CI workflow (scikit-hep/awkward)

The CI workflow from scikit-hep/awkward, explained and optimized by Latchkey.

CI health: A - excellent

Point runs-on at Latchkey and get job timeouts, self-healing for flaky steps, and up to 58% lower cost, applied automatically.

Grade your own workflow free or run it on Latchkey →

Source: scikit-hep/awkward.github/workflows/ci.ymlLicense BSD-3-ClauseView source

What it does

This is the CI workflow from the scikit-hep/awkward repository, a real project running GitHub Actions. It is shown here with attribution under its BSD-3-Clause license.

Below, Latchkey shows a faster, safer version produced by its optimization engine.

The workflow

workflow (.yml)

name: CI

on:
  pull_request:
  push:
    branches:
      - main

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  change-detection:
    uses: ./.github/workflows/reusable-change-detection.yml

  tests:
    needs: change-detection
    if: fromJSON(needs.change-detection.outputs.run-tests)
    uses: ./.github/workflows/reusable-test.yml
    with:
     run-gpu-kernel-tests: ${{ needs.change-detection.outputs.run-gpu-kernel-tests }}

  packaging-tests:
    needs: change-detection
    if: fromJSON(needs.change-detection.outputs.build-wheels)
    uses: ./.github/workflows/reusable-packaging-test.yml

  header-only-tests:
    needs: change-detection
    if: fromJSON(needs.change-detection.outputs.run-header-only-tests)
    uses: ./.github/workflows/reusable-header-only-test.yml

  coverage:
    uses: ./.github/workflows/reusable-coverage.yml
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

  docs:
    uses: ./.github/workflows/reusable-docs.yml
    permissions:
      id-token: write # Required by the reusable docs deploy job for AWS OIDC.
      contents: read
    secrets:
      AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
      AWS_DEPLOY_ROLE: ${{ secrets.AWS_DEPLOY_ROLE }}

  pass:
    name: Check CI result
    if: always()
    needs:
      - change-detection
      - tests
      - packaging-tests
      - header-only-tests
      - coverage
      - docs
    runs-on: ubuntu-latest

    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
        with:
          allowed-skips: >-
            ${{
              fromJSON(needs.change-detection.outputs.run-tests)
              && ''
              || '
              tests,
              '
            }} ${{
              fromJSON(needs.change-detection.outputs.build-wheels)
              && ''
              || '
              packaging-tests,
              '
            }} ${{
              fromJSON(needs.change-detection.outputs.run-header-only-tests)
              && ''
              || '
              header-only-tests,
              '
            }}
          jobs: ${{ toJSON(needs) }}

The same workflow, on Latchkey

Removes redundant runs and caps runaway jobs. Added and changed lines are highlighted.

name: CI
 
on:
  pull_request:
  push:
    branches:
      - main
 
permissions:
  contents: read
 
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
 
jobs:
  change-detection:
    timeout-minutes: 30
    uses: ./.github/workflows/reusable-change-detection.yml
 
  tests:
    timeout-minutes: 30
    needs: change-detection
    if: fromJSON(needs.change-detection.outputs.run-tests)
    uses: ./.github/workflows/reusable-test.yml
    with:
     run-gpu-kernel-tests: ${{ needs.change-detection.outputs.run-gpu-kernel-tests }}
 
  packaging-tests:
    timeout-minutes: 30
    needs: change-detection
    if: fromJSON(needs.change-detection.outputs.build-wheels)
    uses: ./.github/workflows/reusable-packaging-test.yml
 
  header-only-tests:
    timeout-minutes: 30
    needs: change-detection
    if: fromJSON(needs.change-detection.outputs.run-header-only-tests)
    uses: ./.github/workflows/reusable-header-only-test.yml
 
  coverage:
    timeout-minutes: 30
    uses: ./.github/workflows/reusable-coverage.yml
    secrets:
      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
  docs:
    timeout-minutes: 30
    uses: ./.github/workflows/reusable-docs.yml
    permissions:
      id-token: write # Required by the reusable docs deploy job for AWS OIDC.
      contents: read
    secrets:
      AWS_ACCOUNT_ID: ${{ secrets.AWS_ACCOUNT_ID }}
      AWS_DEPLOY_ROLE: ${{ secrets.AWS_DEPLOY_ROLE }}
 
  pass:
    timeout-minutes: 30
    name: Check CI result
    if: always()
    needs:
      - change-detection
      - tests
      - packaging-tests
      - header-only-tests
      - coverage
      - docs
    runs-on: latchkey-small
 
    steps:
      - name: Decide whether the needed jobs succeeded or failed
        uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
        with:
          allowed-skips: >-
            ${{
              fromJSON(needs.change-detection.outputs.run-tests)
              && ''
              || '
              tests,
              '
            }} ${{
              fromJSON(needs.change-detection.outputs.build-wheels)
              && ''
              || '
              packaging-tests,
              '
            }} ${{
              fromJSON(needs.change-detection.outputs.run-header-only-tests)
              && ''
              || '
              header-only-tests,
              '
            }}
          jobs: ${{ toJSON(needs) }}

What changed

Run on Latchkey managed runners with one line (runs-on), which apply the fixes below automatically and self-heal transient failures. This example uses latchkey-small; pick the runner size that fits the job.
Add a job timeout so a hung step cannot burn hours of runner time.

This workflow runs 7 jobs per trigger. On Latchkey the same minutes cost up to 58% less than GitHub-hosted, with zero queue time.