@@ -26,63 +26,69 @@ outputs:
2626runs :
2727 using : composite
2828 steps :
29- # The "required: true" field is not enforced by GitHub, so we need to check it manually
30- - name : Enforce required input is either "true" or "false"
31- run : |
32- if [[ "${{ inputs.is-high-risk-environment }}" == "true" ]]; then
33- echo 'High-risk environment detected. Disabling cache for security.'
34- elif [[ "${{ inputs.is-high-risk-environment }}" == "false" ]]; then
35- echo 'Low-risk environment detected. Enabling cache for optimized performance.'
36- else
37- echo "::error::Invalid value for 'is-high-risk-environment'. Must be 'true' (secure, no cache) or 'false' (faster, cache enabled)."
38- exit 1
39- fi
40- shell : bash
29+ # The "required: true" field is not enforced by GitHub, so we need to check it manually
30+ - name : Enforce required input is either "true" or "false"
31+ run : |
32+ if [[ "${{ inputs.is-high-risk-environment }}" == "true" ]]; then
33+ echo 'High-risk environment detected. Disabling cache for security.'
34+ elif [[ "${{ inputs.is-high-risk-environment }}" == "false" ]]; then
35+ echo 'Low-risk environment detected. Enabling cache for optimized performance.'
36+ else
37+ echo "::error::Invalid value for 'is-high-risk-environment'. Must be 'true' (secure, no cache) or 'false' (faster, cache enabled)."
38+ exit 1
39+ fi
40+ shell : bash
4141
42- # Checkout repository only if not already checked out
43- - name : Checkout repository
44- uses : actions/checkout@v4
45- if : ${{ hashFiles('.git') == '' }}
46- with :
47- fetch-depth : ${{ inputs.fetch-depth }}
48- ref : ${{ inputs.ref }}
42+ # Checkout repository only if not already checked out
43+ - name : Checkout repository
44+ uses : actions/checkout@v4
45+ if : ${{ hashFiles('.git') == '' }}
46+ with :
47+ fetch-depth : ${{ inputs.fetch-depth }}
48+ ref : ${{ inputs.ref }}
4949
50- - run : corepack enable
51- shell : bash
50+ - run : corepack enable
51+ shell : bash
5252
53- # In a low-risk environment, try to download cache of node_modules, if it exists
54- # On failure, will run the yarn install instead
55- - name : Download node_modules cache
56- if : ${{ inputs.is-high-risk-environment == 'false' }}
57- id : download-node-modules
58- uses : actions/cache/restore@v4
59- with :
60- path : ./node_modules
61- key : node-modules-${{ github.sha }}
53+ # In a low-risk environment, try to download cache of node_modules, if it exists
54+ # On failure, will run the yarn install instead
55+ - name : Download node_modules cache
56+ if : ${{ inputs.is-high-risk-environment == 'false' }}
57+ id : download-node-modules
58+ uses : actions/cache/restore@v4
59+ with :
60+ path : ./node_modules
61+ key : node-modules-${{ github.sha }}
6262
63- - name : Set up Node.js
64- uses : actions/setup-node@v4
65- id : setup-node
66- with :
67- node-version-file : .nvmrc
68- # If the node_modules cache was not found, use setup-node cache to restore the '.yarn' folder
69- # Notes: if this is always set to 'yarn':
70- # 1) Will not be secure for high-risk environment
71- # 2) Self-hosted runners will fail to find this cache, and then fail on the 'Post Setup environment' step
72- # 3) This action will run a few seconds slower, because when we restore the 'node_modules' folder from cache, there's no need to download the '.yarn' folder too
73- # (GHA does not allow the : ? ternary operator, you must write && ||)
74- cache : ${{ ( inputs.is-high-risk-environment != 'true' && steps.download-node-modules.outputs.cache-hit != 'true' ) && 'yarn' || '' }}
63+ - name : Set up Node.js
64+ uses : actions/setup-node@v4
65+ id : setup-node
66+ with :
67+ node-version-file : .nvmrc
68+ # If the node_modules cache was not found, use setup-node cache to restore the '.yarn' folder
69+ # Notes: if this is always set to 'yarn':
70+ # 1) Will not be secure for high-risk environment
71+ # 2) Self-hosted runners will fail to find this cache, and then fail on the 'Post Setup environment' step
72+ # 3) This action will run a few seconds slower, because when we restore the 'node_modules' folder from cache, there's no need to download the '.yarn' folder too
73+ # (GHA does not allow the : ? ternary operator, you must write && ||)
74+ cache : ${{ ( inputs.is-high-risk-environment != 'true' && steps.download-node-modules.outputs.cache-hit != 'true' ) && 'yarn' || '' }}
7575
76- # If the node_modules cache was not found (or it's a high-risk environment), run the yarn install
77- - name : Install dependencies
78- if : ${{ steps.download-node-modules.outputs.cache-hit != 'true'}}
79- run : yarn --immutable
76+ # If the node_modules cache was not found (or it's a high-risk environment), run the yarn install
77+ - name : Install dependencies with retry
78+ if : ${{ steps.download-node-modules.outputs.cache-hit != 'true'}}
79+ uses : nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
80+ with :
81+ max_attempts : 2
82+ timeout_minutes : 15
83+ retry_wait_seconds : 30
84+ retry_on : error
85+ command : yarn --immutable
8086 shell : bash
8187
82- # For the 'prep-deps' job, save the node_modules cache
83- - name : Cache workspace
84- if : ${{ inputs.is-high-risk-environment == 'false' && inputs.cache-node-modules == 'true' }}
85- uses : actions/cache/save@v4
86- with :
87- path : ./node_modules
88- key : node-modules-${{ github.sha }}
88+ # For the 'prep-deps' job, save the node_modules cache
89+ - name : Cache workspace
90+ if : ${{ inputs.is-high-risk-environment == 'false' && inputs.cache-node-modules == 'true' }}
91+ uses : actions/cache/save@v4
92+ with :
93+ path : ./node_modules
94+ key : node-modules-${{ github.sha }}
0 commit comments