Skip to content

SRE-927: Migrate same-repo action references to the $/ syntax #9197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
TimDiekmann merged 6 commits into from
Aug 11, 2026
Merged

SRE-927: Migrate same-repo action references to the $/ syntax #9197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
235355b
SRE-927: Migrate same-repo action references to $/ and fix actionlint…
TimDiekmann Aug 11, 2026
3cb7165
SRE-927: Call the centralized actionlint preflight workflow
TimDiekmann Aug 11, 2026
c1e13a8
SRE-927: Drop useless-cat pipelines in the lint workflow
TimDiekmann Aug 11, 2026
fc290bb
SRE-927: Consolidate the pull_request preflights into one file
TimDiekmann Aug 11, 2026
94065d9
SRE-927: Drop the default token permissions in the target preflight
TimDiekmann Aug 11, 2026
bd85fb3
SRE-927: Drop the checkout the warm-up action no longer needs
TimDiekmann Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/actions/docker-build-push/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,7 +63,7 @@ runs:
steps:
- name: Login to ECR
if: inputs.PUSH == 'true' && inputs.ECR_TAGS != ''
uses: ./.github/actions/docker-ecr-login
uses: $/.github/actions/docker-ecr-login

# Log in to GHCR for the build cache (and the by-digest push). Skipped for
# fork PRs: their token can't read the private cache package, and a failed
Expand Down
4 changes: 2 additions & 2 deletions .github/actions/install-tools/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ runs:
GITHUB_TOKEN: ${{ inputs.token }}

- name: Install package manager via corepack
uses: ./.github/actions/install-corepack
uses: $/.github/actions/install-corepack

- name: Setup environment
shell: bash
Expand All @@ -57,7 +57,7 @@ runs:
- name: "Install sccache"
if: ${{ (inputs.rust == true || inputs.rust == 'true') && (inputs.sccache == true || inputs.sccache == 'true') && inputs.cf_access_client_secret != '' }}
continue-on-error: true
uses: ./.github/actions/install-sccache
uses: $/.github/actions/install-sccache
with:
vault_address: ${{ inputs.vault_address }}
cf_access_client_id: ${{ inputs.cf_access_client_id }}
Expand Down
46 changes: 23 additions & 23 deletions .github/workflows/bench.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ jobs:
fetch-depth: 2

- name: Install tools
uses: ./.github/actions/install-tools
uses: $/.github/actions/install-tools
with:
token: ${{ secrets.GITHUB_TOKEN }}
vault_address: ${{ vars.VAULT_STAGE_ADDR }}
Expand All @@ -67,8 +67,8 @@ jobs:
INTEGRATION_BENCH_PACKAGES=$(turbo query "$INTEGRATION_BENCH_QUERY" \
| jq --compact-output '.data.affectedPackages.items | [(.[] | select(.name != "//"))] | { name: [.[].name], include: . }')

echo "unit=$UNIT_BENCH_PACKAGES" | tee -a $GITHUB_OUTPUT
echo "integration=$INTEGRATION_BENCH_PACKAGES" | tee -a $GITHUB_OUTPUT
echo "unit=$UNIT_BENCH_PACKAGES" | tee -a "$GITHUB_OUTPUT"
echo "integration=$INTEGRATION_BENCH_PACKAGES" | tee -a "$GITHUB_OUTPUT"

unit-benches:
name: Unit
Expand All @@ -90,11 +90,11 @@ jobs:

- name: Clean up disk
if: github.event_name == 'pull_request'
uses: ./.github/actions/clean-up-disk
uses: $/.github/actions/clean-up-disk

- name: Install tools
if: github.event_name == 'pull_request'
uses: ./.github/actions/install-tools
uses: $/.github/actions/install-tools
with:
token: ${{ secrets.GITHUB_TOKEN }}
vault_address: ${{ vars.VAULT_STAGE_ADDR }}
Expand All @@ -103,15 +103,15 @@ jobs:

- name: Prune repository
if: github.event_name == 'pull_request'
uses: ./.github/actions/prune-repository
uses: $/.github/actions/prune-repository
with:
scope: |
${{ matrix.name }}
@rust/hash-repo-chores

- name: Warm up repository
if: github.event_name == 'pull_request'
uses: ./.github/actions/warm-up-repo
uses: $/.github/actions/warm-up-repo

- name: Run base benches
if: github.event_name == 'pull_request'
Expand All @@ -132,25 +132,25 @@ jobs:

- name: Clean up disk
if: github.event_name != 'pull_request'
uses: ./.github/actions/clean-up-disk
uses: $/.github/actions/clean-up-disk

