CI workflow (prometheus/pushgateway)

The CI workflow from prometheus/pushgateway, explained and optimized by Latchkey.

CI health: C - fair

Point runs-on at Latchkey and get run de-duplication, job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: prometheus/pushgateway.github/workflows/ci.ymlLicense Apache-2.0View source

What it does

This is the CI workflow from the prometheus/pushgateway repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

---
name: CI
on:
  pull_request:
  push:
    branches: [master, 'release-*']
    tags: ['v*']

permissions:
  contents: read

jobs:
  test_go:
    name: Go tests
    runs-on: ubuntu-latest
    container:
      # Whenever the Go version is updated here, .promu.yml
      # should also be updated.
      image: quay.io/prometheus/golang-builder:1.26-base
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: prometheus/promci-setup@5af30ba8c199a91d6c04ebdc3c48e630e355f62d # v0.1.0
      - run: make

  build:
    name: Build Prometheus for common architectures
    runs-on: ubuntu-latest
    if: |
      !(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v'))
      &&
      !(github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release-'))
      &&
      !(github.event_name == 'push' && github.event.ref == 'refs/heads/main')
      &&
      !(github.event_name == 'push' && github.event.ref == 'refs/heads/master')
    strategy:
      matrix:
        thread: [ 0, 1, 2 ]
    steps:
      - uses: prometheus/promci/build@d9d4f5688814f0b77bf003d07fb8c00507390634 # v0.8.2
        with:
          promu_opts: "-p linux/amd64 -p windows/amd64 -p linux/arm64 -p darwin/amd64 -p darwin/arm64 -p linux/386"
          parallelism: 3
          thread: ${{ matrix.thread }}

  build_all:
    name: Build Prometheus for all architectures
    runs-on: ubuntu-latest
    if: |
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v'))
      ||
      (github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release-'))
      ||
      (github.event_name == 'push' && github.event.ref == 'refs/heads/main')
      ||
      (github.event_name == 'push' && github.event.ref == 'refs/heads/master')
    strategy:
      matrix:
        thread: [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 ]

    steps:
      - uses: prometheus/promci/build@d9d4f5688814f0b77bf003d07fb8c00507390634 # v0.8.2
        with:
          parallelism: 12
          thread: ${{ matrix.thread }}

  publish_master:
    # https://github.com/prometheus/promci/blob/52c7012f5f0070d7281b8db4a119e21341d43c91/actions/publish_main/action.yml
    name: Publish master branch artifacts
    runs-on: ubuntu-latest
    permissions:
      packages: write
    needs: [test_go, build_all]
    if: |
      (github.event_name == 'push' && github.event.ref == 'refs/heads/main')
      ||
      (github.event_name == 'push' && github.event.ref == 'refs/heads/master')
    steps:
      - uses: prometheus/promci/publish_main@d9d4f5688814f0b77bf003d07fb8c00507390634 # v0.8.2
        with:
          docker_hub_login: ${{ secrets.docker_hub_login }}
          docker_hub_password: ${{ secrets.docker_hub_password }}
          ghcr_io_password: ${{ github.token }}
          quay_io_login: ${{ secrets.quay_io_login }}
          quay_io_password: ${{ secrets.quay_io_password }}

  publish_release:
    name: Publish release artefacts
    runs-on: ubuntu-latest
    permissions:
      contents: write
      packages: write
    needs: [test_go, build_all]
    if: |
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v'))
    steps:
      - uses: prometheus/promci/publish_release@d9d4f5688814f0b77bf003d07fb8c00507390634 # v0.8.2
        with:
          docker_hub_login: ${{ secrets.docker_hub_login }}
          docker_hub_password: ${{ secrets.docker_hub_password }}
          ghcr_io_password: ${{ github.token }}
          quay_io_login: ${{ secrets.quay_io_login }}
          quay_io_password: ${{ secrets.quay_io_password }}
          github_token: ${{ github.token }}

