Actions CI workflow (airbnb/streamalert)

C

CI health grade

69/100

Health score

1

Job per trigger

3

Fixes in the optimized version

What it does

This is the Actions CI workflow from the airbnb/streamalert repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

name: Actions CI
on:
  pull_request: {}
  push:
    branches:
      - master
      - release-3-2-0
    tags:
      - 'v*.*.*'

jobs:
  testing:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        python:
          - 3.7
        task:
          - name: Lint
            command: |
              ./tests/scripts/pylint.sh
          - name: Test
            command: |
              ./tests/scripts/unit_tests.sh
              ./manage.py test rules
              ./manage.py test classifier
          - name: Docs
            command: |
              sphinx-build -W docs/source docs/build
          - name: Bandit
            command: |
              bandit --ini setup.cfg -r .
    name: "Python ${{ matrix.python }}/${{ matrix.task.name }}"
    steps:
      - uses: "actions/checkout@v2"
      - uses: "actions/setup-python@v1"
        with:
          python-version: ${{ matrix.python }}
      - name: Install requirements
        run: pip install -r requirements.txt
      - name: ${{ matrix.task.name }}
        run: ${{ matrix.task.command }}
      - name: Submit Coverage
        run: ([ -z "$COVERALLS_REPO_TOKEN" ] && echo "coveralls is skipped in forked repo tests" || coveralls)
        if: matrix.task.name == 'Test'
        env:
          COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: Actions CI
on:
  pull_request: {}
  push:
    branches:
      - master
      - release-3-2-0
    tags:
      - 'v*.*.*'

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  testing:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    runs-on: latchkey-small
    strategy:
      matrix:
        python:
          - 3.7
        task:
          - name: Lint
            command: |
              ./tests/scripts/pylint.sh
          - name: Test
            command: |
              ./tests/scripts/unit_tests.sh
              ./manage.py test rules
              ./manage.py test classifier
          - name: Docs
            command: |
              sphinx-build -W docs/source docs/build
          - name: Bandit
            command: |
              bandit --ini setup.cfg -r .
    name: "Python ${{ matrix.python }}/${{ matrix.task.name }}"
    steps:
      - uses: "actions/checkout@v2"
      - uses: "actions/setup-python@v1"
        with:
          python-version: ${{ matrix.python }}
      - name: Install requirements
        run: pip install -r requirements.txt
      - name: ${{ matrix.task.name }}
        run: ${{ matrix.task.command }}
      - name: Submit Coverage
        run: ([ -z "$COVERALLS_REPO_TOKEN" ] && echo "coveralls is skipped in forked repo tests" || coveralls)
        if: matrix.task.name == 'Test'
        env:
          COVERALLS_REPO_TOKEN: ${{ secrets.COVERALLS_REPO_TOKEN }}

What changed

1. Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. Each Linux x64 job moves to the Latchkey size matching its vCPU count, latchkey-small for a standard 2 vCPU runner; macOS, Windows and arm64 jobs stay as written.
2. Cancel superseded runs when a branch or PR gets a newer push.
3. Add a job timeout so a hung step cannot burn hours of runner time.

What Latchkey heals here

This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:

• Dependency installs

This workflow runs 1 job (4 with the matrix expanded) per trigger. All of them run on a standard GitHub-hosted Linux x64 runner, which in a private repository bills $0.006 a minute against $0.0025 on latchkey-small, 58% lower; in a public repository like this one they are free. Estimate the monthly difference with your own run counts.

Frequently asked questions

References

• GitHub Actions documentation