Snap CI workflows¶

Reusable GitHub workflows to build, test, release and monitor snaps in CI, maintained in the canonical/robotics-actions-workflows repository.

These workflows implement an opinionated pipeline to build, test and release snaps. They are meant to be called from other repositories with the GitHub Actions reusable workflows mechanism:

jobs:
  snap:
    permissions:
      contents: read
    uses: canonical/robotics-actions-workflows/.github/workflows/snap.yaml@main
    secrets:
      snapstore-login: ${{ secrets.SNAPSTORE_LOGIN }}

Workflows¶

Workflow	Description
snap	Build, test and publish a snap in a single pipeline.
build	Build the snap and upload it as a workflow artifact.
test	Install and test the built snap.
publish	Publish the built snap to the Snap Store.
promote	Promote a snap from one channel to another.
generic-upstream-monitor	Monitor upstream for new versions with custom scripts.
upstream-gh-tag-monitor	Monitor an upstream GitHub repository for new releases.
bump-snap-version	Open a pull request that bumps the snap version.
channel-risk-sync-monitor	Monitor snaps waiting for channel promotion.

Snap name and version resolution¶

The promote, bump-snap-version and monitoring workflows read the snap name and version from the snapcraft.yaml file. They look for it, in order, at .snapcraft.yaml, build-aux/snap/snapcraft.yaml, snap/snapcraft.yaml and snapcraft.yaml under the snapcraft-source-subdir directory. The snap version is the source-tag of the part referenced by adopt-info when both are defined, and the top-level version field otherwise. The upstream monitors compare this value to the upstream version.

Permissions¶

Each reusable workflow follows the principle of least privilege. It declares a minimal set of GITHUB_TOKEN permissions and elevates them only on the jobs that need more.

A called reusable workflow cannot be granted more permissions than its caller. The caller job must therefore grant at least the permissions listed below. Keep a restrictive default at the top of your workflow and grant the rest per job:

# Restrictive default for the whole workflow.
permissions: {}

jobs:
  snap:
    permissions:
      contents: read
    uses: canonical/robotics-actions-workflows/.github/workflows/snap.yaml@main
    secrets:
      snapstore-login: ${{ secrets.SNAPSTORE_LOGIN }}

Workflow	contents	issues	pull-requests	actions
`snap`	read	—	—	write [1]
`build`	read	—	—	—
`test`	read	—	—	—
`publish`	read	—	—	—
`promote`	read	—	—	—
`generic-upstream-monitor`	read	write	—	—
`upstream-gh-tag-monitor`	read	write	—	—
`channel-risk-sync-monitor`	read	write	—	—
`bump-snap-version`	write	read	write	—

Note

The bump-snap-version workflow needs contents: write and pull-requests: write to push the version-bump branch and open the pull request. Pull requests created with the default GITHUB_TOKEN do not trigger further workflow runs. One must thus manually trigger it.