Skip to content
Latchkey

Nightly CI workflow (quay/quay)

The Nightly CI workflow from quay/quay, explained and optimized by Latchkey.

A

CI health: A - excellent

Point runs-on at Latchkey and get job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →
Source: quay/quay.github/workflows/CI-nightly.yamlLicense Apache-2.0View source

What it does

This is the Nightly CI workflow from the quay/quay repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)
name: Nightly CI
on:
  schedule:
    - cron: '30 5 * * *'
  workflow_dispatch:
    inputs: {}

permissions:
  contents: read

jobs:
  unit:
    if: github.repository == 'quay/quay'
    name: Run all Test
    runs-on: ubuntu-22.04
    env:
      ZVSI_FP_NAME: ${{ vars.IBMZ_ZVSI_FP_NAME }}
      ZVSI_INSTANCE_NAME: ${{ vars.IBMZ_ZVSI_INSTANCE_NAME }}
      ZVSI_VPC: ${{ vars.IBMZ_ZVSI_VPC }}
      ZVSI_SG: ${{ vars.IBMZ_ZVSI_SG }}
      ZVSI_SGR_ID: ${{ vars.IBMZ_ZVSI_SGR_ID }}
      ZVSI_ZONE_NAME: ${{ vars.IBMZ_ZVSI_ZONE_NAME }}
      ZVSI_PROFILE_NAME: ${{ vars.IBMZ_ZVSI_PROFILE_NAME }}
      ZVSI_SUBNET: ${{ vars.IBMZ_ZVSI_SUBNET }}
      ZVSI_IMAGE: ${{ vars.IBMZ_ZVSI_IMAGE }}
      ZVSI_KEY: ${{ vars.IBMZ_ZVSI_KEY }}
      ZVSI_RG_ID: ${{ vars.IBMZ_ZVSI_RG_ID }}
    strategy:
      fail-fast: false
      matrix:
        platform: ['amd64','ppc64le','s390x']
    steps:
    - name: install ibmcli and setup ibm login
      if: ${{ matrix.platform  == 's390x' }}
      run: |
        curl -fsSL https://clis.cloud.ibm.com/install/linux | sh
        ibmcloud login -q --apikey ${{ secrets.IBMCLOUD_API_KEY }} -r eu-gb
        ibmcloud plugin install vpc-infrastructure

    - name: Creation of ZVSI
      if: ${{ matrix.platform  == 's390x' }}
      id: ZVSI
      run: |
        #update the security-group to allow this machine for inbound activity
        gh_pubilc_ip=$(curl -s https://api.ipify.org)
        ibmcloud is security-group-rule-update $ZVSI_SG $ZVSI_SGR_ID --vpc $ZVSI_VPC --remote=$gh_pubilc_ip
        #creation of zvsi
        ibmcloud is instance-create $ZVSI_INSTANCE_NAME $ZVSI_VPC $ZVSI_ZONE_NAME $ZVSI_PROFILE_NAME $ZVSI_SUBNET --image $ZVSI_IMAGE --keys $ZVSI_KEY --resource-group-id $ZVSI_RG_ID
        #Bouding the Floating ip to the ZVSI
        vniid=$(ibmcloud is instance $ZVSI_INSTANCE_NAME --output json | jq -r .network_attachments[].virtual_network_interface.id)
        ibmcloud is floating-ip-update $ZVSI_FP_NAME --nic $vniid --in $ZVSI_INSTANCE_NAME
        sleep 60

        #Saving the Floating IP to login ZVSI
        ZVSI_HOST=$(ibmcloud is floating-ip $ZVSI_FP_NAME | awk '/Address/{print $2}')
        echo $ZVSI_HOST
        echo "IP=${ZVSI_HOST}" >> $GITHUB_OUTPUT

    - name: Status of ZVSI
      if: ${{ matrix.platform == 's390x' }}
      run: |
        check=$(ibmcloud is ins| awk '/'$ZVSI_INSTANCE_NAME'/{print $3}')
        while [[ $check != "running" ]]
        do
          check=$(ibmcloud is ins | awk '/'$ZVSI_INSTANCE_NAME'/{print $3}')
          if [[ $check == 'failed' ]]
          then
                  echo "Failed to run the ZVSI"
                  break
          fi
        done

    - name: Install dependencies and run tests on amd64
      if: matrix.platform == 'amd64'
      run: >-
        docker run
        --rm
        -w /
        -e GH_REPOSITORY
        -e GH_REF
        ubuntu:20.04
        /bin/bash -ec '
        export DEBIAN_FRONTEND=noninteractive;
        apt-get -y update;
        apt-get -y install libgpgme-dev libldap2-dev libsasl2-dev swig python3.9-dev python3-pip findutils git;
        apt-get -y install libffi-dev libssl-dev libjpeg-dev libpq-dev libxml2-dev libxslt-dev;
        apt-get -y install rustc cargo pkg-config;
        git clone ${GH_REPOSITORY} build;
        cd build && git checkout ${GH_REF};
        cat requirements-dev.txt | grep tox | xargs pip install;

        tox -e py39-unit;
        tox -e py39-e2e;
        tox -e py39-registry;'
      env:
        GH_REPOSITORY: ${{ github.server_url }}/${{ github.repository }}
        GH_REF: ${{ github.ref }}

