Skip to content

Commit e2785f4

Browse files
JulianJulian
committed
Add Bowtie CI scaffolding from bowtie-json-schema/test-harness-template
1 parent 0f00a2b commit e2785f4

9 files changed

Lines changed: 298 additions & 0 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
version: 2
2+
updates:
3+
# common configuration
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "weekly"
8+
cooldown:
9+
default-days: 3
10+
- package-ecosystem: "docker"
11+
directory: "/"
12+
schedule:
13+
interval: "daily"
14+
cooldown:
15+
default-days: 3
16+
17+
# add test harness configuration here

‎.github/workflows/build-all.yml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
# Rebuild and publish every historical version of this harness.
2+
#
3+
# Versions are git tags (`harness-release-*`, created automatically by build.yml) plus the current `main`.
4+
# Each is (re)built and published through Bowtie's reusable `harness-ci.yml` workflow.
5+
# Run this manually to backfill images, e.g. right after extracting a harness that had a `matrix-versions.json`.
6+
name: Build All Versions
7+
8+
on:
9+
workflow_dispatch:
10+
11+
permissions: {}
12+
13+
jobs:
14+
versions:
15+
name: Collect available versions
16+
runs-on: ubuntu-latest
17+
outputs:
18+
revisions: ${{ steps.revisions.outputs.value }}
19+
steps:
20+
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
21+
with:
22+
persist-credentials: false
23+
fetch-depth: 0
24+
fetch-tags: true
25+
26+
- name: Collect available versions
27+
id: revisions
28+
run: |
29+
# Only the auto-created per-version release tags, plus current `main`.
30+
tags=$(jq -c -n '$ARGS.positional + ["main"]' --args $(git tag --list 'harness-release-*'))
31+
echo "value=${tags}" >> "$GITHUB_OUTPUT"
32+
33+
build:
34+
name: Build
35+
needs: versions
36+
strategy:
37+
# Backfill as many versions as possible; don't abort the rest on one failure.
38+
fail-fast: false
39+
matrix:
40+
revision: ${{ fromJson(needs.versions.outputs.revisions) }}
41+
permissions:
42+
id-token: write # needed for build provenance attestation
43+
contents: read # needed for actions/checkout
44+
attestations: write # needed for build provenance attestation
45+
packages: write # needed for pushing to ghcr.io
46+
artifact-metadata: write # needed for build provenance attestation
47+
uses: bowtie-json-schema/bowtie/.github/workflows/harness-ci.yml@a0ae283dca0a0d0eb2381a886d5499162f33c82a # main
48+
with:
49+
ref: ${{ matrix.revision }}
50+
publish: true
51+
is-latest: ${{ matrix.revision == 'main' }}

