@cryptotaxi247 / netdata-1 / commits / 27459fc06

ci: use step-security/changed-files (#19881)

use step-security/changed-files

Ilya Mashchenko committed Mar 17, 2025 at 13:28 UTC 27459fc062475a57f2d03becae34cd9b9b514332
5 files changed +514 -23
.github/workflows/build.yml
+188 -12
@@ -20,30 +20,127 @@ concurrency: # This keeps multiple instances of the job from running concurrentl
20 group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name }}
21 cancel-in-progress: true
22 jobs:
23 + file-check: # Check what files changed if we’re being run in a PR or on a push.
24 + name: Check Modified Files
25 + runs-on: ubuntu-latest
26 + outputs:
27 + run: ${{ steps.check-run.outputs.run }}
28 + skip-go: ${{ steps.check-go.outputs.skip-go }}
29 + steps:
30 + - name: Checkout
31 + id: checkout
32 + uses: actions/checkout@v4
33 + with:
34 + fetch-depth: 0
35 + submodules: recursive
36 + - name: Check source files
37 + id: check-source-files
38 + uses: step-security/changed-files@v45
39 + with:
40 + since_last_remote_commit: ${{ github.event_name != 'pull_request' }}
41 + files: |
42 + **/*.c
43 + **/*.cc
44 + **/*.h
45 + **/*.hh
46 + **/*.in
47 + **/*.patch
48 + src/aclk/aclk-schemas/
49 + src/ml/dlib/
50 + src/fluent-bit/
51 + src/web/server/h2o/libh2o/
52 + files_ignore: |
53 + netdata.spec.in
54 + **/*.md
55 + - name: Check build files
56 + id: check-build-files
57 + uses: step-security/changed-files@v45
58 + with:
59 + since_last_remote_commit: ${{ github.event_name != 'pull_request' }}
60 + files: |
61 + **/*.cmake
62 + CMakeLists.txt
63 + netdata-installer.sh
64 + .github/data/distros.yml
65 + .github/workflows/build.yml
66 + .github/scripts/build-static.sh
67 + .github/scripts/get-static-cache-key.sh
68 + .github/scripts/gen-matrix-static.py
69 + .github/scripts/gen-matrix-build.py
70 + .github/scripts/run-updater-check.sh
71 + packaging/cmake/
72 + packaging/makeself/
73 + packaging/installer/
74 + packaging/windows/
75 + packaging/*.sh
76 + packaging/*.version
77 + packaging/*.checksums
78 + files_ignore: |
79 + **/*.md
80 + packaging/repoconfig/
81 + - name: List all changed files in pattern
82 + continue-on-error: true
83 + if: github.event_name != 'workflow_dispatch'
84 + env:
85 + CHANGED_SOURCE_FILES: ${{ steps.check-source-files.outputs.all_changed_files }}
86 + CHANGED_BUILD_FILES: ${{ steps.check-build-files.outputs.all_changed_files }}
87 + run: |
88 + for file in ${CHANGED_SOURCE_FILES} ${CHANGED_BUILD_FILES} ; do
89 + echo "$file was changed"
90 + done
91 + - name: Check Run
92 + id: check-run
93 + run: |
94 + if [ "${{ steps.check-source-files.outputs.any_modified }}" == "true" ] || [ "${{ steps.check-build-files.outputs.any_modified }}" == "true" ] || [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
95 + echo 'run=true' >> "${GITHUB_OUTPUT}"
96 + else
97 + echo 'run=false' >> "${GITHUB_OUTPUT}"
98 + fi
99 + - name: Check Go
100 + id: check-go
101 + run: |
102 + if [ '${{ github.event_name }}' == 'pull_request' ]; then
103 + if echo "${{ steps.check-source-files.outputs.other_changed_files }}" | grep -q '.*/(.*\.go|go\.mod|go\.sum)$' || [ "${{ steps.check-build-files.outputs.any_modified }}" == "true" ]; then
104 + echo 'skip-go=' >> "${GITHUB_OUTPUT}"
105 + else
106 + echo 'skip-go=--disable-go' >> "${GITHUB_OUTPUT}"
107 + fi
108 + else
109 + echo 'skip-go=' >> "${GITHUB_OUTPUT}"
110 + fi
111 +
112 build-dist: # Build the distribution tarball and store it as an artifact.
113 name: Build Distribution Tarball
114 runs-on: ubuntu-latest
115 + needs:
116 + - file-check
117 outputs:
118 distfile: ${{ steps.build.outputs.distfile }}
119 steps:
120 + - name: Skip Check
121 + id: skip
122 + if: needs.file-check.outputs.run != 'true'
123 + run: echo "SKIPPED"
124 - name: Checkout
125 id: checkout
126 + if: needs.file-check.outputs.run == 'true'
127 uses: actions/checkout@v4
128 with:
129 fetch-depth: 0
130 submodules: recursive
131 - name: Fix tags
132 id: fix-tags
37 - if: github.event_name != 'push'
133 + if: github.event_name != 'push' && needs.file-check.outputs.run == 'true'
134 run: |
135 git fetch --tags --force
136 - name: Mark Stable
137 id: channel
42 - if: github.event_name == 'workflow_dispatch' && github.event.inputs.type != 'nightly'
138 + if: github.event_name == 'workflow_dispatch' && github.event.inputs.type != 'nightly' && needs.file-check.outputs.run == 'true'
139 run: |
140 sed -i 's/^RELEASE_CHANNEL="nightly"/RELEASE_CHANNEL="stable"/' netdata-installer.sh
141 - name: Build
142 id: build
143 + if: needs.file-check.outputs.run == 'true'
144 run: |
145 mkdir -p artifacts/
146 tar --create --file "artifacts/netdata-$(git describe).tar.gz" \
@@ -54,6 +151,7 @@ jobs:
151 echo "distfile=$(find . -name 'netdata-*.tar.gz')" >> "${GITHUB_OUTPUT}"
152 - name: Store
153 id: store
154 + if: needs.file-check.outputs.run == 'true'
155 uses: actions/upload-artifact@v4.6.1
156 with:
157 name: dist-tarball
@@ -81,6 +179,7 @@ jobs:
179 && startsWith(github.ref, 'refs/heads/master')
180 && github.event_name != 'pull_request'
181 && github.repository == 'netdata/netdata'
182 + && needs.file-check.outputs.run == 'true'
183 }}
184
185 static-matrix: # Generate the static build matrix.
