From 61f0d9082950476c5c08a2d010cb64ccc75bbebc Mon Sep 17 00:00:00 2001 From: Jordan Dominion Date: Sat, 17 Aug 2024 11:42:50 -0400 Subject: [PATCH] CI reworking again Switch to reusable workflows --- .github/workflows/ci-pipeline.yml | 464 ++---------------- .github/workflows/ci-security.yml | 61 +-- .github/workflows/code-scanning.yml | 78 --- .../Tgstation.Server.ReleaseNotes/Program.cs | 123 ----- 4 files changed, 57 insertions(+), 669 deletions(-) delete mode 100644 .github/workflows/code-scanning.yml diff --git a/.github/workflows/ci-pipeline.yml b/.github/workflows/ci-pipeline.yml index f72e66d516..9e8579a23d 100644 --- a/.github/workflows/ci-pipeline.yml +++ b/.github/workflows/ci-pipeline.yml @@ -17,7 +17,6 @@ # - apt repo: https://github.com/tgstation/tgstation-ppa # - winget: https://github.com/microsoft/winget-pkgs/tree/master/manifests/t/Tgstation/Server name: 'CI Pipeline' -run-name: CI Pipeline [${{ inputs.distinct_id && inputs.distinct_id || github.ref_name }}] on: schedule: @@ -26,17 +25,16 @@ on: branches: - dev - master - workflow_dispatch: + workflow_call: inputs: pull_request_number: description: 'Pull Request Number' required: true + type: string pull_request_head_sha: description: 'Pull Request HEAD SHA' required: true - distinct_id: - description: 'Distinct ID' - required: true + type: string env: TGS_DOTNET_VERSION: 8 @@ -54,8 +52,8 @@ concurrency: cancel-in-progress: true jobs: - ci-start-gate: - name: CI Start Gate + build-releasenotes: + name: Build ReleaseNotes for Other Jobs runs-on: ubuntu-latest steps: - name: Setup dotnet @@ -74,30 +72,6 @@ jobs: with: ref: "refs/pull/${{ inputs.pull_request_number }}/merge" - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: Build ReleaseNotes run: dotnet publish -c Release -p:TGS_HOST_NO_WEBPANEL=true -o release_notes_bins tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj @@ -107,12 +81,48 @@ jobs: name: release_notes_bins path: ./release_notes_bins/ - - name: Set CI Check Run (Started) - run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --ci-check ${{ inputs.pull_request_head_sha || github.sha }} ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} Started ${{ github.run_id }} + code-scanning: + name: Run CodeQL + runs-on: ubuntu-latest + permissions: + security-events: write + actions: read + env: + TGS_TELEMETRY_KEY_FILE: /tmp/tgs_telemetry_key.txt + steps: + - name: Setup dotnet + uses: actions/setup-dotnet@v4 + with: + dotnet-version: '${{ env.TGS_DOTNET_VERSION }}.0.x' + dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }} + + - name: Checkout (Branch) + uses: actions/checkout@v4 + + - name: Read Current SHA + id: get-pr-sha + if: github.event_name != 'push' && github.event_name != 'schedule' + shell: bash + run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT + + - name: Initialize CodeQL + uses: github/codeql-action/init@v3 + with: + languages: csharp + + - name: Setup Telemetry Key File + run: echo "fake_telemetry_key" > ${{ env.TGS_TELEMETRY_KEY_FILE }} + + - name: Build + run: dotnet build -c ReleaseNoWindows -p:TGS_HOST_NO_WEBPANEL=true + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v3 + with: + category: "/language:csharp" dmapi-build: name: Build DMAPI - needs: ci-start-gate strategy: fail-fast: false matrix: @@ -178,23 +188,6 @@ jobs: shell: bash run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - name: Build DMAPI Test Project run: | @@ -218,7 +211,6 @@ jobs: opendream-build: name: Build DMAPI (OpenDream) - needs: ci-start-gate strategy: fail-fast: false matrix: @@ -249,30 +241,6 @@ jobs: with: ref: "refs/pull/${{ inputs.pull_request_number }}/merge" - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: Checkout OpenDream run: | cd $HOME @@ -298,7 +266,6 @@ jobs: efcore-version-match: name: Check Nuget Versions Match Tools - needs: ci-start-gate runs-on: ubuntu-latest steps: - name: Checkout (Branch) @@ -311,30 +278,6 @@ jobs: with: ref: "refs/pull/${{ inputs.pull_request_number }}/merge" - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: Retrieve dotnet-ef Tool Version id: dotnet-ef-tool run: echo "version=$(cat src/Tgstation.Server.Host/.config/dotnet-tools.json | jq -r '.tools."dotnet-ef".version')" >> $GITHUB_OUTPUT @@ -379,7 +322,7 @@ jobs: pages-build: name: Build gh-pages - needs: ci-start-gate + needs: build-releasenotes runs-on: ubuntu-latest steps: - name: Setup dotnet @@ -398,30 +341,6 @@ jobs: with: ref: "refs/pull/${{ inputs.pull_request_number }}/merge" - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: gh-pages Clone run: git clone -b gh-pages --single-branch "https://git@github.com/tgstation/tgstation-server" $HOME/tgsdox @@ -478,7 +397,6 @@ jobs: docker-build: name: Build Docker Image - needs: ci-start-gate runs-on: ubuntu-latest env: TGS_TELEMETRY_KEY_FILE: tgs_telemetry_key.txt @@ -493,30 +411,6 @@ jobs: with: ref: "refs/pull/${{ inputs.pull_request_number }}/merge" - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: Setup Telemetry Key File shell: bash run: echo "${{ secrets.TGS_TELEMETRY_KEY }}" > ${{ env.TGS_TELEMETRY_KEY_FILE }} @@ -530,7 +424,6 @@ jobs: linux-unit-tests: name: Linux Tests - needs: ci-start-gate strategy: fail-fast: false matrix: @@ -568,30 +461,6 @@ jobs: with: ref: "refs/pull/${{ inputs.pull_request_number }}/merge" - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: Enable Corepack run: corepack enable @@ -623,7 +492,6 @@ jobs: windows-unit-tests: name: Windows Tests - needs: ci-start-gate strategy: fail-fast: false matrix: @@ -655,30 +523,6 @@ jobs: with: ref: "refs/pull/${{ inputs.pull_request_number }}/merge" - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: Enable Corepack run: corepack enable @@ -712,7 +556,7 @@ jobs: windows-integration-tests: name: Windows Live Tests - needs: [dmapi-build, opendream-build] + needs: [ dmapi-build, opendream-build ] strategy: fail-fast: false matrix: @@ -732,15 +576,6 @@ jobs: ${{ env.OD_MIN_COMPAT_DOTNET_VERSION }}.0.x dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }} - - name: Retrieve ReleaseNotes Binaries - uses: actions/download-artifact@v4 - with: - name: release_notes_bins - path: release_notes_bins - - - name: Update CI Check Run (Rerun) # Do this here because these are the flakiest tests - run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --ci-check ${{ inputs.pull_request_head_sha || github.sha }} ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} Rerun ${{ github.run_id }} - - name: Wait for LocalDB Connection # Do this first because we don't want to find out it's failing later shell: powershell if: ${{ matrix.database-type == 'SqlServer' }} @@ -819,30 +654,6 @@ jobs: with: ref: "refs/pull/${{ inputs.pull_request_number }}/merge" - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: Enable Corepack run: corepack enable @@ -1011,15 +822,6 @@ jobs: ${{ env.OD_MIN_COMPAT_DOTNET_VERSION }}.0.x dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }} - - name: Retrieve ReleaseNotes Binaries - uses: actions/download-artifact@v4 - with: - name: release_notes_bins - path: release_notes_bins - - - name: Update CI Check Run (Rerun) # Do this here because