Skip to content

Commit 1122067

Browse files
marcoienimarcoieni
authored
Merge pull request #1715 from Kobzol/ci-merge-queue
Switch to merge queues
2 parents a45a0ce + 2112d77 commit 1122067

File tree

1 file changed

+127
-14
lines changed

1 file changed

+127
-14
lines changed

‎.github/workflows/main.yml

Lines changed: 127 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,16 @@
11
name: CI
22

3-
on: [ push, pull_request ]
3+
on:
4+
pull_request:
5+
merge_group:
46

57
jobs:
6-
ci:
7-
name: CI
8+
test:
9+
name: Test
810
runs-on: ubuntu-latest
911
if: github.repository == 'rust-lang/team'
10-
permissions:
11-
id-token: write
12-
pages: write
1312
steps:
14-
15-
- uses: actions/checkout@main
13+
- uses: actions/checkout@v4
1614
with:
1715
fetch-depth: 50
1816

@@ -23,7 +21,7 @@ jobs:
2321
rustup default stable
2422
rustc -vV
2523
26-
- uses: Swatinem/rust-cache@v2
24+
- uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6
2725

2826
- name: Build the validation tool
2927
run: cargo build
@@ -52,36 +50,151 @@ jobs:
5250
run: echo "${{ github.event.pull_request.number }}" > build/pr.txt
5351

5452
- name: Upload the built JSON as a GitHub artifact
55-
if: ${{ github.event_name == 'pull_request' }}
5653
uses: actions/upload-artifact@v4
5754
with:
5855
name: team-api-output
5956
path: build
57+
deploy:
58+
name: Deploy
59+
needs: [ test ]
60+
runs-on: ubuntu-latest
61+
environment: deploy
62+
concurrency: deploy
63+
permissions:
64+
id-token: write
65+
pages: write
66+
if: github.event_name == 'merge_group'
67+
steps:
68+
- name: Download built JSON API and sync-team
69+
uses: actions/download-artifact@v4
70+
with:
71+
name: team-api-output
72+
path: build
6073

6174
- name: Disable Jekyll
6275
run: touch build/.nojekyll
6376

6477
- name: Upload GitHub pages artifact
65-
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
6678
uses: actions/upload-pages-artifact@v3
6779
with:
6880
path: build
6981

7082
- name: Deploy to GitHub Pages
71-
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
7283
uses: actions/deploy-pages@v4
7384

7485
- name: Configure AWS credentials
75-
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
7686
uses: aws-actions/configure-aws-credentials@v1
7787
with:
7888
role-to-assume: arn:aws:iam::890664054962:role/ci--rust-lang--team
7989
aws-region: us-west-1
8090