@@ -128,34 +227,40 @@ jobs:
227 build-static: # Build the static binary archives, and store them as artifacts.
228 name: Build Static
229 needs:
230 + - file-check
231 - static-matrix
232 strategy:
233 fail-fast: false
234 matrix: ${{ fromJson(needs.static-matrix.outputs.matrix) }}
235 runs-on: ${{ matrix.runner }}
236 steps:
237 + - name: Skip Check
238 + id: skip
239 + if: needs.file-check.outputs.run != 'true'
240 + run: echo "SKIPPED"
241 - name: Checkout
242 id: checkout
243 + if: needs.file-check.outputs.run == 'true'
244 uses: actions/checkout@v4
245 with:
246 fetch-depth: 0
247 submodules: recursive
248 - name: Fix tags
249 id: fix-tags
145 - if: github.event_name != 'push'
250 + if: github.event_name != 'push' && needs.file-check.outputs.run == 'true'
251 run: |
252 git fetch --tags --force
253 - name: Mark Stable
254 id: channel
150 - if: github.event_name == 'workflow_dispatch' && github.event.inputs.type != 'nightly'
255 + if: github.event_name == 'workflow_dispatch' && github.event.inputs.type != 'nightly' && needs.file-check.outputs.run == 'true'
256 run: |
257 sed -i 's/^RELEASE_CHANNEL="nightly"/RELEASE_CHANNEL="stable"/' netdata-installer.sh packaging/makeself/install-or-update.sh
258 - name: Get Cache Key
154 - if: (github.event_name != 'pull_request' || ! contains(github.event.pull_request.labels.*.name, 'run-ci/no-cache'))
259 + if: (github.event_name != 'pull_request' || ! contains(github.event.pull_request.labels.*.name, 'run-ci/no-cache')) && needs.file-check.outputs.run == 'true'
260 id: cache-key
261 run: .github/scripts/get-static-cache-key.sh ${{ matrix.arch }} "${{ contains(github.event.pull_request.labels.*.name, 'run-ci/no-cache') }}"
262 - name: Cache
158 - if: (github.event_name != 'pull_request' || ! contains(github.event.pull_request.labels.*.name, 'run-ci/no-cache'))
263 + if: (github.event_name != 'pull_request' || ! contains(github.event.pull_request.labels.*.name, 'run-ci/no-cache')) && needs.file-check.outputs.run == 'true'
264 id: cache
265 uses: actions/cache@v4
266 with:
@@ -163,28 +268,31 @@ jobs:
268 key: ${{ steps.cache-key.outputs.key }}
269 - name: Set up QEMU
270 id: qemu
166 - if: matrix.qemu
271 + if: matrix.qemu && needs.file-check.outputs.run == 'true'
272 run: |
273 sudo apt-get update
274 sudo apt-get upgrade -y
275 sudo apt-get install -y qemu-user-static
276 - name: Build
172 - if: github.event_name != 'workflow_dispatch' # Don’t use retries on PRs.
277 + if: github.event_name != 'workflow_dispatch' && needs.file-check.outputs.run == 'true' # Don’t use retries on PRs.
278 run: |
279 + export EXTRA_INSTALL_FLAGS=${{ needs.file-check.outputs.skip-go }}
280 [ "${{ matrix.qemu }}" == "true" ] || export SKIP_EMULATION=1
281 .github/scripts/build-static.sh ${{ matrix.arch }}
282 - name: Build
177 - if: github.event_name == 'workflow_dispatch'
283 + if: github.event_name == 'workflow_dispatch' && needs.file-check.outputs.run == 'true'
284 id: build
285 uses: nick-fields/retry@v3
286 with:
287 timeout_minutes: 360
288 max_attempts: 3
289 command: |
290 + export EXTRA_INSTALL_FLAGS=${{ needs.file-check.outputs.skip-go }}
291 [ "${{ matrix.qemu }}" == "true" ] || export SKIP_EMULATION=1
292 .github/scripts/build-static.sh ${{ matrix.arch }}
293 - name: Store
294 id: store
295 + if: needs.file-check.outputs.run == 'true'
296 uses: actions/upload-artifact@v4.6.1
297 with:
298 name: dist-static-${{ matrix.arch }}
@@ -213,34 +321,45 @@ jobs:
321 && startsWith(github.ref, 'refs/heads/master')
322 && github.event_name != 'pull_request'
323 && github.repository == 'netdata/netdata'
324 + && needs.file-check.outputs.run == 'true'
325 }}
326
327 windows-build: # Test building on Windows
328 name: Test building on Windows
329 runs-on: windows-latest
330 + needs:
331 + - file-check
332 steps:
333 + - name: Skip Check
334 + id: skip
335 + if: needs.file-check.outputs.run != 'true'
336 + run: Write-Output "SKIPPED"
337 - name: Checkout
338 uses: actions/checkout@v4
339 id: checkout
340 + if: needs.file-check.outputs.run == 'true'
341 with:
342 submodules: recursive
343 lfs: true
344 - name: Set Up Go
345 id: golang
346 + if: needs.file-check.outputs.run == 'true'
347 uses: actions/setup-go@v5
348 with:
349 go-version: "^1.23"
350 - name: Set Up Dependencies
351 id: deps
352 + if: needs.file-check.outputs.run == 'true'
353 run: ./packaging/windows/install-dependencies.ps1
354 - name: Build Netdata
355 id: build
356 + if: needs.file-check.outputs.run == 'true'
357 env:
358 BUILD_DIR: ${{ github.workspace }}\build
359 run: ./packaging/windows/build.ps1
360 - name: Sign Agent Code
361 id: sign-agent
243 - if: github.event_name != 'pull_request'
362 + if: needs.file-check.outputs.run == 'true' && github.event_name != 'pull_request'
363 uses: azure/trusted-signing-action@v0.5.1
364 with:
365 azure-tenant-id: ${{ secrets.CODE_SIGNING_TENNANT_ID }}
@@ -257,12 +376,13 @@ jobs:
376 timestamp-digest: SHA256
377 - name: Package Netdata
378 id: package
379 + if: needs.file-check.outputs.run == 'true'
380 env:
381 BUILD_DIR: ${{ github.workspace }}\build
382 run: ./packaging/windows/package.ps1
383 - name: Sign Installer
384 id: sign-installer
265 - if: github.event_name != 'pull_request'
385 + if: needs.file-check.outputs.run == 'true' && github.event_name != 'pull_request'
386 uses: azure/trusted-signing-action@v0.5.1
387 with:
388 azure-tenant-id: ${{ secrets.CODE_SIGNING_TENNANT_ID }}
@@ -307,6 +427,7 @@ jobs:
427 && startsWith(github.ref, 'refs/heads/master')
428 && github.event_name != 'pull_request'
429 && github.repository == 'netdata/netdata'
430 + && needs.file-check.outputs.run == 'true'
431 }}
432
433 prepare-upload: # Consolidate the artifacts for uploading or releasing.
