BUILD-8956 Extract config-poetry action from build-poetry #292
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,145 @@ | ||
| --- | ||
| name: Config Poetry | ||
| description: GitHub Action to configure Poetry build environment with build number, JFrog authentication, and caching | ||
| inputs: | ||
| working-directory: | ||
| description: Relative path under github.workspace to execute the build in | ||
| default: . | ||
| artifactory-reader-role: | ||
| description: Suffix for the Artifactory reader role in Vault. Defaults to `private-reader` for private repositories, and `public-reader` | ||
| for public repositories. | ||
| default: '' | ||
| artifactory-pypi-repo: | ||
| description: PyPI virtual repository to resolve dependencies from | ||
| default: sonarsource-pypi | ||
| repox-url: | ||
| description: URL for Repox | ||
| default: https://repox.jfrog.io | ||
| poetry-virtualenvs-path: | ||
| description: Path to the Poetry virtual environments, relative to GitHub workspace. The folder is cached only if it is a subdirectory of | ||
| `poetry-cache-dir`. | ||
| default: .cache/pypoetry/virtualenvs | ||
| poetry-cache-dir: | ||
| description: Path to the Poetry cache directory, relative to GitHub workspace | ||
| default: .cache/pypoetry | ||
| disable-caching: | ||
| description: Whether to disable Poetry caching entirely | ||
| default: 'false' | ||
| host-actions-root: | ||
| description: Path to the actions folder on the host (used when called from another local action) | ||
| default: '' | ||
|
|
||
| outputs: | ||
| BUILD_NUMBER: | ||
| description: The current build number. Also set as environment variable BUILD_NUMBER | ||
| value: ${{ steps.get-build-number.outputs.BUILD_NUMBER }} | ||
|
|
||
| runs: | ||
| using: composite | ||
| steps: | ||
| - id: config-poetry-completed | ||
| if: env.CONFIG_POETRY_COMPLETED != '' | ||
| shell: bash | ||
| run: | | ||
| echo "Action already called by $CONFIG_POETRY_COMPLETED, execution skipped." | ||
| echo "skip=true" >> "$GITHUB_OUTPUT" | ||
|
|
||
| - name: Set local action paths | ||
| id: set-path | ||
| if: steps.config-poetry-completed.outputs.skip != 'true' | ||
| shell: bash | ||
| run: | | ||
| echo "::group::Fix for using local actions" | ||
| echo "GITHUB_ACTION_PATH=$GITHUB_ACTION_PATH" | ||
| echo "github.action_path=${{ github.action_path }}" | ||
| ACTION_PATH_CONFIG_POETRY="${{ github.action_path }}" | ||
| host_actions_root="${{ inputs.host-actions-root }}" | ||
| if [[ -z "$host_actions_root" ]]; then | ||
| host_actions_root="$(dirname "$ACTION_PATH_CONFIG_POETRY")" | ||
| else | ||
| ACTION_PATH_CONFIG_POETRY="$host_actions_root/config-poetry" | ||
| fi | ||
|
Comment on lines
+47
to
+61
There was a problem hiding this comment.
|
||
| echo "ACTION_PATH_CONFIG_POETRY=$ACTION_PATH_CONFIG_POETRY" | ||
| echo "ACTION_PATH_CONFIG_POETRY=$ACTION_PATH_CONFIG_POETRY" >> "$GITHUB_ENV" | ||
| echo "host_actions_root=$host_actions_root" >> "$GITHUB_OUTPUT" | ||
|
|
||
| mkdir -p ".actions" | ||
| ln -sf "$host_actions_root/get-build-number" .actions/get-build-number | ||
| ln -sf "$host_actions_root/shared" .actions/shared | ||
| ls -la .actions/* | ||
| echo "::endgroup::" | ||
|
|
||
| echo "::group::Backup mise files to configure Poetry without interference" | ||
| mise_backup=$(mktemp -d) | ||
| echo "MISE_BACKUP=$mise_backup" >> "$GITHUB_OUTPUT" | ||
| mv mise.* .mise.* mise/ .mise/ .tool-versions "$mise_backup/" 2>/dev/null || true | ||
| cp "$ACTION_PATH_CONFIG_POETRY/mise.local.toml" mise.local.toml | ||
| echo "::endgroup::" | ||
|
Comment on lines
+72
to
+77
There was a problem hiding this comment. 💡 Bug: mise files not restored if a step fails before restoreIn Was this helpful? React with 👍 / 👎 |
||
|
|
||
| - name: Set Artifactory reader role | ||
| if: steps.config-poetry-completed.outputs.skip != 'true' | ||
| shell: bash | ||
| env: | ||
| ARTIFACTORY_READER_ROLE: | ||
| ${{ inputs.artifactory-reader-role != '' && inputs.artifactory-reader-role || | ||
