Skip to content

Commit

Permalink
Hack week 2025: remove unneeded FBV instances (5) - Actions (#53895)
Browse files Browse the repository at this point in the history
  • Loading branch information
mchammer01 authored Jan 15, 2025
1 parent 29ce876 commit 87776f2
Show file tree
Hide file tree
Showing 21 changed files with 14 additions and 94 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -28,12 +28,8 @@ For information on supported operating systems for self-hosted runners, or using
You can set up automation to scale the number of self-hosted runners. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/autoscaling-with-self-hosted-runners).

{% ifversion actions-single-use-tokens %}

You can register ephemeral runners that perform a single job before the registration is cleaned up by using just-in-time runner registration. For more information, see [AUTOTITLE](/actions/security-guides/security-hardening-for-github-actions#using-just-in-time-runners).

{% endif %}

## Prerequisites

{% data reusables.actions.self-hosted-runners-prerequisites %}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -48,12 +48,8 @@ The {% data variables.product.prodname_actions %} service will then automaticall
> [!NOTE]
> If a job is labeled for a certain type of runner, but none matching that type are available, the job does not immediately fail at the time of queueing. Instead, the job will remain queued until the 24 hour timeout period expires.
{% ifversion actions-single-use-tokens %}

Alternatively, you can create ephemeral, just-in-time runners using the REST API. For more information, see [AUTOTITLE](/rest/actions/self-hosted-runners).

{% endif %}

## Controlling runner software updates on self-hosted runners

By default, self-hosted runners will automatically perform a software update whenever a new version of the runner software is available. If you use ephemeral runners in containers then this can lead to repeated software updates when a new runner version is released. Turning off automatic updates allows you to update the runner version on the container image directly on your own schedule.
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,7 @@ shortTitle: Remove self-hosted runners
> [!NOTE]
> * {% data reusables.actions.self-hosted-runner-removal-impact %}
> * {% data reusables.actions.self-hosted-runner-auto-removal %}
{%- ifversion actions-single-use-tokens %}
> * {% data reusables.actions.jit-runner-removal %}
{%- endif %}
To remove a self-hosted runner from a user repository you must be the repository owner. Organization owners{% ifversion custom-org-roles %} and users with the "Manage organization runners and runner groups" permission{% endif %} can remove a runner from a repository in the organization. {% ifversion custom-org-roles %}For more information about custom organization roles, see [AUTOTITLE](/organizations/managing-peoples-access-to-your-organization-with-roles/about-custom-organization-roles).{% endif %}

Expand All @@ -42,9 +40,7 @@ For information about how to remove a self-hosted runner with the REST API, see
> [!NOTE]
> * {% data reusables.actions.self-hosted-runner-removal-impact %}
> * {% data reusables.actions.self-hosted-runner-auto-removal %}
{%- ifversion actions-single-use-tokens %}
> * {% data reusables.actions.jit-runner-removal %}
{%- endif %}
To remove a self-hosted runner from an organization, you must be an organization owner{% ifversion custom-org-roles %} or have the "Manage organization runners and runner groups" permission{% endif %}. We recommend that you also have access to the self-hosted runner machine. For information about how to remove a self-hosted runner with the REST API, see [AUTOTITLE](/rest/actions/self-hosted-runners).

Expand All @@ -67,11 +63,8 @@ If you use {% data variables.product.prodname_ghe_cloud %}, you can also remove
> [!NOTE]
> * {% data reusables.actions.self-hosted-runner-removal-impact %}
> * {% data reusables.actions.self-hosted-runner-auto-removal %}
{%- ifversion actions-single-use-tokens %}
> * {% data reusables.actions.jit-runner-removal %}
{%- endif %}

To remove a self-hosted runner from an enterprise, you must be an enterprise owner. We recommend that you also have access to the self-hosted runner machine. For information about how to remove a self-hosted runner with the REST API, see the enterprise endpoints in the [{% data variables.product.prodname_actions %} REST API](/rest/actions/self-hosted-runners).