‎.github/workflows/build.yml‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
# Build, smoke-test and (on pushes to main) publish this harness's image.
2+
#
3+
# The actual build/test/publish logic is centralized in Bowtie's reusable `harness-ci.yml` workflow
4+
# so that a fix to how we build images reaches every harness at once.
5+
# This file only wires up the triggers and the small amount of per-repository orchestration
6+
# (version bookkeeping and Dependabot automerge).
7+
name: Rebuild Bowtie Image
8+
9+
on:
10+
workflow_dispatch:
11+
pull_request:
12+
push:
13+
branches-ignore:
14+
- "wip*"
15+
16+
concurrency:
17+
group: images-${{ github.ref }}
18+
cancel-in-progress: true
19+
20+
permissions: {}
21+
22+
jobs:
23+
meta:
24+
name: Collect the currently published version
25+
runs-on: ubuntu-latest
26+
outputs:
27+
latest-version: ${{ steps.version.outputs.value }}
28+
steps:
29+
- name: Install Bowtie
30+
uses: bowtie-json-schema/bowtie@a0ae283dca0a0d0eb2381a886d5499162f33c82a # main
31+
32+
- name: Compute implementation name
33+
id: impl
34+
env:
35+
GH_REPOSITORY: ${{ github.repository }}
36+
run: echo "name=${GH_REPOSITORY##*/}" >> "$GITHUB_OUTPUT"
37+
38+
- name: Compute the latest published implementation version
39+
id: version
40+
env:
41+
IMPL_NAME: ${{ steps.impl.outputs.name }}
42+
run: |
43+
# Empty on the very first build, before any image has been published.
44+
version=$(bowtie info --implementation "${IMPL_NAME}" --format json 2>/dev/null | jq -r '.version // empty' || true)
45+
echo "value=${version}" >> "$GITHUB_OUTPUT"
46+
echo "Latest published version: ${version:-<none>}"
47+
48+
ci:
49+
name: Build
50+
needs: meta
51+
# The template repository itself has no real harness to build.
52+
# Repositories created from it do, so this always runs for them.
53+
if: github.repository != 'bowtie-json-schema/test-harness-template'
54+
permissions:
55+
id-token: write # needed for build provenance attestation
56+
contents: read # needed for actions/checkout
57+
attestations: write # needed for build provenance attestation
58+
packages: write # needed for pushing to ghcr.io
59+
artifact-metadata: write # needed for build provenance attestation
60+
uses: bowtie-json-schema/bowtie/.github/workflows/harness-ci.yml@a0ae283dca0a0d0eb2381a886d5499162f33c82a # main
61+
with:
62+
# Only publish from pushes to the default branch; PRs build & smoke only.
63+
publish: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
64+
is-latest: ${{ github.ref == 'refs/heads/main' }}
65+
# Override any of the following per harness as needed:
66+
# qemu: false # for toolchains that build multi-arch natively (Go, .NET)
67+
# smoke-continue-on-error: true # only if the impl can't pass smoke yet
68+
69+
mark-previous-version:
70+
name: Tag the previous version's release
71+
needs: [ci, meta, automerge]
72+
runs-on: ubuntu-latest
73+
74+
# When the freshly built version differs from what was previously
75+
# published, cut a release (and therefore a git tag) pinned to the previous
76+
# commit so `build-all` can rebuild that historical version on demand.
77+
# Skipped on a repository's first push, when there is no previous commit.
78+
if: |
79+
(
80+
(github.event_name == 'push' && github.ref == 'refs/heads/main')
81+
|| (github.event_name == 'pull_request' && github.event.pull_request.user.login == 'dependabot[bot]')
82+
)
83+
&& github.event.before != '0000000000000000000000000000000000000000'
84+
&& needs.meta.outputs.latest-version != ''
85+
&& needs.ci.outputs.current-version != needs.meta.outputs.latest-version
86+
&& !cancelled()
87+
88+
permissions:
89+
contents: write
90+
91+
env:
92+
VERSION: ${{ needs.meta.outputs.latest-version }}
93+
# Either the PR base ref or the previous commit on the branch.
94+
COMMIT: ${{ github.event.pull_request.base.sha || github.event.before }}
95+
GH_REPOSITORY: ${{ github.repository }}
96+
97+
steps:
98+
- name: Create a release for the previous implementation version
99+
env:
100+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
101+
TAG: harness-release-${{ env.VERSION }}
102+
run: >
103+
gh api
104+
--method POST
105+
-H "Accept: application/vnd.github+json"
106+
-H "X-GitHub-Api-Version: 2022-11-28"
107+
"/repos/${GH_REPOSITORY}/releases"
108+
-f "tag_name=$TAG"
109+
-f "target_commitish=$COMMIT"
110+
-f "name=$VERSION"
111+
-f "body=Automatic release for $VERSION"
112+
-F "generate_release_notes=true"
113+
114+
automerge:
115+
name: Automerge Dependabot PRs
116+
needs: ci
117+
runs-on: ubuntu-latest
118+
119+
if: >
120+
!cancelled()
121+
&& github.event_name == 'pull_request'
122+
&& github.event.pull_request.user.login == 'dependabot[bot]'
123+
&& !contains(github.event.pull_request.labels.*.name, 'github_actions')
124+
125+
permissions:
126+
contents: write
127+
pull-requests: write
128+
129+
steps:
130+
- name: Automatically merge allowed PRs
131+
run: gh pr merge --auto --merge "$PR_URL"
132+
env:
133+
PR_URL: ${{ github.event.pull_request.html_url }}
134+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/dependabot-build.yml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Build and publish this harness's image for a Dependabot dependency bump.
2+
#
3+
# Dependabot-triggered `Rebuild Bowtie Image` runs get a read-only token and no access to secrets,
4+
# so they can build & smoke test but cannot publish.
5+
# This workflow runs once that run succeeds, in the trusted context of the base repository,
6+
# and publishes the image built from the Dependabot branch's head commit.
7+
name: Publish Dependabot Image
8+
9+
# `workflow_run` is required so that publishing runs with a writable token;
10+
# it is tightly gated below on a successful, Dependabot-authored `Build Image` run.
11+
on:
12+
workflow_run: # zizmor: ignore[dangerous-triggers] required for a writable token; gated on a successful Dependabot run below
13+
types: [completed]
14+
# Must match the `name:` of build.yml exactly.
15+
workflows: ["Rebuild Bowtie Image"]
16+
branches:
17+
- "dependabot/**"
18+
19+
permissions: {}
20+
21+
concurrency:
22+
# If several Dependabot PRs land close together, only publish the latest.
23+
group: dependabot-${{ github.event.workflow_run.event }}-${{ github.event.workflow_run.triggering_actor.login }}
24+
cancel-in-progress: true
25+
26+
jobs:
27+
publish:
28+
name: Build and Publish
29+
if: >
30+
github.event.workflow_run.event == 'pull_request'
31+
&& github.event.workflow_run.conclusion == 'success'
32+
&& github.event.workflow_run.triggering_actor.login == 'dependabot[bot]'
33+
permissions:
34+
id-token: write # needed for build provenance attestation
35+
contents: read # needed for actions/checkout
36+
attestations: write # needed for build provenance attestation
37+
packages: write # needed for pushing to ghcr.io
38+
artifact-metadata: write # needed for build provenance attestation
39+
uses: bowtie-json-schema/bowtie/.github/workflows/harness-ci.yml@a0ae283dca0a0d0eb2381a886d5499162f33c82a # main
40+
with:
41+
ref: ${{ github.event.workflow_run.head_sha }}
42+
publish: true
43+
is-latest: true