these are the flakiest tests - run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --ci-check ${{ inputs.pull_request_head_sha || github.sha }} ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} Rerun ${{ github.run_id }} - - name: Disable ptrace_scope run: echo 0 | sudo tee /proc/sys/kernel/yama/ptrace_scope @@ -1073,30 +875,6 @@ jobs: with: ref: "refs/pull/${{ inputs.pull_request_number }}/merge" - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: Enable Corepack run: corepack enable @@ -1182,30 +960,6 @@ jobs: with: ref: "refs/pull/${{ inputs.pull_request_number }}/merge" - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: Retrieve OpenAPI Spec uses: actions/download-artifact@v4 with: @@ -1230,30 +984,6 @@ jobs: with: ref: "refs/pull/${{ inputs.pull_request_number }}/merge" - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: Retrieve Linux Unit Test Coverage (Debug) uses: actions/download-artifact@v4 with: @@ -1506,7 +1236,6 @@ jobs: build-deb: name: Build .deb Package # Can't do i386 due to https://github.com/dotnet/core/issues/4595 - needs: ci-start-gate runs-on: ubuntu-latest env: TGS_TELEMETRY_KEY_FILE: /tmp/tgs_telemetry_key.txt @@ -1553,30 +1282,6 @@ jobs: with: ref: "refs/pull/${{ inputs.pull_request_number }}/merge" - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: Grab Most Recent Changelog run: curl -L https://raw.githubusercontent.com/tgstation/tgstation-server/gh-pages/changelog.yml -o changelog.yml @@ -1645,7 +1350,6 @@ jobs: build-msi: name: Build Windows Installer .exe - needs: ci-start-gate runs-on: windows-latest env: TGS_TELEMETRY_KEY_FILE: C:/tgs_telemetry_key.txt @@ -1676,30 +1380,6 @@ jobs: with: ref: "refs/pull/${{ inputs.pull_request_number }}/merge" - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: Restore Wix dotnet Tool run: | cd build/package/winget @@ -1815,7 +1495,7 @@ jobs: check-winget-pr-template: name: Check winget-pkgs Pull Request Template is up to date - needs: ci-start-gate + needs: build-releasenotes runs-on: ubuntu-latest steps: - name: Setup dotnet @@ -1840,24 +1520,6 @@ jobs: shell: bash run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - name: Retrieve Latest winget-pkgs PULL_REQUEST_TEMPLATE commit SHA from GitHub API id: get-sha run: | @@ -1875,37 +1537,11 @@ jobs: ci-completion-gate: name: CI Completion Gate - needs: [ pages-build, docker-build, build-deb, build-msi, validate-openapi-spec, upload-code-coverage, check-winget-pr-template, efcore-version-match, ci-start-gate, dmapi-build, opendream-build, windows-unit-tests, linux-unit-tests, windows-integration-tests, linux-integration-tests ] + needs: [ pages-build, docker-build, build-deb, build-msi, validate-openapi-spec, upload-code-coverage, check-winget-pr-template, efcore-version-match, code-scanning ] runs-on: ubuntu-latest - if: always() && needs.ci-start-gate.result == 'success' steps: - - name: Setup dotnet - uses: actions/setup-dotnet@v4 - with: - dotnet-version: '${{ env.TGS_DOTNET_VERSION }}.0.x' - dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }} - - - name: Retrieve ReleaseNotes Binaries - uses: actions/download-artifact@v4 - with: - name: release_notes_bins - path: release_notes_bins - - - name: Update CI Check Run (Cancelled) # !(success() || failure()) - if: (!