push workflow (netbox-community/netbox-docker)

The push workflow from netbox-community/netbox-docker, explained and optimized by Latchkey.

CI health: B - good

Point runs-on at Latchkey and get job timeouts, SHA-pinned actions, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: netbox-community/netbox-docker.github/workflows/push.ymlLicense Apache-2.0View source

What it does

This is the push workflow from the netbox-community/netbox-docker repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

---
name: push

on:
  push:
    branches-ignore:
      - release
      - renovate/**
  pull_request:
    branches-ignore:
      - release

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  lint:
    runs-on: ubuntu-24.04
    name: Checks syntax of our code
    permissions:
      # contents permission to clone the repository
      contents: read
      packages: read
      # issues and pull-requests permissions to write results as pull
      # request comments. Omit them if you don't need summary comments
      issues: write
      pull-requests: write
      # To report GitHub Actions status checks. Omit if you don't need
      # to update commit status
      statuses: write
    steps:
      - uses: actions/checkout@v6
        with:
          # Full git history is needed to get a proper
          # list of changed files within `super-linter`
          fetch-depth: 0
      - name: Lint Code Base
        uses: super-linter/super-linter@v8
        env:
          DEFAULT_BRANCH: develop
          DOCKERFILE_HADOLINT_FILE_NAME: .hadolint.yaml
          EDITORCONFIG_FILE_NAME: .editorconfig-checker.json
          FILTER_REGEX_EXCLUDE: (.*/)?(LICENSE|configuration/.*)
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          LINTER_RULES_PATH: /
          MARKDOWN_CONFIG_FILE: .markdown-lint.yml
          PYTHON_RUFF_CONFIG_FILE: ruff.toml
          PYTHON_RUFF_FORMAT_CONFIG_FILE: ruff.toml
          SAVE_SUPER_LINTER_SUMMARY: true
          SUPPRESS_POSSUM: true
          YAML_CONFIG_FILE: .yamllint.yaml

          VALIDATE_ALL_CODEBASE: false
          VALIDATE_BIOME_FORMAT: false
          VALIDATE_CHECKOV: false
          VALIDATE_DOCKERFILE: false
          VALIDATE_GITHUB_ACTIONS_ZIZMOR: false
          VALIDATE_GITLEAKS: false
          VALIDATE_JSCPD: false
          VALIDATE_PYTHON_BLACK: false
          VALIDATE_PYTHON_FLAKE8: false
          VALIDATE_PYTHON_ISORT: false
          VALIDATE_PYTHON_MYPY: false
          VALIDATE_PYTHON_PYLINT: false
          VALIDATE_TRIVY: false

  build:
    continue-on-error: ${{ matrix.build_cmd != './build-latest.sh' }}
    strategy:
      matrix:
        build_cmd:
          - ./build-latest.sh
          - PRERELEASE=true ./build-latest.sh
          - ./build.sh feature
          - ./build.sh main
        os:
          - ubuntu-24.04
          - ubuntu-24.04-arm
      fail-fast: false
    env:
      GH_ACTION: enable
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      IMAGE_NAMES: docker.io/netboxcommunity/netbox
    runs-on: ${{ matrix.os }}
    name: Builds new NetBox Docker Images
    steps:
      - id: git-checkout
        name: Checkout
        uses: actions/checkout@v6
      - id: buildx-setup
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - id: arm-install-skopeo
        name: Install 'skopeo' on ARM64
        if: matrix.os == 'ubuntu-24.04-arm'
        run: |
          sudo apt-get install -y skopeo
      - id: arm-buildx-platform
        name: Set BUILDX_PLATFORM to ARM64
        if: matrix.os == 'ubuntu-24.04-arm'
        run: |
          echo "BUILDX_PLATFORM=linux/arm64" >>"${GITHUB_ENV}"
      - id: docker-build
        name: Build the image for '${{ matrix.os }}' with '${{ matrix.build_cmd }}'
        run: ${{ matrix.build_cmd }}
        env:
          BUILDX_BUILDER_NAME: ${{ steps.buildx-setup.outputs.name }}
      - id: arm-time-limit
        name: Set Netbox container start_period higher on ARM64
        if: matrix.os == 'ubuntu-24.04-arm'
        run: |
          echo "NETBOX_START_PERIOD=240s" >>"${GITHUB_ENV}"
      - id: docker-test
        name: Test the image
        run: IMAGE="${FINAL_DOCKER_TAG}" ./test.sh
        if: steps.docker-build.outputs.skipped != 'true'

