import-k8s-schemas workflow (cdk8s-team/cdk8s)
The import-k8s-schemas workflow from cdk8s-team/cdk8s, explained and optimized by Latchkey.
B
CI health: B - good
Point runs-on at Latchkey and get job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.
What it does
This is the import-k8s-schemas workflow from the cdk8s-team/cdk8s repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.
Below, Latchkey shows a faster, safer version produced by its optimization engine.
The workflow
workflow (.yml)
---
name: import-k8s-schemas
on:
schedule:
- cron: '0 10 * * 1' # Weekly on Monday
workflow_dispatch: {} # Allow manual trigger
jobs:
import:
runs-on: ubuntu-latest
permissions:
contents: write
pull-requests: write
steps:
- uses: actions/checkout@v5
- name: Check for new K8s version that are not imported yet
id: check
run: |
# Get latest stable release with .0 patch version (v1.xx.0 only)
# no prereleases - done with select(.prerelease == false)
# only major.minor.0 versions - done with select(endswith(".0"))
# only the first one (latest) - done with [0]
LATEST=$(curl -s \
https://api.github.com/repos/kubernetes/kubernetes/releases | \
jq -r '[.[] | select(.prerelease == false) | .tag_name | select(endswith(".0"))][0]' | \
sed 's/^v//')
echo "latest=$LATEST" >> $GITHUB_OUTPUT
# Check if we already have it
if [ -d "kubernetes-schemas/v${LATEST}" ]; then
echo "exists=true" >> $GITHUB_OUTPUT
else
echo "exists=false" >> $GITHUB_OUTPUT
fi
- name: Import schema
if: steps.check.outputs.exists == 'false'
run: |
VERSION=${{ steps.check.outputs.latest }}
bash tools/import-spec.sh "$VERSION"
- name: Set git identity
if: steps.check.outputs.exists == 'false'
run: |-
git config user.name "github-actions[bot]"
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
- name: Create PR
if: steps.check.outputs.exists == 'false'
uses: peter-evans/create-pull-request@v7
with:
token: ${{ secrets.PROJEN_GITHUB_TOKEN }}
commit-message: >-
chore: import Kubernetes
v${{ steps.check.outputs.latest }} schema
branch: >-
github-actions/k8s-schema-v${{ steps.check.outputs.latest }}
title: >-
chore: import Kubernetes
v${{ steps.check.outputs.latest }} schema
body: |
Import kubernetes schema for v${{ steps.check.outputs.latest }}. See details in [workflow run].
[Workflow Run]: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
------
*Automatically created via the "import-k8s-schemas" workflow*
labels: auto-approve
author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
signoff: true
The same workflow, on Latchkey
Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.
--- name: import-k8s-schemas on: schedule: - cron: '0 10 * * 1' # Weekly on Monday workflow_dispatch: {} # Allow manual trigger jobs: import: timeout-minutes: 30 runs-on: latchkey-small permissions: contents: write pull-requests: write steps: - uses: actions/checkout@v5 - name: Check for new K8s version that are not imported yet id: check run: | # Get latest stable release with .0 patch version (v1.xx.0 only) # no prereleases - done with select(.prerelease == false) # only major.minor.0 versions - done with select(endswith(".0")) # only the first one (latest) - done with [0] LATEST=$(curl -s \ https://api.github.com/repos/kubernetes/kubernetes/releases | \ jq -r '[.[] | select(.prerelease == false) | .tag_name | select(endswith(".0"))][0]' | \ sed 's/^v//') echo "latest=$LATEST" >> $GITHUB_OUTPUT # Check if we already have it if [ -d "kubernetes-schemas/v${LATEST}" ]; then echo "exists=true" >> $GITHUB_OUTPUT else echo "exists=false" >> $GITHUB_OUTPUT fi - name: Import schema if: steps.check.outputs.exists == 'false' run: | VERSION=${{ steps.check.outputs.latest }} bash tools/import-spec.sh "$VERSION" - name: Set git identity if: steps.check.outputs.exists == 'false' run: |- git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - name: Create PR if: steps.check.outputs.exists == 'false' uses: peter-evans/create-pull-request@v7 with: token: ${{ secrets.PROJEN_GITHUB_TOKEN }} commit-message: >- chore: import Kubernetes v${{ steps.check.outputs.latest }} schema branch: >- github-actions/k8s-schema-v${{ steps.check.outputs.latest }} title: >- chore: import Kubernetes v${{ steps.check.outputs.latest }} schema body: | Import kubernetes schema for v${{ steps.check.outputs.latest }}. See details in [workflow run]. [Workflow Run]: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} ------ *Automatically created via the "import-k8s-schemas" workflow* labels: auto-approve author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> committer: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> signoff: true
What changed
- Run on Latchkey managed runners with one line (
runs-on), which apply the fixes below automatically and self-heal transient failures. This example useslatchkey-small; pick the runner size that fits the job. - Add a job timeout so a hung step cannot burn hours of runner time.
1 third-party action is referenced by a movable tag. Pin it to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.
This workflow runs 1 job per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.