Nightly CI workflow (quay/quay)
The Nightly CI workflow from quay/quay, explained and optimized by Latchkey.
CI health: A - excellent
Point runs-on at Latchkey and get job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.
What it does
This is the Nightly CI workflow from the quay/quay repository, a real project running GitHub Actions. It is shown here with attribution under its Apache-2.0 license.
Below, Latchkey shows a faster, safer version produced by its optimization engine.
The workflow
name: Nightly CI
on:
schedule:
- cron: '30 5 * * *'
workflow_dispatch:
inputs: {}
permissions:
contents: read
jobs:
unit:
if: github.repository == 'quay/quay'
name: Run all Test
runs-on: ubuntu-22.04
env:
ZVSI_FP_NAME: ${{ vars.IBMZ_ZVSI_FP_NAME }}
ZVSI_INSTANCE_NAME: ${{ vars.IBMZ_ZVSI_INSTANCE_NAME }}
ZVSI_VPC: ${{ vars.IBMZ_ZVSI_VPC }}
ZVSI_SG: ${{ vars.IBMZ_ZVSI_SG }}
ZVSI_SGR_ID: ${{ vars.IBMZ_ZVSI_SGR_ID }}
ZVSI_ZONE_NAME: ${{ vars.IBMZ_ZVSI_ZONE_NAME }}
ZVSI_PROFILE_NAME: ${{ vars.IBMZ_ZVSI_PROFILE_NAME }}
ZVSI_SUBNET: ${{ vars.IBMZ_ZVSI_SUBNET }}
ZVSI_IMAGE: ${{ vars.IBMZ_ZVSI_IMAGE }}
ZVSI_KEY: ${{ vars.IBMZ_ZVSI_KEY }}
ZVSI_RG_ID: ${{ vars.IBMZ_ZVSI_RG_ID }}
strategy:
fail-fast: false
matrix:
platform: ['amd64','ppc64le','s390x']
steps:
- name: install ibmcli and setup ibm login
if: ${{ matrix.platform == 's390x' }}
run: |
curl -fsSL https://clis.cloud.ibm.com/install/linux | sh
ibmcloud login -q --apikey ${{ secrets.IBMCLOUD_API_KEY }} -r eu-gb
ibmcloud plugin install vpc-infrastructure
- name: Creation of ZVSI
if: ${{ matrix.platform == 's390x' }}
id: ZVSI
run: |
#update the security-group to allow this machine for inbound activity
gh_pubilc_ip=$(curl -s https://api.ipify.org)
ibmcloud is security-group-rule-update $ZVSI_SG $ZVSI_SGR_ID --vpc $ZVSI_VPC --remote=$gh_pubilc_ip
#creation of zvsi
ibmcloud is instance-create $ZVSI_INSTANCE_NAME $ZVSI_VPC $ZVSI_ZONE_NAME $ZVSI_PROFILE_NAME $ZVSI_SUBNET --image $ZVSI_IMAGE --keys $ZVSI_KEY --resource-group-id $ZVSI_RG_ID
#Bouding the Floating ip to the ZVSI
vniid=$(ibmcloud is instance $ZVSI_INSTANCE_NAME --output json | jq -r .network_attachments[].virtual_network_interface.id)
ibmcloud is floating-ip-update $ZVSI_FP_NAME --nic $vniid --in $ZVSI_INSTANCE_NAME
sleep 60
#Saving the Floating IP to login ZVSI
ZVSI_HOST=$(ibmcloud is floating-ip $ZVSI_FP_NAME | awk '/Address/{print $2}')
echo $ZVSI_HOST
echo "IP=${ZVSI_HOST}" >> $GITHUB_OUTPUT
- name: Status of ZVSI
if: ${{ matrix.platform == 's390x' }}
run: |
check=$(ibmcloud is ins| awk '/'$ZVSI_INSTANCE_NAME'/{print $3}')
while [[ $check != "running" ]]
do
check=$(ibmcloud is ins | awk '/'$ZVSI_INSTANCE_NAME'/{print $3}')
if [[ $check == 'failed' ]]
then
echo "Failed to run the ZVSI"
break
fi
done
- name: Install dependencies and run tests on amd64
if: matrix.platform == 'amd64'
run: >-
docker run
--rm
-w /
-e GH_REPOSITORY
-e GH_REF
ubuntu:20.04
/bin/bash -ec '
export DEBIAN_FRONTEND=noninteractive;
apt-get -y update;
apt-get -y install libgpgme-dev libldap2-dev libsasl2-dev swig python3.9-dev python3-pip findutils git;
apt-get -y install libffi-dev libssl-dev libjpeg-dev libpq-dev libxml2-dev libxslt-dev;
apt-get -y install rustc cargo pkg-config;
git clone ${GH_REPOSITORY} build;
cd build && git checkout ${GH_REF};
cat requirements-dev.txt | grep tox | xargs pip install;
tox -e py39-unit;
tox -e py39-e2e;
tox -e py39-registry;'
env:
GH_REPOSITORY: ${{ github.server_url }}/${{ github.repository }}
GH_REF: ${{ github.ref }}
