@@ -143,12 +143,7 @@ on: # yamllint disable-line rule:truthy
143143 ```
144144value : ${{ jobs.publish-manifests.outputs.built-images }}
145145
146- permissions :
147- contents : read
148- issues : read
149- packages : write
150- pull-requests : read
151- id-token : write
146+ permissions : {}
152147
153148jobs :
154149 prepare-variables :
@@ -239,12 +234,16 @@ jobs:
239234
240235id : define-images-by-platform
241236 uses : actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
237+ env :
238+ IMAGES : ${{ steps.validate-inputs.outputs.images }}
239+ RUNS_ON_INPUT : ${{ inputs.runs-on }}
240+ REPOSITORY_PRIVATE : ${{ github.event.repository.private }}
242241 with :
243242 script : |
244- const imagesInput = `${{ steps.validate-inputs.outputs.images }}` ;
243+ const imagesInput = process.env.IMAGES ;
245244 const images = JSON.parse(imagesInput.replace(/\n/g, '\\n'));
246245
247- const runsOnInput = `${{ inputs.runs-on }}` ;
246+ const runsOnInput = process.env.RUNS_ON_INPUT ;
248247 const isDefaultRunsOn = runsOnInput === '["ubuntu-latest"]';
249248 const runsOn = JSON.parse(runsOnInput);
250249
@@ -254,7 +253,7 @@ jobs:
254253 { runner: "windows-latest", platformPattern: /^windows\// }
255254 ];
256255
257- const isRepositoryPrivate = `${{ github.event.repository.private }}` === 'true';
256+ const isRepositoryPrivate = process.env.REPOSITORY_PRIVATE === 'true';
258257 if (!isRepositoryPrivate) {
259258 standardHostedRunnerByPlatform.unshift(
260259 { runner: "ubuntu-24.04-arm", platformPattern: /^linux\/arm/ }, // FIXME: should use latest when available,
@@ -317,6 +316,8 @@ jobs:
317316 }
318317 }
319318
319+ core.debug(`Images by platform: ${JSON.stringify(imagesByPlatform, null, 2)}`);
320+
320321 core.setOutput('images', JSON.stringify(imagesByPlatform));
321322
322323id : define-artifact-name
@@ -344,31 +345,20 @@ jobs:
344345 pull-requests : read
345346 issues : read
346347 packages : write
347- # FIXME: This is a workaround for having workflow actions. See https://github.com/orgs/community/discussions/38659
348- id-token : write
348+ id-token : write # Needed for getting local workflow actions
349349 steps :
350- - uses : hoverkraft-tech/ci-github-common/actions/checkout@5e8d0e6d1e76d8577a070db6d0128a91b1c9d5ad # 0.30.2
350+ - uses : hoverkraft-tech/ci-github-common/actions/checkout@a55670b58d3e064526201acde6c720ede638420c # 0.31.0
351351 with :
352352 lfs : ${{ inputs.lfs }}
353353
354354 - if : inputs.lfs
355355 shell : bash
356356 run : git lfs pull
357357
358- # FIXME: This is a workaround for having workflow actions. See https://github.com/orgs/community/discussions/38659
359- - id : oidc
360- uses : ChristopherHX/oidc@73eee1ff03fdfce10eda179f617131532209edbd # v3
361- - uses : actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
358+ - id : local-workflow-actions
359+ uses : hoverkraft-tech/ci-github-common/actions/local-workflow-actions@e6733528d06b6e1668674c35ef3612ac416cedda # 0.31.1
362360 with :
363- persist-credentials : false
364- path : ./self-workflow
365- repository : ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
366- ref : ${{ steps.oidc.outputs.job_workflow_repo_ref }}
367- sparse-checkout : |
368- actions
369- run : |
370- echo "self-workflow" >> .gitignore
371- echo "self-workflow" >> .dockerignore
361+ actions-path : actions
372362
373363 - uses : actions/create-github-app-token@7e473efe3cb98aa54f8d4bac15400b15fad77d94 # v2.2.0
374364 if : inputs.build-secret-github-app-id
@@ -432,36 +422,31 @@ jobs:
432422
433423 # FIXME: Set built images infos in file to be uploaded as artifacts, because github action does not handle job outputs for matrix
434424 # https://github.com/orgs/community/discussions/26639
435- - uses : hoverkraft-tech/ci-github-common/actions/set-matrix-output@5e8d0e6d1e76d8577a070db6d0128a91b1c9d5ad # 0.30.2
425+ - uses : hoverkraft-tech/ci-github-common/actions/set-matrix-output@a55670b58d3e064526201acde6c720ede638420c # 0.31.0