    - name: Install dependencies and run all tests on ${{ matrix.platform }}
      if: matrix.platform  != 'amd64'
      uses: appleboy/ssh-action@334f9259f2f8eb3376d33fa4c684fff373f2c2a6 # v0.1.10
      env:
        GH_REPOSITORY: ${{ github.server_url }}/${{ github.repository }}
        GH_REF: ${{ github.ref }}
        GRPC_PYTHON_BUILD_SYSTEM_OPENSSL: 1
      with:
        host: ${{ matrix.platform  == 's390x' && steps.ZVSI.outputs.IP || secrets.BUILDER_PPC64LE_SSH_HOST_UBUNTU}}
        username: ${{ matrix.platform  == 's390x' && secrets.ZVSI_SSH_USER || secrets.BUILDER_PPC64LE_SSH_USER }}
        key: ${{ matrix.platform  == 's390x' && secrets.ZVSI_PR_KEY || secrets.BUILDER_PPC64LE_SSH_KEY}}
        envs: GH_REPOSITORY,GH_REF,GRPC_PYTHON_BUILD_SYSTEM_OPENSSL
        command_timeout: 100m
        script: |
          apt-get update -y
          apt-get -y install build-essential libgpgme-dev libldap2-dev libsasl2-dev swig python3.9-dev python3-pip findutils git
          apt-get -y install libffi-dev libssl-dev libjpeg-dev libpq-dev libxml2-dev libxslt-dev
          apt-get -y install rustc cargo pkg-config
          rm -rf build
          git clone ${GH_REPOSITORY} build
          cd build && git checkout ${GH_REF}
          cat requirements-dev.txt | grep tox | xargs python3 -m pip -qq install

          if [[ 's390x' == $(uname -m) ]]; then
            GRPC_LATEST=$(grep "grpcio" requirements.txt |cut -d "=" -f 3)
            export GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 && python3 -m pip install -qq grpcio==${GRPC_LATEST}
          fi

          #Unit
          tox -e py39-unit

          #e2e
          tox -e py39-e2e

          #registry
          tox -e py39-registry

    - name: Cleanup ZVSI
      if: ${{ steps.ZVSI.conclusion == 'success' && always() }}
      run: |
        #Delete the created ZVSI
        ibmcloud is instance-delete $ZVSI_INSTANCE_NAME --force
        sleep 20

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: Nightly CI
on:
  schedule:
    - cron: '30 5 * * *'
  workflow_dispatch:
    inputs: {}
 
permissions:
  contents: read
 
jobs:
  unit:
    timeout-minutes: 30
    if: github.repository == 'quay/quay'
    name: Run all Test
    runs-on: latchkey-small
    env:
      ZVSI_FP_NAME: ${{ vars.IBMZ_ZVSI_FP_NAME }}
      ZVSI_INSTANCE_NAME: ${{ vars.IBMZ_ZVSI_INSTANCE_NAME }}
      ZVSI_VPC: ${{ vars.IBMZ_ZVSI_VPC }}
      ZVSI_SG: ${{ vars.IBMZ_ZVSI_SG }}
      ZVSI_SGR_ID: ${{ vars.IBMZ_ZVSI_SGR_ID }}
      ZVSI_ZONE_NAME: ${{ vars.IBMZ_ZVSI_ZONE_NAME }}
      ZVSI_PROFILE_NAME: ${{ vars.IBMZ_ZVSI_PROFILE_NAME }}
      ZVSI_SUBNET: ${{ vars.IBMZ_ZVSI_SUBNET }}
      ZVSI_IMAGE: ${{ vars.IBMZ_ZVSI_IMAGE }}
      ZVSI_KEY: ${{ vars.IBMZ_ZVSI_KEY }}
      ZVSI_RG_ID: ${{ vars.IBMZ_ZVSI_RG_ID }}
    strategy:
      fail-fast: false
      matrix:
        platform: ['amd64','ppc64le','s390x']
    steps:
    - name: install ibmcli and setup ibm login
      if: ${{ matrix.platform  == 's390x' }}
      run: |
        curl -fsSL https://clis.cloud.ibm.com/install/linux | sh
        ibmcloud login -q --apikey ${{ secrets.IBMCLOUD_API_KEY }} -r eu-gb
        ibmcloud plugin install vpc-infrastructure
 
