Repository navigation
ci(deps): bump jdx/mise-action from 4.1.0 to 4.2.0 #75
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build and Release | |
| on: | |
| pull_request: | |
| branches: [ main, master ] | |
| push: | |
| branches: [ main, master ] | |
| workflow_dispatch: | |
| inputs: | |
| branch: | |
| description: 'Branch to build/release from (use a maintenance branch like release/v1.x for hotfixes)' | |
| required: true | |
| type: string | |
| default: 'master' | |
| create_release: | |
| description: 'Create a release' | |
| required: true | |
| type: boolean | |
| default: false | |
| release_type: | |
| description: 'Version bump type (you must choose)' | |
| required: true | |
| type: choice | |
| options: | |
| - patch | |
| - minor | |
| - major | |
| release_notes: | |
| description: 'Custom release notes (optional). If left empty, the last commit message is used.' | |
| required: false | |
| type: string | |
| jobs: | |
| lint: | |
| name: Lint Python Code | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6.0.3 | |
| with: | |
| ref: ${{ inputs.branch }} | |
| - name: Install mise | |
| uses: jdx/mise-action@v4.2.0 | |
| - name: Run linting | |
| run: mise run lint-check | |
| security: | |
| name: Security Scan | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6.0.3 | |
| with: | |
| ref: ${{ inputs.branch }} | |
| - name: Install mise | |
| uses: jdx/mise-action@v4.2.0 | |
| - name: Install pip-audit | |
| run: pip install pip-audit | |
| - name: Scan vnet-flow-logs dependencies | |
| run: | | |
| echo "Scanning vnet-flow-logs for vulnerabilities..." | |
| pip-audit -r vnet-flow-logs/requirements.txt --desc || true | |
| - name: Scan nsg-flow-logs dependencies | |
| run: | | |
| echo "Scanning nsg-flow-logs for vulnerabilities..." | |
| pip-audit -r nsg-flow-logs/requirements.txt --desc || true | |
| test: | |
| name: Run Tests | |
| runs-on: ubuntu-latest | |
| needs: [lint, security] | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6.0.3 | |
| with: | |
| ref: ${{ inputs.branch }} | |
| - name: Install mise | |
| uses: jdx/mise-action@v4.2.0 | |
| - name: Install dependencies | |
| run: mise run install | |
| - name: Run tests | |
| run: mise run test | |
| build: | |
| name: Build Packages | |
| runs-on: ubuntu-latest | |
| needs: test | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6.0.3 | |
| with: | |
| ref: ${{ inputs.branch }} | |
| - name: Install mise | |
| uses: jdx/mise-action@v4.2.0 | |
| - name: Build vnet-flow-logs package | |
| run: mise run build-vnet | |
| - name: Build nsg-flow-logs package | |
| run: mise run build-nsg | |
| - name: Upload vnet artifact | |
| uses: actions/upload-artifact@v7.0.1 | |
| with: | |
| name: vnet-flow-logs-package | |
| path: vnet-flow-logs/vnet.zip | |
| retention-days: 30 | |
| - name: Upload nsg artifact | |
| uses: actions/upload-artifact@v7.0.1 | |
| with: | |
| name: nsg-flow-logs-package | |
| path: nsg-flow-logs/nsg.zip | |
| retention-days: 30 | |
| release: | |
| name: Create Release | |
| runs-on: ubuntu-latest | |
| needs: build | |
| if: ${{ github.event_name == 'workflow_dispatch' && inputs.create_release == true }} | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v6.0.3 | |
| with: | |
| ref: ${{ inputs.branch }} | |
| fetch-depth: 0 | |
| - name: Get latest tag | |
| id: get_tag | |
| run: | | |
| # Make sure we have all tags locally | |
| git fetch --tags --quiet | |
| # Only consider strict semver release tags (vMAJOR.MINOR.PATCH). | |
| # This ignores draft/pre-release tags like "vdraft-pr12...". | |
