|
1 | | -# Workflow templates are based on starter workflows provided by github at |
2 | | -# https://github.com/actions/starter-workflows/tree/main and customized to |
| 1 | +# Workflow templates are based on starter workflows provided by github at |
| 2 | +# https://github.com/actions/starter-workflows/tree/main and customized to |
3 | 3 | # represent common practices used on ACME repositories. |
4 | 4 |
|
5 | 5 | # This imaginary workflow runs two steps and illustrates a number of options that we use throughout workflows in the Bitwarden repositories |
6 | 6 |
|
7 | 7 | name: Build |
8 | 8 |
|
9 | 9 | on: # Describes when to run the workflow |
10 | | - # https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows |
| 10 | + # https://docs.github.com/en/actions/writing-workflows/choosing-when-your-workflow-runs/events-that-trigger-workflows |
11 | 11 |
|
12 | | - workflow_dispatch: # When triggered manually |
| 12 | + workflow_dispatch: # When triggered manually |
13 | 13 |
|
14 | | - push: # On push to the following branches. Temporarily add a development branch to prompt workflow runs for troubleshooting |
15 | | - branches: ["main", "rc", "hotfix-rc"] |
16 | | - paths-ignore: # Updates to these directories or files will not trigger a workflow run |
17 | | - - ".github/workflows/**" |
| 14 | + push: # On push to the following branches. Temporarily add a development branch to prompt workflow runs for troubleshooting |
| 15 | + branches: ["main", "rc", "hotfix-rc"] |
| 16 | + paths-ignore: # Updates to these directories or files will not trigger a workflow run |
| 17 | + - ".github/workflows/**" |
18 | 18 |
|
19 | | - # Pull_request_target: #We strongly discourage using this unless absolutely necessary as it requires access to certain Github secrets. |
| 19 | + # Pull_request_target: #We strongly discourage using this unless absolutely necessary as it requires access to certain Github secrets. |
20 | 20 | # If using this, include the .github/workflows/check-run.yml job and target only the main branch |
21 | 21 | # More info at https://github.blog/news-insights/product-news/github-actions-improvements-for-fork-and-pull-request-workflows/#improvements-for-public-repository-forks |
22 | 22 |
|
23 | | - pull_request: # When a pull request event occurs |
24 | | - types: [opened, synchronize, unlabeled, labeled, unlabeled, reopened, edited] |
25 | | - branches: ["main"] # Branches where a pull request will trigger the workflow |
| 23 | + pull_request: # When a pull request event occurs |
| 24 | + types: |
| 25 | + [ |
| 26 | + opened, |
| 27 | + synchronize, |
| 28 | + unlabeled, |
| 29 | + labeled, |
| 30 | + unlabeled, |
| 31 | + reopened, |
| 32 | + edited, |
| 33 | + ] |
| 34 | + branches: ["main"] # Branches where a pull request will trigger the workflow |
26 | 35 |
|
| 36 | + release: # Runs your workflow when release activity in your repository occurs |
| 37 | + types: [published, created] |
27 | 38 |
|
28 | | - release: # Runs your workflow when release activity in your repository occurs |
29 | | - types: [published, created] |
| 39 | + merge_group: # Runs required status checks on merge groups created by merge queue |
| 40 | + types: [checks_requested] |
30 | 41 |
|
31 | | - merge_group: # Runs required status checks on merge groups created by merge queue |
32 | | - types: [checks_requested] |
| 42 | + repository_dispatch: # Runs when a webook event triggers a workflow from outside of github |
| 43 | + types: [contentful-publish] # Optional, limit repository dispatch events to those in a specified list |
33 | 44 |
|
34 | | - repository_dispatch: # Runs when a webook event triggers a workflow from outside of github |
35 | | - types: [contentful-publish] # Optional, limit repository dispatch events to those in a specified list |
36 | | - |
37 | | - workflow_call: # Workflow can be called by another workflow |
| 45 | + workflow_call: # Workflow can be called by another workflow |
38 | 46 |
|
39 | 47 | env: # Environment variables set for this step but not accessible by all workflows, steps or jobs. |
40 | | - _AZ_REGISTRY: "ACMEprod.azurecr.io" |
41 | | - INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}" |
| 48 | + _AZ_REGISTRY: "ACMEprod.azurecr.io" |
| 49 | + INCREMENTAL: "${{ contains(github.event_name, 'pull_request') && '--sast-incremental' || '' }}" |
42 | 50 |
|
43 | 51 | jobs: # A workflow run is made up of one or more jobs that can run sequentially or in parallel |
44 | | - first-job: |
45 | | - name: First Job Name |
46 | | - uses: ./.github/templates/workflow-templates/example-references/_version.yml # Path to an existing github action |
47 | | - if: github.event.pull_request.draft == false # prevent part of a job from running on a draft PR |
48 | | - secrets: inherit # When called by another workflow, pass all the calling workflow's secrets to the called workflow |
49 | | - # "secrets" is only available for a reusable workflow call with "uses" |
50 | | - strategy: # Create multiple job runs for each of a set of variables |
51 | | - fail-fast: false # If true, cancel entire run if any job in the matrix fails |
52 | | - matrix: # Matrix of variables used to define multiple job runs |
53 | | - include: |
54 | | - - project_name: Admin |
55 | | - base_path: ./src |
56 | | - node: true # Enables steps with if: ${{ matrix.node }} |
57 | | - |
58 | | - # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token |
59 | | - permissions: # Sets permissions of the GITHUB_TOKEN |
60 | | - security-events: write # Allow actions to upload results to Github |
61 | | - id-token: write # Required to fetch an OpenID Connect (OIDC) token |
62 | | - contents: read # For actions/checkout to fetch code |
63 | | - deployments: write # Permits an action to create a new deployment |
64 | | - issues: write # Permits an action to create a new issue |
