stuttgart-things/github-workflow-templates

REUSABLE WORKFLOW-CALLS

WORFKLOW-FOLDER

mkdir -p .github/workflows

TRIGGER

on:
  workflow_dispatch:
  push:
    branches:
      - 'main'
      - 'feature/**'
      - 'fix/**'
  pull_request:
    types: [opened, reopened]

GOLANG BUILD

jobs:
  validate-golang:
    name: Valdiate Golang
    uses: stuttgart-things/github-workflow-templates/.github/workflows/call-golang-validation.yaml@main
    with:
      module-name: kaeffken
      environment-name: k8s
      runs-on: ghr-kaeffken-skyami-cicd
      golint-version: v1.61.0-alpine
      golang-version: "1.23.1"
      accept-linterrors: true
      accept-failedtests: false
    secrets: inherit

KO BUILD (ttl.sh / ghcr.io)

jobs:
  build-image:
    name: Build & Push Image
    uses: stuttgart-things/github-workflow-templates/.github/workflows/call-ko-build.yaml@main
    with:
      registry: ghcr.io
      image-repo: ${{ github.repository }}
      tags: pr-${{ github.event.number }}-${{ github.event.pull_request.head.sha }}
      push: true
      build-path: ./cmd/myapp
    secrets: inherit

Defaults to registry: ttl.sh with a random repo + tag=latest for throwaway smoke runs. When registry: ghcr.io the workflow uses GITHUB_TOKEN to log in (caller must declare packages: write). The first tag is exposed as the image-ref workflow output for downstream scan/deploy/PR-comment jobs.

PUSH KUSTOMIZE OCI BASE

jobs:
  push-kustomize:
    name: Push Kustomize OCI Base
    uses: stuttgart-things/github-workflow-templates/.github/workflows/call-push-kustomize.yaml@main
    with:
      kcl-source-dir: kcl
      kcl-profile-file: tests/kcl-deploy-profile.yaml
      kustomize-oci-repo: ghcr.io/${{ github.repository }}-kustomize
      tag: pr-${{ github.event.number }}-${{ github.event.pull_request.head.sha }}
    secrets: inherit

Wraps dagger call -m <kcl-module> push-kustomize-base for callers that need a PR-coordinated kustomize artifact on every push (the release-only path lives in call-go-release.yaml). The pushed address:tag is exposed as the artifact-ref workflow output.

CLEANUP PR-TAGGED GHCR ARTIFACTS

on:
  pull_request:
    types: [closed]

jobs:
  cleanup:
    name: Delete PR-tagged GHCR versions
    uses: stuttgart-things/github-workflow-templates/.github/workflows/call-cleanup-pr-artifacts.yaml@main
    with:
      packages: |
        myrepo
        myrepo-kustomize
    secrets: inherit

Defaults to deleting every GHCR version whose tag starts with pr-<num>- for the closed PR. Set dry-run: true first to preview matches. Override tag-pattern for custom tagging schemes. GHCR retains PR-tagged versions forever otherwise, so wire this up alongside any workflow that pushes pr-<num>-<sha> artifacts.

YAML LINT

jobs:
  yaml-lint:
    name: Lint yaml files
    uses: stuttgart-things/github-workflow-templates/.github/workflows/call-yaml-lint.yaml@feature/add-homerun-task-go
    with:
      runs-on: ghr-install-configure-docker-skyami-cicd
      environment-name: k8s
      continue-error: true
      yamllint-version: 1
      lintprofile-path: .yamllint
      artifact-name: yaml-lint

KCL VALIDATE

jobs:
  kcl-validate:
    name: KCL Validate
    strategy:
      matrix:
        module-dir: [kcl/ansible, kcl/ansible-run, kcl/buildah]
    uses: stuttgart-things/github-workflow-templates/.github/workflows/call-kcl-validate.yaml@main
    with:
      module-dir: ${{ matrix.module-dir }}
    secrets: inherit

Validates one KCL module directory per call via the stuttgart-things/dagger/kcl module: a formatting check (kcl fmt + git diff --exit-code, since kcl fmt has no native --check flag) and a compile/render check (validate-kcl). Optionally renders the entrypoint with caller-supplied flat-parameters (-D key=value) and/or composition-parameters (params={oxr:{spec:{...}}}) — parameter values must not contain spaces. Use a matrix in the caller to cover multiple modules.

ACTIONS

SEND MESSAGE TO HOMERUN

jobs:
  send-to-homerun:
    runs-on: ghr-stuttgart-things-skyami-cicd
    steps:
      - name: Send Message To Homerun
        uses: stuttgart-things/github-workflow-templates/actions/send-homerun-message@main
        with:
          url: "https://homerun.homerun-dev.sthings-vsphere.labul.sva.de/generic"
          secretToken: "${{ secrets.HOMERUN_TOKEN }}" # Pass the secret
          title: "Test Homerun Title"
          message: "Test Homerun Message"
          severity: "INFO"
          artifacts: "Test Artifact"
          tags: "github,test"
          assigneeName: "patrick"
          assigneeAddress: ""

VERIFY KUSTOMIZE OCI BASE

Pulls a published kustomize OCI base back out of the registry and checks that every embedded YAML document inside a ConfigMap still parses.

Both call-push-kustomize.yaml and call-go-release.yaml run this already — call it directly only when you push a base some other way.

      - name: Verify the pushed base
        uses: stuttgart-things/github-workflow-templates/actions/verify-kustomize-base@main
        with:
          artifact-ref: ghcr.io/stuttgart-things/my-app-kustomize:v1.2.3
          registry-token: ${{ secrets.GITHUB_TOKEN }} # omit for a public package

Why it exists: a ConfigMap value serialised as a quoted multi-line scalar instead of a block literal (|) is still a perfectly valid manifest. YAML folds the quoted scalar's line breaks into spaces on read, so the embedded document arrives as one line with its indentation gone. The artifact pushes green, every manifest validates, and the consuming Pod dies at startup on

yaml: mapping values are not allowed in this context

That is exactly how homerun2-git-pitcher:v1.0.0 and homerun2-k8s-pitcher:v1.0.0 shipped. Verifying the pulled artifact rather than a local render is deliberate — it is the bytes consumers get, so a defect introduced by the publishing toolchain is in scope.

DEV

ALL TASKS

task: Available tasks for this project:
* branch:              Create branch from main
* check:               Run pre-commit hooks
* commit:              Commit + push code into branch
* pr:                  Create pull request into main
* switch-local:        Switch to local branch
* switch-remote:       Switch to remote branch
* tag:                 Tag repo
* tasks:               Select a task to run

SELECT TASK

task=$(yq e '.tasks | keys' Taskfile.yaml | sed 's/^- //' | gum choose) && task ${task}

AUTHORS

---
authors:
  - patrick.hermann

LICENSE

APACHE 2.0

Copyright 2023 patrick hermann.

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.