| LATEST_TAG=$(git tag --list 'v[0-9]*.[0-9]*.[0-9]*' \ | |
| | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' \ | |
| | sort -V \ | |
| | tail -n 1) | |
| if [ -z "$LATEST_TAG" ]; then | |
| LATEST_TAG="v0.0.0" | |
| fi | |
| echo "latest_tag=$LATEST_TAG" >> $GITHUB_OUTPUT | |
| echo "Latest release tag: $LATEST_TAG" | |
| - name: Bump version | |
| id: bump_version | |
| run: | | |
| LATEST_TAG="${{ steps.get_tag.outputs.latest_tag }}" | |
| # Validate the tag is strict semver before doing arithmetic on it. | |
| if ! [[ "$LATEST_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then | |
| echo "::error::Latest tag '$LATEST_TAG' is not valid semver (vMAJOR.MINOR.PATCH). Refusing to bump." | |
| exit 1 | |
| fi | |
| # Remove 'v' prefix if present | |
| VERSION=${LATEST_TAG#v} | |
| # Split version into parts | |
| IFS='.' read -r -a VERSION_PARTS <<< "$VERSION" | |
| MAJOR=${VERSION_PARTS[0]:-0} | |
| MINOR=${VERSION_PARTS[1]:-0} | |
| PATCH=${VERSION_PARTS[2]:-0} | |
| # Bump according to the selected release type | |
| case "${{ inputs.release_type }}" in | |
| major) MAJOR=$((MAJOR + 1)); MINOR=0; PATCH=0 ;; | |
| minor) MINOR=$((MINOR + 1)); PATCH=0 ;; | |
| patch) PATCH=$((PATCH + 1)) ;; | |
| *) echo "::error::Invalid release_type '${{ inputs.release_type }}'"; exit 1 ;; | |
| esac | |
| NEW_VERSION="v${MAJOR}.${MINOR}.${PATCH}" | |
| echo "new_version=$NEW_VERSION" >> $GITHUB_OUTPUT | |
| echo "New version: $NEW_VERSION (bump: ${{ inputs.release_type }})" | |
| - name: Ensure tag does not already exist | |
| run: | | |
| NEW_VERSION="${{ steps.bump_version.outputs.new_version }}" | |
| # Refresh tags from the remote to catch tags not present locally | |
| git fetch --tags --quiet | |
| if git rev-parse -q --verify "refs/tags/${NEW_VERSION}" >/dev/null; then | |
| echo "::error::Tag ${NEW_VERSION} already exists. Refusing to overwrite an existing release." | |
| exit 1 | |
| fi | |
| echo "Tag ${NEW_VERSION} is available." | |
| - name: Prepare release notes | |
| id: get_commit_msg | |
| env: | |
| CUSTOM_NOTES: ${{ inputs.release_notes }} | |
| run: | | |
| # Prefer custom release notes when provided via workflow_dispatch. | |
| if [[ -n "${CUSTOM_NOTES//[[:space:]]/}" ]]; then | |
| printf '%s\n' "$CUSTOM_NOTES" > commit_message.txt | |
| echo "Using custom release notes from workflow input" | |
| else | |
| # Fall back to the last non-merge commit message. | |
| if [[ "${{ github.event_name }}" == "push" ]]; then | |
| # For push events, get the commit message before the merge commit | |
| COMMIT_MSG=$(git log --no-merges -1 --pretty=%B) | |
| else | |
| # For manual workflow dispatch, get the latest commit | |
| COMMIT_MSG=$(git log -1 --pretty=%B) | |
| fi | |
| printf '%s\n' "$COMMIT_MSG" > commit_message.txt | |
| echo "Using last commit message as release notes" | |
| fi | |
| - name: Download vnet artifact | |
| uses: actions/download-artifact@v8.0.1 | |
| with: | |
| name: vnet-flow-logs-package | |
| path: ./artifacts | |
| - name: Download nsg artifact | |
| uses: actions/download-artifact@v8.0.1 | |
| with: | |
| name: nsg-flow-logs-package | |
| path: ./artifacts | |
| - name: Create Release | |
| uses: softprops/action-gh-release@v3.0.0 | |
| with: | |
| tag_name: ${{ steps.bump_version.outputs.new_version }} | |
| name: Release ${{ steps.bump_version.outputs.new_version }} | |
| body_path: commit_message.txt | |
| draft: false | |
| prerelease: false | |
| files: | | |
| ./artifacts/vnet.zip | |
| ./artifacts/nsg.zip | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} |