65 | | - checks: write # Permits an action to create a check run |
66 | | - actions: write # Permits an action to cancel a workflow run |
67 | | - packages: read # Permits an action to access packages on GitHub Packages |
68 | | - pull-requests: write # Permits an action to add a label to a pull request |
69 | | - |
70 | | - # steps: when a reusable workflow is called with "uses", "steps" is not available |
71 | | - second-job: |
72 | | - name: Second Job Name |
73 | | - runs-on: ubuntu-22.04 # The type of runner that the job will run on, not available if "uses" is used |
74 | | - defaults: |
75 | | - run: # Set the default shell and working directory |
76 | | - shell: bash |
77 | | - working-directory: "home/WorkingDirectory" |
78 | | - |
79 | | - needs: |
80 | | - - first-job # This job will wait until first-job completes |
81 | | - # # # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/setting-a-default-shell-and-working-directory |
82 | | - steps: |
83 | | - - name: Descriptive step name |
84 | | - # NOT RECOMMENDED if: always() # run even if previous steps failed or the workflow is canceled, this can cause a workflow run to hang indefinitely |
85 | | - if: failure() # run when any previous step of a job fails |
86 | | - # if: '!cancelled()' # run even if previous steps failed |
87 | | - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 Always pin a public action version to a full git SHA, followed by the version number in a comment. Version pins are insecure and can introduce vulnerabilities into workflows. |
88 | | - with: # Parameters specific to this action that need to be defined in order for the step to be completed |
89 | | - fetch-depth: 0 # Full git history for actions that rely on whether a change has occurred |
90 | | - ref: ${{ github.event.pull_request.head.sha }} |
91 | | - creds: ${{ secrets.SECRETS_OR_CREDENTIALS }} |
92 | | - - name: Another descriptive step name |
93 | | - # Run a script instead of an existing github action |
94 | | - run: | |
95 | | - whoami |
96 | | - dotnet --info |
97 | | - node --version |
98 | | - npm --version |
99 | | - echo "GitHub ref: $GITHUB_REF" |
100 | | - echo "GitHub event: $GITHUB_EVENT" |
| 52 | + first-job: |
| 53 | + name: First Job Name |
| 54 | + uses: ./.github/templates/workflow-templates/example-references/_version.yml # Path to an existing github action |
| 55 | + if: github.event.pull_request.draft == false # prevent part of a job from running on a draft PR |
| 56 | + secrets: inherit # When called by another workflow, pass all the calling workflow's secrets to the called workflow |
| 57 | + # "secrets" is only available for a reusable workflow call with "uses" |
| 58 | + strategy: # Create multiple job runs for each of a set of variables |
| 59 | + fail-fast: false # If true, cancel entire run if any job in the matrix fails |
| 60 | + matrix: # Matrix of variables used to define multiple job runs |
| 61 | + include: |
| 62 | + - project_name: Admin |
| 63 | + base_path: ./src |
| 64 | + node: true # Enables steps with if: ${{ matrix.node }} |
| 65 | + |
| 66 | + # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token |
| 67 | + permissions: # Sets permissions of the GITHUB_TOKEN |
| 68 | + security-events: write # Allow actions to upload results to Github |
| 69 | + id-token: write # Required to fetch an OpenID Connect (OIDC) token |
| 70 | + contents: read # For actions/checkout to fetch code |
| 71 | + deployments: write # Permits an action to create a new deployment |
| 72 | + issues: write # Permits an action to create a new issue |
| 73 | + checks: write # Permits an action to create a check run |
| 74 | + actions: write # Permits an action to cancel a workflow run |
| 75 | + packages: read # Permits an action to access packages on GitHub Packages |
| 76 | + pull-requests: write # Permits an action to add a label to a pull request |
| 77 | + |
| 78 | + # steps: when a reusable workflow is called with "uses", "steps" is not available |
| 79 | + second-job: |
| 80 | + name: Second Job Name |
| 81 | + runs-on: ubuntu-22.04 # The type of runner that the job will run on, not available if "uses" is used |
| 82 | + defaults: |
| 83 | + run: # Set the default shell and working directory |
| 84 | + shell: bash |
| 85 | + working-directory: "home/WorkingDirectory" |
| 86 | + |
| 87 | + needs: |
| 88 | + - first-job # This job will wait until first-job completes |
| 89 | + # # # https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/setting-a-default-shell-and-working-directory |
| 90 | + steps: |
| 91 | + - name: Descriptive step name |
| 92 | + # NOT RECOMMENDED if: always() # run even if previous steps failed or the workflow is canceled, this can cause a workflow run to hang indefinitely |
| 93 | + if: failure() # run when any previous step of a job fails |
| 94 | + # if: '!cancelled()' # run even if previous steps failed |
| 95 | + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 Always pin a public action version to a full git SHA, followed by the version number in a comment. Version pins are insecure and can introduce vulnerabilities into workflows. |
| 96 | + with: # Parameters specific to this action that need to be defined in order for the step to be completed |
| 97 | + fetch-depth: 0 # Full git history for actions that rely on whether a change has occurred |
| 98 | + ref: ${{ github.event.pull_request.head.sha }} |
| 99 | + creds: ${{ secrets.SECRETS_OR_CREDENTIALS }} |
| 100 | + - name: Another descriptive step name |
| 101 | + # Run a script instead of an existing github action |
| 102 | + run: | |
| 103 | + whoami |
| 104 | + dotnet --info |
| 105 | + node --version |
| 106 | + npm --version |
| 107 | + echo "GitHub ref: $GITHUB_REF" |
| 108 | + echo "GitHub event: $GITHUB_EVENT" |
0 commit comments