Skip to content

CI: manual no-cache rebuild, fix venv cache, Node 24 actions #412

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
irvingpop merged 3 commits into from
Oct 24, 2026
Merged

CI: manual no-cache rebuild, fix venv cache, Node 24 actions #412

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cc1b252
Add manual no-cache rebuild to CI workflow
irvingpop Oct 24, 2026
17c2d7c
Fix stale venv cache and move actions to Node 24
irvingpop Oct 24, 2026
e607f08
Install Poetry with pipx instead of snok/install-poetry
irvingpop Oct 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
103 changes: 41 additions & 62 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,13 @@ on:
branches: [main]
pull_request:
branches: [main]
# Manual rebuild, e.g. to pick up Debian security updates when nothing in the repo changed
workflow_dispatch:
inputs:
no_cache:
description: "Build without layer cache (re-runs apt-get upgrade)"
type: boolean
default: true

env:
POETRY_VERSION: "2.5.1"
Expand All @@ -18,36 +25,26 @@ jobs:
if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main'
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Set up Python
uses: actions/setup-python@v5
id: setup-python
uses: actions/setup-python@v7
with:
python-version: "3.14"

- name: Load cached Poetry installation
id: cached-poetry
uses: actions/cache@v4
with:
path: ~/.local
key: poetry-${{ env.POETRY_VERSION }}-${{ runner.os }}

# pipx is preinstalled on GitHub runners; avoids a third-party install action
- name: Install Poetry
if: steps.cached-poetry.outputs.cache-hit != 'true'
uses: snok/install-poetry@v1
with:
version: ${{ env.POETRY_VERSION }}
virtualenvs-create: true
virtualenvs-in-project: true
run: pipx install "poetry==${{ env.POETRY_VERSION }}" --python "${{ steps.setup-python.outputs.python-path }}"

- name: Load cached venv
id: cached-venv
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: .venv
key: venv-lint-${{ runner.os }}-py3.14-${{ hashFiles('poetry.lock') }}
key: venv-lint-${{ runner.os }}-py${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}
restore-keys: |
venv-lint-${{ runner.os }}-py3.14-
venv-lint-${{ runner.os }}-py${{ steps.setup-python.outputs.python-version }}-

- name: Install dependencies
if: steps.cached-venv.outputs.cache-hit != 'true'
Expand All @@ -66,36 +63,26 @@ jobs:
if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main'
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Set up Python 3.14
uses: actions/setup-python@v5
id: setup-python
uses: actions/setup-python@v7
with:
python-version: "3.14"

- name: Load cached Poetry installation
id: cached-poetry
uses: actions/cache@v4
with:
path: ~/.local
key: poetry-${{ env.POETRY_VERSION }}-${{ runner.os }}

# pipx is preinstalled on GitHub runners; avoids a third-party install action
- name: Install Poetry
if: steps.cached-poetry.outputs.cache-hit != 'true'
uses: snok/install-poetry@v1
with:
version: ${{ env.POETRY_VERSION }}
virtualenvs-create: true
virtualenvs-in-project: true
run: pipx install "poetry==${{ env.POETRY_VERSION }}" --python "${{ steps.setup-python.outputs.python-path }}"

- name: Load cached venv
id: cached-venv
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: .venv
key: venv-test-${{ runner.os }}-py3.14-${{ hashFiles('poetry.lock') }}
key: venv-test-${{ runner.os }}-py${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}
restore-keys: |
venv-test-${{ runner.os }}-py3.14-
venv-test-${{ runner.os }}-py${{ steps.setup-python.outputs.python-version }}-

- name: Install dependencies
if: steps.cached-venv.outputs.cache-hit != 'true'
Expand All @@ -116,7 +103,7 @@ jobs:
SECRET_KEY: test-secret-key-for-ci

- name: Upload coverage to Codecov
uses: codecov/codecov-action@v5
uses: codecov/codecov-action@v7
with:
files: ./src/coverage.xml
fail_ci_if_error: false
Expand All @@ -129,36 +116,26 @@ jobs:
if: github.event_name == 'pull_request' || github.ref == 'refs/heads/main'
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Set up Python 3.14
uses: actions/setup-python@v5
id: setup-python
uses: actions/setup-python@v7
with:
python-version: "3.14"

- name: Load cached Poetry installation
id: cached-poetry
uses: actions/cache@v4
with:
path: ~/.local
key: poetry-${{ env.POETRY_VERSION }}-${{ runner.os }}

# pipx is preinstalled on GitHub runners; avoids a third-party install action
- name: Install Poetry
if: steps.cached-poetry.outputs.cache-hit != 'true'
uses: snok/install-poetry@v1
with:
version: ${{ env.POETRY_VERSION }}
virtualenvs-create: true
virtualenvs-in-project: true
run: pipx install "poetry==${{ env.POETRY_VERSION }}" --python "${{ steps.setup-python.outputs.python-path }}"

- name: Load cached venv
id: cached-venv
uses: actions/cache@v4
uses: actions/cache@v6
with:
path: .venv
key: venv-security-${{ runner.os }}-py3.14-${{ hashFiles('poetry.lock') }}
key: venv-security-${{ runner.os }}-py${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('poetry.lock') }}
restore-keys: |
venv-security-${{ runner.os }}-py3.14-
venv-security-${{ runner.os }}-py${{ steps.setup-python.outputs.python-version }}-

- name: Install dependencies
if: steps.cached-venv.outputs.cache-hit != 'true'
Expand All @@ -173,21 +150,21 @@ jobs:
docker-build-push:
name: Build and Push Docker Image
runs-on: ubuntu-24.04-arm
# Run on push to main (build+push) and on PRs (build only)
if: github.event_name == 'push' || github.event_name == 'pull_request'
# Run on push to main (build+push), manual dispatch (build+push) and on PRs (build only)
if: github.event_name == 'push' || github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
# For main/PR, wait for CI checks to pass
needs: [ci-success]
permissions:
id-token: write # Required for OIDC authentication
contents: read # Required to checkout code
steps:
- name: Checkout code
uses: actions/checkout@v4
uses: actions/checkout@v7

- name: Determine push eligibility
id: can-push
run: |
if [ "${{ github.event_name }}" == "push" ]; then
if [ "${{ github.event_name }}" == "push" ] || [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
echo "push=true" >> $GITHUB_OUTPUT
elif [ "${{ github.event.pull_request.head.repo.full_name }}" == "${{ github.repository }}" ]; then
echo "push=true" >> $GITHUB_OUTPUT
Expand Down Expand Up @@ -242,13 +219,13 @@ jobs:
echo "Building for ${{ steps.docker-tag.outputs.environment }} with image: ${{ steps.docker-tag.outputs.image }}"

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
uses: docker/setup-buildx-action@v4
with:
platforms: linux/arm64

- name: Configure AWS credentials
if: steps.can-push.outputs.push == 'true'
uses: aws-actions/configure-aws-credentials@v4
uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
role-session-name: GitHubActions-DockerBuild-${{ steps.docker-tag.outputs.environment }}
Expand All @@ -260,7 +237,7 @@ jobs:
uses: aws-actions/amazon-ecr-login@v2

- name: Build and push Docker image
uses: docker/build-push-action@v6
uses: docker/build-push-action@v7
with:
context: .
target: runtime
Expand All @@ -269,6 +246,8 @@ jobs:
tags: |
${{ steps.docker-tag.outputs.image }}
provenance: false
no-cache: ${{ inputs.no_cache == true }}
pull: ${{ inputs.no_cache == true }}
cache-from: type=gha,scope=arm64
cache-to: type=gha,mode=max,scope=arm64

Expand Down
Loading