((needs.pages-build.result == 'success' && needs.docker-build.result == 'success' && needs.build-deb.result == 'success' && needs.build-msi.result == 'success' && needs.validate-openapi-spec.result == 'success' && needs.upload-code-coverage.result == 'success' && needs.check-winget-pr-template.result == 'success' && needs.efcore-version-match.result == 'success' && needs.ci-start-gate.result == 'success') || (needs.pages-build.result == 'failure' || needs.docker-build.result == 'failure' || needs.build-deb.result == 'failure' || needs.build-msi.result == 'failure' || needs.validate-openapi-spec.result == 'failure' || needs.upload-code-coverage.result == 'failure' || needs.check-winget-pr-template.result == 'failure' || needs.efcore-version-match.result == 'failure' || needs.ci-start-gate.result == 'failure' || needs.dmapi-build.result == 'failure' || needs.opendream-build.result == 'failure' || needs.windows-unit-tests.result == 'failure' || needs.linux-unit-tests.result == 'failure' || needs.windows-integration-tests.result == 'failure' || needs.linux-integration-tests.result == 'failure'))) - run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --ci-check ${{ inputs.pull_request_head_sha || github.sha }} ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} Cancelled ${{ github.run_id }} - - - name: Update CI Check Run (Failure) - if: needs.pages-build.result == 'failure' || needs.docker-build.result == 'failure' || needs.build-deb.result == 'failure' || needs.build-msi.result == 'failure' || needs.validate-openapi-spec.result == 'failure' || needs.upload-code-coverage.result == 'failure' || needs.check-winget-pr-template.result == 'failure' || needs.efcore-version-match.result == 'failure' || needs.ci-start-gate.result == 'failure' || needs.dmapi-build.result == 'failure' || needs.opendream-build.result == 'failure' || needs.windows-unit-tests.result == 'failure' || needs.linux-unit-tests.result == 'failure' || needs.windows-integration-tests.result == 'failure' || needs.linux-integration-tests.result == 'failure' - run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --ci-check ${{ inputs.pull_request_head_sha || github.sha }} ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} Failure ${{ github.run_id }} - - - name: Update CI Check Run (Success) # Only need to check direct dependencies - if: needs.pages-build.result == 'success' && needs.docker-build.result == 'success' && needs.build-deb.result == 'success' && needs.build-msi.result == 'success' && needs.validate-openapi-spec.result == 'success' && needs.upload-code-coverage.result == 'success' && needs.check-winget-pr-template.result == 'success' && needs.efcore-version-match.result == 'success' && needs.ci-start-gate.result == 'success' - run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --ci-check ${{ inputs.pull_request_head_sha || github.sha }} ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} Success ${{ github.run_id }} - - - name: Fail Job if Prerequisites Failed - if: needs.pages-build.result == 'failure' || needs.docker-build.result == 'failure' || needs.build-deb.result == 'failure' || needs.build-msi.result == 'failure' || needs.validate-openapi-spec.result == 'failure' || needs.upload-code-coverage.result == 'failure' || needs.check-winget-pr-template.result == 'failure' || needs.efcore-version-match.result == 'failure' || needs.ci-start-gate.result == 'failure' || needs.dmapi-build.result == 'failure' || needs.opendream-build.result == 'failure' || needs.windows-unit-tests.result == 'failure' || needs.linux-unit-tests.result == 'failure' || needs.windows-integration-tests.result == 'failure' || needs.linux-integration-tests.result == 'failure' - run: exit 1 + - name: Mandatory Empty Step + run: exit 0 deployment-gate: name: Deployment Start Gate diff --git a/.github/workflows/ci-security.yml b/.github/workflows/ci-security.yml index f9998cff17..14b60544ba 100644 --- a/.github/workflows/ci-security.yml +++ b/.github/workflows/ci-security.yml @@ -6,9 +6,6 @@ on: branches: - dev - master -env: - TGS_DOTNET_VERSION: 8 - TGS_DOTNET_QUALITY: ga concurrency: group: "ci-security-${{ github.head_ref || github.run_id }}-${{ github.event_name }}" @@ -26,7 +23,7 @@ jobs: if: github.event.action == 'opened' && !contains(github.event.pull_request.labels.