Add optional Entra ID user pre-sync before asset sync (#33) #102
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Tests, Docker (GHCR), and on semver tags: Helm package, GitHub Release, GitHub Pages Helm index. | |
| # Unit tests (pytest) + helm lint run on every push to any branch, every PR to main/master, tags, | |
| # and workflow_dispatch. Docker push to GHCR only on semver tags + workflow_dispatch; PRs with | |
| # code changes also docker build without push. | |
| name: CI, Docker, and Release | |
| on: | |
| push: | |
| branches: | |
| - "**" | |
| tags: | |
| - "v*" | |
| pull_request: | |
| branches: | |
| - main | |
| - master | |
| workflow_dispatch: | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| env: | |
| REGISTRY: ghcr.io | |
| IMAGE_NAME: ${{ github.repository }} | |
| jobs: | |
| changes: | |
| name: Detect code vs docs-only | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| outputs: | |
| code: ${{ steps.filter.outputs.code }} | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Paths filter | |
| uses: dorny/paths-filter@v4 | |
| id: filter | |
| with: | |
| filters: | | |
| code: | |
| - '**' | |
| - '!**/*.md' | |
| - '!docs/**' | |
| - '!.github/ISSUE_TEMPLATE/**' | |
| - '!.github/RELEASE_NOTES_TEMPLATE.md' | |
| - '!.github/LABELS.md' | |
| - '!.cursor/**' | |
| - '!LICENSE' | |
| test: | |
| needs: changes | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Set up Python | |
| uses: actions/setup-python@v6 | |
| with: | |
| python-version: "3.11" | |
| cache: pip | |
| cache-dependency-path: | | |
| requirements.txt | |
| requirements-dev.txt | |
| - name: Install dependencies | |
| run: | | |
| python -m pip install --upgrade pip | |
| pip install -r requirements.txt -r requirements-dev.txt | |
| - name: Run tests | |
| run: python -m pytest tests/ -v | |
| - name: Install Helm | |
| uses: azure/setup-helm@v5 | |
| with: | |
| version: v3.16.2 | |
| - name: Helm lint (chart) | |
| run: helm lint charts/intune2snipe | |
| build-and-push: | |
| name: Build and push Docker image | |
| needs: [test, changes] | |
| if: | | |
| github.event_name == 'workflow_dispatch' || | |
| (github.ref_type == 'tag' && startsWith(github.ref_name, 'v')) || | |
| (github.event_name == 'pull_request' && needs.changes.outputs.code == 'true') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Set up Docker Buildx | |
| uses: docker/setup-buildx-action@v4 | |
| - name: Log in to Container Registry | |
| if: github.event_name != 'pull_request' | |
| uses: docker/login-action@v4 | |
| with: | |
| registry: ${{ env.REGISTRY }} | |
| username: ${{ github.actor }} | |
| password: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Extract metadata (tags, labels) for Docker | |
| id: meta | |
| uses: docker/metadata-action@v6 | |
| with: | |
| images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }} | |
| tags: | | |
| type=ref,event=pr | |
| type=semver,pattern={{version}} | |
| type=semver,pattern={{major}}.{{minor}} | |
| type=semver,pattern={{major}} | |
| type=sha | |
| type=raw,value=latest,enable={{is_default_branch}} | |
| - name: Build and push Docker image | |
| uses: docker/build-push-action@v7 | |
| with: | |
| context: . | |
| file: ./Dockerfile | |
| push: ${{ github.event_name != 'pull_request' }} | |
| tags: ${{ steps.meta.outputs.tags }} | |
| labels: ${{ steps.meta.outputs.labels }} | |
| cache-from: type=gha | |
| cache-to: type=gha,mode=max | |
| helm-release: | |
| name: Helm package and GitHub Release | |
| needs: build-and-push | |
| if: github.ref_type == 'tag' && startsWith(github.ref_name, 'v') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write | |
| actions: write | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| - name: Install Helm | |
| uses: azure/setup-helm@v5 | |
| with: | |
| version: v3.16.2 | |
| - name: Parse version from tag | |
| id: meta | |
| run: | | |
| TAG="${GITHUB_REF_NAME}" | |
| if [[ ! "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then | |
| echo "Tag must be semver: vMAJOR.MINOR.PATCH optional pre-release, got: $TAG" | |
| exit 1 | |
| fi | |
| VER="${TAG#v}" | |
| echo "version=$VER" >> "$GITHUB_OUTPUT" | |
| echo "Packaging Helm chart version $VER (from tag $TAG)" | |
| - name: Package Helm chart | |
| run: | | |
| helm package charts/intune2snipe \ | |
| --version "${{ steps.meta.outputs.version }}" \ | |
| --app-version "${{ steps.meta.outputs.version }}" | |
| - name: Upload chart package for Pages job | |
| uses: actions/upload-artifact@v7 | |
| with: | |
| name: helm-chart-package | |
| path: intune2snipe-*.tgz | |
| if-no-files-found: error | |
| - name: Check for committed release notes (major/minor policy) | |
| id: relnotes | |
| run: | | |
| CUSTOM=".github/release-notes-${GITHUB_REF_NAME}.md" | |
| if [[ -f "$CUSTOM" ]]; then | |
| echo "has_custom=true" >> "$GITHUB_OUTPUT" | |
| echo "Using ${CUSTOM} for release body (see RELEASING.md)." | |
| else | |
| echo "has_custom=false" >> "$GITHUB_OUTPUT" | |
| echo "No ${CUSTOM}; using auto-generated release notes." | |
| fi | |
| - name: Create GitHub Release (committed release notes) | |
| if: steps.relnotes.outputs.has_custom == 'true' | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: ${{ github.ref_name }} | |
| files: intune2snipe-*.tgz | |
| generate_release_notes: false | |
| body_path: .github/release-notes-${{ github.ref_name }}.md | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Create GitHub Release (auto-generated notes) | |
| if: steps.relnotes.outputs.has_custom == 'false' | |
| uses: softprops/action-gh-release@v3 | |
| with: | |
| tag_name: ${{ github.ref_name }} | |
| files: intune2snipe-*.tgz | |
| generate_release_notes: true | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| helm-github-pages: | |
| name: Publish Helm repo (GitHub Pages) | |
| needs: helm-release | |
| if: github.ref_type == 'tag' && startsWith(github.ref_name, 'v') | |
| runs-on: ubuntu-latest | |
| permissions: | |
| pages: write | |
| id-token: write | |
| actions: read | |
| # Do not set `environment: github-pages` here: the default github-pages environment | |
| # often restricts deployments to branches only, which blocks tag-triggered releases. | |
| # OIDC + pages:write still authorize the deploy (see actions/deploy-pages README). | |
| concurrency: | |
| group: pages | |
| cancel-in-progress: false | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v7 | |
| with: | |
| fetch-depth: 0 | |
| - name: Install Helm | |
| uses: azure/setup-helm@v5 | |
| with: | |
| version: v3.16.2 | |
| - name: Download chart package from release job | |
| uses: actions/download-artifact@v8 | |
| with: | |
| name: helm-chart-package | |
| path: chart-download | |
| - name: Build Helm repository index | |
| env: | |
| TAG: ${{ github.ref_name }} | |
| CHART_LOCAL_DIR: ${{ github.workspace }}/chart-download | |
| run: bash .github/scripts/update-helm-repo-index.sh | |
| - name: Upload Pages artifact | |
| uses: actions/upload-pages-artifact@v5 | |
| with: | |
| path: ./helm-chart-repo | |
| - name: Deploy to GitHub Pages | |
| id: deployment | |
| uses: actions/deploy-pages@v5 |