Skip to content

add reusable workflow #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
arnaudbossobita merged 1 commit into from
Dec 27, 2025
Merged

add reusable workflow #18

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
76 changes: 76 additions & 0 deletions .github/workflows/ci-with-step.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,76 @@
name: CI

on:
push:
branches: [ "main" ]

jobs:
build:
name: CI
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4 # Check out the repository first

# The other verification steps (checkout, build, format, etc.) will be run from PR Verify workflow already
- name: Dotnet test
run: dotnet test src/GitHubActionsDotNet.Api.Tests/GitHubActionsDotNet.Api.Tests.csproj --configuration Release

- name: Dotnet publish
run: dotnet publish src/GitHubActionsDotNet.Api/GitHubActionsDotNet.Api.csproj --configuration Release -o artifacts

- uses: actions/upload-artifact@v4
with:
name: domtrain-artifacts
path: artifacts/

deploy_dev:
Comment on lines +9 to +27

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {contents: read}

Copilot Autofix

AI about 1 month ago

To fix the problem, explicitly declare a permissions block so that the GITHUB_TOKEN used in this workflow has only the minimal rights it needs. Since none of the jobs perform operations that modify the repository (such as pushing commits, creating releases, or managing issues/PRs), the minimal and sufficient permission is contents: read. Placing this permissions block at the root of the workflow ensures it applies to all jobs unless they override it.

Concretely, in .github/workflows/ci-with-step.yml, add a top-level permissions: section right under the name: CI line (before on:). The block should read:

permissions:
  contents: read

No changes are needed inside the individual jobs. No additional imports or actions are required; this change only adjusts the workflow’s static YAML configuration and does not alter the functional behavior of the build and deployments.

Suggested changeset 1
.github/workflows/ci-with-step.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/ci-with-step.yml b/.github/workflows/ci-with-step.yml
--- a/.github/workflows/ci-with-step.yml
+++ b/.github/workflows/ci-with-step.yml
@@ -1,4 +1,6 @@
 name: CI
+permissions:
+  contents: read
 
 on:
   push:
EOF
@@ -1,4 +1,6 @@
name: CI
permissions:
contents: read

on:
push:
Copilot is powered by AI and may make mistakes. Always verify output.
name: Deploy Dev
runs-on: ubuntu-latest
needs: build # By default jobs runs in parallel, this makes sure deploy runs after build
environment: dev

steps:
- uses: actions/download-artifact@v4
with:
name: domtrain-artifacts #The name "domtrain-artifacts" is what makes teh link between the upload and download steps
path: artifacts/

- name: Azure login
uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

# Deploy to Azure Web apps
- name: 'Deploy to Azure App Service'
uses: azure/webapps-deploy@v2
with:
app-name: ${{ env.AZURE_WEBAPP_NAME }} # Replace with your app name, i.e. app-domtrain-github-scottsauber-dev
package: artifacts/

deploy_prod:
Comment on lines +28 to +53

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 1 month ago

In general, the fix is to explicitly declare a permissions: block instead of relying on the repository’s default GITHUB_TOKEN permissions. Since all three jobs only need to read the repository to run and upload/download artifacts (which do not require elevated repo scopes), we can safely set contents: read at the workflow root, applying to all jobs.

The best minimal fix without changing functionality is:

  • Add a top-level permissions: block after the name: (or after on:) setting contents: read.
  • There is no evidence any job needs write permissions to issues, pull requests, or contents, so we do not grant them.

Concretely, in .github/workflows/ci-with-step.yml, between line 2 and line 3 (or equivalently between the existing name: CI and on:), add:

permissions:
  contents: read

No imports or additional definitions are needed, as this is purely a YAML workflow configuration change.

Suggested changeset 1
.github/workflows/ci-with-step.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/ci-with-step.yml b/.github/workflows/ci-with-step.yml
--- a/.github/workflows/ci-with-step.yml
+++ b/.github/workflows/ci-with-step.yml
@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ "main" ]
EOF
@@ -1,5 +1,8 @@
name: CI

permissions:
contents: read

on:
push:
branches: [ "main" ]
Copilot is powered by AI and may make mistakes. Always verify output.
name: Deploy Prod
runs-on: ubuntu-latest
needs: deploy_dev # By default jobs runs in parallel, this makes sure deploy prod runs after deploy dev
environment: prod
steps:
- uses: actions/download-artifact@v4
with:
name: domtrain-artifacts #The name "domtrain-artifacts" is what makes teh link between the upload and download steps
path: artifacts/

- name: Azure login
uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

# Deploy to Azure Web apps
- name: 'Deploy to Azure App Service'
uses: azure/webapps-deploy@v2
with:
app-name: ${{ env.AZURE_WEBAPP_NAME }} # Replace with your app name, i.e. app-domtrain-github-scottsauber-prod
package: artifacts/
Comment on lines +54 to +76

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI about 1 month ago

In general, the fix is to add an explicit permissions: block that grants only the minimum GitHub token permissions required. Since this workflow only checks out code, runs tests, builds, and uploads/downloads artifacts, it doesn’t need any write permission to the repository; a read-only token is sufficient, and in this specific case we can even set all permissions to none if the workflow doesn’t require the token at all.

