zakoverflow / note-arduino / 39994412146

92%

push

github

ci: tag CI image by Dockerfile hash, parallelize memcheck, harden workflows (#171)

* ci: tag CI image by Dockerfile hash, parallelize memcheck, harden workflows

- Replace dorny/paths-filter and the skippable build job with a ci_image
  job that tags the image by Dockerfile hash and only builds when that tag
  is missing from ghcr (or force_build is set).
- Drop if: always() so tests and examples never run against a stale image
  after a failed build, and stop running after a cancel.
- Publish on every passing master run and point latest at the tested image,
  guarded so an old re-run can't roll latest back. force_build only
  publishes from master.
- Run unit tests and Valgrind memcheck in parallel (CTEST_PARALLEL_LEVEL).
- Cancel superseded PR runs; never cancel master runs.
- Least-privilege token permissions, timeouts, 7-day artifact retention.
- Add Dependabot for GitHub Actions, including the composite action.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci: pass the resolved CI image digest between jobs

Resolve an existing dockerfile-<hash> tag to its digest once in ci_image
so every job in a run uses the same image, and promote latest from the
exact digest that was tested (imagetools copy, no re-pull by tag).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci: only the head of master publishes the CI image, one run at a time

Check that the run is still master's head before pushing anything, gate
every publish step on it, and serialize publish jobs across runs so an
older or concurrent run can't overwrite the dockerfile-<hash> tag or latest.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* ci: make the CI image hash tag write-once and queue publishes

The hash tag is only pushed when missing (or on force_build), so an older
or concurrent build can't replace a newer one, and a build from a run
that isn't master's head still lands. latest moves only from the head of
master, to the exact digest that run tes... (continued)

114 of 142 branches covered (80.28%)

Branch coverage included in aggregate %.

349 of 355 relevant lines covered (98.31%)

20.23 hits per line