@@ -316,15 +437,23 @@ jobs:
437 - build-dist
438 - build-static
439 - windows-build
440 + - file-check
441 steps:
442 + - name: Skip Check
443 + id: skip
444 + if: needs.file-check.outputs.run != 'true'
445 + run: echo "SKIPPED"
446 - name: Checkout
447 id: checkout
448 + if: needs.file-check.outputs.run == 'true'
449 uses: actions/checkout@v4
450 - name: Prepare Environment
451 id: prepare
452 + if: needs.file-check.outputs.run == 'true'
453 run: mkdir -p artifacts
454 - name: Retrieve Build Artifacts
455 id: fetch-dist
456 + if: needs.file-check.outputs.run == 'true'
457 uses: Wandalen/wretry.action@v3
458 with:
459 action: actions/download-artifact@v4
@@ -336,6 +465,7 @@ jobs:
465 attempt_delay: 2000
466 - name: Retrieve Windows Artifacts
467 id: fetch-windows
468 + if: needs.file-check.outputs.run == 'true'
469 uses: Wandalen/wretry.action@v3
470 with:
471 action: actions/download-artifact@v4
@@ -347,6 +477,7 @@ jobs:
477 attempt_delay: 2000
478 - name: Prepare Artifacts
479 id: consolidate
480 + if: needs.file-check.outputs.run == 'true'
481 working-directory: ./artifacts/
482 run: |
483 mv ../dist-artifacts/* . || exit 1
@@ -356,6 +487,7 @@ jobs:
487 cat sha256sums.txt
488 - name: Store Artifacts
489 id: store
490 + if: needs.file-check.outputs.run == 'true'
491 uses: actions/upload-artifact@v4.6.1
492 with:
493 name: final-artifacts
@@ -384,6 +516,7 @@ jobs:
516 && startsWith(github.ref, 'refs/heads/master')
517 && github.event_name != 'pull_request'
518 && github.repository == 'netdata/netdata'
519 + && needs.file-check.outputs.run == 'true'
520 }}
521
522 artifact-verification-dist: # Verify the regular installer works with the consolidated artifacts.
@@ -391,6 +524,7 @@ jobs:
524 runs-on: ubuntu-latest
525 needs:
526 - prepare-upload
527 + - file-check
528 services:
529 apache: # This gets used to serve the dist tarball for the updater script.
530 image: httpd:2.4
@@ -399,11 +533,17 @@ jobs:
533 volumes:
534 - ${{ github.workspace }}:/usr/local/apache2/htdocs/
535 steps:
536 + - name: Skip Check
537 + id: skip
538 + if: needs.file-check.outputs.run != 'true'
539 + run: echo "SKIPPED"
540 - name: Checkout
541 id: checkout
542 + if: needs.file-check.outputs.run == 'true'
543 uses: actions/checkout@v4
544 - name: Fetch artifacts
545 id: fetch
546 + if: needs.file-check.outputs.run == 'true'
547 uses: Wandalen/wretry.action@v3
548 with:
549 action: actions/download-artifact@v4
@@ -414,12 +554,14 @@ jobs:
554 attempt_delay: 2000
555 - name: Prepare artifacts directory
556 id: prepare
557 + if: needs.file-check.outputs.run == 'true'
558 run: |
559 mkdir -p download/latest
560 mv artifacts/* download/latest
561 ls -al download/latest
562 - name: Verify that artifacts work with installer
563 id: verify
564 + if: needs.file-check.outputs.run == 'true'
565 env:
566 NETDATA_TARBALL_BASEURL: http://localhost:8080/
567 run: sh -x packaging/installer/kickstart.sh --build-only --dont-start-it --disable-telemetry --dont-wait
@@ -443,6 +585,7 @@ jobs:
585 && startsWith(github.ref, 'refs/heads/master')
586 && github.event_name != 'pull_request'
587 && github.repository == 'netdata/netdata'
588 + && needs.file-check.outputs.run == 'true'
589 }}
590
591 artifact-verification-static: # Verify the static installer works with the consolidated artifacts.
@@ -450,6 +593,7 @@ jobs:
593 runs-on: ubuntu-latest
594 needs:
595 - prepare-upload
596 + - file-check
597 services:
598 apache: # This gets used to serve the static archives.
599 image: httpd:2.4
@@ -458,11 +602,17 @@ jobs:
602 volumes:
603 - ${{ github.workspace }}:/usr/local/apache2/htdocs/
604 steps:
605 + - name: Skip Check
606 + id: skip
607 + if: needs.file-check.outputs.run != 'true'
608 + run: echo "SKIPPED"
609 - name: Checkout
610 id: checkout
611 + if: needs.file-check.outputs.run == 'true'
612 uses: actions/checkout@v4
613 - name: Fetch artifacts
614 id: fetch-artifacts
615 + if: needs.file-check.outputs.run == 'true'
616 uses: Wandalen/wretry.action@v3
617 with:
618 action: actions/download-artifact@v4
@@ -473,12 +623,14 @@ jobs:
623 attempt_delay: 2000
624 - name: Prepare artifacts directory
625 id: prepare
626 + if: needs.file-check.outputs.run == 'true'
627 run: |
628 mkdir -p download/latest
629 mv artifacts/* download/latest
630 ls -al download/latest
631 - name: Verify that artifacts work with installer
632 id: verify
633 + if: needs.file-check.outputs.run == 'true'
634 env:
635 NETDATA_TARBALL_BASEURL: http://localhost:8080/
636 run: sh -x packaging/installer/kickstart.sh --static-only --dont-start-it --disable-telemetry
@@ -502,6 +654,7 @@ jobs:
654 && startsWith(github.ref, 'refs/heads/master')
655 && github.event_name != 'pull_request'
656 && github.repository == 'netdata/netdata'
657 + && needs.file-check.outputs.run == 'true'
658 }}
659
660 artifact-verification-updater: # Test the generated dist archive using the updater code.
