Simplify workflows and use ghcr on release too

SciCatProject / backend-v3

SciCat Data Catalogue Backend

https://scicatproject.github.io/documentation/

BSD 3-Clause "New" or "Revised" License

13 stars 17 forks source link

Simplify workflows and use ghcr on release too #697

Closed minottic closed 1 year ago

minottic commented 1 year ago

Description

Review and simplification of existing workflows, triggered by failing steps when a PR was opened from a fork

Motivation

Avoid pushing on PR, given the possible permission problems on PRs from forks.
Use GHCR as container registry for releases too
Simplify workflows by removing non-needed steps
Add commit sha tag on push to ghcr after merge
remove test jobs from push to master, as changes on master require having gone through a successful and approved PR

minottic commented 1 year ago

I've simplified the workflows a little, the commits try to summarise the changes (one commit per file for readability).

To note that I've removed the test step for push as I've added protection rules to the master branch, meaning that it should be able to modify it only through an approved PR with passing checks.

Another important change is that on release the image is pushed to ghcr instead of dockerhub.

Also, pushing the image on PR might be useful if many of us have the use case of using it (e.g. for deploying not yet approved PRs or for local testing by downloading the image). I've disabled it for now as I don't know how frequent that is and might be an overkill for now.

dylanmcreynolds commented 1 year ago

This is great.

This is how I'm reading it now:

On every push to any branch: test (test-build.yaml)
On every push to master: build and push to ghcr, with tags :latest and :<commit hash> (build-push.yaml)
On publish: build and push to ghcr, with tags <release tag name> and :stable (build-push.yaml)

My only comment is that in build-push.yaml, we might want a tag with "latest" as well, right? It makes very little different, but latest will be one commit behind depending on how people apply their releases. (I think some people apply an empty commit when they tag for a release.)

minottic commented 1 year ago

On every push to any branch: test (test-build.yaml)

Just a note from your previous comment, the test-build.yaml is triggered on PR, so strictly speaking the build and test does not happen on every push to any branch, but just when the PR is opened (from any branch to any branch).

I've added the latest tag when pushing from main-release.yaml, thanks for noticing that!