*.name, 'CI Cleared') && github.event.pull_request.user.id != 49699333 uses: thollander/actions-comment-pull-request@1d3973dc4b8e1399c0620d3f2b1aa5e795465308 with: - message: Thank you for contributing to ${{ github.event.pull_request.base.repo.name }}! The workflow '${{ github.workflow }}' requires repository secrets and will not run without approval. Maintainers can add the `CI Cleared` label to allow it to run. Note that any changes to ci-security.yml will not be reflected in the run. + message: Thank you for contributing to ${{ github.event.pull_request.base.repo.name }}! The workflow '${{ github.workflow }}' requires repository secrets and will not run without approval. Maintainers can add the `CI Cleared` label to allow it to run. Note that any changes to ci-security.yml will not be reflected in the run and the ci-pipeline.yml at the HEAD of the pull request will be used. - name: Comment on dependabot PR if: github.event.action == 'opened' && !contains(github.event.pull_request.labels.*.name, 'CI Cleared') && github.event.pull_request.user.id == 49699333 @@ -57,53 +54,9 @@ jobs: if: (github.event.action == 'synchronize' || github.event.action == 'reopened') || ((github.event.action == 'opened' || github.event.action == 'labeled') && !contains(github.event.pull_request.labels.*.name, 'CI Cleared')) run: exit 1 - ci-dispatch: - name: Start CI Pipeline - runs-on: ubuntu-latest - needs: security-checkpoint - permissions: - actions: write - contents: write - steps: - - name: Setup dotnet - uses: actions/setup-dotnet@v4 - with: - dotnet-version: '${{ env.TGS_DOTNET_VERSION }}.0.x' - dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }} - - - name: Checkout - uses: actions/checkout@v4 - with: - ref: refs/pull/${{ github.event.pull_request.number }}/merge - - - name: Build ReleaseNotes - run: dotnet publish -c Release -p:TGS_HOST_NO_WEBPANEL=true -o release_notes_bins tools/Tgstation.Server.ReleaseNotes/Tgstation.Server.ReleaseNotes.csproj - - - name: Generate Temporary Branch to Reference Merge - run: | - git checkout -b ${{ github.event.pull_request.number }}-merge - git push -f -u origin ${{ github.event.pull_request.number }}-merge - - - name: Send Workflow Dispatch - uses: lasith-kg/dispatch-workflow@5623bf13f09bbbbdb549ec692b070307f39b66ac #v2.0.0 + setup_node@v4 - id: dispatch - with: - dispatch-method: workflow_dispatch - owner: ${{ github.repository_owner }} - repo: ${{ github.event.pull_request.base.repo.name }} - ref: ${{ github.event.pull_request.number }}-merge - workflow: ci-pipeline.yml - token: ${{ github.token }} - discover: true - workflow-inputs: | - { - "pull_request_number": "${{ github.event.pull_request.number }}", - "pull_request_head_sha": "${{ github.event.pull_request.head.sha }}" - } - - - name: Set CI Check Run (Pending) - run: dotnet release_notes_bins/Tgstation.Server.ReleaseNotes.dll --ci-check ${{ github.event.pull_request.head.sha }} ${{ secrets.TGS_CI_GITHUB_APP_TOKEN_BASE64 }} Pending ${{ steps.dispatch.outputs.run-id }} - - - name: Delete Temporary Branch - if: always() - run: git push -d origin ${{ github.event.pull_request.number }}-merge + ci-pipline-workflow-call: + uses: ./.github/workflows/ci-pipeline.yml@${{ github.event.pull_request.head.sha }} + secrets: inherit + with: + pull_request_number: ${{ github.event.pull_request.number }} + pull_request_head_sha: ${{ github.event.pull_request.head.sha }} diff --git a/.github/workflows/code-scanning.yml b/.github/workflows/code-scanning.yml deleted file mode 100644 index f1fe0397ee..0000000000 --- a/.github/workflows/code-scanning.yml +++ /dev/null @@ -1,78 +0,0 @@ -name: Code Scanning - -on: - push: - branches: - - dev - - master - pull_request: - branches: - - dev - - master - -concurrency: - group: "code-scanning-${{ github.head_ref || github.run_id }}-${{ github.event_name }}" - cancel-in-progress: true - -env: - TGS_DOTNET_VERSION: 8 - TGS_DOTNET_QUALITY: ga - -jobs: - code-scanning: - name: Run CodeQL - runs-on: ubuntu-latest - permissions: - security-events: write - actions: read - env: - TGS_TELEMETRY_KEY_FILE: /tmp/tgs_telemetry_key.txt - steps: - - name: Setup dotnet - uses: actions/setup-dotnet@v4 - with: - dotnet-version: '${{ env.TGS_DOTNET_VERSION }}.0.x' - dotnet-quality: ${{ env.TGS_DOTNET_QUALITY }} - - - name: Checkout (Branch) - uses: actions/checkout@v4 - - - name: Read Current SHA - id: get-pr-sha - if: github.event_name != 'push' && github.event_name != 'schedule' - shell: bash - run: echo "head_sha=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT - - - name: Abort if PR Merge SHA has Changed - uses: actions/github-script@v7 - if: github.event_name != 'push' && github.event_name != 'schedule' && steps.get-pr-sha.outputs.head_sha != github.sha - with: - script: | - const delay = ms => new Promise(res => setTimeout(res, ms)); - - github.rest.actions.cancelWorkflowRun({ - owner: context.repo.owner, - repo: context.repo.repo, - run_id: context.runId - }); - - while (true) { - core.info('Waiting for workflow to cancel ...'); - await delay(5000); - } - - - name: Initialize CodeQL - uses: github/codeql-action/init@v3 - with: - languages: csharp - - - name: Setup Telemetry Key File - run: echo "fake_telemetry_key" > ${{ env.TGS_TELEMETRY_KEY_FILE }} - - - name: Build - run: dotnet build -c ReleaseNoWindows -p:TGS_HOST_NO_WEBPANEL=true - - - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@v3 - with: - category: "/language:csharp" diff --git a/tools/Tgstation.Server.ReleaseNotes/Program.cs b/tools/Tgstation.Server.ReleaseNotes/Program.cs index a23479de57..46c887fd5f 100644 --- a/tools/Tgstation.Server.ReleaseNotes/Program.cs +++ b/tools/Tgstation.Server.ReleaseNotes/Program.cs @@ -59,7 +59,6 @@ namespace Tgstation.Server.ReleaseNotes var shaCheck = versionString.Equals("--winget-template-check", StringComparison.OrdinalIgnoreCase); var fullNotes = versionString.Equals("--generate-full-notes", StringComparison.OrdinalIgnoreCase); var nuget = versionString.Equals("--nuget", StringComparison.OrdinalIgnoreCase); - var ciCheck = versionString.Equals("--ci-check", StringComparison.OrdinalIgnoreCase); var genToken = versionString.Equals("--token-output-file", StringComparison.OrdinalIgnoreCase); if ((!Version.TryParse(versionString, out var version) || version.Revision != -1) @@ -68,7 +67,6 @@ namespace Tgstation.Server.ReleaseNotes && !shaCheck && !fullNotes && !nuget - && !ciCheck && !genToken) { Console.WriteLine("Invalid version: " + versionString); @@ -126,17 +124,6 @@ namespace Tgstation.Server.ReleaseNotes return await EnsureRelease(client); } - if (ciCheck) - { - if (args.Length < 5) - { - Console.WriteLine("Missing check parameters!"); - return 