posh/.github/workflows/ci.yml at dev · arcticportal/posh · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
name: CI Gate

on:
  pull_request:
    branches: [main, dev]
  push:
    branches: [main, dev]
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # main only receives promotions from dev; block any other PR source branch.
  main-source-check:
    if: github.event_name == 'pull_request' && github.base_ref == 'main'
    runs-on: ubuntu-latest
    steps:
      - name: PRs to main must come from dev
        run: |
          if [ "${{ github.head_ref }}" != "dev" ]; then
            echo "::error::PRs targeting main must originate from the dev branch (head: ${{ github.head_ref }})"
            exit 1
          fi
          echo "promotion PR from dev - ok"

  changes:
    runs-on: ubuntu-latest
    outputs:
      backend: ${{ steps.f.outputs.backend }}
      angular: ${{ steps.f.outputs.angular }}
    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0
      - name: Detect changed paths
        id: f
        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d
        with:
          # push: base=pushed branch so dorny diffs github.event.before..head (not default_branch); PR ignores 'base'.
          base: ${{ github.event_name == 'push' && github.ref_name || '' }}
          filters: |
            backend:
              - 'backend/**'
              - 'deploy/backend/**'
            angular:
              - 'angular/**'
              - 'deploy/frontend/**'

  angular-build:
    needs: changes
    if: needs.changes.outputs.angular == 'true'
    uses: ./.github/workflows/angular-build.yml
    with:
      push: ${{ github.event_name == 'push' }}
    secrets: inherit

  backend-build:
    needs: changes
    if: needs.changes.outputs.backend == 'true'
    uses: ./.github/workflows/backend-build.yml
    with:
      push: ${{ github.event_name == 'push' }}
    secrets: inherit

  gate:
    needs: [main-source-check, angular-build, backend-build]
    if: always()
    runs-on: ubuntu-latest
    steps:
      - name: Aggregate results
        run: |
          for r in "${{ needs.main-source-check.result }}" "${{ needs.angular-build.result }}" "${{ needs.backend-build.result }}"; do
            echo "result=$r"
            if [ "$r" = "failure" ] || [ "$r" = "cancelled" ]; then
              echo "blocked by a failed/cancelled job"
              exit 1
            fi
          done
          echo "gate passed"