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

---
name: push
 
on:
  push:
    branches-ignore:
      - release
      - renovate/**
  pull_request:
    branches-ignore:
      - release
 
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true
 
jobs:
  lint:
    timeout-minutes: 30
    runs-on: latchkey-small
    name: Checks syntax of our code
    permissions:
      # contents permission to clone the repository
      contents: read
      packages: read
      # issues and pull-requests permissions to write results as pull
      # request comments. Omit them if you don't need summary comments
      issues: write
      pull-requests: write
      # To report GitHub Actions status checks. Omit if you don't need
      # to update commit status
      statuses: write
    steps:
      - uses: actions/checkout@v6
        with:
          # Full git history is needed to get a proper
          # list of changed files within `super-linter`
          fetch-depth: 0
      - name: Lint Code Base
        uses: super-linter/super-linter@v8
        env:
          DEFAULT_BRANCH: develop
          DOCKERFILE_HADOLINT_FILE_NAME: .hadolint.yaml
          EDITORCONFIG_FILE_NAME: .editorconfig-checker.json
          FILTER_REGEX_EXCLUDE: (.*/)?(LICENSE|configuration/.*)
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          LINTER_RULES_PATH: /
          MARKDOWN_CONFIG_FILE: .markdown-lint.yml
          PYTHON_RUFF_CONFIG_FILE: ruff.toml
          PYTHON_RUFF_FORMAT_CONFIG_FILE: ruff.toml
          SAVE_SUPER_LINTER_SUMMARY: true
          SUPPRESS_POSSUM: true
          YAML_CONFIG_FILE: .yamllint.yaml
 
          VALIDATE_ALL_CODEBASE: false
          VALIDATE_BIOME_FORMAT: false
          VALIDATE_CHECKOV: false
          VALIDATE_DOCKERFILE: false
          VALIDATE_GITHUB_ACTIONS_ZIZMOR: false
          VALIDATE_GITLEAKS: false
          VALIDATE_JSCPD: false
          VALIDATE_PYTHON_BLACK: false
          VALIDATE_PYTHON_FLAKE8: false
          VALIDATE_PYTHON_ISORT: false
          VALIDATE_PYTHON_MYPY: false
          VALIDATE_PYTHON_PYLINT: false
          VALIDATE_TRIVY: false
 
  build:
    timeout-minutes: 30
    continue-on-error: ${{ matrix.build_cmd != './build-latest.sh' }}
    strategy:
      matrix:
        build_cmd:
          - ./build-latest.sh
          - PRERELEASE=true ./build-latest.sh
          - ./build.sh feature
          - ./build.sh main
        os:
          - ubuntu-24.04
          - ubuntu-24.04-arm
      fail-fast: false
    env:
      GH_ACTION: enable
      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      IMAGE_NAMES: docker.io/netboxcommunity/netbox
    runs-on: ${{ matrix.os }}
    name: Builds new NetBox Docker Images
    steps:
      - id: git-checkout
        name: Checkout
        uses: actions/checkout@v6
      - id: buildx-setup
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v4
      - id: arm-install-skopeo
        name: Install 'skopeo' on ARM64
        if: matrix.os == 'ubuntu-24.04-arm'
        run: |
          sudo apt-get install -y skopeo
      - id: arm-buildx-platform
        name: Set BUILDX_PLATFORM to ARM64
        if: matrix.os == 'ubuntu-24.04-arm'
        run: |
          echo "BUILDX_PLATFORM=linux/arm64" >>"${GITHUB_ENV}"
      - id: docker-build
        name: Build the image for '${{ matrix.os }}' with '${{ matrix.build_cmd }}'
        run: ${{ matrix.build_cmd }}
        env:
          BUILDX_BUILDER_NAME: ${{ steps.buildx-setup.outputs.name }}
      - id: arm-time-limit
        name: Set Netbox container start_period higher on ARM64
        if: matrix.os == 'ubuntu-24.04-arm'
        run: |
          echo "NETBOX_START_PERIOD=240s" >>"${GITHUB_ENV}"
      - id: docker-test
        name: Test the image
        run: IMAGE="${FINAL_DOCKER_TAG}" ./test.sh
        if: steps.docker-build.outputs.skipped != 'true'

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Add a job timeout so a hung step cannot burn hours of runner time.

2 third-party actions are referenced by a movable tag. Pin them to the commit SHA (Latchkey resolves and applies this automatically) so a repointed tag cannot change what runs.

What Latchkey heals here

This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:

Dependency installs
Container pulls and builds

This workflow runs 2 jobs (9 with the matrix expanded) per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/checkout super-linter/super-linter docker/setup-buildx-action