Reusable workflows->composite actions - #89
Draft
samuelburnham wants to merge 4 commits into
Draft
Conversation
- Drop the GitHub App token everywhere: automation runs on the scoped `GITHUB_TOKEN` with job-level `permissions` blocks and fail-closed workflow defaults. repo-sync falls back to opening an issue asking for a manual sync when a push touches workflow files, which the token cannot write. - Replace JasonEtco/create-an-issue and peter-evans/create-issue-from-file with a first-party `create-issue` action: stdlib Python around the gh CLI that dedupes by title and updates the existing open issue. - Convert reusable workflows to composite actions: repo-sync, rust-version-check, unused-deps, links-check, typos, lints, msrv, wasm, codecov, gpu-ci (cuda and opencl merged behind a `gpu-framework` input), and gpu-bench. Keep docs and licenses-audits as reusable workflows since they take no configuration. Remove check-lurk-compiles and bench-pr-comment, superseded in ix. - Reference sibling actions and same-repo actions with `$/` self-repository refs, deleting all ci-workflows self-checkouts along with their default-branch version skew; actionlint gets an ignore for its `$/` false positive (rhysd/actionlint#711), and zizmor's self-repository audit endorses the syntax. - Standardize on actions-rust-lang/setup-rust-toolchain: Rust CI actions assume the caller provisions the toolchain and cache (or a wrapper like ix's), while release-pr and typos provision their own since Rust is incidental there. ci-env is gone; the toolchain action covers its env vars. - gpu-bench reports regressions via a step output because composite steps silently ignore `continue-on-error`; also fix its NUM_VCPUS typo and release-pr's unguarded `cd`s. Callers migrate from `uses: .../.github/workflows/<x>.yml@main` to job steps calling `.../.github/actions/<x>@<ref>`; each action description documents its required permissions and setup assumptions.
The github-actions ecosystem's "/" directory only covers `.github/workflows/`, so the third-party actions that moved into composite actions would no longer receive update PRs without listing their directories explicitly.
- create-issue runs end-to-end against a stub `gh` on PATH that records its calls: the create + label path, the update-existing-by-title path, and rejection when both `body` and `body-file` are set, asserted against the recorded call log - lints, wasm, and unused-deps run on a generated fixture crate through the documented caller pattern (checkout, then setup-rust-toolchain, then the action) - rust-version-check runs twice against the stub `gh`: an up-to-date pin must not open an issue, and an outdated pin (installed so `rustup show` reports it as active) must open exactly one with the parsed version in the body
actionlint can't parse composite actions (rhysd/actionlint#46), so their bash `run:` blocks otherwise go unchecked — the class of bug that produced the NUM_VCPUS typo and release-pr's unguarded `cd`s. A Python script beside the action extracts each block via `yq -o=json`, masks `${{ }}` expressions the way actionlint does, and batches everything through one shellcheck invocation. Both tools are preinstalled on GitHub-hosted runners.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.