@@ -509,6 +662,7 @@ jobs:
662 runs-on: ubuntu-latest
663 needs:
664 - prepare-upload
665 + - file-check
666 services:
667 apache: # This gets used to serve the dist tarball for the updater script.
668 image: httpd:2.4
@@ -519,12 +673,15 @@ jobs:
673 steps:
674 - name: Skip Check
675 id: skip
676 + if: needs.file-check.outputs.run != 'true'
677 run: echo "SKIPPED"
678 - name: Checkout
679 id: checkout
680 + if: needs.file-check.outputs.run == 'true'
681 uses: actions/checkout@v4
682 - name: Fetch artifacts
683 id: fetch-artifacts
684 + if: needs.file-check.outputs.run == 'true'
685 uses: Wandalen/wretry.action@v3
686 with:
687 action: actions/download-artifact@v4
@@ -535,12 +692,14 @@ jobs:
692 attempt_delay: 2000
693 - name: Prepare artifacts directory
694 id: prepare
695 + if: needs.file-check.outputs.run == 'true'
696 run: |
697 mkdir -p download/latest
698 mv artifacts/* download/latest
699 ls -al download/latest
700 - name: Run Updater Check
701 id: check
702 + if: needs.file-check.outputs.run == 'true'
703 run: |
704 docker run --security-opt seccomp=unconfined -e DISABLE_TELEMETRY=1 --network host \
705 -v $PWD:/netdata -w /netdata \
@@ -566,6 +725,7 @@ jobs:
725 && startsWith(github.ref, 'refs/heads/master')
726 && github.event_name != 'pull_request'
727 && github.repository == 'netdata/netdata'
728 + && needs.file-check.outputs.run == 'true'
729 }}
730
731 create-nightly: # Create a nightly build release in netdata/netdata-nightlies
@@ -820,6 +980,7 @@ jobs:
980 if: github.event_name != 'workflow_dispatch'
981 needs:
982 - src-matrix
983 + - file-check
984 strategy:
985 fail-fast: false
986 max-parallel: 8
@@ -827,9 +988,11 @@ jobs:
988 steps:
989 - name: Skip Check
990 id: skip
991 + if: needs.file-check.outputs.run != 'true'
992 run: echo "SKIPPED"
993 - name: Checkout
994 id: checkout
995 + if: needs.file-check.outputs.run == 'true'
996 uses: actions/checkout@v4
997 with:
998 submodules: recursive
@@ -854,9 +1017,10 @@ jobs:
1017 attempt_delay: 15000
1018 - name: netdata-installer on ${{ matrix.distro }}
1019 id: build-cloud
1020 + if: needs.file-check.outputs.run == 'true'
1021 run: |
1022 docker run --security-opt seccomp=unconfined -w /netdata test:${{ matrix.artifact_key }} \
859 - /bin/sh -c './netdata-installer.sh --dont-wait --dont-start-it --one-time-build'
1023 + /bin/sh -c './netdata-installer.sh --dont-wait --dont-start-it --one-time-build ${{ needs.file-check.outputs.skip-go }}'
1024 - name: Failure Notification
1025 uses: rtCamp/action-slack-notify@v2
1026 env:
@@ -878,12 +1042,15 @@ jobs:
1042 && startsWith(github.ref, 'refs/heads/master')
1043 && github.event_name != 'pull_request'
1044 && github.repository == 'netdata/netdata'
1045 + && needs.file-check.outputs.run == 'true'
1046 }}
1047
1048 macos-build: # Test building on macOS
1049 name: Test building on macOS
1050 runs-on: ${{ matrix.runner }}
1051 if: github.event_name != 'workflow_dispatch'
1052 + needs:
1053 + - file-check
1054 strategy:
1055 fail-fast: false
1056 max-parallel: 8
@@ -896,24 +1063,33 @@ jobs:
1063 - name: macos-15-M1
1064 runner: macos-15
1065 steps:
1066 + - name: Skip Check
1067 + id: skip
1068 + if: needs.file-check.outputs.run != 'true'
1069 + run: echo "SKIPPED"
1070 - uses: actions/checkout@v4
1071 id: checkout
1072 + if: needs.file-check.outputs.run == 'true'
1073 with:
1074 submodules: recursive
1075 - name: Install latest bash
1076 id: install-bash
1077 + if: needs.file-check.outputs.run == 'true'
1078 run: |
1079 brew install bash
1080 - name: Install netdata dependencies
1081 id: install-nd-dep
1082 + if: needs.file-check.outputs.run == 'true'
1083 run: |
1084 bash ./packaging/installer/install-required-packages.sh --dont-wait --non-interactive netdata-all
1085 - name: Build from source
1086 id: build-source
1087 + if: needs.file-check.outputs.run == 'true'
1088 run: |
1089 sudo bash ./netdata-installer.sh --install-no-prefix /usr/local/netdata --dont-wait --dont-start-it --one-time-build
1090 - name: Test Agent start up
1091 id: test-agent
1092 + if: needs.file-check.outputs.run == 'true'
1093 run: |
1094 /usr/local/netdata/usr/sbin/netdata -D > ./netdata.log 2>&1 &
1095 ./packaging/runtime-check.sh
.github/workflows/checks.yml
+82
@@ -11,15 +11,89 @@ concurrency:
11 group: checks-${{ github.ref }}
12 cancel-in-progress: true
13 jobs:
14 + file-check: # Check what files changed if we’re being run in a PR or on a push.
