ci: Clean up workflows

.github/workflows/build-terraform-oci.yaml

@@ -1,33 +1,29 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 name: "Terraform: Build OCI artifacts"
 
-on: # yamllint disable-line rule:truthy
+on:
   workflow_dispatch:
   push:
     branches:
       - main
     paths:
-      - "infrastructure/terraform/**"
+      - .github/workflows/build-terraform-oci.yaml
+      - infrastructure/terraform/**
 
 jobs:
   changed-files:
     name: Generate matrix for building images
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
 
-      - name: Install Nix
-        uses: cachix/install-nix-action@v24
-        with:
-          github_access_token: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Switch to Nix devShell
-        uses: nicknovitski/[email protected]
-        with:
-          arguments: "./.ci"
+      - name: Install System Tools
+        shell: bash
+        run: sudo apt-get -qq update && sudo apt-get -qq install --no-install-recommends -y jo
 
       - name: Get changed files
         id: changed-files
@@ -53,21 +49,31 @@ jobs:
           fi
 
   publish:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     needs:
       - changed-files
     strategy:
       matrix: ${{ fromJSON(needs.changed-files.outputs.matrix) }}
     steps:
-      - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - name: Generate Token
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.BJWS_APP_ID }}
+          private-key: ${{ secrets.BJWS_APP_PRIVATE_KEY }}
 
-      - name: Set up Homebrew
-        uses: Homebrew/actions/setup-homebrew@master
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          token: ${{ steps.app-token.outputs.token }}
 
-      - name: Setup Tools
-        run: |
-          brew install fluxcd/tap/flux
+      - uses: jdx/rtx-action@v1
+        with:
+          install: true
+          cache: true
+          rtx_toml: |
+            [tools]
+            flux2 = "latest"
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
@@ -76,14 +82,18 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Generate tag
+        id: generate-tag
+        shell: bash
+        run: echo "tag=ghcr.io/${{ github.repository_owner }}/terraform/$(basename ${{ matrix.project }}):$(git rev-parse --short HEAD)" >> "${GITHUB_OUTPUT}"
+
       - name: Publish OCI
         run: |
-          flux push artifact "oci://ghcr.io/bjw-s/terraform/$(basename ${{ matrix.project }}):$(git rev-parse --short HEAD)" \
+          flux push artifact "oci://${{ steps.generate-tag.outputs.tag }}" \
             --path="./${{ matrix.project }}" \
             --source="$(git config --get remote.origin.url)" \
             --revision="$(git branch --show-current)/$(git rev-parse HEAD)"
 
       - name: Tag OCI
         run: |
-          flux tag artifact "oci://ghcr.io/bjw-s/terraform/$(basename ${{ matrix.project }}):$(git rev-parse --short HEAD)" \
-            --tag main
+          flux tag artifact "oci://${{ steps.generate-tag.outputs.tag }}" --tag main

.github/workflows/docs-publish.yaml

@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 name: "Docs: Release to GitHub pages"
 
 on:
@@ -7,28 +8,27 @@ on:
     branches:
       - main
     paths:
-      - ".github/workflows/docs-publish.yaml"
-      - "docs/**"
+      - .github/workflows/docs-publish.yaml
+      - docs/**
 
 jobs:
   release-docs:
     name: Release documentation
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
     steps:
-      - name: "Generate Short Lived OAuth App Token (ghs_*)"
-        uses: actions/create-github-app-token@v1.6.2
+      - name: Generate Token
+        uses: actions/create-github-app-token@v1
         id: app-token
         with:
-          app-id: "${{ secrets.BJWS_APP_ID }}"
-          private-key: "${{ secrets.BJWS_APP_PRIVATE_KEY }}"
+          app-id: ${{ secrets.BJWS_APP_ID }}
+          private-key: ${{ secrets.BJWS_APP_PRIVATE_KEY }}
 
       - name: Checkout main branch
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4
         with:
           token: ${{ steps.app-token.outputs.token }}
-          fetch-depth: 0
 
       - name: Build docs
         uses: docker://ghcr.io/bjw-s/mdbook:0.4.36@sha256:d86edc42a0d22e38f3d59d6cf517a9d93a7dbe8ec3ec80a114dfd7a99d9354cd

