ci: add aggregate CI OK check so a skipped job cannot pass the gate #499
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build | |
| on: | |
| push: | |
| branches: [ localstack ] | |
| tags: v*.* | |
| pull_request: | |
| branches: [ localstack ] | |
| # Callable by weekly-release.yml; publishes a release when `version` is set. | |
| workflow_call: | |
| inputs: | |
| version: | |
| description: "Release version to tag and publish (e.g. v0.2.1). When set, a release is published." | |
| type: string | |
| required: false | |
| default: "" | |
| prerelease: | |
| description: "Publish as a pre-release. Promoted to a full release once localstack-pro validates it." | |
| type: boolean | |
| required: false | |
| default: false | |
| jobs: | |
| test: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| - name: Run tests | |
| run: make tests-with-docker | |
| build: | |
| runs-on: ubuntu-latest | |
| needs: test | |
| permissions: | |
| contents: write | |
| steps: | |
| - uses: actions/checkout@v7 | |
| - name: Set up Go | |
| uses: actions/setup-go@v7 | |
| with: | |
| go-version-file: go.mod | |
| - name: Build | |
| env: | |
| RELEASE_BUILD_LINKER_FLAGS: "-s -w" | |
| run: make compile-lambda-linux-all | |
| - uses: actions/upload-artifact@v7 | |
| with: | |
| name: aws-lambda-rie | |
| path: bin/* | |
| - name: Push tag | |
| if: inputs.version != '' | |
| run: | | |
| git tag "${{ inputs.version }}" "$GITHUB_SHA" | |
| git push origin "${{ inputs.version }}" | |
| - name: Release binaries | |
| uses: softprops/action-gh-release@v3 | |
| if: startsWith(github.ref, 'refs/tags/') || inputs.version != '' | |
| with: | |
| tag_name: ${{ inputs.version || github.ref_name }} | |
| files: bin/* | |
| generate_release_notes: true | |
| prerelease: ${{ inputs.prerelease || endsWith(github.ref, '-pre') || endsWith(inputs.version, '-pre') }} | |
| # Single aggregate check for the branch ruleset to require. | |
| # | |
| # `build` needs `test`, so a failing `test` leaves `build` reporting "skipped" — | |
| # which GitHub counts as a passing required status check. That is how six | |
| # Renovate PRs automerged onto a red `localstack` between Aug 22 and Aug 30. | |
| # | |
| # This job depends on every other job and treats anything other than "success" | |
| # as a failure, so a skip can no longer masquerade as a pass. `if: always()` | |
| # is required: without it the job would itself be skipped when an upstream job | |
| # fails, and a required check that never reports blocks the PR as pending. | |
| # Add new jobs to `needs` as they are introduced. | |
| ci-ok: | |
| name: CI OK | |
| if: always() | |
| needs: [test, build] | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Verify upstream jobs succeeded | |
| env: | |
| RESULTS: ${{ toJSON(needs) }} | |
| run: | | |
| echo "$RESULTS" | |
| echo "$RESULTS" | jq -e 'to_entries | map(select(.value.result != "success")) | length == 0' > /dev/null \ | |
| || { echo "::error::One or more upstream jobs did not succeed"; exit 1; } |