Merge pull request #5529 from fluxcd/fluxcd/gha-workflows

ci: Refactor CI with `fluxcd/gha-workflows`

.github/workflows/backport.yaml

@@ -1,34 +1,12 @@
 name: backport
-
 on:
   pull_request_target:
     types: [closed, labeled]
-
-permissions: 
-  contents: read
-
 jobs:
-  pull-request:
+  backport:
-    runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: write # for reading and creating branches.
-      pull-requests: write
+      pull-requests: write # for creating pull requests against release branches.
-    if: github.event.pull_request.state == 'closed' && github.event.pull_request.merged && (github.event_name != 'labeled' || startsWith('backport:', github.event.label.name))
+    uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.3.0
-    steps:
+    secrets:
-      - name: Checkout
+      github-token: ${{ secrets.GITHUB_TOKEN }}
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          ref: ${{ github.event.pull_request.head.sha }}
-      - name: Create backport PRs
-        uses: korthout/backport-action@ca4972adce8039ff995e618f5fc02d1b7961f27a # v3.3.0
-        # xref: https://github.com/korthout/backport-action#inputs
-        with:
-          # Use token to allow workflows to be triggered for the created PR
-          github_token: ${{ secrets.BOT_GITHUB_TOKEN }}
-          # Match labels with a pattern `backport:<target-branch>`
-          label_pattern: '^backport:([^ ]+)$'
-          # A bit shorter pull-request title than the default
-          pull_title: '[${target_branch}] ${pull_title}'
-          # Simpler PR description than default
-          pull_description: |-
-            Automated backport to `${target_branch}`, triggered by a label in #${pull_number}.

.github/workflows/scan.yaml

@@ -1,5 +1,4 @@
 name: scan
-
 on:
   workflow_dispatch:
   push:
@@ -8,46 +7,12 @@ on:
     branches: [ 'main', 'release/**' ]
   schedule:
     - cron: '18 10 * * 3'
-
-permissions:
-  contents: read
-
 jobs:
-  scan-fossa:
+  analyze:
-    runs-on: ubuntu-latest
-    if: github.actor != 'dependabot[bot]'
-    steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-      - name: Run FOSSA scan and upload build data
-        uses: fossa-contrib/fossa-action@3d2ef181b1820d6dcd1972f86a767d18167fa19b # v3.0.1
-        with:
-          # FOSSA Push-Only API Token
-          fossa-api-key: 5ee8bf422db1471e0bcf2bcb289185de
-          github-token: ${{ github.token }}
-
-  scan-codeql:
-    runs-on: ubuntu-latest
     permissions:
-      security-events: write
+      contents: read # for reading the repository code.
-    if: github.actor != 'dependabot[bot]'
+      security-events: write # for uploading the CodeQL analysis results.
-    steps:
+    uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.3.0
-      - name: Checkout repository
+    secrets:
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      github-token: ${{ secrets.GITHUB_TOKEN }}
-      - name: Setup Go
+      fossa-token: ${{ secrets.FOSSA_TOKEN }}
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
-        with:
-          go-version-file: 'go.mod'
-          cache-dependency-path: |
-            **/go.sum
-            **/go.mod
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11
-        with:
-          languages: go
-          # xref: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-          # xref: https://codeql.github.com/codeql-query-help/go/
-          queries: security-and-quality
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11

.github/workflows/sync-labels.yaml

@@ -6,23 +6,11 @@ on:
       - main
     paths:
       - .github/labels.yaml
-
-permissions:
-  contents: read
-
 jobs:
-  labels:
+  sync-labels:
-    name: Run sync
-    runs-on: ubuntu-latest
     permissions:
-      issues: write
+      contents: read # for reading the labels file.
-    steps:
+      issues: write # for creating and updating labels.
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+    uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.3.0
-      - uses: EndBug/label-sync@52074158190acb45f3077f9099fea818aa43f97a # v2.3.3
+    secrets:
-        with:
+      github-token: ${{ secrets.GITHUB_TOKEN }}
-          # Configuration file
-          config-file: |
-            https://raw.githubusercontent.com/fluxcd/community/main/.github/standard-labels.yaml
-            .github/labels.yaml
-          # Strictly declarative
-          delete-other-labels: true