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

---
name: CI
on:
  pull_request:
  push:
    branches: [master, 'release-*']
    tags: ['v*']
 
permissions:
  contents: read
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  test_go:
    timeout-minutes: 30
    name: Go tests
    runs-on: latchkey-small
    container:
      # Whenever the Go version is updated here, .promu.yml
      # should also be updated.
      image: quay.io/prometheus/golang-builder:1.26-base
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - uses: prometheus/promci-setup@5af30ba8c199a91d6c04ebdc3c48e630e355f62d # v0.1.0
      - run: make
 
  build:
    timeout-minutes: 30
    name: Build Prometheus for common architectures
    runs-on: latchkey-small
    if: |
      !(github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v'))
      &&
      !(github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release-'))
      &&
      !(github.event_name == 'push' && github.event.ref == 'refs/heads/main')
      &&
      !(github.event_name == 'push' && github.event.ref == 'refs/heads/master')
    strategy:
      matrix:
        thread: [ 0, 1, 2 ]
    steps:
      - uses: prometheus/promci/build@d9d4f5688814f0b77bf003d07fb8c00507390634 # v0.8.2
        with:
          promu_opts: "-p linux/amd64 -p windows/amd64 -p linux/arm64 -p darwin/amd64 -p darwin/arm64 -p linux/386"
          parallelism: 3
          thread: ${{ matrix.thread }}
 
  build_all:
    timeout-minutes: 30
    name: Build Prometheus for all architectures
    runs-on: latchkey-small
    if: |
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v'))
      ||
      (github.event_name == 'pull_request' && startsWith(github.event.pull_request.base.ref, 'release-'))
      ||
      (github.event_name == 'push' && github.event.ref == 'refs/heads/main')
      ||
      (github.event_name == 'push' && github.event.ref == 'refs/heads/master')
    strategy:
      matrix:
        thread: [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 ]
 
    steps:
      - uses: prometheus/promci/build@d9d4f5688814f0b77bf003d07fb8c00507390634 # v0.8.2
        with:
          parallelism: 12
          thread: ${{ matrix.thread }}
 
  publish_master:
    timeout-minutes: 30
    # https://github.com/prometheus/promci/blob/52c7012f5f0070d7281b8db4a119e21341d43c91/actions/publish_main/action.yml
    name: Publish master branch artifacts
    runs-on: latchkey-small
    permissions:
      packages: write
    needs: [test_go, build_all]
    if: |
      (github.event_name == 'push' && github.event.ref == 'refs/heads/main')
      ||
      (github.event_name == 'push' && github.event.ref == 'refs/heads/master')
    steps:
      - uses: prometheus/promci/publish_main@d9d4f5688814f0b77bf003d07fb8c00507390634 # v0.8.2
        with:
          docker_hub_login: ${{ secrets.docker_hub_login }}
          docker_hub_password: ${{ secrets.docker_hub_password }}
          ghcr_io_password: ${{ github.token }}
          quay_io_login: ${{ secrets.quay_io_login }}
          quay_io_password: ${{ secrets.quay_io_password }}
 
  publish_release:
    timeout-minutes: 30
    name: Publish release artefacts
    runs-on: latchkey-small
    permissions:
      contents: write
      packages: write
    needs: [test_go, build_all]
    if: |
      (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v'))
    steps:
      - uses: prometheus/promci/publish_release@d9d4f5688814f0b77bf003d07fb8c00507390634 # v0.8.2
        with:
          docker_hub_login: ${{ secrets.docker_hub_login }}
          docker_hub_password: ${{ secrets.docker_hub_password }}
          ghcr_io_password: ${{ github.token }}
          quay_io_login: ${{ secrets.quay_io_login }}
          quay_io_password: ${{ secrets.quay_io_password }}
          github_token: ${{ github.token }}

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Cancel superseded runs when a branch or PR gets a newer push.
Add a job timeout so a hung step cannot burn hours of runner time.

This workflow runs 5 jobs (18 with the matrix expanded) per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.

Actions used in this workflow

actions/checkout