.github/workflows/flux-diff.yaml

@@ -1,4 +1,5 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 name: "Flux Diff"
 
 on:
@@ -7,20 +8,57 @@ on:
       - main
     paths:
       - .github/workflows/flux-diff.yaml
-      - kubernetes/**.yaml
+      - kubernetes/**
+
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
 
 jobs:
+  changed-files:
+    name: Get Changed Files
+    runs-on: ubuntu-latest
+    outputs:
+      matrix: ${{ steps.changed-files.outputs.all_changed_and_modified_files }}
+    steps:
+      - name: Generate Token
+        uses: actions/create-github-app-token@v1
+        id: app-token
+        with:
+          app-id: ${{ secrets.BJWS_APP_ID }}
+          private-key: ${{ secrets.BJWS_APP_PRIVATE_KEY }}
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          token: "${{ steps.app-token.outputs.token }}"
+          fetch-depth: 0
+
+      - name: Get changed files
+        id: changed-files
+        uses: tj-actions/changed-files@v40
+        with:
+          files: kubernetes/**
+          dir_names: true
+          dir_names_max_depth: 2
+          json: true
+          quotepath: false
+          escape_json: false
+
+      - name: List all changed files
+        run: echo "${{ steps.changed-files.outputs.all_changed_and_modified_files }}"
+
   flux-diff:
     name: Flux Diff
     runs-on: ubuntu-latest
+    needs:
+      - changed-files
     permissions:
       pull-requests: write
     strategy:
       matrix:
-        path:
-          - kubernetes/main
-          - kubernetes/nas
-        resource:
+        paths: ${{ fromJSON(needs.changed-files.outputs.matrix) }}
+        resources:
           - helmrelease
           - kustomization
     steps:
@@ -31,22 +69,45 @@ jobs:
           app-id: ${{ secrets.BJWS_APP_ID }}
           private-key: ${{ secrets.BJWS_APP_PRIVATE_KEY }}
 
+      - uses: jdx/rtx-action@v1
+        with:
+          install: true
+          cache: true
+          rtx_toml: |
+            [tools]
+            flux2 = "latest"
+
       - name: Diff Resources
         uses: allenporter/flux-local/action/[email protected]
         id: diff
         with:
           sources: home-ops-kubernetes
-          path: "${{ matrix.path }}"
-          resource: "${{ matrix.resource }}"
+          path: "${{ matrix.paths }}"
+          resource: "${{ matrix.resources }}"
 
       - if: ${{ steps.diff.outputs.diff != '' }}
         name: Add comment
         uses: mshick/[email protected]
         with:
           repo-token: "${{ steps.app-token.outputs.token }}"
-          message-id: "${{ github.event.pull_request.number }}/${{ matrix.path }}/${{ matrix.resource }}"
+          message-id: "${{ github.event.pull_request.number }}/${{ matrix.paths }}/${{ matrix.resources }}"
           message-failure: Diff was not successful
           message: |
             ```diff
             ${{ steps.diff.outputs.diff }}
             ```
+
+  flux-diff-success:
+    needs:
+      - flux-diff
+    if: ${{ always() }}
+    name: Flux Diff successful
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check matrix status
+        if: >-
+          ${{
+               contains(needs.*.result, 'failure')
+            || contains(needs.*.result, 'cancelled')
+          }}
+        run: exit 1

.github/workflows/flux-hr-image-test.yaml

@@ -10,6 +10,10 @@ on:
       - .github/workflows/flux-hr-image-test.yaml
       - kubernetes/**/helmrelease.yaml
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
   changed-files:
     name: Get Changed Files
@@ -88,7 +92,6 @@ jobs:
       - name: Test Images from Helm Release
         run: docker pull ${{ matrix.images }}
 
-  # Summarize matrix https://github.community/t/status-check-for-a-matrix-jobs/127354/7
   test-images-success:
     needs:
       - test-images

.github/workflows/flux-ks-sync.yaml

@@ -12,6 +12,10 @@ on:
       - kubernetes/main/**
       - kubernetes/nas/**
 
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
   sync:
     name: Flux Kustomization Sync
@@ -36,20 +40,13 @@ jobs:
         with:
           token: "${{ steps.app-token.outputs.token }}"
 
-      - name: Install OS Deps
-        shell: bash
-        run: |
-          sudo apt-get update && sudo apt-get install -y curl git xz-utils
-
-      - name: Install Nix
-        uses: cachix/install-nix-action@v24
-        with:
-          github_access_token: "${{ steps.app-token.outputs.token }}"
-
-      - name: Switch to Nix devShell
-        uses: nicknovitski/[email protected]
+      - uses: jdx/rtx-action@v1
         with:
-          arguments: "./.ci"
+          install: true
+          cache: true
+          rtx_toml: |
+            [tools]
+            flux2 = "latest"
 
       - name: Write kubeconfig
         id: kubeconfig

.github/workflows/lint.yaml

@@ -1,7 +1,8 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 name: Lint
 
-on: # yamllint disable-line rule:truthy
+on:
   workflow_dispatch:
   pull_request:
     branches:
@@ -17,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+        uses: actions/checkout@v4
         with:
           fetch-depth: 0
 

.github/workflows/meta-enforce-labels.yaml

@@ -1,9 +1,12 @@
 ---
+# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
 name: Meta - Enforce PR labels
 
-on: # yamllint disable-line rule:truthy
+on:
   pull_request:
-    types: [labeled, unlabeled, opened, edited, synchronize]
+    types:
+      - labeled
+      - unlabeled
 
 jobs:
   enforce-label: