CNTRLPLANE-3352: Convert GHA callers to use reusable workflows @main

.github/workflows/codespell.yaml

@@ -6,16 +6,8 @@ on:
       - main
       - release-4.22
 
-permissions:
-  contents: read
-
 jobs:
   codespell:
-    name: Codespell
-    runs-on: arc-runner-set
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - run: make verify-codespell
+    uses: openshift/hypershift/.github/workflows/codespell-reusable.yaml@main
+    permissions:
+      contents: read

.github/workflows/cpo-container-sync.yaml

@@ -6,16 +6,8 @@ on:
       - main
       - release-4.22
 
-permissions:
-  contents: read
-
 jobs:
   cpo-container-sync:
-    name: CPO Container Sync
-    runs-on: arc-runner-set
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - run: make cpo-container-sync
+    uses: openshift/hypershift/.github/workflows/cpo-container-sync-reusable.yaml@main
+    permissions:
+      contents: read

.github/workflows/docs-build.yaml

@@ -9,30 +9,8 @@ on:
       - 'docs/**'
       - '.github/workflows/docs-build.yaml'
 
-permissions:
-  contents: read
-
 jobs:
   build:
-    name: Build Docs
-    runs-on: arc-runner-set
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-        with:
-          python-version: '3.x'
-          pip-install: '-r docs/requirements.txt'
-        env:
-          PIP_CACHE_DIR: ${{ runner.temp }}/.pip-cache
-      - name: Build documentation
-        run: mkdocs build --strict
-        working-directory: docs
-      - name: Save PR metadata
-        run: echo "${{ github.event.pull_request.number }}" > docs/site/pr-number.txt
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: docs-site
-          path: docs/site
+    uses: openshift/hypershift/.github/workflows/docs-build-reusable.yaml@main
+    permissions:
+      contents: read

.github/workflows/envtest-kube-reusable.yaml

@@ -24,19 +24,19 @@ jobs:
       - name: Check for relevant file changes
         id: check
         env:
-          EVENT_NAME: ${{ github.event_name }}
-          CREATED: ${{ github.event.created }}
-          PR_DIFF_REF: origin/${{ github.base_ref }}...HEAD
-          PUSH_DIFF_REF: ${{ github.event.before }}..HEAD
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PUSH_BEFORE_SHA: ${{ github.event.before }}
         run: |
-          if [ "$EVENT_NAME" = "workflow_dispatch" ] || [ "$CREATED" = "true" ]; then
+          set -euo pipefail
+          if [ -n "${PR_BASE_SHA:-}" ] && [ -n "${PR_HEAD_SHA:-}" ]; then
+            ref="${PR_BASE_SHA}...${PR_HEAD_SHA}"
+          elif [ -n "${PUSH_BEFORE_SHA:-}" ] && [ "$PUSH_BEFORE_SHA" != "0000000000000000000000000000000000000000" ]; then
+            ref="${PUSH_BEFORE_SHA}..HEAD"
+          else
             echo "should_run=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          ref="$PUSH_DIFF_REF"
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            ref="$PR_DIFF_REF"
-          fi
           if git diff --name-only "$ref" | grep -qE '^(api/|test/envtest/|cmd/install/assets/crds/hypershift-operator/tests/|karpenter-operator/controllers/karpenter/assets/tests/|\.github/workflows/envtest-kube(-reusable)?\.yaml$)'; then
             echo "should_run=true"
           else

.github/workflows/envtest-kube.yaml

@@ -1,88 +1,14 @@
 name: Envtest Vanilla Kube API Validation
 
 on:
-  push:
-    branches:
-      - main
-      - release-4.22
   pull_request:
     branches:
       - main
       - release-4.22
   workflow_dispatch: {}
 
