feat: fixing and reorganizing workflows, reusable actions

smartcontractkit · Jan 17, 2024 · 368f4cf · 368f4cf
1 parent f85cd9f
commit 368f4cf
Show file tree

Hide file tree

Showing 5 changed files with 82 additions and 65 deletions.
diff --git a/.github/workflows/ci-lint.yml b/.github/workflows/ci-lint.yml
@@ -0,0 +1,25 @@
+name: CI Lint
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+
+jobs:
+  ci-lint:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+      actions: read
+    steps:
+      - name: ci-lint
+        uses: smartcontractkit/.github/actions/ci-lint-go@9e7cc0779934cae4a9028b8588c9adb64d8ce68c # [email protected]
+        with:
+          metrics-job-name: ci-lint
+          golangci-lint-version: v1.55.2
+          golangci-lint-args: --enable=gofmt --tests=false --exclude-use-default --timeout=5m0s --out-format checkstyle:golangci-lint-report.xml
+          gc-basic-auth: ${{ secrets.GRAFANA_CLOUD_BASIC_AUTH }}
+          gc-host: ${{ secrets.GRAFANA_CLOUD_HOST }}
+
diff --git a/.github/workflows/ci.yml → .github/workflows/ci-test.yml b/.github/workflows/ci.yml → .github/workflows/ci-test.yml
@@ -1,44 +1,55 @@
-name: wsrpc
+name: CI Test
 
-on: 
+on:
   push:
-
+    branches:
+      - main
+  pull_request:
+
 jobs:
-  ci_test:
-    name: CI Tests
+  ci-test:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repo
-        uses: actions/checkout@v3
-      
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
       - name: Setup Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version-file: "go.mod"
           cache: true
-          
+
       - name: Cache dependencies
-        uses: actions/cache@v3
+        uses: actions/cache@e12d46a63a90f2fae62d114769bbf2a179198b5c # v3.3.3
         with:
           path: |
             ~/.cache/go-build
             ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
           restore-keys: |
             ${{ runner.os }}-go
-      
+
       - name: Run Test Suite
         run: set -o pipefail && go test ./... -coverpkg=./... -coverprofile=coverage.txt $1 | tee $OUTPUT_FILE
-      
+
       - name: Run Race Test Suite
         run: set -o pipefail && go test -race ./... -coverpkg=./... -coverprofile=race_coverage.txt $1 | tee $OUTPUT_FILE
 
       - name: Upload Go test results
         if: always()
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: go-test-results
           path: |
-            ./output.txt
             ./coverage.txt
             ./race_coverage.txt
+
+      - name: Collect Metrics
+        if: always()
+        id: collect-gha-metrics
+        uses: smartcontractkit/[email protected]
+        with:
+          basic-auth: ${{ secrets.GRAFANA_CLOUD_BASIC_AUTH }}
+          hostname: ${{ secrets.GRAFANA_CLOUD_HOST }}
+          this-job-name: ci-test
+        continue-on-error: true
diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml
@@ -11,7 +11,8 @@ jobs:
       changes: ${{ steps.changes.outputs.src }}
     steps:
       - name: Checkout the repo
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+
       - uses: dorny/paths-filter@4512585405083f25c027a35db413c2b3b9006d50 # v2.11.1
         id: changes
         with:
@@ -25,26 +26,26 @@ jobs:
     needs: [changes]
     steps:
       - name: Check out code
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Set up Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version-file: 'go.mod'
+            go-version-file: 'go.mod'
         id: go
 
       - name: Write Go Modules list
         run: go list -json -m all > go.list
 
       - name: Check vulnerabilities
-        uses: sonatype-nexus-community/nancy-github-action@main
+        uses: sonatype-nexus-community/nancy-github-action@726e338312e68ecdd4b4195765f174d3b3ce1533 # v1.0.3
         with:
           nancyVersion: "v1.0.42"
 
       - name: Collect Metrics
         if: always()
         id: collect-gha-metrics
-        uses: smartcontractkit/push-gha-metrics-action@90fcbaac8ebf86da9c4d55dba24f6fe3029f0e0b
+        uses: smartcontractkit/push-gha-metrics-action@v2.0.2
         with:
           basic-auth: ${{ secrets.GRAFANA_CLOUD_BASIC_AUTH }}
           hostname: ${{ secrets.GRAFANA_CLOUD_HOST }}

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
diff --git a/.github/workflows/sonar-scan.yml b/.github/workflows/sonar-scan.yml
@@ -1,6 +1,10 @@
 name: SonarQube Scan
 
-on: [push]
+on:
+  push:
+    branches:
+      - main
+  pull_request:
 
 jobs:
   wait_for_workflows:
@@ -9,9 +13,9 @@ jobs:
     if: always()
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
-          ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
+          ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Wait for workflows
         uses: smartcontractkit/chainlink-github-actions/utils/wait-for-workflows@main
@@ -28,40 +32,48 @@ jobs:
     name: SonarQube Scan
     needs: [wait_for_workflows]
     runs-on: ubuntu-latest
+    permissions:
+      actions: read
     if: always()
     steps:
       - name: Checkout the repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0 # fetches all history for all tags and branches to provide more metadata for sonar reports
 
       - name: Download Golangci-lint report
         if: always()
         uses: dawidd6/[email protected]
         with:
-          workflow: golangci_lint.yml
+          workflow: ci-lint.yml
+          name: golangci-lint-report
           workflow_conclusion: ""
           name_is_regexp: true
-          name: golangci-lint-report
           if_no_artifact_found: warn
+          github_token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Download Go PKG test reports
+      - name: Download go unit test coverage reports
         if: always()
         uses: dawidd6/[email protected]
         with:
-          workflow: pkg.yml
+          workflow: ci-test.yml
+          name: go-test-results
           workflow_conclusion: ""
           name_is_regexp: true
-          name: go-test-results
           if_no_artifact_found: warn
+          github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set SonarQube Report Paths
         if: always()
         id: sonarqube_report_paths
         shell: bash
         run: |
-          echo "sonarqube_coverage_report_paths=$(find -type f -name '*coverage.out' -printf "%p,")" >> $GITHUB_OUTPUT
-          echo "sonarqube_golangci_report_paths=$(find -type f -name 'golangci-lint-report.xml' -printf "%p,")" >> $GITHUB_OUTPUT
+          COVERAGE_REPORT_PATHS=$(find -type f -name '*coverage.txt' -printf '%p,')
+          GOLANGCI_REPORT_PATHS=$(find -type f -name 'golangci-lint-report.xml' -printf '%p,')
+          echo "COVERAGE_REPORT_PATHS=$COVERAGE_REPORT_PATHS"
+          echo "GOLANGCI_REPORT_PATHS=$GOLANGCI_REPORT_PATHS"
+          echo "sonarqube_coverage_report_paths=$COVERAGE_REPORT_PATHS" >> $GITHUB_OUTPUT
+          echo "sonarqube_golangci_report_paths=$GOLANGCI_REPORT_PATHS" >> $GITHUB_OUTPUT
 
       - name: SonarQube Scan
         if: always()
@@ -72,4 +84,5 @@ jobs:
             -Dsonar.go.golangci-lint.reportPaths=${{ steps.sonarqube_report_paths.outputs.sonarqube_golangci_report_paths }}
         env:
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
+