Build adev for preview deployment workflow (angular/angular)

The Build adev for preview deployment workflow from angular/angular, explained and optimized by Latchkey.

CI health: C - fair

Point runs-on at Latchkey and get run de-duplication, job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: angular/angular.github/workflows/adev-preview-build.ymlLicense MITView source

What it does

This is the Build adev for preview deployment workflow from the angular/angular repository, a real project running GitHub Actions. It is shown here with attribution under its MIT license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

# This workflow builds the previews for pull requests when a certain label is applied.
# The actual deployment happens as part of a dedicated second workflow to avoid security
# issues where the building would otherwise occur in an authorized context where secrets
# could be leaked. More details can be found here:

# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.

name: Build adev for preview deployment

on:
  pull_request:
    types: [synchronize, labeled]

permissions: read-all

jobs:
  adev-build:
    runs-on: ubuntu-latest-8core
    if: |
      (github.event.action == 'labeled' && github.event.label.name == 'adev: preview') ||
      (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'adev: preview'))
    steps:
      - name: Initialize environment
        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@442c2fcbf06a321b5196b4c5fc70e78a49242958
      - name: Setup Bazel
        uses: angular/dev-infra/github-actions/bazel/setup@442c2fcbf06a321b5196b4c5fc70e78a49242958
      - name: Setup Bazel RBE
        uses: angular/dev-infra/github-actions/bazel/configure-remote@442c2fcbf06a321b5196b4c5fc70e78a49242958
      - name: Install node modules
        run: pnpm install --frozen-lockfile
      - name: Build adev
        # `snapshot-build` config is used to stamp the exact version with sha in the footer.
        run: pnpm bazel build //adev:build.production --config=snapshot-build
      - uses: angular/dev-infra/github-actions/previews/pack-and-upload-artifact@442c2fcbf06a321b5196b4c5fc70e78a49242958
        with:
          workflow-artifact-name: 'adev-preview'
          pull-number: '${{github.event.pull_request.number}}'
          artifact-build-revision: '${{github.event.pull_request.head.sha}}'
          deploy-directory: './dist/bin/adev/dist/browser'

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

# This workflow builds the previews for pull requests when a certain label is applied.
# The actual deployment happens as part of a dedicated second workflow to avoid security
# issues where the building would otherwise occur in an authorized context where secrets
# could be leaked. More details can be found here:
 
# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.
 
name: Build adev for preview deployment
 
on:
  pull_request:
    types: [synchronize, labeled]
 
permissions: read-all
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  adev-build:
    timeout-minutes: 30
    runs-on: latchkey-small-8core
    if: |
      (github.event.action == 'labeled' && github.event.label.name == 'adev: preview') ||
      (github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'adev: preview'))
    steps:
      - name: Initialize environment
        uses: angular/dev-infra/github-actions/npm/checkout-and-setup-node@442c2fcbf06a321b5196b4c5fc70e78a49242958
      - name: Setup Bazel
        uses: angular/dev-infra/github-actions/bazel/setup@442c2fcbf06a321b5196b4c5fc70e78a49242958
      - name: Setup Bazel RBE
        uses: angular/dev-infra/github-actions/bazel/configure-remote@442c2fcbf06a321b5196b4c5fc70e78a49242958
      - name: Install node modules
        run: pnpm install --frozen-lockfile
      - name: Build adev
        # `snapshot-build` config is used to stamp the exact version with sha in the footer.
        run: pnpm bazel build //adev:build.production --config=snapshot-build
      - uses: angular/dev-infra/github-actions/previews/pack-and-upload-artifact@442c2fcbf06a321b5196b4c5fc70e78a49242958
        with:
          workflow-artifact-name: 'adev-preview'
          pull-number: '${{github.event.pull_request.number}}'
          artifact-build-revision: '${{github.event.pull_request.head.sha}}'
          deploy-directory: './dist/bin/adev/dist/browser'

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Cancel superseded runs when a branch or PR gets a newer push.
Add a job timeout so a hung step cannot burn hours of runner time.

What Latchkey heals here

This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:

Dependency installs

This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.