GitHub Actions

name: CI

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    runs-on: ubuntu-latest
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7.0.1
      - uses: actions/setup-node@v7.1.0
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm test

on:
  push:
    tags: ["v*.*.*"]
    paths: ["src/**", "package-lock.json"]
  schedule:
    - cron: "0 3 * * 1"          # Mondays 03:00 UTC
  workflow_dispatch:
    inputs:
      environment:
        description: Target environment
        type: choice
        options: [staging, production]
        default: staging
      dry_run:
        type: boolean
        default: true

      - id: ver
        run: echo "version=$(cat VERSION)" >> "$GITHUB_OUTPUT"
      - run: echo "Building ${{ steps.ver.outputs.version }}"
      - run: echo "### Done :rocket:" >> "$GITHUB_STEP_SUMMARY"

jobs:
  test:
    strategy:
      fail-fast: false
      max-parallel: 4
      matrix:
        os: [ubuntu-latest, windows-latest]
        python: ["3.12", "3.13"]
        include:
          - os: ubuntu-latest
            python: "3.14"
            experimental: true
        exclude:
          - os: windows-latest
            python: "3.12"
    runs-on: ${{ matrix.os }}
    continue-on-error: ${{ matrix.experimental == true }}
    steps:
      - uses: actions/checkout@v7.0.1
      - uses: actions/setup-python@v7.1.0
        with:
          python-version: ${{ matrix.python }}
          cache: pip
      - run: pytest

      - uses: actions/cache@v6.1.0
        with:
          path: ~/.cache/go-build
          key: go-${{ runner.os }}-${{ hashFiles('**/go.sum') }}
          restore-keys: |
            go-${{ runner.os }}-

      - uses: actions/upload-artifact@v7.0.2
        with:
          name: dist
          path: dist/
          retention-days: 7
          if-no-files-found: error

  # in a later job
      - uses: actions/download-artifact@v8.0.2
        with:
          name: dist
          path: dist/

permissions:
  contents: read          # workflow default

jobs:
  release:
    permissions:
      contents: write       # create releases and tags
      pull-requests: write
      packages: write       # push to GHCR
      id-token: write       # OIDC token request
      attestations: write   # artifact attestations

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://example.com
    steps:
      - run: ./deploy.sh
        env:
          API_TOKEN: ${{ secrets.API_TOKEN }}

# .github/workflows/build.yml (callee)
on:
  workflow_call:
    inputs:
      image:
        required: true
        type: string
    secrets:
      registry_token:
        required: false
    outputs:
      digest:
        value: ${{ jobs.build.outputs.digest }}
jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.push.outputs.digest }}
    steps:
      - id: push
        run: echo "digest=sha256:example" >> "$GITHUB_OUTPUT"

# caller
jobs:
  build:
    uses: <OWNER>/<REPO>/.github/workflows/build.yml@v1
    with:
      image: ghcr.io/<OWNER>/app
    secrets: inherit        # or pass named secrets explicitly

# .github/actions/setup/action.yml (composite action, used as ./.github/actions/setup)
name: Setup
runs:
  using: composite
  steps:
    - uses: actions/setup-node@v7.1.0
      with: { node-version: 22, cache: npm }
    - run: npm ci
      shell: bash

permissions:
  id-token: write
  contents: read

steps:
  - uses: aws-actions/configure-aws-credentials@v6.3.0
    with:
      role-to-assume: arn:aws:iam::<ACCOUNT_ID>:role/<ROLE>
      aws-region: eu-west-2

  - uses: azure/login@v3.1.0
    with:
      client-id: ${{ vars.AZURE_CLIENT_ID }}
      tenant-id: ${{ vars.AZURE_TENANT_ID }}
      subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

  - uses: google-github-actions/auth@v3
    with:
      workload_identity_provider: projects/<NUM>/locations/global/workloadIdentityPools/<POOL>/providers/<PROVIDER>
      service_account: <SA>@<PROJECT>.iam.gserviceaccount.com

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: false      # queue deploys instead of killing a running one

jobs:
  integration:
    runs-on: ubuntu-latest
    services:
      db:
        image: postgres:17
        env:
          POSTGRES_PASSWORD: example     # throw-away CI value
        ports: ["5432:5432"]
        options: >-
          --health-cmd pg_isready --health-interval 10s --health-retries 5
    steps:
      - uses: actions/checkout@v7.0.1
      - run: ./scripts/integration-tests.sh
        env:
          DATABASE_URL: postgres://postgres:example@localhost:5432/postgres

      - name: Deploy only from main
        if: github.ref == 'refs/heads/main'
        run: ./deploy.sh

      - name: Annotate
        run: echo "::notice title=Done::finished"      # also ::warning and ::error

gh run watch "$(gh run list --branch "$(git branch --show-current)" --limit 1 --json databaseId --jq '.[0].databaseId')" --exit-status

      - name: Print PR title
        env:
          TITLE: ${{ github.event.pull_request.title }}
        run: echo "$TITLE"