ci: consolidate and harden CI workflows

.github/actions/fix-directory/action.yml

@@ -0,0 +1,18 @@
+name: Fix Directory Structure
+description: >
+  Moves checked-out files from the nested GitHub Actions workspace layout to
+  /home/runner/_work/claasp as expected by the self-hosted runner environment
+  and the project Makefile.
+runs:
+  using: composite
+  steps:
+    - name: Relocate workspace
+      shell: bash
+      run: |
+        mkdir /home/runner/_work/claasp_backup
+        mv -f /home/runner/_work/claasp/claasp/* /home/runner/_work/claasp_backup
+        rm -rf /home/runner/_work/claasp/
+        mkdir /home/runner/_work/claasp
+        mv -f /home/runner/_work/claasp_backup/* /home/runner/_work/claasp
+        chmod g+w /home/runner/_work/claasp/ -R
+        rm -rf /home/runner/_work/claasp_backup

.github/workflows/build-claasp-base-image.yaml

@@ -16,7 +16,7 @@ jobs:
         os: [ubuntu-latest]
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         persist-credentials: false
         fetch-depth: 0

.github/workflows/build-main-webapp-image.yaml

@@ -9,23 +9,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         persist-credentials: false
         fetch-depth: 0
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v2
 
-    - name: Cache Docker layers
-      uses: actions/cache@v3
-      with:
-        path: /tmp/.buildx-cache
-        key: ${{ runner.os }}-buildx-${{ github.sha }}
-        restore-keys: |
-          ${{ runner.os }}-buildx-
-
-
     - name: Login dockerhub
       uses: docker/login-action@v3
       with:
@@ -40,19 +31,14 @@ jobs:
         file: ./docker/Dockerfile
         push: true
         tags: tiicrc/claasp-lib:latest
-        cache-from: type=local,src=/tmp/.buildx-cache
-        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
-
-    - name: Move cache
-      run: |
-        rm -rf /tmp/.buildx-cache
-        mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+        cache-from: type=gha,scope=claasp-base
+        cache-to: type=gha,scope=claasp-base,mode=max
 
   commit-deployment-repo:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         persist-credentials: false
         fetch-depth: 0

.github/workflows/build-staging-webapp-image.yaml

@@ -9,32 +9,20 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         persist-credentials: false
         fetch-depth: 0
 
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v2
 
-    - name: Cache Docker layers
-      uses: actions/cache@v3
-      with:
-        path: /tmp/.buildx-cache
-        key: ${{ runner.os }}-buildx-${{ github.sha }}
-        restore-keys: |
-          ${{ runner.os }}-buildx-
-
     - name: Login dockerhub
       uses: docker/login-action@v3
       with:
         username: ${{ secrets.DOCKER_REGISTRY_USER }}
         password: ${{  secrets.DOCKER_REGISTRY_PASSWORD }}
 
-    - name: Clean docker
-      run: |
-        docker system prune -a --volumes -f
-
     - name: Build & Push
       uses: docker/build-push-action@v4
       id: built-image
@@ -43,19 +31,14 @@ jobs:
         file: ./docker/Dockerfile
         push: true
         tags: tiicrc/claasp-lib-staging:latest
-        cache-from: type=local,src=/tmp/.buildx-cache
-        cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
-
-    - name: Move cache
-      run: |
-        rm -rf /tmp/.buildx-cache
-        mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+        cache-from: type=gha,scope=claasp-base
+        cache-to: type=gha,scope=claasp-base,mode=max
 
   commit-deployment-repo:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         persist-credentials: false
         fetch-depth: 0

.github/workflows/fork-run-pytest.yaml

@@ -1,9 +1,10 @@
-name: Run pytest for Forked projects
+name: Run tests for Forked projects
 
 on:
   push:
     branches:
-      - '**'
+      - develop
+      - main
   pull_request:
     types: [opened, synchronize, reopened, edited]
     branches:
@@ -15,14 +16,28 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  run-doctest:
+    if: ${{ github.event.repository.fork }}
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+
+    - name: Run doctest
+      # Reduced parallelism (-tp 4) to fit within the 7 GB / 2 vCPU GitHub-hosted limit.
+      run: docker run --rm -v $PWD:/home/sage/tii-claasp tiicrc/claasp-base:latest bash -lc "cd /home/sage/tii-claasp && make install && SAGE_TIMEOUT=600 sage -tp 4 claasp"
+
   run-pytest:
     if: ${{ github.event.repository.fork }}
     runs-on: ubuntu-latest
 
     steps:
 
