Skip to content

Commit 9827768

Browse files
cesararrobacesararroba
authored
ci: reduce GitHub Actions consumption across CI workflows (#11007)
1 parent 0ddd7fb commit 9827768

26 files changed

Lines changed: 300 additions & 149 deletions

‎.github/workflows/api-code-quality.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,20 @@ on:
55
branches:
66
- 'master'
77
- 'v5.*'
8+
paths:
9+
- 'api/**'
10+
- '.github/workflows/api-tests.yml'
11+
- '.github/workflows/api-code-quality.yml'
12+
- '.github/actions/setup-python-poetry/**'
813
pull_request:
914
branches:
1015
- 'master'
1116
- 'v5.*'
17+
paths:
18+
- 'api/**'
19+
- '.github/workflows/api-tests.yml'
20+
- '.github/workflows/api-code-quality.yml'
21+
- '.github/actions/setup-python-poetry/**'
1222

1323
concurrency:
1424
group: ${{ github.workflow }}-${{ github.ref }}

‎.github/workflows/api-container-build-push.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -158,7 +158,7 @@ jobs:
158158
tags: |
159159
${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}
160160
cache-from: type=gha,scope=${{ matrix.arch }}
161-
cache-to: type=gha,mode=max,scope=${{ matrix.arch }}
161+
cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
162162

163163
# Create and push multi-architecture manifest
164164
create-manifest:

‎.github/workflows/api-container-checks.yml‎

Lines changed: 13 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,16 @@ on:
55
branches:
66
- 'master'
77
- 'v5.*'
8+
paths:
9+
- 'api/**'
10+
- '.github/workflows/api-container-checks.yml'
811
pull_request:
912
branches:
1013
- 'master'
1114
- 'v5.*'
15+
paths:
16+
- 'api/**'
17+
- '.github/workflows/api-container-checks.yml'
1218

1319
concurrency:
1420
group: ${{ github.workflow }}-${{ github.ref }}
@@ -57,16 +63,7 @@ jobs:
5763

5864
api-container-build-and-scan:
5965
if: github.repository == 'prowler-cloud/prowler'
60-
runs-on: ${{ matrix.runner }}
61-
strategy:
62-
matrix:
63-
include:
64-
- platform: linux/amd64
65-
runner: ubuntu-latest
66-
arch: amd64
67-
- platform: linux/arm64
68-
runner: ubuntu-24.04-arm
69-
arch: arm64
66+
runs-on: ubuntu-latest
7067
timeout-minutes: 30
7168
permissions:
7269
contents: read
@@ -119,23 +116,22 @@ jobs:
119116
if: steps.check-changes.outputs.any_changed == 'true'
120117
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
121118

122-
- name: Build container for ${{ matrix.arch }}
119+
- name: Build container
123120
if: steps.check-changes.outputs.any_changed == 'true'
124121
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
125122
with:
126123
context: ${{ env.API_WORKING_DIR }}
127124
push: false
128125
load: true
129-
platforms: ${{ matrix.platform }}
130-
tags: ${{ env.IMAGE_NAME }}:${{ github.sha }}-${{ matrix.arch }}
131-
cache-from: type=gha,scope=${{ matrix.arch }}
132-
cache-to: type=gha,mode=max,scope=${{ matrix.arch }}
126+
tags: ${{ env.IMAGE_NAME }}:${{ github.sha }}
127+
cache-from: type=gha
128+
cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }}
133129

134-
- name: Scan container with Trivy for ${{ matrix.arch }}
130+
- name: Scan container with Trivy
135131
if: steps.check-changes.outputs.any_changed == 'true'
136132
uses: ./.github/actions/trivy-scan
137133
with:
138134
image-name: ${{ env.IMAGE_NAME }}
139-
image-tag: ${{ github.sha }}-${{ matrix.arch }}
135+
image-tag: ${{ github.sha }}
140136
fail-on-critical: 'false'
141137
severity: 'CRITICAL'

‎.github/workflows/api-security.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,20 @@ on:
55
branches:
66
- "master"
77
- "v5.*"
8+
paths:
9+
- 'api/**'
10+
- '.github/workflows/api-tests.yml'
11+
- '.github/workflows/api-security.yml'
12+
- '.github/actions/setup-python-poetry/**'
813
pull_request:
914
branches:
1015
- "master"
1116
- "v5.*"
17+
paths:
18+
- 'api/**'
19+
- '.github/workflows/api-tests.yml'
20+
- '.github/workflows/api-security.yml'
21+
- '.github/actions/setup-python-poetry/**'
1222

1323
concurrency:
1424
group: ${{ github.workflow }}-${{ github.ref }}

‎.github/workflows/api-tests.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,18 @@ on:
55
branches:
66
- 'master'
77
- 'v5.*'
8+
paths:
9+
- 'api/**'
10+
- '.github/workflows/api-tests.yml'
11+
- '.github/actions/setup-python-poetry/**'
812
pull_request:
913
branches:
1014
- 'master'
1115
- 'v5.*'
16+
paths:
17+
- 'api/**'
18+
- '.github/workflows/api-tests.yml'
19+
- '.github/actions/setup-python-poetry/**'
1220

1321
concurrency:
1422
group: ${{ github.workflow }}-${{ github.ref }}

‎.github/workflows/conventional-commit.yml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@ on:
44
pull_request:
55
branches:
66
- 'master'
7-
- 'v3'
8-
- 'v4.*'
97
- 'v5.*'
108
types:
119
- 'opened'