- name: Install tools
uses: ./.github/actions/install-tools
uses: $/.github/actions/install-tools
with:
token: ${{ secrets.GITHUB_TOKEN }}
vault_address: ${{ vars.VAULT_STAGE_ADDR }}
cf_access_client_id: ${{ vars.CF_ACCESS_STAGE_CLIENT_ID }}
cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }}

- name: Prune repository
uses: ./.github/actions/prune-repository
uses: $/.github/actions/prune-repository
with:
scope: |
${{ matrix.name }}
@rust/hash-repo-chores

- name: Warm up repository
uses: ./.github/actions/warm-up-repo
uses: $/.github/actions/warm-up-repo

- name: Run head benches
run: turbo run bench:unit --filter "${{ matrix.name }}"
Expand All @@ -159,7 +159,7 @@ jobs:
if: github.event_name == 'pull_request'
run: |
TRIMMED_PACKAGE_NAME=$(echo "${{ matrix.name }}" | sed 's|@||g' | sed 's|/|.|g')
echo "TRIMMED_PACKAGE_NAME=$TRIMMED_PACKAGE_NAME" >> $GITHUB_ENV
echo "TRIMMED_PACKAGE_NAME=$TRIMMED_PACKAGE_NAME" >> "$GITHUB_ENV"
echo '<details><summary><h2>${{ matrix.name }} – Units</h2></summary>' > "/tmp/$TRIMMED_PACKAGE_NAME.md"
echo >> "/tmp/$TRIMMED_PACKAGE_NAME.md"
turbo run analyze-benchmarks -- --output "/tmp/benches.md" --artifacts-path "$(pwd)/${{ matrix.path }}/out" --enforce-flame-graph
Expand Down Expand Up @@ -210,11 +210,11 @@ jobs:

- name: Clean up disk
if: github.event_name == 'pull_request'
uses: ./.github/actions/clean-up-disk
uses: $/.github/actions/clean-up-disk

- name: Install tools
if: github.event_name == 'pull_request'
uses: ./.github/actions/install-tools
uses: $/.github/actions/install-tools
with:
token: ${{ secrets.GITHUB_TOKEN }}
vault_address: ${{ vars.VAULT_STAGE_ADDR }}
Expand All @@ -223,15 +223,15 @@ jobs:

- name: Prune repository
if: github.event_name == 'pull_request'
uses: ./.github/actions/prune-repository
uses: $/.github/actions/prune-repository
with:
scope: |
${{ matrix.name }}
@rust/hash-repo-chores

- name: Warm up repository
if: github.event_name == 'pull_request'
uses: ./.github/actions/warm-up-repo
uses: $/.github/actions/warm-up-repo

- name: Create temp files and folders
run: mkdir -p var/logs
Expand Down Expand Up @@ -265,7 +265,7 @@ jobs:
mkdir -p logs
turbo run start --env-mode=loose --log-order stream >var/logs/base-background-task.log 2>&1 &
PID=$!
echo "pid=$PID" | tee -a $GITHUB_OUTPUT
echo "pid=$PID" | tee -a "$GITHUB_OUTPUT"

turbo run start:healthcheck --env-mode=loose

Expand Down Expand Up @@ -311,10 +311,10 @@ jobs:

- name: Clean up disk
if: github.event_name != 'pull_request'
uses: ./.github/actions/clean-up-disk
uses: $/.github/actions/clean-up-disk

- name: Install tools
uses: ./.github/actions/install-tools
uses: $/.github/actions/install-tools
with:
token: ${{ secrets.GITHUB_TOKEN }}
vault_address: ${{ vars.VAULT_STAGE_ADDR }}
Expand All @@ -323,14 +323,14 @@ jobs:
sccache: false # sccache is already running in the background

- name: Prune repository
uses: ./.github/actions/prune-repository
uses: $/.github/actions/prune-repository
with:
scope: |
${{ matrix.name }}
@rust/hash-repo-chores

- name: Warm up repository
uses: ./.github/actions/warm-up-repo
uses: $/.github/actions/warm-up-repo