15 + name: Check Modified Files
16 + runs-on: ubuntu-latest
17 + outputs:
18 + run: ${{ steps.check-run.outputs.run }}
19 + steps:
20 + - name: Checkout
21 + id: checkout
22 + uses: actions/checkout@v4
23 + with:
24 + fetch-depth: 0
25 + submodules: recursive
26 + - name: Check source files
27 + id: check-source-files
28 + uses: step-security/changed-files@v45
29 + with:
30 + since_last_remote_commit: ${{ github.event_name != 'pull_request' }}
31 + files: |
32 + **/*.c
33 + **/*.cc
34 + **/*.h
35 + **/*.hh
36 + **/*.in
37 + **/*.patch
38 + src/aclk/aclk-schemas/
39 + src/ml/dlib/
40 + src/fluent-bit/
41 + src/web/server/h2o/libh2o/
42 + files_ignore: |
43 + netdata.spec.in
44 + **/*.md
45 + - name: Check build files
46 + id: check-build-files
47 + uses: step-security/changed-files@v45
48 + with:
49 + since_last_remote_commit: ${{ github.event_name != 'pull_request' }}
50 + files: |
51 + **/*.cmake
52 + CMakeLists.txt
53 + .gitignore
54 + .github/data/distros.yml
55 + .github/workflows/build.yml
56 + packaging/cmake/
57 + packaging/*.version
58 + packaging/*.checksums
59 + files_ignore: |
60 + **/*.md
61 + packaging/repoconfig/
62 + - name: List all changed files in pattern
63 + continue-on-error: true
64 + env:
65 + CHANGED_SOURCE_FILES: ${{ steps.check-source-files.outputs.all_changed_files }}
66 + CHANGED_BUILD_FILES: ${{ steps.check-build-files.outputs.all_changed_files }}
67 + run: |
68 + for file in ${CHANGED_SOURCE_FILES} ${CHANGED_BUILD_FILES} ; do
69 + echo "$file was changed"
70 + done
71 + - name: Check Run
72 + id: check-run
73 + run: |
74 + if [ "${{ steps.check-source-files.outputs.any_modified }}" == "true" ] || [ "${{ steps.check-build-files.outputs.any_modified }}" == "true" ] || [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
75 + echo 'run=true' >> "${GITHUB_OUTPUT}"
76 + else
77 + echo 'run=false' >> "${GITHUB_OUTPUT}"
78 + fi
79 +
80 libressl-checks:
81 name: LibreSSL
82 + needs:
83 + - file-check
84 runs-on: ubuntu-latest
85 steps:
86 + - name: Skip Check
87 + id: skip
88 + if: needs.file-check.outputs.run != 'true'
89 + run: echo "SKIPPED"
90 - name: Checkout
91 + if: needs.file-check.outputs.run == 'true'
92 uses: actions/checkout@v4
93 with:
94 submodules: recursive
95 - name: Build
96 + if: needs.file-check.outputs.run == 'true'
97 run: >
98 docker run -v "$PWD":/netdata -w /netdata alpine:latest /bin/sh -c
99 'apk add bash;
@@ -30,11 +104,19 @@ jobs:
104
105 clang-checks:
106 name: Clang
107 + needs:
108 + - file-check
109 runs-on: ubuntu-latest
110 steps:
111 + - name: Skip Check
112 + id: skip
113 + if: needs.file-check.outputs.run != 'true'
114 + run: echo "SKIPPED"
115 - name: Checkout
116 + if: needs.file-check.outputs.run == 'true'
117 uses: actions/checkout@v4
118 with:
119 submodules: recursive
120 - name: Build
121 + if: needs.file-check.outputs.run == 'true'
122 run: docker build -f .github/dockerfiles/Dockerfile.clang .
.github/workflows/docker.yml
+107 -5
@@ -26,6 +26,98 @@ concurrency:
26 group: docker-${{ github.ref }}-${{ github.event_name }}
27 cancel-in-progress: true
28 jobs:
29 + file-check: # Check what files changed if we’re being run in a PR or on a push.
30 + name: Check Modified Files
31 + runs-on: ubuntu-latest
32 + outputs:
33 + run: ${{ steps.check-run.outputs.run }}
34 + skip-go: ${{ steps.check-go.outputs.skip-go }}
35 + steps:
36 + - name: Checkout
37 + id: checkout
38 + if: github.event_name != 'workflow_dispatch'
39 + uses: actions/checkout@v4
40 + with:
41 + fetch-depth: 0
42 + submodules: recursive
43 + - name: Check source files
44 + id: check-source-files
45 + if: github.event_name != 'workflow_dispatch'
46 + uses: step-security/changed-files@v45
47 + with:
48 + since_last_remote_commit: ${{ github.event_name != 'pull_request' }}
49 + files: |
50 + **/*.c
51 + **/*.cc
52 + **/*.h
53 + **/*.hh
54 + **/*.in
55 + **/*.patch
56 + src/aclk/aclk-schemas/
57 + src/ml/dlib/
58 + src/fluent-bit/
59 + src/web/server/h2o/libh2o/
60 + files_ignore: |
61 + netdata.spec.in
62 + **/*.md
63 + - name: Check build system files
64 + id: check-build-files
65 + if: github.event_name != 'workflow_dispatch'
66 + uses: step-security/changed-files@v45
67 + with:
68 + since_last_remote_commit: ${{ github.event_name != 'pull_request' }}
69 + files: |
70 + .dockerignore
71 + CMakeLists.txt
72 + netdata-installer.sh
73 + .github/data/distros.yml
74 + .github/workflows/docker.yml
75 + .github/scripts/docker-test.sh
76 + .github/scripts/gen-matrix-docker.py
77 + .github/scripts/gen-docker-tags.py
78 + .github/scripts/gen-docker-imagetool-args.py
79 + packaging/cmake/
80 + packaging/docker/
81 + packaging/installer/
82 + packaging/runtime-check.sh
83 + packaging/*.version
84 + packaging/*.checksums
85 + files_ignore: |