8191
- name: Start the synchronization tool
82-
if: github.event_name == 'push' && github.ref == 'refs/heads/master'
8392
run: |
8493
# Introduce some artificial delay to help github pages propagate.
8594
sleep 60
8695
aws --region us-west-1 lambda invoke --function-name start-sync-team output.json
8796
cat output.json | python3 -m json.tool
97+
98+
# GitHub tokens generated from GitHub Apps can access resources from one organization,
99+
# so we need to generate a token for each organization.
100+
- name: Generate GitHub token (rust-lang)
101+
uses: actions/create-github-app-token@v1
102+
id: rust-lang-token
103+
with:
104+
# GitHub App ID secret name
105+
app-id: ${{ secrets.SYNC_TEAM_GH_APP_READ_ID }}
106+
# GitHub App private key secret name
107+
private-key: ${{ secrets.SYNC_TEAM_GH_APP_READ_PRIVATE_KEY }}
108+
# Set the owner, so the token can be used in all repositories
109+
owner: rust-lang
110+
111+
- name: Generate GitHub token (rust-lang-ci)
112+
uses: actions/create-github-app-token@v1
113+
id: rust-lang-ci-token
114+
with:
115+
app-id: ${{ secrets.SYNC_TEAM_GH_APP_READ_ID }}
116+
private-key: ${{ secrets.SYNC_TEAM_GH_APP_READ_PRIVATE_KEY }}
117+
owner: rust-lang-ci
118+
119+
- name: Generate GitHub token (rust-lang-deprecated)
120+
uses: actions/create-github-app-token@v1
121+
id: rust-lang-deprecated-token
122+
with:
123+
app-id: ${{ secrets.SYNC_TEAM_GH_APP_READ_ID }}
124+
private-key: ${{ secrets.SYNC_TEAM_GH_APP_READ_PRIVATE_KEY }}
125+
owner: rust-lang-deprecated
126+
127+
- name: Generate GitHub token (rust-lang-nursery)
128+
uses: actions/create-github-app-token@v1
129+
id: rust-lang-nursery-token
130+
with:
131+
app-id: ${{ secrets.SYNC_TEAM_GH_APP_READ_ID }}
132+
private-key: ${{ secrets.SYNC_TEAM_GH_APP_READ_PRIVATE_KEY }}
133+
owner: rust-lang-nursery
134+
135+
- name: Generate GitHub token (bors-rs)
136+
uses: actions/create-github-app-token@v1
137+
id: bors-rs-token
138+
with:
139+
app-id: ${{ secrets.SYNC_TEAM_GH_APP_READ_ID }}
140+
private-key: ${{ secrets.SYNC_TEAM_GH_APP_READ_PRIVATE_KEY }}
141+
owner: bors-rs
142+
143+
- name: Generate GitHub token (rust-analyzer)
144+
uses: actions/create-github-app-token@v1
145+
id: rust-analyzer-token
146+
with:
147+
app-id: ${{ secrets.SYNC_TEAM_GH_APP_READ_ID }}
148+
private-key: ${{ secrets.SYNC_TEAM_GH_APP_READ_PRIVATE_KEY }}
149+
owner: rust-analyzer
150+
151+
- name: Generate GitHub token (rust-embedded)
152+
uses: actions/create-github-app-token@v1
153+
id: rust-embedded-token
154+
with:
155+
app-id: ${{ secrets.SYNC_TEAM_GH_APP_READ_ID }}
156+
private-key: ${{ secrets.SYNC_TEAM_GH_APP_READ_PRIVATE_KEY }}
157+
owner: rust-embedded
158+
159+
- name: Generate GitHub token (rust-dev-tools)
160+
uses: actions/create-github-app-token@v1
161+
id: rust-dev-tools-token
162+
with:
163+
app-id: ${{ secrets.SYNC_TEAM_GH_APP_READ_ID }}
164+
private-key: ${{ secrets.SYNC_TEAM_GH_APP_READ_PRIVATE_KEY }}
165+
owner: rust-dev-tools
166+
167+
- uses: actions/checkout@v4
168+
169+
- name: Run sync-team (dry-run)
170+
env:
171+
GITHUB_TOKEN_RUST_LANG: ${{ steps.rust-lang-token.outputs.token }}
172+
GITHUB_TOKEN_RUST_LANG_CI: ${{ steps.rust-lang-ci-token.outputs.token }}
173+
GITHUB_TOKEN_RUST_LANG_DEPRECATED: ${{ steps.rust-lang-deprecated-token.outputs.token }}
174+
GITHUB_TOKEN_RUST_LANG_NURSERY: ${{ steps.rust-lang-nursery-token.outputs.token }}
175+
GITHUB_TOKEN_BORS_RS: ${{ steps.bors-rs-token.outputs.token }}
176+
GITHUB_TOKEN_RUST_ANALYZER: ${{ steps.rust-analyzer-token.outputs.token }}
177+
GITHUB_TOKEN_RUST_EMBEDDED: ${{ steps.rust-embedded-token.outputs.token }}
178+
GITHUB_TOKEN_RUST_DEV_TOOLS: ${{ steps.rust-dev-tools-token.outputs.token }}
179+
run: |
180+
cargo run --manifest-path sync-team/Cargo.toml \
181+
print-plan --team-json build
182+
183+
# Summary job for the merge queue.
184+
# ALL THE PREVIOUS JOBS NEED TO BE ADDED TO THE `needs` SECTION OF THIS JOB!
185+
CI:
186+
needs: [ test, deploy ]
187+
# We need to ensure this job does *not* get skipped if its dependencies fail,
188+
# because a skipped job is considered a success by GitHub. So we have to
189+
# overwrite `if:`. We use `!cancelled()` to ensure the job does still not get run
190+
# when the workflow is canceled manually.
191+
if: ${{ !cancelled() }}
192+
runs-on: ubuntu-latest
193+
steps:
194+
# Manually check the status of all dependencies. `if: failure()` does not work.
195+
- name: Conclusion
196+
run: |
197+
# Print the dependent jobs to see them in the CI log
198+
jq -C <<< '${{ toJson(needs) }}'
199+
# Check if all jobs that we depend on (in the needs array) were successful.
200+
jq --exit-status 'all(.result == "success" or .result == "skipped")' <<< '${{ toJson(needs) }}'

0 commit comments

Comments
 (0)