it. The release gate and the required check use the check 'Checking the code' instead of ci-ok.
just lint stopped when actionlint was missing. It now downloads version 1.7.12 into ~/.cache/actionlint when it is not on the PATH, so a local run and CI use the same version.
A label event no longer starts the CI of this repo: only opened, synchronize, reopened and ready_for_review do. A draft pull request skips the lint. The lint job installs actionlint through scripts/lint.sh now, so its install step is removed. The fixture image job is removed too.
Before, an image build of a pull request was never pushed. Now a pull request with the label push-image pushes its image to ECR, and a merge or a manual run pushes too. Other labels do not start the workflow again. The push input now defaults to false and forces a push. The commit input builds a commit other than the one of the event. The service templates listen for labeled events, skip the image job for drafts and failed checks, and no longer pass push.
dennis-tra
force-pushed
the
ci/simplify-shared-workflows
branch
from
November 9, 2026 13:16
c72b48d to
8eab51d
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
The shared workflows carried the needs of single repos as inputs.
go.ymlandpython.ymlhad 7 ClickHouse inputs that only nebula used, and inputs such asgoprivate,smoke-urlandgcp-service-accountthat no repo used. A workflow with 15 inputs is harder to read than 20 lines in the repo.This is version 2:
go.yml,python.ymlandterraform.ymlare removed. A repo spells out acheckjob from a template and runsjust ci. The needs of one repo, such as a service container, stay in that repo'sci.yml.image.yml,deploy-ecs.ymlandrelease.ymlstay shared, because they hold production credentials or set a naming contract. Each lost the inputs that no repo needs.deploy-ecs.ymlchecks thedeploylabel by itself when aworkflow_runevent starts the deploy. A repo has onedeploy.ymlwith the triggersworkflow_dispatchandworkflow_run, andci.ymlhas no deploy job.release.ymlfails unless the tagged commit has a passingci-ok, so a repo does not run its checks again on a tag. It uses goreleaser when the repo has a.goreleaser.yaml.checkjob and call@v2.python-service-ciis new.just lintand CI runscripts/lint.sh.Callers of
@v1keep working.How I checked it
just cipasses locally: actionlint 1.7.12 on the workflows and on the templates against the workflows of this commit.deploy-ecs.ymlwith aworkflow_runevent, and theci-okgate ofrelease.yml. Both need a merged caller. The plan is to test the deploy with boomo first.Deploy
After the merge, tag the major version:
git tag v2.0.0 && git tag v2 && git push origin v2.0.0 v2. Move the## [Unreleased]section ofCHANGELOG.mdto## [2.0.0]first. The pull requests that move the repos to@v2cannot start their image jobs before this tag exists.This conflicts with #6 in
README.md.