86 + **/*.md
87 + packaging/repoconfig/
88 + - name: List all changed files in pattern
89 + continue-on-error: true
90 + if: github.event_name != 'workflow_dispatch'
91 + env:
92 + CHANGED_SOURCE_FILES: ${{ steps.check-source-files.outputs.all_changed_files }}
93 + CHANGED_BUILD_FILES: ${{ steps.check-build-files.outputs.all_changed_files }}
94 + run: |
95 + for file in ${CHANGED_SOURCE_FILES} ${CHANGED_BUILD_FILES} ; do
96 + echo "$file was changed"
97 + done
98 + - name: Check Run
99 + id: check-run
100 + run: |
101 + if [ "${{ steps.check-source-files.outputs.any_modified }}" == "true" ] || [ "${{ steps.check-build-files.outputs.any_modified }}" == "true" ] || [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
102 + echo 'run=true' >> "${GITHUB_OUTPUT}"
103 + else
104 + echo 'run=false' >> "${GITHUB_OUTPUT}"
105 + fi
106 + - name: Check Go
107 + id: check-go
108 + env:
109 + OTHER_CHANGED_FILES: ${{ steps.check-source-files.outputs.other_changed_files }}
110 + run: |
111 + if [ '${{ github.event_name }}' == 'pull_request' ]; then
112 + if echo "${OTHER_CHANGED_FILES}" | grep -q '.*/(.*\.go|go\.mod|go\.sum)$' || [ "${{ steps.check-build-files.outputs.any_modified }}" == "true" ]; then
113 + echo 'skip-go=' >> "${GITHUB_OUTPUT}"
114 + else
115 + echo 'skip-go=--disable-go' >> "${GITHUB_OUTPUT}"
116 + fi
117 + else
118 + echo 'skip-go=' >> "${GITHUB_OUTPUT}"
119 + fi
120 +
121 matrix:
122 name: Generate Docker Build Matrix
123 runs-on: ubuntu-latest
@@ -71,6 +163,7 @@ jobs:
163 build-images:
164 name: Build Docker Images
165 needs:
166 + - file-check
167 - matrix
168 runs-on: ${{ matrix.runner }}
169 strategy:
@@ -78,32 +171,39 @@ jobs:
171 # Fail fast on releases, but run everything to completion on other triggers.
172 fail-fast: false
173 steps:
174 + - name: Skip Check
175 + id: skip
176 + if: needs.file-check.outputs.run != 'true'
177 + run: echo "SKIPPED"
178 - name: Checkout
179 id: checkout
180 + if: needs.file-check.outputs.run == 'true'
181 uses: actions/checkout@v4
182 with:
183 fetch-depth: 0
184 submodules: recursive
185 - name: Generate Artifact Name
186 id: artifact-name
89 - if: github.repository == 'netdata/netdata' && github.event_name == 'workflow_dispatch'
187 + if: github.repository == 'netdata/netdata' && needs.file-check.outputs.run == 'true' && github.event_name == 'workflow_dispatch'
188 run: echo "platform=$(echo ${{ matrix.platform }} | tr '/' '-' | cut -f 2- -d '-')" >> "${GITHUB_OUTPUT}"
189 - name: Mark image as official
190 id: env
93 - if: github.repository == 'netdata/netdata' && github.event_name == 'workflow_dispatch'
191 + if: github.repository == 'netdata/netdata' && needs.file-check.outputs.run == 'true' && github.event_name == 'workflow_dispatch'
192 run: echo "OFFICIAL_IMAGE=true" >> "${GITHUB_ENV}"
193 - name: Setup QEMU
194 id: qemu
97 - if: matrix.qemu
195 + if: matrix.qemu && needs.file-check.outputs.run == 'true'
196 run: |
197 sudo apt-get update
198 sudo apt-get upgrade -y
199 sudo apt-get install -y qemu-user-static
200 - name: Setup Buildx
201 id: prepare
202 + if: needs.file-check.outputs.run == 'true'
203 uses: docker/setup-buildx-action@v3
204 - name: Build Image
205 id: build
206 + if: needs.file-check.outputs.run == 'true'
207 uses: docker/build-push-action@v6
208 with:
209 platforms: ${{ matrix.platform }}
@@ -112,15 +212,16 @@ jobs:
212 cache-to: type=local,dest=/tmp/build-cache,mode=max
213 build-args: |
214 OFFICIAL_IMAGE=${{ env.OFFICIAL_IMAGE }}
215 + EXTRA_INSTALL_OPTS=${{ needs.file-check.outputs.skip-go }}
216 BUILD_VERSION=test
217 BUILD_DATE=${{ github.event.repository.updated_at }}
218 - name: Test Image
219 id: test
119 - if: matrix.platform == 'linux/amd64'
220 + if: needs.file-check.outputs.run == 'true' && matrix.platform == 'linux/amd64'
221 run: .github/scripts/docker-test.sh
222 - name: Upload Cache
223 id: upload-cache
123 - if: github.repository == 'netdata/netdata' && github.event_name == 'workflow_dispatch'
224 + if: github.repository == 'netdata/netdata' && needs.file-check.outputs.run == 'true' && github.event_name == 'workflow_dispatch'
225 uses: actions/upload-artifact@v4.6.1
226 with:
227 name: cache-${{ steps.artifact-name.outputs.platform }}
@@ -150,6 +251,7 @@ jobs:
251 failure()
252 && github.event_name != 'pull_request'
253 && github.repository == 'netdata/netdata'
254 + && needs.file-check.outputs.run == 'true'
255 }}
256
257 gen-tags:
.github/workflows/go-tests.yml
+61
@@ -10,6 +10,50 @@ concurrency: # This keeps multiple instances of the job from running concurrentl
10 group: go-test-${{ github.ref }}-${{ github.event_name }}
11 cancel-in-progress: true
12 jobs:
13 + file-check: # Check what files changed if we’re being run in a PR or on a push.