-permissions:
-  contents: read
-
 jobs:
-  changes:
-    name: Detect Changes
-    runs-on: arc-runner-set
-    outputs:
-      should_run: ${{ steps.check.outputs.should_run }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - name: Check for relevant file changes
-        id: check
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          CREATED: ${{ github.event.created }}
-          PR_DIFF_REF: origin/${{ github.base_ref }}...HEAD
-          PUSH_DIFF_REF: ${{ github.event.before }}..HEAD
-        run: |
-          if [ "$EVENT_NAME" = "workflow_dispatch" ] || [ "$CREATED" = "true" ]; then
-            echo "should_run=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          ref="$PUSH_DIFF_REF"
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            ref="$PR_DIFF_REF"
-          fi
-          if git diff --name-only "$ref" | grep -qE '^(api/|test/envtest/|cmd/install/assets/crds/hypershift-operator/tests/|karpenter-operator/controllers/karpenter/assets/tests/|\.github/workflows/envtest-kube\.yaml$)'; then
-            echo "should_run=true"
-          else
-            echo "should_run=false"
-          fi >> "$GITHUB_OUTPUT"
-
   envtest-kube:
-    name: Envtest Vanilla Kube ${{ matrix.version }}
-    needs: changes
-    if: needs.changes.outputs.should_run == 'true'
-    runs-on: arc-runner-set
-    timeout-minutes: 15
-    strategy:
-      fail-fast: false
-      matrix:
-        version: ["1.31.0", "1.32.0", "1.33.0", "1.34.0", "1.35.0"]
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - run: make test-envtest-kube ENVTEST_KUBE_VERSIONS="${{ matrix.version }}"
-
-  conclusion:
-    name: Conclusion
-    needs:
-      - changes
-      - envtest-kube
-    if: always()
-    runs-on: arc-runner-set
-    steps:
-      - name: Aggregate results
-        run: |
-          changes_result="${{ needs.changes.result }}"
-          envtest_result="${{ needs.envtest-kube.result }}"
-          if [ "$changes_result" != "success" ]; then
-            echo "Change detection failed: $changes_result"
-            exit 1
-          fi
-          if [ "$envtest_result" = "success" ] || [ "$envtest_result" = "skipped" ]; then
-            echo "All envtest jobs passed or were skipped"
-            exit 0
-          else
-            echo "Envtest jobs failed: $envtest_result"
-            exit 1
-          fi
+    uses: openshift/hypershift/.github/workflows/envtest-kube-reusable.yaml@main
+    permissions:
+      contents: read

.github/workflows/envtest-ocp-reusable.yaml

@@ -24,19 +24,19 @@ jobs:
       - name: Check for relevant file changes
         id: check
         env:
-          EVENT_NAME: ${{ github.event_name }}
-          CREATED: ${{ github.event.created }}
-          PR_DIFF_REF: origin/${{ github.base_ref }}...HEAD
-          PUSH_DIFF_REF: ${{ github.event.before }}..HEAD
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PUSH_BEFORE_SHA: ${{ github.event.before }}
         run: |
-          if [ "$EVENT_NAME" = "workflow_dispatch" ] || [ "$CREATED" = "true" ]; then
+          set -euo pipefail
+          if [ -n "${PR_BASE_SHA:-}" ] && [ -n "${PR_HEAD_SHA:-}" ]; then
+            ref="${PR_BASE_SHA}...${PR_HEAD_SHA}"
+          elif [ -n "${PUSH_BEFORE_SHA:-}" ] && [ "$PUSH_BEFORE_SHA" != "0000000000000000000000000000000000000000" ]; then
+            ref="${PUSH_BEFORE_SHA}..HEAD"
+          else
             echo "should_run=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
-          ref="$PUSH_DIFF_REF"
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            ref="$PR_DIFF_REF"
-          fi
           if git diff --name-only "$ref" | grep -qE '^(api/|test/envtest/|cmd/install/assets/crds/hypershift-operator/tests/|karpenter-operator/controllers/karpenter/assets/tests/|\.github/workflows/envtest-ocp(-reusable)?\.yaml$)'; then
             echo "should_run=true"
           else

.github/workflows/envtest-ocp.yaml

@@ -1,89 +1,14 @@
 name: Envtest OCP API Validation
 
 on:
-  push:
-    branches:
-      - main
-      - release-4.22
   pull_request:
     branches:
       - main
       - release-4.22
   workflow_dispatch: {}
 