4543; - } - - return await CICheck(client, args[1], args[2], Enum.Parse(args[3]), Int64.Parse(args[4])); - } - if (genToken) { if (args.Length < 3) @@ -1675,116 +1662,6 @@ package (version) distribution(s); urgency=urgency gitHubClient.Credentials = new Credentials(installToken.Token); } - enum CheckMode - { - Pending, - Started, - Rerun, - Cancelled, - Success, - Failure, - } - - static async ValueTask CICheck(GitHubClient gitHubClient, string ciTargetSha, string pemBase64, CheckMode mode, long runID) - { - await GenerateAppCredentials(gitHubClient, pemBase64, false); - - const string CheckName = "CI Pipeline"; - var detailsUrl = $"https://github.com/{RepoOwner}/{RepoName}/actions/runs/{runID}"; - - if (mode == CheckMode.Pending) - { - await gitHubClient.Check.Run.Create(RepoOwner, RepoName, new NewCheckRun("CI Pipeline", ciTargetSha) - { - DetailsUrl = detailsUrl - }); - - return 0; - } - - var prChecks = await gitHubClient.Check.Run.GetAllForReference(RepoOwner, RepoName, ciTargetSha); - var theCheckWeWant = prChecks.CheckRuns.FirstOrDefault(x => x.Name == CheckName && x.DetailsUrl == detailsUrl); - switch (mode) - { - case CheckMode.Started: - if (theCheckWeWant != null && theCheckWeWant.Status != CheckStatus.Completed) - { - if (theCheckWeWant.Status != CheckStatus.InProgress) - { - await gitHubClient.Check.Run.Update(RepoOwner, RepoName, theCheckWeWant.Id, new CheckRunUpdate - { - Status = CheckStatus.InProgress, - StartedAt = DateTimeOffset.UtcNow, - }); - } - } - else - await gitHubClient.Check.Run.Create(RepoOwner, RepoName, new NewCheckRun("CI Pipeline", ciTargetSha) - { - Status = CheckStatus.InProgress, - StartedAt = DateTimeOffset.UtcNow, - DetailsUrl = detailsUrl, - }); - - break; - case CheckMode.Rerun: - if(theCheckWeWant != null && theCheckWeWant.Status == CheckStatus.Completed) - { - // need a new check run - await gitHubClient.Check.Run.Create(RepoOwner, RepoName, new NewCheckRun("CI Pipeline", ciTargetSha) - { - Status = CheckStatus.InProgress, - DetailsUrl = $"https://github.com/{RepoOwner}/{RepoName}/actions/runs/{runID}", - StartedAt = DateTimeOffset.UtcNow, - }); - } - else if (theCheckWeWant.Status != CheckStatus.InProgress) - { - await gitHubClient.Check.Run.Update(RepoOwner, RepoName, theCheckWeWant.Id, new CheckRunUpdate - { - Status = CheckStatus.InProgress, - StartedAt = DateTimeOffset.UtcNow, - }); - } - - break; - case CheckMode.Cancelled: - case CheckMode.Failure: - case CheckMode.Success: - var conclusion = mode switch - { - CheckMode.Cancelled => CheckConclusion.Cancelled, - CheckMode.Failure => CheckConclusion.Failure, - CheckMode.Success => CheckConclusion.Success, - _ => throw new InvalidOperationException("Impossible"), - }; - - if (theCheckWeWant != null && theCheckWeWant.Status != CheckStatus.Completed) - { - await gitHubClient.Check.Run.Update(RepoOwner, RepoName, theCheckWeWant.Id, new CheckRunUpdate - { - Status = CheckStatus.Completed, - CompletedAt = DateTimeOffset.UtcNow, - Conclusion = conclusion, - }); - } - else - { - // need a new check run - await gitHubClient.Check.Run.Create(RepoOwner, RepoName, new NewCheckRun("CI Pipeline", ciTargetSha) - { - Status = CheckStatus.Completed, - DetailsUrl = $"https://github.com/{RepoOwner}/{RepoName}/actions/runs/{runID}", - CompletedAt = DateTimeOffset.UtcNow, - Conclusion = conclusion, - }); - } - break; - } - - return 0; - } - static void DebugAssert(bool condition, string message = null) { // This exists because one of the fucking asserts evaluates an enumerable or something and it was getting optimized out in release