14 + name: Check Modified Files
15 + runs-on: ubuntu-latest
16 + outputs:
17 + run: ${{ steps.check-run.outputs.run }}
18 + steps:
19 + - name: Checkout
20 + id: checkout
21 + uses: actions/checkout@v4
22 + with:
23 + fetch-depth: 0
24 + submodules: recursive
25 + - name: Check files
26 + id: check-files
27 + uses: step-security/changed-files@v45
28 + with:
29 + since_last_remote_commit: ${{ github.event_name != 'pull_request' }}
30 + files: |
31 + **/*.cmake
32 + CMakeLists.txt
33 + .github/workflows/go-tests.yml
34 + packaging/cmake/
35 + src/go/**
36 + files_ignore: |
37 + **/*.md
38 + src/go/**/metadata.yaml
39 + packaging/repoconfig/
40 + - name: List all changed files in pattern
41 + continue-on-error: true
42 + env:
43 + ALL_CHANGED_FILES: ${{ steps.check-files.outputs.all_changed_files }}
44 + run: |
45 + for file in ${ALL_CHANGED_FILES}; do
46 + echo "$file was changed"
47 + done
48 + - name: Check Run
49 + id: check-run
50 + run: |
51 + if [ "${{ steps.check-files.outputs.any_modified }}" == "true" ] || [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
52 + echo 'run=true' >> "${GITHUB_OUTPUT}"
53 + else
54 + echo 'run=false' >> "${GITHUB_OUTPUT}"
55 + fi
56 +
57 matrix:
58 name: Generate Build Matrix
59 runs-on: ubuntu-latest
@@ -30,42 +74,54 @@ jobs:
74 name: Go toolchain tests
75 runs-on: ubuntu-latest
76 needs:
77 + - file-check
78 - matrix
79 strategy:
80 fail-fast: false
81 matrix:
82 include: ${{ fromJson(needs.matrix.outputs.matrix) }}
83 steps:
84 + - name: Skip Check
85 + id: skip
86 + if: needs.file-check.outputs.run != 'true'
87 + run: echo "SKIPPED"
88 - name: Install Go
89 uses: actions/setup-go@v5
90 with:
91 go-version: ${{ matrix.version }}
92 - name: Checkout
93 + if: needs.file-check.outputs.run == 'true'
94 uses: actions/checkout@v4
95 with:
96 submodules: recursive
97 - name: Go mod download
98 + if: needs.file-check.outputs.run == 'true'
99 run: go mod download
100 working-directory: ${{ matrix.module }}
101 - name: Compile
102 + if: needs.file-check.outputs.run == 'true'
103 run: |
104 CGO_ENABLED=0 go build -o /tmp/go-test-build ${{ matrix.build_target }}
105 /tmp/go-test-build --help || true
106 working-directory: ${{ matrix.module }}
107 - name: Go fmt
108 + if: needs.file-check.outputs.run == 'true'
109 run: |
110 go fmt ./... | tee modified-files
111 [ "$(wc -l modified-files | cut -f 1 -d ' ')" -eq 0 ] || exit 1
112 working-directory: ${{ matrix.module }}
113 - name: Go vet
114 + if: needs.file-check.outputs.run == 'true'
115 run: go vet ./...
116 working-directory: ${{ matrix.module }}
117 - name: Set up gotestfmt
118 + if: needs.file-check.outputs.run == 'true'
119 uses: GoTestTools/gotestfmt-action@v2
120 with:
121 token: ${{ secrets.GITHUB_TOKEN }}
122 version: v2.0.0
123 - name: Go test
124 + if: needs.file-check.outputs.run == 'true'
125 run: |
126 set -euo pipefail
127 go test -json ./... -race -count=1 2>&1 | gotestfmt -hide all
@@ -75,6 +131,7 @@ jobs:
131 name: Go build tests
132 runs-on: ubuntu-latest
133 needs:
134 + - file-check
135 - matrix
136 strategy:
137 fail-fast: false
@@ -90,12 +147,14 @@ jobs:
147 steps:
148 - name: Skip Check
149 id: skip
150 + if: needs.file-check.outputs.run != 'true'
151 run: echo "SKIPPED"
152 - name: Install Go
153 uses: actions/setup-go@v5
154 with:
155 go-version: ${{ matrix.version }}
156 - name: Checkout
157 + if: needs.file-check.outputs.run == 'true'
158 uses: actions/checkout@v4
159 with:
160 submodules: recursive
@@ -104,9 +163,11 @@ jobs:
163 echo "GOOS=$(echo "${{ matrix.platform }}" | cut -f 1 -d '/')" >> "${GITHUB_ENV}"
164 echo "GOARCH=$(echo "${{ matrix.platform }}" | cut -f 2 -d '/')" >> "${GITHUB_ENV}"
165 - name: Go mod download
166 + if: needs.file-check.outputs.run == 'true'
167 run: go mod download
168 working-directory: ${{ matrix.module }}
169 - name: Compile
170 + if: needs.file-check.outputs.run == 'true'
171 run: |
172 CGO_ENABLED=0 go build -o /tmp/go-test-build ${{ matrix.build_target }}
173 working-directory: ${{ matrix.module }}
.github/workflows/packaging.yml
+76 -6
@@ -27,6 +27,65 @@ concurrency:
27 group: packages-${{ github.ref }}-${{ github.event_name }}
28 cancel-in-progress: true
29 jobs:
30 + file-check: # Check what files changed if we’re being run in a PR or on a push.