{% data reusables.actions.self-hosted-runner-reusing %}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ The following table shows the permissions granted to the `GITHUB_TOKEN` by defau
| {% endif %} |
| issues | read/write | none | read |
| metadata | read | read | read |
| packages | read/write | {% ifversion actions-default-workflow-permissions-restrictive %}read{% else %}none{% endif %} | read |
| packages | read/write | read | read |
| pages | read/write | none | read |
| pull-requests | read/write | none | read |
| repository-projects | read/write | none | read |
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -352,8 +352,6 @@ You should also consider the environment of the self-hosted runner machines:

Some customers might attempt to partially mitigate these risks by implementing systems that automatically destroy the self-hosted runner after each job execution. However, this approach might not be as effective as intended, as there is no way to guarantee that a self-hosted runner only runs one job. Some jobs will use secrets as command-line arguments which can be seen by another job running on the same runner, such as `ps x -w`. This can lead to secret leakages.

{% ifversion actions-single-use-tokens %}

### Using just-in-time runners

To improve runner registration security, you can use the REST API to create ephemeral, just-in-time (JIT) runners. These self-hosted runners perform at most one job before being automatically removed from the repository, organization, or enterprise. For more information about configuring JIT runners, see [AUTOTITLE](/rest/actions/self-hosted-runners#create-configuration-for-a-just-in-time-runner-for-an-organization).
Expand All @@ -367,8 +365,6 @@ Once you have the config file from the REST API response, you can pass it to the
./run.sh --jitconfig ${encoded_jit_config}
```

{% endif %}

### Planning your management strategy for self-hosted runners

A self-hosted runner can be added to various levels in your {% data variables.product.prodname_dotcom %} hierarchy: the enterprise, organization, or repository level. This placement determines who will be able to manage the runner:
Expand Down
2 changes: 1 addition & 1 deletion content/actions/sharing-automations/required-workflows.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ redirect_from:

## Overview

You can configure a workflow that must run in repositories in an organization for all pull requests opened against {% ifversion actions-required-workflow-improvements %}any target branch{% else %}the default branch{% endif %}. Required workflows allow you to implement organization-wide CI/CD policies that apply to current and future repositories. A required workflow is triggered by {% ifversion actions-required-workflow-improvements %}`pull_request` and `pull_request_target` default events{% else %}pull request events{% endif %} and appears as a required status check, which blocks the ability to merge the pull request until the required workflow succeeds.
You can configure a workflow that must run in repositories in an organization for all pull requests opened against any target branch. Required workflows allow you to implement organization-wide CI/CD policies that apply to current and future repositories. A required workflow is triggered by `pull_request` and `pull_request_target` default events and appears as a required status check, which blocks the ability to merge the pull request until the required workflow succeeds.

Required workflows are not the same as reusable workflows. Reusable workflows can be called by another workflow. Required workflows are enforced on repositories by an organization owner.

Expand Down
17 changes: 2 additions & 15 deletions content/actions/sharing-automations/reusing-workflows.md
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,6 @@ Called workflows that are owned by the same user or organization{% ifversion ghe
* You can call a maximum of 20 unique reusable workflows from a single workflow file.
{% endif %}
{% ifversion private-actions %}{% else %}- Reusable workflows stored within a private repository can only be used by workflows within the same repository.{% endif %}
{% ifversion actions-reusable-workflow-matrix %}{% else %}* The `strategy` property is not supported in any job that calls a reusable workflow.{% endif %}
* Any environment variables set in an `env` context defined at the workflow level in the caller workflow are not propagated to the called workflow. For more information, see [AUTOTITLE](/actions/learn-github-actions/variables) and [AUTOTITLE](/actions/learn-github-actions/contexts#env-context).
* Similarly, environment variables set in the `env` context, defined in the called workflow, are not accessible in the `env` context of the caller workflow. Instead, you must use outputs of the reusable workflow. For more information, see [Using outputs from a reusable workflow](#using-outputs-from-a-reusable-workflow).
* To reuse variables in multiple workflows, set them at the organization, repository, or environment levels and reference them using the `vars` context. For more information see [AUTOTITLE](/actions/learn-github-actions/variables) and [AUTOTITLE](/actions/learn-github-actions/contexts#vars-context).
Expand Down Expand Up @@ -142,16 +141,11 @@ You can define inputs and secrets, which can be passed from the caller workflow

{% endraw %}
For details of the syntax for defining inputs and secrets, see [`on.workflow_call.inputs`](/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_callinputs) and [`on.workflow_call.secrets`](/actions/using-workflows/workflow-syntax-for-github-actions#onworkflow_callsecrets).
{% ifversion actions-inherit-secrets-reusable-workflows %}
1. In the reusable workflow, reference the input or secret that you defined in the `on` key in the previous step.

> [!NOTE]
> If the secrets are inherited by using `secrets: inherit` in the calling workflow, you can reference them even if they are not explicitly defined in the `on` key. For more information, see [AUTOTITLE](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idsecretsinherit).

{%- else %}
1. In the reusable workflow, reference the input or secret that you defined in the `on` key in the previous step.
{%- endif %}

{% raw %}

