refactor: mark the workflows called only by other shared workflows as internal

.github/workflows/reusable--kubernetes-hydrator.yaml → .github/workflows/internal--helmfile-hydrator.yaml

@@ -1,5 +1,5 @@
 # Renders the given components into kubernetes/manifests and commits the result to the pull request branch.
-name: 'Reusable - Kubernetes Hydrator'
+name: 'Internal - Helmfile Hydrator'
 
 on:
   workflow_call:

.github/workflows/reusable--container-builder.yaml → .github/workflows/internal--image-builder.yaml

@@ -1,5 +1,5 @@
 # Builds the container image of one service and pushes it to ghcr.io.
-name: Reusable Container Builder
+name: 'Internal - Image Builder'
 
 on:
   workflow_call:

.github/workflows/reusable--kubernetes-builder.yaml → .github/workflows/internal--kustomize-builder.yaml

@@ -1,5 +1,5 @@
 # Posts the kustomize diff of one kustomization directory as a pull request comment.
-name: 'Reusable - Kubernetes Builder'
+name: 'Internal - Kustomize Builder'
 
 on:
   workflow_call:

.github/workflows/reusable--label-base-deploy--resolver.yaml

@@ -100,7 +100,7 @@ jobs:
     concurrency:
       group: image-build-${{ matrix.target.stack_id }}-${{ matrix.target.service }}-${{ github.sha }}
       cancel-in-progress: false
-    uses: $/.github/workflows/reusable--container-builder.yaml
+    uses: $/.github/workflows/internal--image-builder.yaml
     with:
       image-name: ${{ matrix.target.stack == 'container' && matrix.target.service || '' }}
       working-directory: ${{ matrix.target.working_directory }}
@@ -119,7 +119,7 @@ jobs:
       matrix:
         target: ${{ fromJson(needs.resolve.outputs.targets) }}
       fail-fast: false
-    uses: $/.github/workflows/reusable--kubernetes-builder.yaml
+    uses: $/.github/workflows/internal--kustomize-builder.yaml
     with:
       service-name: ${{ matrix.target.service }}
       environment: ${{ matrix.target.environment }}
@@ -158,7 +158,7 @@ jobs:
       matrix:
         env: ${{ fromJson(needs.helmfile-targets-group.outputs.environments) }}
       fail-fast: false
-    uses: $/.github/workflows/reusable--kubernetes-hydrator.yaml
+    uses: $/.github/workflows/internal--helmfile-hydrator.yaml
     with:
       environment: ${{ matrix.env.environment }}
       services: ${{ toJson(matrix.env.services) }}
@@ -177,7 +177,7 @@ jobs:
       matrix:
         target: ${{ fromJson(needs.resolve.outputs.targets) }}
       fail-fast: false
-    uses: $/.github/workflows/reusable--kubernetes-builder.yaml
+    uses: $/.github/workflows/internal--kustomize-builder.yaml
     with:
       service-name: ${{ matrix.target.service }}
       environment: ${{ matrix.target.environment }}

.github/workflows/reusable--release--build.yaml

@@ -60,7 +60,7 @@ jobs:
     concurrency:
       group: image-build-${{ needs.detect-component.outputs.service }}-${{ github.sha }}
       cancel-in-progress: false
-    uses: $/.github/workflows/reusable--container-builder.yaml
+    uses: $/.github/workflows/internal--image-builder.yaml
     with:
       image-name: ${{ needs.detect-component.outputs.service }}
       working-directory: ${{ needs.detect-component.outputs.working-directory }}

README.md

@@ -12,6 +12,7 @@ panicboat アカウントのリポジトリで共有する GitHub の設定を
 `.github/workflows/reusable--*.yaml` は、panicboat の他のリポジトリから呼び出す共通の workflow。
 呼び出し側は `uses: panicboat/.github/.github/workflows/<file>@<sha> # vX.Y.Z` と書いて、release の commit SHA に固定する。
 固定した SHA は Renovate が更新する。
+`.github/workflows/internal--*.yaml` は、共通の workflow の中からだけ呼ぶ workflow で、他のリポジトリからは呼ばない。
 
 ```yaml
 jobs:

scripts/workflows/test.sh

@@ -33,19 +33,26 @@ test_release_deploy_declares_environment() {
     assert_eq '${{ needs.resolve.outputs.tag }}' "$(yq '.jobs.apply.with.ref' "${workflow}")"
 }
 
-test_kubernetes_builder_checks_out_head_ref_only_for_helmfile() {
+test_kustomize_builder_checks_out_head_ref_only_for_helmfile() {
     local resolver="${workflows_dir}/reusable--label-base-deploy--resolver.yaml"
-    local builder="${workflows_dir}/reusable--kubernetes-builder.yaml"
+    local kustomize_builder="${workflows_dir}/internal--kustomize-builder.yaml"
     assert_eq '${{ github.head_ref }}' "$(yq '.jobs["deploy-helmfile"].with.ref' "${resolver}")"
     assert_eq 'null' "$(yq '.jobs["deploy-kustomize"].with.ref' "${resolver}")"
-    assert_eq '${{ inputs.ref }}' "$(yq '.jobs["kustomize-diff"].steps[] | select(.name == "Checkout") | .with.ref' "${builder}")"
+    assert_eq '${{ inputs.ref }}' "$(yq '.jobs["kustomize-diff"].steps[] | select(.name == "Checkout") | .with.ref' "${kustomize_builder}")"
 }
 
 test_nested_test_workflow_uses_dollar_slash() {
     local workflow="${workflows_dir}/test-shared-workflows--nested.yaml"
     assert_eq '$/.github/workflows/test-shared-workflows--checkout.yaml' "$(yq '.jobs[].uses' "${workflow}")"
 }
 
+test_nested_calls_resolve_to_existing_workflows() {
+    local target
+    for target in $(yq -N '.jobs[].uses | select(. != null and test("^\\$/"))' "${workflows_dir}"/*.y*ml); do
+        [ -f "${repo_root}/${target#\$/}" ] || { echo "  missing: ${target}" >&2; exit 1; }
+    done
+}
+
 failed=0
 for test_name in $(compgen -A function test_); do
     set +e