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
       with:
         persist-credentials: false
         fetch-depth: 0

.github/workflows/generate-and-submit-documentation.yaml

@@ -9,7 +9,7 @@ jobs:
     runs-on: self-hosted-k3s
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
       with:
         persist-credentials: false
         fetch-depth: 0
@@ -23,7 +23,6 @@ jobs:
         branch: 'main'
         github_token: ${{ secrets.AUTHORIZATION_TOKEN }}
         message: "Update documentation"
-        force: true
 
     - name: Update develop branch
       uses: morbalint/git-merge-action@v1

.github/workflows/run-benchmark-tests.yaml

@@ -16,24 +16,12 @@ jobs:
     timeout-minutes: 3600
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
       with:
         persist-credentials: false
         fetch-depth: 0
-    - name: Print GITHUB_WORKSPACE
-      run: |
-          echo ${GITHUB_WORKSPACE}
-          pwd
-          ls -lah
     - name: Fix Directory Structure
-      run: |
-          mkdir /home/runner/_work/claasp_backup
-          mv -f /home/runner/_work/claasp/claasp/* /home/runner/_work/claasp_backup
-          rm -rf /home/runner/_work/claasp/
-          mkdir /home/runner/_work/claasp
-          mv -f /home/runner/_work/claasp_backup/* /home/runner/_work/claasp
-          chmod g+w /home/runner/_work/claasp/ -R
-          rm -rf /home/runner/_work/claasp_backup
+      uses: ./.github/actions/fix-directory
 
     - name: Run pytest-benchmark
       run: |

.github/workflows/run-pytest-and-sonarcloud-scan.yaml

@@ -1,9 +1,10 @@
-name: Run pytest and SonarCloud Scan
+name: Run tests and SonarCloud Scan
 
 on:
   push:
     branches:
-      - '**'
+      - develop
+      - main
   pull_request:
     types: [opened, synchronize, reopened, edited]
     branches:
@@ -15,25 +16,38 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  run-pytest:
+  run-doctest:
     if: ${{ !github.event.repository.fork }}
     runs-on: self-hosted
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
       with:
         persist-credentials: false
         fetch-depth: 0
 
     - name: Fix Directory Structure
+      uses: ./.github/actions/fix-directory
+
+    - name: Run doctest
       run: |
-          mkdir /home/runner/_work/claasp_backup
-          mv -f /home/runner/_work/claasp/claasp/* /home/runner/_work/claasp_backup
-          rm -rf /home/runner/_work/claasp/
-          mkdir /home/runner/_work/claasp
-          mv -f /home/runner/_work/claasp_backup/* /home/runner/_work/claasp
-          chmod g+w /home/runner/_work/claasp/ -R
-          rm -rf /home/runner/_work/claasp_backup
+            cd /home/runner/_work/claasp
+            make test
+      env:
+        GUROBI_COMPUTE_SERVER: ${{ secrets.GUROBI_COMPUTE_SERVER }}
+
+  run-pytest:
+    if: ${{ !github.event.repository.fork }}
+    runs-on: self-hosted
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v4
+      with:
+        persist-credentials: false
+        fetch-depth: 0
+
+    - name: Fix Directory Structure
+      uses: ./.github/actions/fix-directory
 
     - name: Run remote-pytest
       run: |
@@ -50,10 +64,11 @@ jobs:
         overwrite: true
 
   run-code-coverage:
+    if: ${{ !github.event.repository.fork }}
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
       with:
         persist-credentials: false
         fetch-depth: 0

.github/workflows/update-changelog.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+          uses: actions/checkout@v4
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -55,7 +55,7 @@ jobs:
           message: ${{ env.release_message }}
 
       - name: Set up Python
-        uses: actions/setup-python@v2
+          uses: actions/setup-python@v5
         with:
           python-version: '3.x'
 
@@ -64,15 +64,12 @@ jobs:
 
       - name: Create release
         if: ${{ env.should_add_last_changes_to_master == 'true' }}
-        uses: actions/create-release@v1
-        env:
-            GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          tag_name: ${{ env.tag_name }}
-          release_name: Release ${{ env.tag_name }}
-          body_path: ./docs/release_notes.md
-          draft: false
-          prerelease: false
+          run: |
+            gh release create "${{ env.tag_name }}" \
+              --title "Release ${{ env.tag_name }}" \
+              --notes-file ./docs/release_notes.md
+          env:
+            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Update develop branch
         if: ${{ env.should_add_last_changes_to_master == 'true' }}