    - name: Creation of ZVSI
      if: ${{ matrix.platform  == 's390x' }}
      id: ZVSI
      run: |
        #update the security-group to allow this machine for inbound activity
        gh_pubilc_ip=$(curl -s https://api.ipify.org)
        ibmcloud is security-group-rule-update $ZVSI_SG $ZVSI_SGR_ID --vpc $ZVSI_VPC --remote=$gh_pubilc_ip
        #creation of zvsi
        ibmcloud is instance-create $ZVSI_INSTANCE_NAME $ZVSI_VPC $ZVSI_ZONE_NAME $ZVSI_PROFILE_NAME $ZVSI_SUBNET --image $ZVSI_IMAGE --keys $ZVSI_KEY --resource-group-id $ZVSI_RG_ID
        #Bouding the Floating ip to the ZVSI
        vniid=$(ibmcloud is instance $ZVSI_INSTANCE_NAME --output json | jq -r .network_attachments[].virtual_network_interface.id)
        ibmcloud is floating-ip-update $ZVSI_FP_NAME --nic $vniid --in $ZVSI_INSTANCE_NAME
        sleep 60
 
        #Saving the Floating IP to login ZVSI
        ZVSI_HOST=$(ibmcloud is floating-ip $ZVSI_FP_NAME | awk '/Address/{print $2}')
        echo $ZVSI_HOST
        echo "IP=${ZVSI_HOST}" >> $GITHUB_OUTPUT
 
    - name: Status of ZVSI
      if: ${{ matrix.platform == 's390x' }}
      run: |
        check=$(ibmcloud is ins| awk '/'$ZVSI_INSTANCE_NAME'/{print $3}')
        while [[ $check != "running" ]]
        do
          check=$(ibmcloud is ins | awk '/'$ZVSI_INSTANCE_NAME'/{print $3}')
          if [[ $check == 'failed' ]]
          then
                  echo "Failed to run the ZVSI"
                  break
          fi
        done
 
    - name: Install dependencies and run tests on amd64
      if: matrix.platform == 'amd64'
      run: >-
        docker run
        --rm
        -w /
        -e GH_REPOSITORY
        -e GH_REF
        ubuntu:20.04
        /bin/bash -ec '
        export DEBIAN_FRONTEND=noninteractive;
        apt-get -y update;
        apt-get -y install libgpgme-dev libldap2-dev libsasl2-dev swig python3.9-dev python3-pip findutils git;
        apt-get -y install libffi-dev libssl-dev libjpeg-dev libpq-dev libxml2-dev libxslt-dev;
        apt-get -y install rustc cargo pkg-config;
        git clone ${GH_REPOSITORY} build;
        cd build && git checkout ${GH_REF};
        cat requirements-dev.txt | grep tox | xargs pip install;
 
        tox -e py39-unit;
        tox -e py39-e2e;
        tox -e py39-registry;'
      env:
        GH_REPOSITORY: ${{ github.server_url }}/${{ github.repository }}
        GH_REF: ${{ github.ref }}
 
    - name: Install dependencies and run all tests on ${{ matrix.platform }}
      if: matrix.platform  != 'amd64'
      uses: appleboy/ssh-action@334f9259f2f8eb3376d33fa4c684fff373f2c2a6 # v0.1.10
      env:
        GH_REPOSITORY: ${{ github.server_url }}/${{ github.repository }}
        GH_REF: ${{ github.ref }}
        GRPC_PYTHON_BUILD_SYSTEM_OPENSSL: 1
      with:
        host: ${{ matrix.platform  == 's390x' && steps.ZVSI.outputs.IP || secrets.BUILDER_PPC64LE_SSH_HOST_UBUNTU}}
        username: ${{ matrix.platform  == 's390x' && secrets.ZVSI_SSH_USER || secrets.BUILDER_PPC64LE_SSH_USER }}
        key: ${{ matrix.platform  == 's390x' && secrets.ZVSI_PR_KEY || secrets.BUILDER_PPC64LE_SSH_KEY}}
        envs: GH_REPOSITORY,GH_REF,GRPC_PYTHON_BUILD_SYSTEM_OPENSSL
        command_timeout: 100m
        script: |
          apt-get update -y
          apt-get -y install build-essential libgpgme-dev libldap2-dev libsasl2-dev swig python3.9-dev python3-pip findutils git
          apt-get -y install libffi-dev libssl-dev libjpeg-dev libpq-dev libxml2-dev libxslt-dev
          apt-get -y install rustc cargo pkg-config
          rm -rf build
          git clone ${GH_REPOSITORY} build
          cd build && git checkout ${GH_REF}
          cat requirements-dev.txt | grep tox | xargs python3 -m pip -qq install
 
          if [[ 's390x' == $(uname -m) ]]; then
            GRPC_LATEST=$(grep "grpcio" requirements.txt |cut -d "=" -f 3)
            export GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 && python3 -m pip install -qq grpcio==${GRPC_LATEST}
          fi
 
          #Unit
          tox -e py39-unit
 
          #e2e
          tox -e py39-e2e
 
          #registry
          tox -e py39-registry
 
    - name: Cleanup ZVSI
      if: ${{ steps.ZVSI.conclusion == 'success' && always() }}
      run: |
        #Delete the created ZVSI
        ibmcloud is instance-delete $ZVSI_INSTANCE_NAME --force
        sleep 20
 

What changed

What Latchkey heals here

This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:

This workflow runs 1 job (3 with the matrix expanded) per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.