Refactor GitHub Action Pipelines

[Vincinator]

We need GitHub actions to help us with the following tasks

1. PR Checks
   • run build pipelines without publishing
   • shellcheck for our bash scripts
   • more checks if we require them
2. Publishing Pipelines
   • Publish Releases, can only run on main branch. We enforce PR workflow and restrict publishing to releases to run for main branch only
   • Publish Images for testing and development (based on a feature branch)

An example for Differential-Shellchek action: https://github.com/gardenlinux/gardenlinux/blob/main/.github/workflows/differential-shellcheck.yml

Related Issues

• Consider providing all available versions #87, especially this comment: Consider providing all available versions #87 (comment)

[Vincinator]

Proposal for workflow structure

release workflow:

• Runs only on main branch
• Triggered manually via workflow_dispatch
• Triggered automatically if versions.yaml changed
• builds and publishes all versions defined in versions.yaml

on:
  push:
    branches:
      - main
    paths:
      - 'versions.yaml'
   
# Implementation ... 

dev workflow:

• Runs on branches of this repository
• Triggered by pull_request, will not publish anything if triggered by pull_request.
• Triggered by workflow_dispatch, in case maintainer wants to publish for e2e testing

on:
  workflow_dispatch:
    inputs:
      publish: 
       description: 'Publish a build from a selected branch to ghcr.io' 
          required: true
          default: 'no'
          type: choice
          options:
            - yes
            - no
  pull_request:

# Implementation ... 

Differential shellcheck

name: Differential ShellCheck
on:
  pull_request:
jobs:
  lint:
    runs-on: ubuntu-24.04

    permissions:
      security-events: write

    steps:
      - name: Repository checkout
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # pin@v5.0.0
        with:
          fetch-depth: 0

      - id: ShellCheck
        name: Differential ShellCheck
        uses: redhat-plumbers-in-action/differential-shellcheck@0d9e5b29625f871e6a4215380486d6f1a7cb6cdd # pin@aa647ec4466543e8555c2c3b648124a9813cee44
        with:
          token: ${{ secrets.GITHUB_TOKEN }}

Dependabot updates for shellcheck action dependency

Note, this is placed in .github/dependabot.yml file.

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
    reviewers:
      - "gardenlinux/nvidia-gpu-operator-maintainers"