```yaml
Expand Down Expand Up @@ -225,8 +219,6 @@ You can call multiple workflows, referencing each in a separate job.

{% data reusables.actions.pass-inputs-to-reusable-workflows %}

{% ifversion actions-reusable-workflow-matrix %}

### Using a matrix strategy with a reusable workflow

Jobs using the matrix strategy can call a reusable workflow.
Expand All @@ -249,7 +241,6 @@ jobs:
```

{% endraw %}
{% endif %}

### Supported keywords for jobs that call a reusable workflow

Expand All @@ -261,12 +252,8 @@ When you call a reusable workflow, you can only use the following keywords in th
* [`jobs.<job_id>.with.<input_id>`](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idwithinput_id)
* [`jobs.<job_id>.secrets`](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idsecrets)
* [`jobs.<job_id>.secrets.<secret_id>`](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idsecretssecret_id)
{%- ifversion actions-inherit-secrets-reusable-workflows %}
* [`jobs.<job_id>.secrets.inherit`](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idsecretsinherit)
{%- endif %}
{%- ifversion actions-reusable-workflow-matrix %}
* [`jobs.<job_id>.strategy`](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstrategy)
{%- endif %}
* [`jobs.<job_id>.needs`](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idneeds)
* [`jobs.<job_id>.if`](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idif)
* [`jobs.<job_id>.concurrency`](/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idconcurrency)
Expand Down Expand Up @@ -368,10 +355,10 @@ For information on how to use the API to determine which workflow files were inv

## Using outputs from a reusable workflow

A reusable workflow may generate data that you want to use in the caller workflow. To use these outputs, you must specify them as the outputs of the reusable workflow.{% ifversion actions-reusable-workflow-matrix %}
A reusable workflow may generate data that you want to use in the caller workflow. To use these outputs, you must specify them as the outputs of the reusable workflow.

If a reusable workflow that sets an output is executed with a matrix strategy, the output will be the output set by the last successful completing reusable workflow of the matrix which actually sets a value.
That means if the last successful completing reusable workflow sets an empty string for its output, and the second last successful completing reusable workflow sets an actual value for its output, the output will contain the value of the second last completing reusable workflow.{% endif %}
That means if the last successful completing reusable workflow sets an empty string for its output, and the second last successful completing reusable workflow sets an actual value for its output, the output will contain the value of the second last completing reusable workflow.

The following reusable workflow has a single job containing two steps. In each of these steps we set a single word as the output: "hello" and "world." In the `outputs` section of the job, we map these step outputs to job outputs called: `output1` and `output2`. In the `on.workflow_call.outputs` section we then define two outputs for the workflow itself, one called `firstword` which we map to `output1`, and one called `secondword` which we map to `output2`.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -148,9 +148,8 @@ You can use `go get` to install dependencies:

### Caching dependencies

You can cache and restore dependencies using the [`setup-go` action](https://github.com/actions/setup-go). By default, caching is {% ifversion actions-setup-go-default-cache-enabled %}enabled when using the `setup-go` action.{% else %}disabled, but you can set the `cache` parameter to `true` to enable it.{% endif %}
You can cache and restore dependencies using the [`setup-go` action](https://github.com/actions/setup-go). By default, caching is enabled when using the `setup-go` action.

{% ifversion actions-setup-go-default-cache-enabled %}
The `setup-go` action searches for the dependency file, `go.sum`, in the repository root and uses the hash of the dependency file as a part of the cache key.

You can use the `cache-dependency-path` parameter for cases when multiple dependency files are used, or when they are located in different subdirectories.
Expand All @@ -163,30 +162,6 @@ You can use the `cache-dependency-path` parameter for cases when multiple depend
cache-dependency-path: subdir/go.sum
```