- name: Create temp files and folders
run: mkdir -p var/logs
Expand Down Expand Up @@ -362,7 +362,7 @@ jobs:
mkdir -p logs
turbo run start --env-mode=loose --log-order stream >var/logs/head-background-task.log 2>&1 &
PID=$!
echo "pid=$PID" | tee -a $GITHUB_OUTPUT
echo "pid=$PID" | tee -a "$GITHUB_OUTPUT"

turbo run start:healthcheck --env-mode=loose

Expand All @@ -379,7 +379,7 @@ jobs:
if: github.event_name == 'pull_request'
run: |
TRIMMED_PACKAGE_NAME=$(echo "${{ matrix.name }}" | sed 's|@||g' | sed 's|/|.|g')
echo "TRIMMED_PACKAGE_NAME=$TRIMMED_PACKAGE_NAME" >> $GITHUB_ENV
echo "TRIMMED_PACKAGE_NAME=$TRIMMED_PACKAGE_NAME" >> "$GITHUB_ENV"
echo '<details><summary><h2>${{ matrix.name }} – Integrations</h2></summary>' > "/tmp/$TRIMMED_PACKAGE_NAME.md"
echo >> "/tmp/$TRIMMED_PACKAGE_NAME.md"
turbo run analyze-benchmarks -- --output "/tmp/benches.md" --artifacts-path "$(pwd)/${{ matrix.path }}/out" --enforce-flame-graph
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/canary-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,15 +14,15 @@ jobs:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Install tools
uses: ./.github/actions/install-tools
uses: $/.github/actions/install-tools
with:
token: ${{ secrets.GITHUB_TOKEN }}
vault_address: ${{ vars.VAULT_STAGE_ADDR }}
cf_access_client_id: ${{ vars.CF_ACCESS_STAGE_CLIENT_ID }}
cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }}

- name: Warm up repository
uses: ./.github/actions/warm-up-repo
uses: $/.github/actions/warm-up-repo

- name: Publish changesets to npm, with 'canary' tags
run: |
Expand All @@ -31,9 +31,9 @@ jobs:
git config user.email "support@hash.ai"
git config user.name "hashdotai"
git commit -am "temporarily convert changesets to canary releases"
git revert `git rev-parse HEAD` --no-edit
git revert "$(git rev-parse HEAD)" --no-edit
git push
git checkout `git rev-parse HEAD~1`
git checkout "$(git rev-parse HEAD~1)"

cat << EOF > "$HOME/.npmrc"
//registry.npmjs.org/:_authToken=$NPM_TOKEN
Expand Down
12 changes: 6 additions & 6 deletions .github/workflows/codspeed.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ jobs:
fetch-depth: 2

- name: Install tools
uses: ./.github/actions/install-tools
uses: $/.github/actions/install-tools
with:
token: ${{ secrets.GITHUB_TOKEN }}
vault_address: ${{ vars.VAULT_STAGE_ADDR }}
Expand All @@ -42,7 +42,7 @@ jobs:
PACKAGES=$(turbo query "$PACKAGES_QUERY" \
| jq --compact-output '.data.affectedPackages.items | [(.[] | select(.name != "//"))] | { name: [.[].name], include: . }')

echo "packages=$PACKAGES" | tee -a $GITHUB_OUTPUT
echo "packages=$PACKAGES" | tee -a "$GITHUB_OUTPUT"

benchmarks:
name: Run benchmarks
Expand All @@ -59,23 +59,23 @@ jobs:
fetch-depth: 2

- name: Clean up disk
uses: ./.github/actions/clean-up-disk
uses: $/.github/actions/clean-up-disk

- name: Install tools
uses: ./.github/actions/install-tools
uses: $/.github/actions/install-tools
with:
token: ${{ secrets.GITHUB_TOKEN }}
vault_address: ${{ vars.VAULT_STAGE_ADDR }}
cf_access_client_id: ${{ vars.CF_ACCESS_STAGE_CLIENT_ID }}
cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }}

- name: Prune repository
uses: ./.github/actions/prune-repository
uses: $/.github/actions/prune-repository
with:
scope: ${{ matrix.name }}

- name: Warm up repository
uses: ./.github/actions/warm-up-repo
uses: $/.github/actions/warm-up-repo

- name: Build the benchmark target
run: turbo run build:codspeed --filter=${{ matrix.name }}
Expand Down
28 changes: 14 additions & 14 deletions .github/workflows/deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ jobs:
fetch-depth: 2

- name: Install tools
uses: ./.github/actions/install-tools
uses: $/.github/actions/install-tools
with:
token: ${{ secrets.GITHUB_TOKEN }}
vault_address: ${{ vars.VAULT_STAGE_ADDR }}
Expand Down Expand Up @@ -84,7 +84,7 @@ jobs:
SOURCEMAPS_PACKAGES=$(turbo query "$SOURCEMAPS_QUERY" \
| jq --compact-output '.data.affectedPackages.items | [(.[] | select(.name != "//"))] | { name: [.[].name], include: . }')

echo "sourcemaps=$SOURCEMAPS_PACKAGES" | tee -a $GITHUB_OUTPUT
echo "sourcemaps=$SOURCEMAPS_PACKAGES" | tee -a "$GITHUB_OUTPUT"