31 + name: Check Modified Files
32 + runs-on: ubuntu-latest
33 + outputs:
34 + run: ${{ steps.check-run.outputs.run }}
35 + steps:
36 + - name: Checkout
37 + id: checkout
38 + uses: actions/checkout@v4
39 + with:
40 + fetch-depth: 0
41 + submodules: recursive
42 + - name: Check files
43 + id: check-files
44 + uses: step-security/changed-files@v45
45 + with:
46 + since_last_remote_commit: ${{ github.event_name != 'pull_request' }}
47 + files: |
48 + **/*.c
49 + **/*.cc
50 + **/*.h
51 + **/*.hh
52 + **/*.in
53 + **/*.patch
54 + **/*.cmake
55 + netdata.spec.in
56 + CMakeLists.txt
57 + .github/data/distros.yml
58 + .github/workflows/packaging.yml
59 + .github/scripts/gen-matrix-packaging.py
60 + .github/scripts/pkg-test.sh
61 + packaging/cmake/
62 + packaging/*.sh
63 + packaging/*.version
64 + packaging/*.checksums
65 + src/aclk/aclk-schemas/
66 + src/ml/dlib/
67 + src/fluent-bit/
68 + src/web/server/h2o/libh2o/
69 + files_ignore: |
70 + **/*.md
71 + packaging/repoconfig/
72 + - name: List all changed files in pattern
73 + continue-on-error: true
74 + env:
75 + ALL_CHANGED_FILES: ${{ steps.check-files.outputs.all_changed_files }}
76 + run: |
77 + for file in ${ALL_CHANGED_FILES}; do
78 + echo "$file was changed"
79 + done
80 + - name: Check Run
81 + id: check-run
82 + run: |
83 + if [ "${{ steps.check-files.outputs.any_modified }}" == "true" ] || [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
84 + echo 'run=true' >> "${GITHUB_OUTPUT}"
85 + else
86 + echo 'run=false' >> "${GITHUB_OUTPUT}"
87 + fi
88 +
89 matrix:
90 name: Prepare Build Matrix
91 runs-on: ubuntu-latest
@@ -137,6 +196,7 @@ jobs:
196 needs:
197 - matrix
198 - version-check
199 + - file-check
200 strategy:
201 matrix: ${{ fromJson(needs.matrix.outputs.matrix) }}
202 # We intentiaonally disable the fail-fast behavior so that a
@@ -145,8 +205,13 @@ jobs:
205 fail-fast: false
206 max-parallel: 8
207 steps:
208 + - name: Skip Check
209 + id: skip
210 + if: needs.file-check.outputs.run != 'true'
211 + run: echo "SKIPPED"
212 - name: Checkout
213 id: checkout
214 + if: needs.file-check.outputs.run == 'true'
215 uses: actions/checkout@v4
216 with:
217 fetch-depth: 0 # We need full history for versioning
@@ -165,13 +230,14 @@ jobs:
230 fi
231 - name: Setup QEMU
232 id: qemu
168 - if: matrix.qemu
233 + if: matrix.qemu && needs.file-check.outputs.run == 'true'
234 run: |
235 sudo apt-get update
236 sudo apt-get upgrade -y
237 sudo apt-get install -y qemu-user-static
238 - name: Fetch images
239 id: fetch-images
240 + if: needs.file-check.outputs.run == 'true'
241 uses: nick-invision/retry@v3
242 with:
243 max_attempts: 3
@@ -182,6 +248,7 @@ jobs:
248 docker pull --platform ${{ matrix.platform }} netdata/package-builders:${{ matrix.distro }}${{ matrix.version }}-${{ matrix.builder_rev }}
249 - name: Build Packages
250 id: build
251 + if: needs.file-check.outputs.run == 'true'
252 shell: bash
253 run: |
254 docker run --security-opt seccomp=unconfined -e DISABLE_TELEMETRY=1 -e VERSION=${{ needs.version-check.outputs.version }} \
@@ -192,6 +259,7 @@ jobs:
259 --platform=${{ matrix.platform }} -v "$PWD":/netdata netdata/package-builders:${{ matrix.distro }}${{ matrix.version }}-${{ matrix.builder_rev }}
260 - name: Save Packages
261 id: artifacts
262 + if: needs.file-check.outputs.run == 'true'
263 continue-on-error: true
264 uses: actions/upload-artifact@v4.6.1
265 with:
@@ -199,6 +267,7 @@ jobs:
267 path: ${{ github.workspace }}/artifacts/*
268 - name: Test Packages
269 id: test
270 + if: needs.file-check.outputs.run == 'true'
271 shell: bash
272 run: |
273 docker run --security-opt seccomp=unconfined -e DISABLE_TELEMETRY=1 -e DISTRO=${{ matrix.distro }} \
@@ -207,18 +276,18 @@ jobs:
276 /netdata/.github/scripts/pkg-test.sh
277 - name: Import GPG Keys
278 id: import-keys
210 - if: matrix.format == 'deb' && github.event_name != 'pull_request'
279 + if: needs.file-check.outputs.run == 'true' && matrix.format == 'deb' && github.event_name != 'pull_request'
280 uses: crazy-max/ghaction-import-gpg@v6
281 with:
282 gpg_private_key: ${{ secrets.NETDATABOT_PACKAGE_SIGNING_KEY }}
283 - name: Sign DEB Packages
284 id: sign-deb
216 - if: matrix.format == 'deb' && github.event_name != 'pull_request'
285 + if: needs.file-check.outputs.run == 'true' && matrix.format == 'deb' && github.event_name != 'pull_request'
286 shell: bash
287 run: .github/scripts/deb-sign.sh artifacts ${{ steps.import-keys.outputs.fingerprint }}
288 - name: SSH setup
289 id: ssh-setup
221 - if: github.event_name == 'workflow_dispatch' && github.repository == 'netdata/netdata'
290 + if: github.event_name == 'workflow_dispatch' && github.repository == 'netdata/netdata' && needs.file-check.outputs.run == 'true'
291 uses: shimataro/ssh-key-action@v2
292 with:
293 key: ${{ secrets.NETDATABOT_PACKAGES_SSH_KEY }}
@@ -227,7 +296,7 @@ jobs:
296 - name: Upload to packages.netdata.cloud
297 id: package-upload
298 continue-on-error: true
230 - if: github.event_name == 'workflow_dispatch' && github.repository == 'netdata/netdata'
299 + if: github.event_name == 'workflow_dispatch' && github.repository == 'netdata/netdata' && needs.file-check.outputs.run == 'true'
300 run: |
301 .github/scripts/package-upload.sh \
302 packages.netdata.cloud \
@@ -237,7 +306,7 @@ jobs:
306 ${{ needs.version-check.outputs.repo }}
307 - name: Upload to packages2.netdata.cloud
308 id: package2-upload
240 - if: github.event_name == 'workflow_dispatch' && github.repository == 'netdata/netdata'
309 + if: github.event_name == 'workflow_dispatch' && github.repository == 'netdata/netdata' && needs.file-check.outputs.run == 'true'
310 run: |
311 .github/scripts/package-upload.sh \
312 packages2.netdata.cloud \
@@ -271,4 +340,5 @@ jobs:
340 && github.event_name != 'pull_request'
341 && startsWith(github.ref, 'refs/heads/master')
342 && github.repository == 'netdata/netdata'
343 + && needs.file-check.outputs.run == 'true'
344 }}