The single best minimal fix here is to add a permissions block at the root of the workflow (applies to all jobs) and set contents: read, which is a safe, common default for workflows that only need to read the repository. This both satisfies CodeQL’s requirement for an explicit permissions block and adheres to least privilege, while not breaking actions/checkout, which can operate with contents: read. No imports or additional methods are needed, only a small YAML change near the top of .github/workflows/ci-with-step.yml.

Concretely: edit .github/workflows/ci-with-step.yml to insert a permissions: section after the name: CI (line 1) and before the on: block (line 3). The rest of the workflow remains unchanged.

Suggested changeset 1
.github/workflows/ci-with-step.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/ci-with-step.yml b/.github/workflows/ci-with-step.yml
--- a/.github/workflows/ci-with-step.yml
+++ b/.github/workflows/ci-with-step.yml
@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ "main" ]
EOF
@@ -1,5 +1,8 @@
name: CI

permissions:
contents: read

on:
push:
branches: [ "main" ]
Copilot is powered by AI and may make mistakes. Always verify output.
97 changes: 49 additions & 48 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,50 +1,51 @@
name: CI

on:
push:
branches: [ "main" ]

jobs:
build:
name: CI
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4 # Check out the repository first

# The other verification steps (checkout, build, format, etc.) will be run from PR Verify workflow already
- name: Dotnet test
run: dotnet test src/GitHubActionsDotNet.Api.Tests/GitHubActionsDotNet.Api.Tests.csproj --configuration Release

- name: Dotnet publish
run: dotnet publish src/GitHubActionsDotNet.Api/GitHubActionsDotNet.Api.csproj --configuration Release -o artifacts

- uses: actions/upload-artifact@v4
with:
name: domtrain-artifacts
path: artifacts/

deploy_dev:
name: Deploy Dev
runs-on: ubuntu-latest
needs: build # By default jobs runs in parallel, this makes sure deploy runs after build

steps:
- uses: actions/download-artifact@v4
with:
name: domtrain-artifacts #The name "domtrain-artifacts" is what makes teh link between the upload and download steps
path: artifacts/
# name: CI

# on:
# push:
# branches: [ "main" ]

# jobs:
# build:
# name: CI
# runs-on: ubuntu-latest

# steps:
# - uses: actions/checkout@v4 # Check out the repository first

# # The other verification steps (checkout, build, format, etc.) will be run from PR Verify workflow already
# - name: Dotnet test
# run: dotnet test src/GitHubActionsDotNet.Api.Tests/GitHubActionsDotNet.Api.Tests.csproj --configuration Release

# - name: Dotnet publish
# run: dotnet publish src/GitHubActionsDotNet.Api/GitHubActionsDotNet.Api.csproj --configuration Release -o artifacts

# - uses: actions/upload-artifact@v4
# with:
# name: domtrain-artifacts
# path: artifacts/

# deploy_dev:
# name: Deploy Dev
# runs-on: ubuntu-latest
# needs: build # By default jobs runs in parallel, this makes sure deploy runs after build

# steps:
# - uses: actions/download-artifact@v4
# with:
# name: domtrain-artifacts #The name "domtrain-artifacts" is what makes teh link between the upload and download steps
# path: artifacts/

- name: Azure login
uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
# # Login to Azure
# - name: Azure login
# uses: azure/login@v2
# with:
# client-id: ${{ secrets.AZURE_CLIENT_ID }}
# tenant-id: ${{ secrets.AZURE_TENANT_ID }}
# subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

# Deploy to Azure Web apps
- name: 'Deploy to Azure App Service'
uses: azure/webapps-deploy@v2
with:
app-name: ${{ env.AZURE_WEBAPP_NAME }} # Replace with your app name, i.e. app-domtrain-github-scottsauber-dev
package: artifacts/
# # Deploy to Azure Web apps
# - name: 'Deploy to Azure App Service'
# uses: azure/webapps-deploy@v2
# with:
# app-name: ${{ env.AZURE_WEBAPP_NAME }} # Replace with your app name, i.e. app-domtrain-github-scottsauber-dev
# package: artifacts/
42 changes: 42 additions & 0 deletions .github/workflows/step-deploy.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,42 @@
name: "Step Deploy"

on:
workflow_call:
inputs:
env:
required: true
type: string
secrets:
AZURE_CLIENT_ID:
required: true
AZURE_TENANT_ID:
required: true
AZURE_SUBSCRIPTION_ID:
required: true

jobs:
deploy:
name: Deploy to ${{ inputs.env }}
runs-on: ubuntu-latest
environment: ${{ inputs.env }}

steps:
- uses: actions/download-artifact@v4
with:
name: domtrain-artifacts #The name "domtrain-artifacts" is what makes teh link between the upload and download steps
path: artifacts/

# Login to Azure
- name: Azure login
uses: azure/login@v2
with:
client-id: ${{ secrets.AZURE_CLIENT_ID }}
tenant-id: ${{ secrets.AZURE_TENANT_ID }}
subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

# Deploy to Azure Web apps
- name: 'Deploy to Azure App Service'
uses: azure/webapps-deploy@v2
with:
app-name: ${{ env.AZURE_WEBAPP_NAME }} # Replace with your app name, i.e. app-domtrain-github-scottsauber-dev
package: artifacts/