♻️ [#28] Improve and use common actions and files

.github/workflows/ci.yml

@@ -15,76 +15,74 @@ env:
   IMAGE_NAME: maykinmedia/opendms
   DJANGO_SETTINGS_MODULE: opendms.conf.ci
   DOCKER_BUILDKIT: '1'
+  DB_PASSWORD: ''
+  DB_USER: postgres
 
 jobs:
 
-  setup:
-    name: Set up the build variables
-    runs-on: ubuntu-latest
-    outputs:
-      tag: ${{ steps.vars.outputs.tag }}
-      git_hash: ${{ steps.vars.outputs.git_hash }}
-
+  # determine changed files to decide if certain jobs can be skipped or not
+  changed-files:
+    runs-on: ubuntu-latest  # windows-latest | macos-latest
+    name: Determine changed files
     steps:
-      - name: Extract version information
-        id: vars
-        run: |
-          # Strip git ref prefix from version
-          VERSION=$(echo "${{ github.ref }}" | sed -e 's,.*/\(.*\),\1,')
 
-          # Strip "v" prefix from tag name (if present at all)
-          [[ "${{ github.ref }}" == "refs/tags/"* ]] && VERSION=$(echo $VERSION | sed -e 's/^v//')
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
-          # Use Docker `latest` tag convention
-          [ "$VERSION" == "main" ] && VERSION=latest
+      - name: Get changed PY files
+        id: changed-py-files
+        run: bin/check_changed_files.sh ^src/.*\.py$
 
-          # PRs result in version 'merge' -> transform that into 'latest'
-          [ "$VERSION" == "merge" ] && VERSION=latest
+      - name: Get changed requirements files
+        id: changed-requirements
+        run: bin/check_changed_files.sh ^requirements/.*\.txt$
 
-          echo "tag=${VERSION}" >> $GITHUB_OUTPUT
-          echo "git_hash=${GITHUB_SHA}" >> $GITHUB_OUTPUT
+    outputs:
+      changed-py-files: ${{ steps.changed-py-files.outputs.any_changed }}
+      changed-requirements: ${{ steps.changed-requirements.outputs.any_changed }}
 
   tests:
-    name: Run the Django test suite
+    name: Tests (PG ${{ matrix.postgres }})
     runs-on: ubuntu-latest
+    needs:
+      - changed-files
+
+    # only run tests if source files have changed (e.g. skip for PRs that only update docs)
+    if: ${{ needs.changed-files.outputs.changed-py-files == 'true'|| needs.changed-files.outputs.changed-requirements == 'true'|| github.event_name == 'push' }}
+
+    strategy:
+      matrix:
+        postgres: ["14", "15", "16", "17"]
 
     services:
       postgres:
-        image: postgres:17
+        image: postgres:${{ matrix.postgres }}
         env:
           POSTGRES_HOST_AUTH_METHOD: trust
         ports:
           - 5432:5432
-        # Needed because the postgres container does not provide a healthcheck
-        options: >-
-          --name postgres
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+        # needed because the postgres container does not provide a healthcheck
+        options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
       redis:
-        image: redis:6
+        image: redis:8
         ports:
           - 6379:6379
+
     steps:
       - uses: actions/checkout@v4
       - name: Set up backend environment
         uses: maykinmedia/setup-django-backend@v1.3
         with:
           python-version: '3.14'
-          optimize-postgres: 'yes'
-          pg-service: 'postgres'
-          setup-node: 'no'
+          setup-node: true
 
       - name: Run tests
         run: |
-          python src/manage.py compilemessages
           python src/manage.py collectstatic --noinput --link
           coverage run src/manage.py test src
         env:
           SECRET_KEY: dummy
-          DB_USER: postgres
-          DB_PASSWORD: ''
 
       - name: Publish coverage report
         uses: codecov/codecov-action@v4
@@ -115,79 +113,61 @@ jobs:
           npx playwright install
           npm run test
 
-  # docs:
-  #   name: Build and check documentation
-  #   runs-on: ubuntu-latest
-
-  #   steps:
-  #     - uses: actions/checkout@v4
-  #     - uses: maykinmedia/setup-django-backend@v1.3
-  #       with:
-  #         python-version: '3.14'
-  #         setup-node: 'no'
-  #         # apt-packages: 'gettext postgresql-client'  # the default
-
-  #     - name: Build and test docs
-  #       run: |
-  #         export OPENSSL_CONF=$(pwd)/openssl.conf
-  #         pytest check_sphinx.py -v --tb=auto
-  #       working-directory: docs
-
-  docker_build:
-    name: Build Docker image
+  check-envvar-docs:
     runs-on: ubuntu-latest
-    outputs:
-      image_tag: ${{ steps.image_build.outputs.image_tag }}
-
-    needs:
-      - setup
+    name: Documentation build
 
     steps:
       - uses: actions/checkout@v4
+      - name: Set up backend environment
+        uses: maykinmedia/setup-django-backend@v1.3
+        with:
+          python-version: '3.14'
+          apt-packages: "libgdal-dev gdal-bin"
+          setup-node: false
 
-      - name: Build the production Docker image
-        id: image_build
+      - name: Generate environment variable documentation using OAf and check if it was updated
         run: |
-          image_tag="$IMAGE_NAME:$RELEASE_VERSION"
-          echo "image_tag=${image_tag}" >> $GITHUB_OUTPUT
-          docker build . \
-            --tag $image_tag \
-            --build-arg COMMIT_HASH=${{ needs.setup.outputs.git_hash }} \
-            --build-arg RELEASE=${{ needs.setup.outputs.tag }} \
-        env:
-          RELEASE_VERSION: ${{ needs.setup.outputs.tag }}
+          bin/generate_envvar_docs.sh
+          changes=$(git diff docs/installation/config/env_configuration.rst)
+          if [ ! -z "$changes" ]; then
+              echo $changes
+              echo "Please update the environment documentation by running \`bin/generate_envvar_docs.sh\`"
+              exit 1
+          fi
+
+  store-reusable-workflow-vars:
+    name: create values which can be passed through a reusable workflow
+    runs-on: ubuntu-latest
+    outputs:
+      image-name: ${{ steps.image-name.outputs.image-name }}
 
-      - run: docker image save -o image.tar $IMAGE_NAME:${{ needs.setup.outputs.tag }}
-      - name: Store image artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: docker-image
-          path: image.tar
-          retention-days: 1
+    steps:
+      - run: echo "image-name=$IMAGE_NAME" >> $GITHUB_OUTPUT
+        name: 'Store the docker image name'
+        id: image-name
 
-#  docker_push:
+  open-api-ci:
+    uses: maykinmedia/open-api-workflows/.github/workflows/ci.yml@v6
+    needs:
+      - store-reusable-workflow-vars
+    with:
+      apt-packages: 'graphviz graphviz-dev'
+      main-branch: 'main'
+      run-docs: true
+      python-version: '3.14'
+      docker-image-name: ${{ needs.store-reusable-workflow-vars.outputs.image-name }}
+      django-settings-module: opendms.conf.ci
+
+#  open-api-publish:
+#    uses: maykinmedia/open-api-workflows/.github/workflows/publish.yml@v6
 #    needs:
+#      - store-reusable-workflow-vars
+#      - open-api-ci
 #      - tests
-#      - docker_build
-#
-#    name: Push Docker image
-#    runs-on: ubuntu-latest
-#    if: github.event_name == 'push' # Exclude PRs
-#
-#    steps:
-#      - name: Download built image
-#        uses: actions/download-artifact@v4
-#        with:
-#          name: docker-image
-#
-#      - name: Load image
-#        run: |
-#          docker image load -i image.tar
-#
-#      - name: Log into registry
-#        run:
-#          echo "${{ secrets.DOCKER_TOKEN }}" | docker login -u ${{ secrets.DOCKER_USERNAME }}
-#          --password-stdin
-#
-#      - name: Push the Docker image (production)
-#        run: docker push ${{ needs.docker_build.outputs.image_tag }}
+#    with:
+#      docker-image-name: ${{ needs.store-reusable-workflow-vars.outputs.image-name }}
+#      repository-owner: 'maykinmedia'
+#    secrets:
+#      docker-username: ${{ secrets.DOCKER_USERNAME }}
+#      docker-token: ${{ secrets.DOCKER_TOKEN }}

.github/workflows/code-quality.yml

@@ -1,89 +1,23 @@
+# For most projects, this workflow file will not need changing; you simply need
+# to commit it to your repository.
+#
+# You may wish to alter this file to override the set of languages analyzed,
+# or to provide custom queries or build logic.
 name: Code quality checks
 
-# Run this workflow every time a new commit pushed to your repository
 on:
   push:
     branches:
       - main
-      - stable/*
-    tags:
-      - '*'
   pull_request:
   workflow_dispatch:
 
 jobs:
-  ruff:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/ruff-action@v3
-      - name: Linting
-        run: ruff check
-      - name: Check formatting
-        run: ruff format --check
-
-  migrations:
-    name: Check for model changes not present in migrations
-    runs-on: ubuntu-latest
-
-    services:
-      postgres:
-        image: postgres:17
-        env:
-          POSTGRES_HOST_AUTH_METHOD: trust
-        ports:
-          - 5432:5432
-        # Needed because the postgres container does not provide a healthcheck
-        options:
-          --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up backend environment
-        uses: maykinmedia/setup-django-backend@v1.3
-        with:
-          python-version: '3.14'
-          setup-node: 'no'
-
-      - name: Run makemigrations to check for missing migrations
-        run: |
-          src/manage.py makemigrations \
-            --check \
-            --dry-run
-        env:
-          DJANGO_SETTINGS_MODULE: "opendms.conf.ci"
-          DEBUG: 'true'
-          SECRET_KEY: dummy
-          DB_USER: postgres
-          DB_NAME: postgres
-          DB_PASSWORD: ''
-
-  translations:
-    name: Check for missing translations
-    runs-on: ubuntu-latest
-
-    services:
-      postgres:
-        image: postgres:17
-        env:
-          POSTGRES_HOST_AUTH_METHOD: trust
-        ports:
-          - 5432:5432
-        # Needed because the postgres container does not provide a healthcheck
-        options:
-          --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Set up backend environment
-        uses: maykinmedia/setup-django-backend@v1.3
-        with:
-          python-version: '3.14'
-          setup-node: 'no'
-
-      - name: Run makemessages to check for missing translations
-        run: |
-          python src/manage.py makemessages --all
-          git diff --exit-code
-        env:
-          DJANGO_SETTINGS_MODULE: "opendms.conf.ci"
+  open-api-workflow-code-quality:
+    uses: maykinmedia/open-api-workflows/.github/workflows/code-quality.yml@v6
+    with:
+      python-version: "3.14"
+      node-version: "24"
+
+      django-settings-module: "opendms.conf.ci"
+      django-secret-key: dummy

.github/workflows/codeql-analysis.yml

@@ -1,39 +1,14 @@
-name: 'CodeQL'
+name: "CodeQL"
 
 on:
   push:
     branches:
       - main
       - stable/*
+  pull_request:
   schedule:
     - cron: '32 20 * * 3'
 
 jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ['javascript', 'python']
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      # Initializes the CodeQL tools for scanning.
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: ${{ matrix.language }}
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
-
-      - name: Perform CodeQL Analysis
-        if: ${{ github.event.repository.visibility == 'public' }}  # Seems to fail on private repo's
-        uses: github/codeql-action/analyze@v3
+  open-api-workflow-code-analysis:
+    uses: maykinmedia/open-api-workflows/.github/workflows/code-analysis.yml@v6