| (github.event.repository.visibility == 'public' && 'public-reader' || 'private-reader') }} | ||
| run: | | ||
| echo "ARTIFACTORY_READER_ROLE=${ARTIFACTORY_READER_ROLE}" >> "$GITHUB_ENV" | ||
|
Comment on lines
+79
to
+87
Contributor
There was a problem hiding this comment. No need for a separate step, this can be merged with the above |
||
|
|
||
| - uses: ./.actions/get-build-number | ||
| id: get-build-number | ||
| if: steps.config-poetry-completed.outputs.skip != 'true' | ||
| with: | ||
| host-actions-root: ${{ steps.set-path.outputs.host_actions_root }} | ||
|
|
||
| - name: Cache local Poetry cache | ||
| uses: SonarSource/gh-action_cache@a7d13cdd1c9f097a5f8382ccec463be2831e3dbc # v1.6.0 | ||
| if: steps.config-poetry-completed.outputs.skip != 'true' && inputs.disable-caching == 'false' | ||
| with: | ||
| path: ${{ github.workspace }}/${{ inputs.poetry-cache-dir }} | ||
| key: poetry-${{ runner.os }}-${{ hashFiles('poetry.lock') }} | ||
| restore-keys: poetry-${{ runner.os }}- | ||
|
Comment on lines
+95
to
+101
Contributor
There was a problem hiding this comment. The other config actions seem to have an improved cache key that includes the workflow name: ci-github-actions/config-gradle/action.yml Lines 193 to 207 in 136be4d This looks like a debt in the Poetry action. Either implement now, or consider as out of scope and create a ticket for this specific debt. |
||
|
|
||
| - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1 | ||
| if: steps.config-poetry-completed.outputs.skip != 'true' | ||
| with: | ||
| version: 2026.5.9 | ||
|
|
||
| - uses: SonarSource/vault-action-wrapper@0a3114fe1230b784c35b53b099f9ab1f1e538cc7 # 3.5.0 | ||
| if: steps.config-poetry-completed.outputs.skip != 'true' | ||
| id: secrets | ||
| with: | ||
| url: ${{ contains(inputs.repox-url, 'dev.sonar.build') && 'https://vault.dev.sonar.build' || 'https://vault.sonar.build' }} | ||
| secrets: | | ||
| development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} username | ARTIFACTORY_USERNAME; | ||
| development/artifactory/token/{REPO_OWNER_NAME_DASH}-${{ env.ARTIFACTORY_READER_ROLE }} access_token | ARTIFACTORY_ACCESS_TOKEN; | ||
|
|
||
| - name: Configure Poetry authentication | ||
| if: steps.config-poetry-completed.outputs.skip != 'true' | ||
| shell: bash | ||
| working-directory: ${{ inputs.working-directory }} | ||
| env: | ||
| ARTIFACTORY_URL: ${{ format('{0}/artifactory', inputs.repox-url) }} | ||
| ARTIFACTORY_USERNAME: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_USERNAME }} | ||
| ARTIFACTORY_ACCESS_TOKEN: ${{ fromJSON(steps.secrets.outputs.vault).ARTIFACTORY_ACCESS_TOKEN }} | ||
| ARTIFACTORY_PYPI_REPO: ${{ inputs.artifactory-pypi-repo }} | ||
| run: | | ||
| $ACTION_PATH_CONFIG_POETRY/poetry_config.sh | ||
|
|
||
| echo "::group::Restore mise files" | ||
| rm mise.local.toml | ||
| mv "${{ steps.set-path.outputs.MISE_BACKUP }}"/* "${{ steps.set-path.outputs.MISE_BACKUP }}"/.* ./ 2>/dev/null || true | ||
| rmdir "${{ steps.set-path.outputs.MISE_BACKUP }}" | ||
| echo "::endgroup::" | ||
|
|
||
| - name: Set Config Poetry completed | ||
| if: steps.config-poetry-completed.outputs.skip != 'true' | ||
| shell: bash | ||
| run: echo "CONFIG_POETRY_COMPLETED=$GITHUB_ACTION" >> "$GITHUB_ENV" | ||
|
|
||
| - name: Clean up local action symlinks | ||
| if: always() && steps.config-poetry-completed.outputs.skip != 'true' | ||
| shell: bash | ||
| run: | | ||
| rm -f .actions/get-build-number .actions/shared | ||
| rmdir .actions 2>/dev/null || true | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,6 @@ | ||
| [tools] | ||
| jfrog-cli = "2.96.0" | ||
|
|
||
| [env] | ||
| JFROG_CLI_AVOID_NEW_VERSION_WARNING = "true" | ||
| JFROG_CLI_ENV_EXCLUDE = "*password*;*secret*;*key*;*token*;*auth*;*credential*" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
?
If moving the set_project_version() function to the config action. See following related comment.