Skip to content

fix(ci): make unique and improve Github workflow job ids to make it easier to reference them from Github settings #918

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jenstroeger wants to merge 3 commits into
base: main
Choose a base branch
from
Open

fix(ci): make unique and improve Github workflow job ids to make it easier to reference them from Github settings #918

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
66fc8df
fix(ci): make unique and improve Github workflow job ids to make it e…
jenstroeger Apr 7, 2025
ff49d27
chore: rename job ids to actionable names/verbs
jenstroeger Apr 14, 2025
2adc4d5
chore: incorporate PR feedback
jenstroeger Jun 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .github/workflows/_build.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ on:
description: Enable or disable running pip_audit to check installed packages for vulnerabilities
outputs:
artifacts-sha256:
value: ${{ jobs.build.outputs.artifacts-sha256 }}
value: ${{ jobs.check-and-build-package.outputs.artifacts-sha256 }}
description: The hash of the artifacts
permissions:
contents: read
Expand All @@ -38,7 +38,7 @@ env:
ARTIFACT_PYTHON: '3.13' # The default Python version for release.

jobs:
build:
check-and-build-package:
# Uncomment the following to disable checks and tests for Draft pull requests.
# if: github.event.pull_request.draft == false
outputs:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/_generate-rebase.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ permissions:
contents: read

jobs:
rebase:
rebase-branch:
runs-on: ubuntu-latest
steps:

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/_release-notifications.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ on:
permissions: {}

jobs:
slack:
send-release-notification-slack:
name: Slack release notification
runs-on: ubuntu-latest
steps:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/codeql-analysis.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Run CodeQL over the package. For more configuration options see codeql/codeql-config.yaml
# and: https://github.com/github/codeql-action

name: CodeQL
name: Analyze repository using CodeQL
on:
push:
branches:
Expand All @@ -20,7 +20,7 @@ permissions:
contents: read

jobs:
analyze:
analyze-codeql:
name: Analyze
runs-on: ubuntu-latest
permissions:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/dependabot-automerge.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ permissions:
pull-requests: write

jobs:
comment:
merge-dependabot-pr:
if: ${{ github.event.review.state == 'approved' && github.event.pull_request.user.login == 'dependabot[bot]' }}
runs-on: ubuntu-latest
steps:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pr-change-set.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ permissions:
contents: read

jobs:
build:
build-package:
Copy link
Copy Markdown
Collaborator

@behnazh behnazh Jun 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
build-package:
check-and-build-package:

Copy link
Copy Markdown
Owner Author

@jenstroeger jenstroeger Jun 14, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Commit 2adc4d5.

Also, should we then rename _build.yaml to _check_and_build.yaml? The only job in this reusable workflow is also named check-and-build-package so maybe renaming the workflow file would improve consistency between file name and executed jobs? 🤔

Copy link
Copy Markdown
Collaborator

@behnazh behnazh Sep 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the current file name is intuitive, and build should only pass when checks pass anyway.

uses: ./.github/workflows/_build.yaml
permissions:
contents: read
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/pr-conventional-commits.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@ permissions:
contents: read

jobs:
conventional-commits:
check-conventional-commits:
runs-on: ubuntu-latest
steps:

Expand Down
48 changes: 24 additions & 24 deletions .github/workflows/release.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ permissions:
contents: read

jobs:
check:
check-package-for-release:
if: ${{ !startsWith(github.event.commits[0].message, 'bump:') }}
uses: ./.github/workflows/_build.yaml
permissions:
Expand All @@ -21,8 +21,8 @@ jobs:

# On pushes to the 'release' branch create a new release by bumping the version
# and generating a change log. That's the new bump commit and associated tag.
bump:
needs: check
bump-package-version:
needs: [check-package-for-release]
if: github.ref == 'refs/heads/release'
runs-on: ubuntu-latest
permissions:
Expand Down Expand Up @@ -76,7 +76,7 @@ jobs:
git push --tags

# When triggered by the version bump commit, build the package and publish the release artifacts.
build:
build-package-for-release:
if: github.ref == 'refs/heads/release' && startsWith(github.event.commits[0].message, 'bump:')
uses: ./.github/workflows/_build.yaml
permissions:
Expand All @@ -86,8 +86,8 @@ jobs:

# Create a new Release on Github from the verified build artifacts, and optionally
# publish the artifacts to a PyPI server.
release:
needs: [build]
release-package:
needs: [build-package-for-release]
name: Release
outputs:
release-tag: ${{ steps.upload-assets.outputs.release-tag }}
Expand Down Expand Up @@ -118,7 +118,7 @@ jobs:
# against the hashes computed by the build job.
- name: Verify the artifact hash
env:
ARTIFACT_HASH: ${{ needs.build.outputs.artifacts-sha256 }}
ARTIFACT_HASH: ${{ needs.build-package-for-release.outputs.artifacts-sha256 }}
run: |
set -euo pipefail
echo "Hash of package should be $ARTIFACT_HASH."
Expand Down Expand Up @@ -175,11 +175,11 @@ jobs:
# provenance generator which depends on an external service Rekor (https://github.com/sigstore/rekor)
# we build this generator from source for now. For more information see this discussion:
# https://github.com/slsa-framework/slsa-github-generator/issues/942
provenance:
needs: [build, release]
generate-provenance:
needs: [build-package-for-release, release-package]
uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.0.0
with:
base64-subjects: ${{ needs.build.outputs.artifacts-sha256 }}
base64-subjects: ${{ needs.build-package-for-release.outputs.artifacts-sha256 }}
compile-generator: false # Do not build the provenance generator from source anymore.
# Set private-repository to true for private repositories. Note that the repository name is
# uploaded as part of the transparency log entry on the public Rekor instance (rekor.sigstore.dev).
Expand All @@ -190,8 +190,8 @@ jobs:
contents: write # To add assets to a release.

# Publish the SLSA provenance as the GitHub release asset.
publish_provenance:
needs: [release, provenance]
release-provenance:
needs: [release-package, generate-provenance]
name: Publish provenance
runs-on: ubuntu-latest
permissions:
Expand All @@ -212,41 +212,41 @@ jobs:
- name: Download provenance
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
with:
name: ${{ needs.provenance.outputs.provenance-name }}
name: ${{ needs.generate-provenance.outputs.provenance-name }}

- name: Upload provenance
run: gh release upload ${{ needs.release.outputs.release-tag }} ${{ needs.provenance.outputs.provenance-name }}
run: gh release upload ${{ needs.release-package.outputs.release-tag }} ${{ needs.generate-provenance.outputs.provenance-name }}
env:
GH_TOKEN: ${{ secrets.REPO_ACCESS_TOKEN }}

# Send out release notifications after the Release was published on GitHub.
# Uncomment the `if` to disable sending release notifications.
notifications:
send-release-notifications:
# if: ${{ false }}
needs: [release]
needs: [release-package]
name: Send Release notifications
uses: ./.github/workflows/_release-notifications.yaml
permissions:
contents: read
with:
repo-name: ${{ github.event.repository.name }}
release-tag: ${{ needs.release.outputs.release-tag }}
release-url: ${{ needs.release.outputs.release-url }}
release-tag: ${{ needs.release-package.outputs.release-tag }}
release-url: ${{ needs.release-package.outputs.release-url }}
secrets:
SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

# Publish the generated Markdown documentation to the repository's Wiki.
# Uncomment the `if` to disable generating Wiki documentation.
wiki:
publish-wiki:
# if: ${{ false }}
needs: [release]
needs: [release-package]
name: Publish Github Wiki documentation
uses: ./.github/workflows/_wiki-documentation.yaml
permissions:
contents: read
with:
release-tag: ${{ needs.release.outputs.release-tag }}
release-url: ${{ needs.release.outputs.release-url }}
release-tag: ${{ needs.release-package.outputs.release-tag }}
release-url: ${{ needs.release-package.outputs.release-url }}
# Github disallows passing environment variables as arguments to a reusable
# workflow, so we have to duplicate these values here. Related discussion
# here: https://github.com/actions/toolkit/issues/931
Expand All @@ -259,9 +259,9 @@ jobs:
# After the bump commit was pushed to the release branch, rebase the main branch
# (to_head argument) on top of the new release branch (from_base argument), to keep
# the histories of both branches in sync.
rebase_main:
rebase-main-branch:
# if: ${{ false }}
needs: [release]
needs: [release-package]
name: Rebase main branch on release
uses: ./.github/workflows/_generate-rebase.yaml
permissions:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/scorecards-analysis.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ on:
permissions: read-all

jobs:
analysis:
analyze-scorecard:
name: Scorecards analysis
runs-on: ubuntu-latest
permissions:
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/sync-with-upstream.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ permissions:
contents: read

jobs:
sync:
sync-with-upstream:
if: github.repository != 'jenstroeger/python-package-template'
runs-on: ubuntu-latest
permissions:
Expand Down