‎.github/workflows/create-backport-label.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,14 +43,11 @@ jobs:
4343
4444
echo "Processing release tag: $RELEASE_TAG"
4545
46-
# Remove 'v' prefix if present (e.g., v3.2.0 -> 3.2.0)
4746
VERSION_ONLY="${RELEASE_TAG#v}"
4847
49-
# Check if it's a minor version (X.Y.0)
5048
if [[ "$VERSION_ONLY" =~ ^([0-9]+)\.([0-9]+)\.0$ ]]; then
5149
echo "Release $RELEASE_TAG (version $VERSION_ONLY) is a minor version. Proceeding to create backport label."
5250
53-
# Extract X.Y from X.Y.0 (e.g., 5.6 from 5.6.0)
5451
MAJOR="${BASH_REMATCH[1]}"
5552
MINOR="${BASH_REMATCH[2]}"
5653
TWO_DIGIT_VERSION="${MAJOR}.${MINOR}"
@@ -62,7 +59,6 @@ jobs:
6259
echo "Label name: $LABEL_NAME"
6360
echo "Label description: $LABEL_DESC"
6461
65-
# Check if label already exists
6662
if gh label list --repo ${{ github.repository }} --limit 1000 | grep -q "^${LABEL_NAME}[[:space:]]"; then
6763
echo "Label '$LABEL_NAME' already exists."
6864
else

‎.github/workflows/find-secrets.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,10 +37,13 @@ jobs:
3737
- name: Checkout repository
3838
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3939
with:
40-
fetch-depth: 0
40+
# PRs only need the diff range; push to master/release walks the new range from event.before.
41+
# 50 is enough headroom for the longest realistic PR/push chain without paying for a full clone.
42+
fetch-depth: 50
4143
persist-credentials: false
4244

43-
- name: Scan for secrets with TruffleHog
45+
- name: Scan diff for secrets with TruffleHog
46+
# Action auto-injects --since-commit/--branch from event payload; passing them in extra_args produces duplicate flags.
4447
uses: trufflesecurity/trufflehog@ef6e76c3c4023279497fab4721ffa071a722fd05 # v3.92.4
4548
with:
46-
extra_args: '--results=verified,unknown'
49+
extra_args: --results=verified,unknown

‎.github/workflows/mcp-container-build-push.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ jobs:
152152
org.opencontainers.image.created=${{ github.event_name == 'release' && github.event.release.published_at || github.event.head_commit.timestamp }}
153153
${{ github.event_name == 'release' && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
154154
cache-from: type=gha,scope=${{ matrix.arch }}
155-
cache-to: type=gha,mode=max,scope=${{ matrix.arch }}
155+
cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
156156

157157
# Create and push multi-architecture manifest
158158
create-manifest:

‎.github/workflows/mcp-container-checks.yml‎

Lines changed: 13 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,16 @@ on:
55
branches:
66
- 'master'
77
- 'v5.*'
8+
paths:
9+
- 'mcp_server/**'
10+
- '.github/workflows/mcp-container-checks.yml'
811
pull_request:
912
branches:
1013
- 'master'
1114
- 'v5.*'
15+
paths:
16+
- 'mcp_server/**'
17+
- '.github/workflows/mcp-container-checks.yml'
1218

1319
concurrency:
1420
group: ${{ github.workflow }}-${{ github.ref }}
@@ -56,16 +62,7 @@ jobs:
5662

5763
mcp-container-build-and-scan:
5864
if: github.repository == 'prowler-cloud/prowler'
59-
runs-on: ${{ matrix.runner }}
60-
strategy:
61-
matrix:
62-
include:
63-
- platform: linux/amd64
64-
runner: ubuntu-latest
65-
arch: amd64
66-
- platform: linux/arm64
67-
runner: ubuntu-24.04-arm
68-
arch: arm64
65+
runs-on: ubuntu-latest
6966
timeout-minutes: 30
7067
permissions:
7168
contents: read
@@ -112,23 +109,22 @@ jobs:
112109
if: steps.check-changes.outputs.any_changed == 'true'
113110
uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
114111

115-
- name: Build MCP container for ${{ matrix.arch }}
112+
- name: Build MCP container
116113
if: steps.check-changes.outputs.any_changed == 'true'
117114
uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
118115
with:
119116
context: ${{ env.MCP_WORKING_DIR }}
120117
push: false
121118
load: true
122-
platforms: ${{ matrix.platform }}
123-
tags: ${{ env.IMAGE_NAME }}:${{ github.sha }}-${{ matrix.arch }}
124-
cache-from: type=gha,scope=${{ matrix.arch }}
125-
cache-to: type=gha,mode=max,scope=${{ matrix.arch }}
119+
tags: ${{ env.IMAGE_NAME }}:${{ github.sha }}
120+
cache-from: type=gha
121+
cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }}
126122

127-
- name: Scan MCP container with Trivy for ${{ matrix.arch }}
123+
- name: Scan MCP container with Trivy
128124
if: steps.check-changes.outputs.any_changed == 'true'
129125
uses: ./.github/actions/trivy-scan
130126
with:
131127
image-name: ${{ env.IMAGE_NAME }}
132-
image-tag: ${{ github.sha }}-${{ matrix.arch }}
128+
image-tag: ${{ github.sha }}
133129
fail-on-critical: 'false'
134130
severity: 'CRITICAL'

0 commit comments

Comments
 (0)