{% else %}

When caching is enabled, the `setup-go` action searches for the dependency file, `go.sum`, in the repository root and uses the hash of the dependency file as a part of the cache key.

```yaml copy
- name: Setup Go
uses: {% data reusables.actions.action-setup-go %}
with:
go-version: '1.21.x'
cache: true
```

Alternatively, you can use the `cache-dependency-path` parameter for cases when multiple dependency files are used, or when they are located in different subdirectories.

```yaml copy
- uses: {% data reusables.actions.action-setup-go %}
with:
go-version: '1.17'
cache: true
cache-dependency-path: subdir/go.sum
```

{% endif %}

If you have a custom requirement or need finer controls for caching, you can use the [`cache` action](https://github.com/marketplace/actions/cache). For more information, see [AUTOTITLE](/actions/using-workflows/caching-dependencies-to-speed-up-workflows).

## Building and testing your code
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ title: Enabling GitHub Actions with Google Cloud Storage
intro: 'You can enable {% data variables.product.prodname_actions %} on {% data variables.product.prodname_ghe_server %} and use Google Cloud Storage to store data generated by workflow runs.'
permissions: 'Site administrators can enable {% data variables.product.prodname_actions %} and configure enterprise settings.'
versions:
feature: actions-ghes-gcp-storage
ghes: '*'
type: how_to
topics:
- Actions
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -79,9 +79,7 @@ All other {% data variables.product.prodname_actions %} data, such as the workfl

* Azure Blob storage
* Amazon S3
{%- ifversion actions-ghes-gcp-storage %}
* Google Cloud Storage
{%- endif %}
* S3-compatible MinIO cluster

> [!NOTE]
Expand All @@ -101,9 +99,7 @@ Follow one of the procedures below to enable {% data variables.product.prodname_

* [Enabling GitHub Actions with Azure Blob storage](/admin/github-actions/enabling-github-actions-for-github-enterprise-server/enabling-github-actions-with-azure-blob-storage)
* [Enabling GitHub Actions with Amazon S3 storage](/admin/github-actions/enabling-github-actions-for-github-enterprise-server/enabling-github-actions-with-amazon-s3-storage)
{%- ifversion actions-ghes-gcp-storage %}
* [Enabling GitHub Actions with Google Cloud Storage](/admin/github-actions/enabling-github-actions-for-github-enterprise-server/enabling-github-actions-with-google-cloud-storage)
{%- endif %}
* [Enabling GitHub Actions with MinIO storage](/admin/github-actions/enabling-github-actions-for-github-enterprise-server/enabling-github-actions-with-minio-storage)

## Managing access permissions for {% data variables.product.prodname_actions %} in your enterprise
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -96,7 +96,6 @@ The following aggregate metrics will be collected and transmitted on a daily bas
| AN | `ghe_stats.users.total_users` | Number of user accounts |
| AO | `ghe_stats.users.admin_users` | Number of user accounts that are site administrators |
| AP | `ghe_stats.users.suspended_users` | Number of user accounts that are suspended |
| {% ifversion actions-server-statistics %} |
| AQ | `actions_stats.number_of_repos_using_actions` | Number of repositories using {% data variables.product.prodname_actions %} |
| AR | `actions_stats.percentage_of_repos_using_actions` | Percentage of repositories using {% data variables.product.prodname_actions %} |
| AS | `packages_stats.registry_enabled` | Whether {% data variables.product.prodname_registry %} with repository-scoped packages is enabled for {% data variables.location.product_location %} |
Expand Down Expand Up @@ -167,7 +166,6 @@ The following aggregate metrics will be collected and transmitted on a daily bas
| DF |`packages_stats.ecosystems.containers.daily_update_count` | Number of container images updated |
| DG |`packages_stats.ecosystems.containers.daily_delete_count` | Number of container images deleted |
| DH | `packages_stats.ecosystems.containers.daily_create_count` | Number of container images created |
| {% endif %} |

## {% data variables.product.prodname_server_statistics %} data examples

Expand Down
Loading

0 comments on commit 87776f2

Please sign in to comment.