- name: Install dependencies and run all tests on ${{ matrix.platform }}
if: matrix.platform != 'amd64'
uses: appleboy/ssh-action@334f9259f2f8eb3376d33fa4c684fff373f2c2a6 # v0.1.10
env:
GH_REPOSITORY: ${{ github.server_url }}/${{ github.repository }}
GH_REF: ${{ github.ref }}
GRPC_PYTHON_BUILD_SYSTEM_OPENSSL: 1
with:
host: ${{ matrix.platform == 's390x' && steps.ZVSI.outputs.IP || secrets.BUILDER_PPC64LE_SSH_HOST_UBUNTU}}
username: ${{ matrix.platform == 's390x' && secrets.ZVSI_SSH_USER || secrets.BUILDER_PPC64LE_SSH_USER }}
key: ${{ matrix.platform == 's390x' && secrets.ZVSI_PR_KEY || secrets.BUILDER_PPC64LE_SSH_KEY}}
envs: GH_REPOSITORY,GH_REF,GRPC_PYTHON_BUILD_SYSTEM_OPENSSL
command_timeout: 100m
script: |
apt-get update -y
apt-get -y install build-essential libgpgme-dev libldap2-dev libsasl2-dev swig python3.9-dev python3-pip findutils git
apt-get -y install libffi-dev libssl-dev libjpeg-dev libpq-dev libxml2-dev libxslt-dev
apt-get -y install rustc cargo pkg-config
rm -rf build
git clone ${GH_REPOSITORY} build
cd build && git checkout ${GH_REF}
cat requirements-dev.txt | grep tox | xargs python3 -m pip -qq install
if [[ 's390x' == $(uname -m) ]]; then
GRPC_LATEST=$(grep "grpcio" requirements.txt |cut -d "=" -f 3)
export GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 && python3 -m pip install -qq grpcio==${GRPC_LATEST}
fi
#Unit
tox -e py39-unit
#e2e
tox -e py39-e2e
#registry
tox -e py39-registry
- name: Cleanup ZVSI
if: ${{ steps.ZVSI.conclusion == 'success' && always() }}
run: |
#Delete the created ZVSI
ibmcloud is instance-delete $ZVSI_INSTANCE_NAME --force
sleep 20
The same workflow, on Latchkey
Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.
name: Nightly CI on: schedule: - cron: '30 5 * * *' workflow_dispatch: inputs: {} permissions: contents: read jobs: unit: timeout-minutes: 30 if: github.repository == 'quay/quay' name: Run all Test runs-on: latchkey-small env: ZVSI_FP_NAME: ${{ vars.IBMZ_ZVSI_FP_NAME }} ZVSI_INSTANCE_NAME: ${{ vars.IBMZ_ZVSI_INSTANCE_NAME }} ZVSI_VPC: ${{ vars.IBMZ_ZVSI_VPC }} ZVSI_SG: ${{ vars.IBMZ_ZVSI_SG }} ZVSI_SGR_ID: ${{ vars.IBMZ_ZVSI_SGR_ID }} ZVSI_ZONE_NAME: ${{ vars.IBMZ_ZVSI_ZONE_NAME }} ZVSI_PROFILE_NAME: ${{ vars.IBMZ_ZVSI_PROFILE_NAME }} ZVSI_SUBNET: ${{ vars.IBMZ_ZVSI_SUBNET }} ZVSI_IMAGE: ${{ vars.IBMZ_ZVSI_IMAGE }} ZVSI_KEY: ${{ vars.IBMZ_ZVSI_KEY }} ZVSI_RG_ID: ${{ vars.IBMZ_ZVSI_RG_ID }} strategy: fail-fast: false matrix: platform: ['amd64','ppc64le','s390x'] steps: - name: install ibmcli and setup ibm login if: ${{ matrix.platform == 's390x' }} run: | curl -fsSL https://clis.cloud.ibm.com/install/linux | sh ibmcloud login -q --apikey ${{ secrets.IBMCLOUD_API_KEY }} -r eu-gb ibmcloud plugin install vpc-infrastructure - name: Creation of ZVSI if: ${{ matrix.platform == 's390x' }} id: ZVSI run: | #update the security-group to allow this machine for inbound activity gh_pubilc_ip=$(curl -s https://api.ipify.org) ibmcloud is security-group-rule-update $ZVSI_SG $ZVSI_SGR_ID --vpc $ZVSI_VPC --remote=$gh_pubilc_ip #creation of zvsi ibmcloud is instance-create $ZVSI_INSTANCE_NAME $ZVSI_VPC $ZVSI_ZONE_NAME $ZVSI_PROFILE_NAME $ZVSI_SUBNET --image $ZVSI_IMAGE --keys $ZVSI_KEY --resource-group-id $ZVSI_RG_ID #Bouding the Floating ip to the ZVSI vniid=$(ibmcloud is instance $ZVSI_INSTANCE_NAME --output json | jq -r .network_attachments[].virtual_network_interface.id) ibmcloud is floating-ip-update $ZVSI_FP_NAME --nic $vniid --in $ZVSI_INSTANCE_NAME sleep 60 #Saving the Floating IP to