Build workflow (grafana/alloy)

The Build workflow from grafana/alloy, explained and optimized by Latchkey.

Source: grafana/alloy.github/workflows/build.ymlLicense Apache-2.0View source

A: CI health grade
85/100: Health score
5: Jobs per trigger
1: Fix in the optimized version

In short

CI health: A (excellent)
The optimized version below adds job timeouts.

What it does

This is the Build workflow from the grafana/alloy repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: Build
on:
  pull_request:
concurrency:
  # Cancel any running workflow for the same branch when new commits are pushed.
  # We group both by ref_name (available when CI is triggered by a push to a branch/tag)
  # and head_ref (available when CI is triggered by a PR).
  group: "${{ github.ref_name }}-${{ github.head_ref }}"
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build_linux:
    name: Build on Linux
    runs-on: github-hosted-ubuntu-x64-large
    container: grafana/alloy-build-image:v0.1.34@sha256:4371598809230ffd7611367ba0dcb92bbc8b74bda88471293e5d478b48a0d186
    strategy:
      matrix:
        os: [linux]
        arch: [amd64, arm64, ppc64le, s390x]
    steps:
    - name: Checkout code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        persist-credentials: false
    - name: Set ownership
      # https://github.com/actions/runner/issues/2033#issuecomment-1204205989
      run: |
          # this is to fix GIT not liking owner of the checkout dir
          chown -R $(id -u):$(id -g) $PWD
    - run: GO_TAGS="embedalloyui promtail_journal_enabled" GOOS=${{ matrix.os }} GOARCH=${{ matrix.arch }} GOARM= make alloy

  build_linux_boringcrypto:
    name: Build on Linux (boringcrypto)
    runs-on: github-hosted-ubuntu-x64-large
    container: grafana/alloy-build-image:v0.1.34@sha256:4371598809230ffd7611367ba0dcb92bbc8b74bda88471293e5d478b48a0d186
    strategy:
      matrix:
        os: [linux]
        arch: [amd64, arm64]
    steps:
    - name: Checkout code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        persist-credentials: false
    - name: Set ownership
      # https://github.com/actions/runner/issues/2033#issuecomment-1204205989
      run: |
          # this is to fix GIT not liking owner of the checkout dir
          chown -R $(id -u):$(id -g) $PWD
    - run: GO_TAGS="embedalloyui promtail_journal_enabled" GOOS=${{ matrix.os }} GOARCH=${{ matrix.arch }} GOARM= GOEXPERIMENT=boringcrypto make alloy

  build_mac:
    name: Build on MacOS
    runs-on: macos-15-xlarge
    steps:
    - name: Checkout code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        persist-credentials: false
    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version-file: go.mod
        cache: false
    - name: Build native arm64
      run: CGO_LDFLAGS="-ld_classic $CGO_LDFLAGS" GO_TAGS="embedalloyui" GOOS=darwin GOARCH=arm64 GOARM= make alloy
    - name: Cross-compile amd64
      run: GO_TAGS="embedalloyui" GOOS=darwin GOARCH=amd64 GOARM= SKIP_UI_BUILD=1 make alloy

  build_windows:
    name: Build on Windows (AMD64)
    runs-on: windows-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        persist-credentials: false
    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version-file: go.mod
        # cache: true is only net-positive on Windows (~9 min savings on warm runs).
        # Other runners either suffer cache restore overhead exceeding savings, or
        # are subject to LRU eviction in the repo's contested cache storage.
        cache: true
    - run: echo "GO_TAGS=embedalloyui" | Out-File -FilePath $env:GITHUB_ENV -Append
    - run: echo "GOOS=windows" | Out-File -FilePath $env:GITHUB_ENV -Append
    - run: echo "GOARCH=amd64" | Out-File -FilePath $env:GITHUB_ENV -Append
    - run: make alloy

  build_freebsd:
    name: Build on FreeBSD (AMD64)
    runs-on: github-hosted-ubuntu-x64-large
    container: grafana/alloy-build-image:v0.1.34@sha256:4371598809230ffd7611367ba0dcb92bbc8b74bda88471293e5d478b48a0d186
    steps:
    - name: Checkout code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
          persist-credentials: false
    - name: Set ownership
      # https://github.com/actions/runner/issues/2033#issuecomment-1204205989
      run: |
          # this is to fix GIT not liking owner of the checkout dir
          chown -R $(id -u):$(id -g) $PWD
    - run: GO_TAGS="embedalloyui" GOOS=freebsd GOARCH=amd64 GOARM= make alloy

