Documentation

Modèles de flux de travail pour les exécuteurs GitHub Actions

Installez la GitHub App de Runzivo, sélectionnez un dépôt privé appartenant à une organisation GitHub, puis utilisez l’étiquette d’exécuteur publiée du modèle choisi.

Rédiger un modèle

Node.js

Installer les dépendances npm verrouillées, tester et compiler.

rzv-ubuntu-24.04-x64-2vcpu-8gb

Fichiers requis : package.json et package-lock.json.

Validez package-lock.json avant d’utiliser le cache des dépendances npm.

name: Node.js

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: nodejs-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    runs-on: rzv-ubuntu-24.04-x64-2vcpu-8gb
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
        with:
          node-version: 24
          cache: npm
          cache-dependency-path: package-lock.json
      - run: npm ci
      - run: npm test
      - run: npm run build

Python

Installer les dépendances et exécuter pytest.

rzv-ubuntu-24.04-x64-2vcpu-8gb

Fichiers requis : requirements.txt et les tests.

name: Python

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: python-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    runs-on: rzv-ubuntu-24.04-x64-2vcpu-8gb
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version: "3.13"
          cache: pip
          cache-dependency-path: requirements.txt
      - run: python -m pip install --requirement requirements.txt
      - run: python -m pytest

Go

Analyser (vet), tester et compiler un module Go.

rzv-ubuntu-24.04-x64-2vcpu-8gb

Fichiers requis : go.mod et go.sum.

name: Go

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: go-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    runs-on: rzv-ubuntu-24.04-x64-2vcpu-8gb
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          go-version-file: go.mod
          cache: true
      - run: go vet ./...
      - run: go test ./...
      - run: go build ./...

Java avec Maven

Compiler et tester un projet Maven avec son Maven Wrapper versionné.

rzv-ubuntu-24.04-x64-2vcpu-8gb

Fichiers requis : pom.xml, mvnw et .mvn/wrapper/.

Conservez le bit d’exécution de mvnw.

name: Java with Maven

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: java-maven-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    runs-on: rzv-ubuntu-24.04-x64-2vcpu-8gb
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
        with:
          distribution: temurin
          java-version: "21"
          cache: maven
      - run: ./mvnw --batch-mode verify

Build Docker et publication GHCR

Compiler les demandes de tirage et publier seulement à partir des poussées vers main.

rzv-ubuntu-24.04-x64-2vcpu-8gb

Fichier requis : Dockerfile.

name: Docker build and GHCR publish

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: docker-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  build:
    if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
    runs-on: rzv-ubuntu-24.04-x64-2vcpu-8gb
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          push: false
          cache-from: type=gha
          cache-to: type=gha,mode=max
  publish:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    runs-on: rzv-ubuntu-24.04-x64-2vcpu-8gb
    timeout-minutes: 25
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
      - id: metadata
        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
        with:
          images: ghcr.io/${{ github.repository }}
      - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
        with:
          context: .
          push: true
          tags: ${{ steps.metadata.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

Terraform

Planifier les demandes de tirage et appliquer main après la configuration des réviseurs d’environnement obligatoires.

rzv-ubuntu-24.04-x64-2vcpu-8gb

Répertoire requis : terraform/.

Configurez un backend distant, les identifiants du fournisseur et l’environnement terraform-apply avec des réviseurs obligatoires avant d’utiliser apply.

Validez .terraform.lock.hcl dès que la configuration utilise des fournisseurs.

Pour un dépôt privé, confirmez que votre forfait GitHub prend en charge les réviseurs d’environnement obligatoires avant de vous fier à cette barrière.

Protégez main afin que des modifications révisées soient exigées avant qu’une poussée puisse atteindre apply.

Un nom d’environnement ne constitue pas, à lui seul, une barrière d’approbation.

La tâche apply refait un plan avant d’appliquer : elle applique donc ce que main contient à ce moment, et non le plan antérieur de la demande de tirage.

Donnez à la tâche de plan de la demande de tirage des identifiants infonuagiques en lecture seule ; gardez les identifiants d’écriture uniquement sur l’environnement terraform-apply.