-permissions:
-  contents: read
-
 jobs:
-  changes:
-    name: Detect Changes
-    runs-on: arc-runner-set
-    outputs:
-      should_run: ${{ steps.check.outputs.should_run }}
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - name: Check for relevant file changes
-        id: check
-        env:
-          EVENT_NAME: ${{ github.event_name }}
-          CREATED: ${{ github.event.created }}
-          PR_DIFF_REF: origin/${{ github.base_ref }}...HEAD
-          PUSH_DIFF_REF: ${{ github.event.before }}..HEAD
-        run: |
-          if [ "$EVENT_NAME" = "workflow_dispatch" ] || [ "$CREATED" = "true" ]; then
-            echo "should_run=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          ref="$PUSH_DIFF_REF"
-          if [ "$EVENT_NAME" = "pull_request" ]; then
-            ref="$PR_DIFF_REF"
-          fi
-          if git diff --name-only "$ref" | grep -qE '^(api/|test/envtest/|cmd/install/assets/crds/hypershift-operator/tests/|karpenter-operator/controllers/karpenter/assets/tests/|\.github/workflows/envtest-ocp\.yaml$)'; then
-            echo "should_run=true"
-          else
-            echo "should_run=false"
-          fi >> "$GITHUB_OUTPUT"
-
   envtest-ocp:
-    name: Envtest OCP (K8s ${{ matrix.version }})
-    needs: changes
-    if: needs.changes.outputs.should_run == 'true'
-    runs-on: arc-runner-set
-    timeout-minutes: 15
-    strategy:
-      fail-fast: false
-      matrix:
-        # OCP 4.17=1.30, 4.18=1.31, 4.19=1.32, 4.20=1.33, 4.21=1.34, 4.22=1.35
-        version: ["1.30.3", "1.31.2", "1.32.1", "1.33.2", "1.34.1", "1.35.1"]
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-      - run: make test-envtest-ocp ENVTEST_OCP_K8S_VERSIONS="${{ matrix.version }}"
-
-  conclusion:
-    name: Conclusion
-    needs:
-      - changes
-      - envtest-ocp
-    if: always()
-    runs-on: arc-runner-set
-    steps:
-      - name: Aggregate results
-        run: |
-          changes_result="${{ needs.changes.result }}"
-          envtest_result="${{ needs.envtest-ocp.result }}"
-          if [ "$changes_result" != "success" ]; then
-            echo "Change detection failed: $changes_result"
-            exit 1
-          fi
-          if [ "$envtest_result" = "success" ] || [ "$envtest_result" = "skipped" ]; then
-            echo "All envtest jobs passed or were skipped"
-            exit 0
-          else
-            echo "Envtest jobs failed: $envtest_result"
-            exit 1
-          fi
+    uses: openshift/hypershift/.github/workflows/envtest-ocp-reusable.yaml@main
+    permissions:
+      contents: read

.github/workflows/gitlint.yaml

@@ -6,20 +6,8 @@ on:
       - main
       - release-4.22
 
-permissions:
-  contents: read
-
 jobs:
   gitlint:
-    name: Gitlint
-    runs-on: arc-runner-set
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-      - run: make run-gitlint
-        env:
-          PULL_BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          PULL_PULL_SHA: ${{ github.event.pull_request.head.sha }}
+    uses: openshift/hypershift/.github/workflows/gitlint-reusable.yaml@main
+    permissions:
+      contents: read

.github/workflows/lint-reusable.yaml

@@ -16,7 +16,10 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - run: git fetch origin ${{ github.base_ref }}:${{ github.base_ref }}
+      - run: |
+          if [ -n "${{ github.base_ref }}" ]; then
+            git fetch origin "${{ github.base_ref }}:${{ github.base_ref }}"
+          fi
       - name: Use pre-built lint tools
         run: |
           if [ -d /opt/lint-tools ]; then

.github/workflows/lint.yaml

@@ -6,25 +6,8 @@ on:
       - main
       - release-4.22
 
-permissions:
-  contents: read
-
 jobs:
   lint:
-    name: Lint
-    runs-on: arc-runner-set
-    timeout-minutes: 60
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-      - run: git fetch origin ${{ github.base_ref }}:${{ github.base_ref }}
-      - name: Use pre-built lint tools
-        run: |
-          if [ -d /opt/lint-tools ]; then
-            mkdir -p hack/tools/bin
-            cp /opt/lint-tools/golangci-lint hack/tools/bin/
-            cp /opt/lint-tools/kube-api-linter.so hack/tools/bin/
-            touch hack/tools/bin/golangci-lint hack/tools/bin/kube-api-linter.so
-          fi
-      - run: make lint
+    uses: openshift/hypershift/.github/workflows/lint-reusable.yaml@main
+    permissions:
+      contents: read