436426 with :
437427 artifact-name : ${{ needs.prepare-variables.outputs.artifact-name }}
438428 value : ${{ steps.build.outputs.built-image }}
439429
440- # FIXME: This is a workaround for having workflow actions. See https://github.com/orgs/community/discussions/38659
441- - uses : actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
442- if : always() && steps.oidc.outputs.job_workflow_repo_name_and_owner
430+ - uses : hoverkraft-tech/ci-github-common/actions/local-workflow-actions@e6733528d06b6e1668674c35ef3612ac416cedda # 0.31.1
431+ if : always() && steps.local-workflow-actions.outputs.repository
443432 with :
444- persist-credentials : false
445- path : ./self-workflow
446- repository : ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
447- ref : ${{ steps.oidc.outputs.job_workflow_repo_ref }}
448- sparse-checkout : |
449- actions
433+ actions-path : actions
434+ repository : ${{ steps.local-workflow-actions.outputs.repository }}
435+ ref : ${{ steps.local-workflow-actions.outputs.ref }}
450436
451437 publish-manifests :
452438 name : Publish images manifests
453439 permissions :
454440 contents : read
455441 packages : write
456- # FIXME: This is a workaround for having workflow ref. See https://github.com/orgs/community/discussions/38659
457- id-token : write
442+ id-token : write # Needed for getting local workflow actions
458443 needs : [prepare-variables, build-images]
459444 runs-on : ${{ fromJson(inputs.runs-on) }}
460445 outputs :
461446 built-images : ${{ steps.create-images-manifests.outputs.built-images }}
462447 steps :
463448 - id : get-matrix-outputs
464- uses : hoverkraft-tech/ci-github-common/actions/get-matrix-outputs@5e8d0e6d1e76d8577a070db6d0128a91b1c9d5ad # 0.30.2
449+ uses : hoverkraft-tech/ci-github-common/actions/get-matrix-outputs@a55670b58d3e064526201acde6c720ede638420c # 0.31.0
465450 with :
466451 artifact-name : ${{ needs.prepare-variables.outputs.artifact-name }}
467452
@@ -496,21 +481,10 @@ jobs:
496481
497482 core.setOutput('built-images', JSON.stringify(images));
498483
499- # FIXME: This is a workaround for having workflow ref. See https://github.com/orgs/community/discussions/38659
500- - id : oidc
501- uses : ChristopherHX/oidc@73eee1ff03fdfce10eda179f617131532209edbd # v3
502- - uses : actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
484+ id : local-workflow-actions
485+ uses : hoverkraft-tech/ci-github-common/actions/local-workflow-actions@e6733528d06b6e1668674c35ef3612ac416cedda # 0.31.1
503486 with :
504- persist-credentials : false
505- path : ./self-workflow
506- repository : ${{ steps.oidc.outputs.job_workflow_repo_name_and_owner }}
507- ref : ${{ steps.oidc.outputs.job_workflow_repo_ref }}
508- sparse-checkout : |
509- actions
510- name : ignore self-worfklow changes
511- run : |
512- echo "self-workflow" >> .gitignore
513- echo "self-workflow" >> .dockerignore
487+ actions-path : actions
514488
515489 - id : create-images-manifests
516490 uses : ./self-workflow/actions/docker/create-images-manifests
@@ -536,8 +510,16 @@ jobs:
536510 // Get images to sign
537511 const imagesToSign = Object.values(builtImages).map(image => image.images).flat();
538512 core.setOutput('images-to-sign', JSON.stringify(imagesToSign));
513+
539514uses : ./self-workflow/actions/docker/sign-images
540515 if : steps.get-images-to-sign.outputs.images-to-sign
541516 with :
542517 images : ${{ steps.get-images-to-sign.outputs.images-to-sign }}
543518 github-token : ${{ secrets.GITHUB_TOKEN }}
519+
520+ - uses : hoverkraft-tech/ci-github-common/actions/local-workflow-actions@e6733528d06b6e1668674c35ef3612ac416cedda # 0.31.1
521+ if : always() && steps.local-workflow-actions.outputs.repository
522+ with :
523+ actions-path : actions
524+ repository : ${{ steps.local-workflow-actions.outputs.repository }}
525+ ref : ${{ steps.local-workflow-actions.outputs.ref }}
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
0 commit comments