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# add ignored files specific to test harness

‎.pre-commit-config.yaml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
repos:
2+
# common hooks - should be added to template project
3+
- repo: https://github.com/pre-commit/pre-commit-hooks
4+
rev: v6.0.0
5+
hooks:
6+
- id: check-added-large-files
7+
- id: check-ast
8+
- id: check-json
9+
- id: check-toml
10+
- id: check-vcs-permalinks
11+
- id: check-yaml
12+
- id: debug-statements
13+
- id: end-of-file-fixer
14+
- id: mixed-line-ending
15+
args: [--fix, lf]
16+
- id: trailing-whitespace
17+
- repo: https://github.com/zizmorcore/zizmor-pre-commit
18+
rev: v1.28.0
19+
hooks:
20+
- id: zizmor
21+
22+
# add test harness specific hooks

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
Copyright (c) 2022 Bowtie's Authors
2+
3+
Permission is hereby granted, free of charge, to any person obtaining a copy
4+
of this software and associated documentation files (the "Software"), to deal
5+
in the Software without restriction, including without limitation the rights
6+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
7+
copies of the Software, and to permit persons to whom the Software is
8+
furnished to do so, subject to the following conditions:
9+
10+
The above copyright notice and this permission notice shall be included in
11+
all copies or substantial portions of the Software.
12+
13+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
14+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
15+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
16+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
17+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
18+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
19+
THE SOFTWARE.
20+
21+
Bowtie's logo was designed by @PaulWaller with work sponsored by [endjin](https://endjin.com).

‎README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# java-jsonschemafriend
2+
3+
A [Bowtie](https://github.com/bowtie-json-schema/bowtie) test harness.
4+
5+
Its image is published to `ghcr.io/bowtie-json-schema/java-jsonschemafriend` and run via `bowtie run -i java-jsonschemafriend`.

‎zizmor.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
rules:
2+
dependabot-cooldown:
3+
config:
4+
days: 3

0 commit comments

Comments
 (0)