CATALOG=$(jq -nc '[
{
Expand Down Expand Up @@ -226,10 +226,10 @@ jobs:
map(select(.push | index("ecr"))) | { service: [.[].service] }
' <<<"$AFFECTED_CATALOG")

echo "backend-images=$BUILD_MATRIX" | tee -a $GITHUB_OUTPUT
echo "backend-manifests=$MANIFEST_MATRIX" | tee -a $GITHUB_OUTPUT
echo "backend-deploys=$DEPLOY_MATRIX" | tee -a $GITHUB_OUTPUT
echo "backend-staging=$STAGING_MATRIX" | tee -a $GITHUB_OUTPUT
echo "backend-images=$BUILD_MATRIX" | tee -a "$GITHUB_OUTPUT"
echo "backend-manifests=$MANIFEST_MATRIX" | tee -a "$GITHUB_OUTPUT"
echo "backend-deploys=$DEPLOY_MATRIX" | tee -a "$GITHUB_OUTPUT"
echo "backend-staging=$STAGING_MATRIX" | tee -a "$GITHUB_OUTPUT"

sourcemaps:
name: Sourcemaps
Expand Down Expand Up @@ -276,20 +276,20 @@ jobs:
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

- name: Install tools
uses: ./.github/actions/install-tools
uses: $/.github/actions/install-tools
with:
token: ${{ secrets.GITHUB_TOKEN }}
vault_address: ${{ vars.VAULT_STAGE_ADDR }}
cf_access_client_id: ${{ vars.CF_ACCESS_STAGE_CLIENT_ID }}
cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }}

- name: Prune repository
uses: ./.github/actions/prune-repository
uses: $/.github/actions/prune-repository
with:
scope: ${{ matrix.name }}

- name: Warm up repository
uses: ./.github/actions/warm-up-repo
uses: $/.github/actions/warm-up-repo

- name: Log in to Sentry
run: sentry-cli login --auth-token ${{ steps.secrets.outputs.SENTRY_AUTH_TOKEN }}
Expand Down Expand Up @@ -388,7 +388,7 @@ jobs:

- name: Build${{ steps.targets.outputs.push == 'true' && ' and push' || '' }} ${{ matrix.service }} (${{ matrix.arch }})
id: build
uses: ./.github/actions/docker-build-push
uses: $/.github/actions/docker-build-push
with:
CONTEXT_PATH: ${{ github.workspace }}/${{ matrix.context }}
DOCKERFILE_LOCATION: ${{ github.workspace }}/${{ matrix.dockerfile }}
Expand Down Expand Up @@ -450,15 +450,15 @@ jobs:
aws-region: ${{ env.AWS_REGION }}

- name: Log in to ECR
uses: ./.github/actions/docker-ecr-login
uses: $/.github/actions/docker-ecr-login

- name: Set up Docker Buildx
uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1

# ECR images are single-arch (arm64). Advance :staging onto this commit's
# immutable sha tag only if it is newer than the one currently tagged.
- name: Advance :staging if newer
uses: ./.github/actions/tag-if-newer
uses: $/.github/actions/tag-if-newer
with:
image: ${{ env.AWS_ECR_ACCOUNT_ID }}.dkr.ecr.${{ env.AWS_REGION }}.amazonaws.com/${{ github.repository }}/${{ matrix.service }}
mutable-tag: staging
Expand Down Expand Up @@ -528,7 +528,7 @@ jobs:
# descends from, permanently blocking the guard from ever advancing it again.
- name: Advance :latest if newer
if: github.ref == 'refs/heads/main'
uses: ./.github/actions/tag-if-newer
uses: $/.github/actions/tag-if-newer
with:
image: ghcr.io/${{ github.repository_owner }}/hash/${{ matrix.service }}
mutable-tag: latest
Expand Down Expand Up @@ -561,7 +561,7 @@ jobs:
aws-region: ${{ env.AWS_REGION }}

- name: Redeploy ${{ matrix.service }} staging service
uses: ./.github/actions/redeploy-ecs-service
uses: $/.github/actions/redeploy-ecs-service
with:
ECS_CLUSTER_NAME: ${{ matrix.cluster }}
ECS_SERVICE_NAME: ${{ matrix.service_name }}
Expand Down
Loading
Loading