login ZVSI ZVSI_HOST=$(ibmcloud is floating-ip $ZVSI_FP_NAME | awk '/Address/{print $2}') echo $ZVSI_HOST echo "IP=${ZVSI_HOST}" >> $GITHUB_OUTPUT - name: Status of ZVSI if: ${{ matrix.platform == 's390x' }} run: | check=$(ibmcloud is ins| awk '/'$ZVSI_INSTANCE_NAME'/{print $3}') while [[ $check != "running" ]] do check=$(ibmcloud is ins | awk '/'$ZVSI_INSTANCE_NAME'/{print $3}') if [[ $check == 'failed' ]] then echo "Failed to run the ZVSI" break fi done - name: Install dependencies and run tests on amd64 if: matrix.platform == 'amd64' run: >- docker run --rm -w / -e GH_REPOSITORY -e GH_REF ubuntu:20.04 /bin/bash -ec ' export DEBIAN_FRONTEND=noninteractive; apt-get -y update; apt-get -y install libgpgme-dev libldap2-dev libsasl2-dev swig python3.9-dev python3-pip findutils git; apt-get -y install libffi-dev libssl-dev libjpeg-dev libpq-dev libxml2-dev libxslt-dev; apt-get -y install rustc cargo pkg-config; git clone ${GH_REPOSITORY} build; cd build && git checkout ${GH_REF}; cat requirements-dev.txt | grep tox | xargs pip install; tox -e py39-unit; tox -e py39-e2e; tox -e py39-registry;' env: GH_REPOSITORY: ${{ github.server_url }}/${{ github.repository }} GH_REF: ${{ github.ref }} - name: Install dependencies and run all tests on ${{ matrix.platform }} if: matrix.platform != 'amd64' uses: appleboy/ssh-action@334f9259f2f8eb3376d33fa4c684fff373f2c2a6 # v0.1.10 env: GH_REPOSITORY: ${{ github.server_url }}/${{ github.repository }} GH_REF: ${{ github.ref }} GRPC_PYTHON_BUILD_SYSTEM_OPENSSL: 1 with: host: ${{ matrix.platform == 's390x' && steps.ZVSI.outputs.IP || secrets.BUILDER_PPC64LE_SSH_HOST_UBUNTU}} username: ${{ matrix.platform == 's390x' && secrets.ZVSI_SSH_USER || secrets.BUILDER_PPC64LE_SSH_USER }} key: ${{ matrix.platform == 's390x' && secrets.ZVSI_PR_KEY || secrets.BUILDER_PPC64LE_SSH_KEY}} envs: GH_REPOSITORY,GH_REF,GRPC_PYTHON_BUILD_SYSTEM_OPENSSL command_timeout: 100m script: | apt-get update -y apt-get -y install build-essential libgpgme-dev libldap2-dev libsasl2-dev swig python3.9-dev python3-pip findutils git apt-get -y install libffi-dev libssl-dev libjpeg-dev libpq-dev libxml2-dev libxslt-dev apt-get -y install rustc cargo pkg-config rm -rf build git clone ${GH_REPOSITORY} build cd build && git checkout ${GH_REF} cat requirements-dev.txt | grep tox | xargs python3 -m pip -qq install if [[ 's390x' == $(uname -m) ]]; then GRPC_LATEST=$(grep "grpcio" requirements.txt |cut -d "=" -f 3) export GRPC_PYTHON_BUILD_SYSTEM_OPENSSL=1 && python3 -m pip install -qq grpcio==${GRPC_LATEST} fi #Unit tox -e py39-unit #e2e tox -e py39-e2e #registry tox -e py39-registry - name: Cleanup ZVSI if: ${{ steps.ZVSI.conclusion == 'success' && always() }} run: | #Delete the created ZVSI ibmcloud is instance-delete $ZVSI_INSTANCE_NAME --force sleep 20
What changed
- Run on Latchkey managed runners with one line (
runs-on), which apply the fixes below automatically and self-heal transient failures. This example useslatchkey-small; pick the runner size that fits the job. - Add a job timeout so a hung step cannot burn hours of runner time.
What Latchkey heals here
This workflow has steps that commonly fail on transient issues (network, registries, flaky browsers). On Latchkey managed runners they are detected, retried, and self-healed instead of failing your build:
- Dependency installs
- End-to-end and browser tests
- Network fetches
This workflow runs 1 job (3 with the matrix expanded) per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.