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

workflow (.yml), optimized

name: Build
on:
  pull_request:
concurrency:
  # Cancel any running workflow for the same branch when new commits are pushed.
  # We group both by ref_name (available when CI is triggered by a push to a branch/tag)
  # and head_ref (available when CI is triggered by a PR).
  group: "${{ github.ref_name }}-${{ github.head_ref }}"
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  build_linux:
    timeout-minutes: 30
    name: Build on Linux
    runs-on: github-hosted-ubuntu-x64-large
    container: grafana/alloy-build-image:v0.1.34@sha256:4371598809230ffd7611367ba0dcb92bbc8b74bda88471293e5d478b48a0d186
    strategy:
      matrix:
        os: [linux]
        arch: [amd64, arm64, ppc64le, s390x]
    steps:
    - name: Checkout code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        persist-credentials: false
    - name: Set ownership
      # https://github.com/actions/runner/issues/2033#issuecomment-1204205989
      run: |
          # this is to fix GIT not liking owner of the checkout dir
          chown -R $(id -u):$(id -g) $PWD
    - run: GO_TAGS="embedalloyui promtail_journal_enabled" GOOS=${{ matrix.os }} GOARCH=${{ matrix.arch }} GOARM= make alloy

  build_linux_boringcrypto:
    timeout-minutes: 30
    name: Build on Linux (boringcrypto)
    runs-on: github-hosted-ubuntu-x64-large
    container: grafana/alloy-build-image:v0.1.34@sha256:4371598809230ffd7611367ba0dcb92bbc8b74bda88471293e5d478b48a0d186
    strategy:
      matrix:
        os: [linux]
        arch: [amd64, arm64]
    steps:
    - name: Checkout code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        persist-credentials: false
    - name: Set ownership
      # https://github.com/actions/runner/issues/2033#issuecomment-1204205989
      run: |
          # this is to fix GIT not liking owner of the checkout dir
          chown -R $(id -u):$(id -g) $PWD
    - run: GO_TAGS="embedalloyui promtail_journal_enabled" GOOS=${{ matrix.os }} GOARCH=${{ matrix.arch }} GOARM= GOEXPERIMENT=boringcrypto make alloy

  build_mac:
    timeout-minutes: 30
    name: Build on MacOS
    runs-on: macos-15-xlarge
    steps:
    - name: Checkout code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        persist-credentials: false
    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version-file: go.mod
        cache: false
    - name: Build native arm64
      run: CGO_LDFLAGS="-ld_classic $CGO_LDFLAGS" GO_TAGS="embedalloyui" GOOS=darwin GOARCH=arm64 GOARM= make alloy
    - name: Cross-compile amd64
      run: GO_TAGS="embedalloyui" GOOS=darwin GOARCH=amd64 GOARM= SKIP_UI_BUILD=1 make alloy

  build_windows:
    timeout-minutes: 30
    name: Build on Windows (AMD64)
    runs-on: windows-latest
    steps:
    - name: Checkout code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
        persist-credentials: false
    - name: Set up Go
      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
      with:
        go-version-file: go.mod
        # cache: true is only net-positive on Windows (~9 min savings on warm runs).
        # Other runners either suffer cache restore overhead exceeding savings, or
        # are subject to LRU eviction in the repo's contested cache storage.
        cache: true
    - run: echo "GO_TAGS=embedalloyui" | Out-File -FilePath $env:GITHUB_ENV -Append
    - run: echo "GOOS=windows" | Out-File -FilePath $env:GITHUB_ENV -Append
    - run: echo "GOARCH=amd64" | Out-File -FilePath $env:GITHUB_ENV -Append
    - run: make alloy

  build_freebsd:
    timeout-minutes: 30
    name: Build on FreeBSD (AMD64)
    runs-on: github-hosted-ubuntu-x64-large
    container: grafana/alloy-build-image:v0.1.34@sha256:4371598809230ffd7611367ba0dcb92bbc8b74bda88471293e5d478b48a0d186
    steps:
    - name: Checkout code
      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
      with:
          persist-credentials: false
    - name: Set ownership
      # https://github.com/actions/runner/issues/2033#issuecomment-1204205989
      run: |
          # this is to fix GIT not liking owner of the checkout dir
          chown -R $(id -u):$(id -g) $PWD
    - run: GO_TAGS="embedalloyui" GOOS=freebsd GOARCH=amd64 GOARM= make alloy

What changed

Add a job timeout so a hung step cannot burn hours of runner time.

This workflow runs 5 jobs (9 with the matrix expanded) per trigger. 2 of the 9 run on macOS and Windows, which Latchkey does not offer, so those stay where they are. Grade your own workflow to price the jobs you run.

Actions used in this workflow

actions/checkout
actions/setup-go

Frequently asked questions

What does the Build workflow (grafana/alloy) workflow do?

This is the Build workflow from the grafana/alloy repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

What CI health grade does this workflow get?

This Go workflow grades A. Paste your own workflow into the Latchkey grader to see its grade and the exact fixes.

How can I improve this Go workflow?

Add job timeouts. Latchkey applies these automatically on managed runners when you point runs-on at Latchkey.