name: Terraform

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: terraform-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  validate:
    runs-on: rzv-ubuntu-24.04-x64-2vcpu-8gb
    timeout-minutes: 15
    defaults:
      run:
        working-directory: terraform
    env:
      TF_PLUGIN_CACHE_DIR: ${{ github.workspace }}/.terraform.d/plugin-cache
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
        with:
          terraform_version: 1.16.7
          terraform_wrapper: false
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: .terraform.d/plugin-cache
          key: terraform-${{ runner.os }}-${{ hashFiles('terraform/.terraform.lock.hcl', 'terraform/*.tf') }}
      - run: mkdir -p "$TF_PLUGIN_CACHE_DIR"
      - run: terraform fmt -check -recursive
      - run: terraform init -backend=false -input=false -lockfile=readonly
      - run: terraform validate
  plan:
    if: github.event_name == 'pull_request'
    needs: validate
    runs-on: rzv-ubuntu-24.04-x64-2vcpu-8gb
    timeout-minutes: 15
    defaults:
      run:
        working-directory: terraform
    env:
      TF_PLUGIN_CACHE_DIR: ${{ github.workspace }}/.terraform.d/plugin-cache
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
        with:
          terraform_version: 1.16.7
          terraform_wrapper: false
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: .terraform.d/plugin-cache
          key: terraform-${{ runner.os }}-${{ hashFiles('terraform/.terraform.lock.hcl', 'terraform/*.tf') }}
      - run: mkdir -p "$TF_PLUGIN_CACHE_DIR"
      - run: terraform init -input=false -lockfile=readonly
      - run: terraform plan -input=false -lock=false
  apply:
    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
    needs: validate
    runs-on: rzv-ubuntu-24.04-x64-2vcpu-8gb
    timeout-minutes: 20
    environment: terraform-apply
    defaults:
      run:
        working-directory: terraform
    env:
      TF_PLUGIN_CACHE_DIR: ${{ github.workspace }}/.terraform.d/plugin-cache
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
        with:
          terraform_version: 1.16.7
          terraform_wrapper: false
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: .terraform.d/plugin-cache
          key: terraform-${{ runner.os }}-${{ hashFiles('terraform/.terraform.lock.hcl', 'terraform/*.tf') }}
      - run: mkdir -p "$TF_PLUGIN_CACHE_DIR"
      - run: terraform init -input=false -lockfile=readonly
      - run: terraform apply -auto-approve -input=false

Ansible

Analyser, vérifier la syntaxe et exécuter en mode vérification un playbook local.

rzv-ubuntu-24.04-x64-2vcpu-8gb

Fichiers requis : ansible/requirements-ci.txt, inventory.yml et playbook.yml.

name: Ansible

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: ansible-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  validate:
    runs-on: rzv-ubuntu-24.04-x64-2vcpu-8gb
    timeout-minutes: 20
    defaults:
      run:
        working-directory: ansible
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
        with:
          python-version: "3.13"
          cache: pip
          cache-dependency-path: ansible/requirements-ci.txt
      - run: python -m pip install --requirement requirements-ci.txt
      - run: ansible-lint playbook.yml
      - run: ansible-playbook --inventory inventory.yml --syntax-check playbook.yml
      - run: ansible-playbook --inventory inventory.yml --check playbook.yml

Rust

Vérifier le format, analyser, tester et compiler un projet Cargo.

rzv-ubuntu-24.04-x64-2vcpu-8gb

Fichiers requis : Cargo.toml et Cargo.lock.

Validez Cargo.lock avant d’utiliser le cache de Cargo.

name: Rust

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: rust-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    runs-on: rzv-ubuntu-24.04-x64-2vcpu-8gb
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
        with:
          toolchain: stable
          components: rustfmt, clippy
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: |
            ~/.cargo/bin/
            ~/.cargo/registry/index/
            ~/.cargo/registry/cache/
            target/
          key: rust-${{ runner.os }}-${{ hashFiles('Cargo.lock') }}
      - run: cargo fmt --check
      - run: cargo clippy --all-targets -- -D warnings
      - run: cargo test
      - run: cargo build --release

.NET

Restaurer, compiler et tester une solution .NET.

rzv-ubuntu-24.04-x64-2vcpu-8gb

Fichiers requis : global.json et une solution.

name: .NET

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: dotnet-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
  test:
    runs-on: rzv-ubuntu-24.04-x64-2vcpu-8gb
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
        env:
          DOTNET_INSTALL_DIR: ${{ runner.temp }}/dotnet
        with:
          global-json-file: global.json
      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
        with:
          path: ~/.nuget/packages
          key: dotnet-${{ runner.os }}-${{ hashFiles('**/*.csproj', 'global.json') }}
      - run: dotnet restore
      - run: dotnet build --no-restore --configuration Release
      - run: dotnet test --no-build --configuration Release

Flux de travail Go réutilisable

Appeler un flux de travail Go de validation réutilisable.

rzv-ubuntu-24.04-x64-2vcpu-8gb

Fichiers requis : go.mod et go.sum.

Copiez le fichier choisi dans .github/workflows/ avant de l’appeler depuis un autre flux de travail.

name: Reusable Go validation

on:
  workflow_call:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: reusable-go-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

jobs:
  test:
    runs-on: rzv-ubuntu-24.04-x64-2vcpu-8gb
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false
      - uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6.0.0
        with:
          go-version-file: go.mod
          cache: true
      - run: go vet ./...
      - run: go test ./...
      - run: go build ./...

Sur cette page et outils de la page