From 31c7f223814e14b2f7370e8343fa6fae87bb9faa Mon Sep 17 00:00:00 2001 From: Mathieu Leplatre Date: Mon, 6 Jul 2026 11:35:37 +0200 Subject: [PATCH 1/4] Reuse test workflow --- .github/workflows/ci.yaml | 31 +------------------------------ 1 file changed, 1 insertion(+), 30 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 7e6ac4be..6f0ca959 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -51,36 +51,7 @@ jobs: run: make docs run_test: needs: run_lint - runs-on: ubuntu-latest - services: - postgres: - image: postgres:15 - env: - POSTGRES_DB: testdb - POSTGRES_USER: postgres - POSTGRES_PASSWORD: postgres # pragma: allowlist secret - POSTGRES_HOST_AUTH_METHOD: trust - LC_COLLATE: en_US.UTF8 - LC_CTYPE: en_US.UTF8 - ports: - - 5432:5432 - options: >- - --health-cmd pg_isready - --health-interval 10s - --health-timeout 5s - --health-retries 5 - steps: - - uses: actions/checkout@v7 - - name: Install uv - uses: astral-sh/setup-uv@v7 - with: - enable-cache: true - cache-dependency-glob: "uv.lock" - python-version: "3.14.6" - - name: Install dependencies - run: make install - - name: Run tests - run: make test + uses: ./.github/workflows/test.yaml cronjobs-test: needs: run_test From dd33b4e155949c713d3b0e9f5625b5354662c349 Mon Sep 17 00:00:00 2001 From: Mathieu Leplatre Date: Mon, 6 Jul 2026 11:38:01 +0200 Subject: [PATCH 2/4] Wait on tests before publishing --- .github/workflows/publish.yaml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 79d7773d..2b78138a 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -55,8 +55,16 @@ jobs: check browser_tests '^.github/workflows/|^browser-tests/' check git_reader '^.github/workflows/|^git-reader/' + # Make sure we don't deploy images with failing tests. + # On pull-requests, tests are already ran in CI. + tests: + if: github.event_name != 'pull_request' + uses: ./.github/workflows/test.yaml + server_container: # Always build the server (since it depends on lots of files uv.lock, dockerfiles, kinto-slack, etc.) + needs: tests + if: ${{ !cancelled() && needs.tests.result != 'failure' }} env: DOCKERHUB_IMAGE_NAME: mozilla/remote-settings GAR_IMAGE_NAME: remote-settings From aa3eaf53e8d777666bcfda0a263c003d6d20a745 Mon Sep 17 00:00:00 2001 From: Mathieu Leplatre Date: Tue, 7 Jul 2026 16:55:34 +0200 Subject: [PATCH 3/4] Add reusable test.yaml workflow referenced by ci and publish --- .github/workflows/publish.yaml | 2 +- .github/workflows/test.yaml | 43 ++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/test.yaml diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml index 2b78138a..45d220c4 100644 --- a/.github/workflows/publish.yaml +++ b/.github/workflows/publish.yaml @@ -192,7 +192,7 @@ jobs: SRC: ${{ env.GAR_LOCATION }}-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/${{ env.GAR_REPOSITORY}}/remote-settings:${{ env.LATEST_TAG }} run: | for tag in $TAGS; do - docker buildx imagetools create --tag "${tag}" "${SRC}" + docker buildx imagetools create --tag "${tag}" "${SRC}" done - name: Notify DEVs of build failure if: failure() diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml new file mode 100644 index 00000000..ee690333 --- /dev/null +++ b/.github/workflows/test.yaml @@ -0,0 +1,43 @@ +name: Tests + +# Reusable workflow so the exact same test suite gates both CI checks +# (ci.yaml) and the deployable image build (publish.yaml). Keeping a single +# definition avoids drift between "what CI runs" and "what gates the deploy". +on: + workflow_call: + +permissions: + contents: read + +jobs: + run_test: + runs-on: ubuntu-latest + services: + postgres: + image: postgres:15 + env: + POSTGRES_DB: testdb + POSTGRES_USER: postgres + POSTGRES_PASSWORD: postgres # pragma: allowlist secret + POSTGRES_HOST_AUTH_METHOD: trust + LC_COLLATE: en_US.UTF8 + LC_CTYPE: en_US.UTF8 + ports: + - 5432:5432 + options: >- + --health-cmd pg_isready + --health-interval 10s + --health-timeout 5s + --health-retries 5 + steps: + - uses: actions/checkout@v7 + - name: Install uv + uses: astral-sh/setup-uv@v7 + with: + enable-cache: true + cache-dependency-glob: "uv.lock" + python-version: "3.14.6" + - name: Install dependencies + run: make install + - name: Run tests + run: make test From c03e2a9b9e70c361e16a6f367380e993f0c24fc9 Mon Sep 17 00:00:00 2001 From: Mathieu Leplatre Date: Tue, 7 Jul 2026 16:57:08 +0200 Subject: [PATCH 4/4] Change workflow title for less confusion --- .github/workflows/ingestion-job-publish.yaml | 2 +- .github/workflows/test.yaml | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ingestion-job-publish.yaml b/.github/workflows/ingestion-job-publish.yaml index 189e9b2b..112bbb76 100644 --- a/.github/workflows/ingestion-job-publish.yaml +++ b/.github/workflows/ingestion-job-publish.yaml @@ -23,7 +23,7 @@ # publish: $\{{ github.event_name != 'pull_request' }} # ``` # -name: Build and Publish Docker Container +name: Build and Publish Ingestion Docker Container on: workflow_call: diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml index ee690333..f68ff3db 100644 --- a/.github/workflows/test.yaml +++ b/.github/workflows/test.yaml @@ -1,8 +1,7 @@ name: Tests # Reusable workflow so the exact same test suite gates both CI checks -# (ci.yaml) and the deployable image build (publish.yaml). Keeping a single -# definition avoids drift between "what CI runs" and "what gates the deploy". +# (ci.yaml) and the deployable image build (publish.yaml). on: workflow_call: