Workflows réutilisables

---

Table des matières

1. Concept de réutilisabilité
2. Créer un workflow réutilisable
3. Appeler un workflow
4. Inputs et secrets
5. Outputs
6. Exercices pratiques

---

1 - Concept de réutilisabilité

Problème

Types de réutilisation

Type	Description	Usage
Reusable workflow	Workflow complet	Processus standard
Composite action	Groupe de steps	Tâches communes
Starter workflow	Template	Nouveau repo

Avantages

• DRY : Ne pas répéter le code
• Maintenance : Un seul endroit à modifier
• Standards : Processus cohérents
• Gouvernance : Contrôle centralisé

🔝 Retour à la table des matières

---

2 - Créer un workflow réutilisable

Structure de base

# .github/workflows/reusable-build.yml
name: Reusable Build Workflow

on:
  workflow_call:  # Permet l'appel depuis d'autres workflows
    inputs:
      node-version:
        description: 'Node.js version'
        required: false
        type: string
        default: '18'
    secrets:
      npm-token:
        description: 'NPM authentication token'
        required: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}
      
      - run: npm ci
        env:
          NPM_TOKEN: ${{ secrets.npm-token }}
      
      - run: npm run build

workflow_call

on:
  workflow_call:
    inputs:
      # Input string
      environment:
        type: string
        required: true
      
      # Input booléen
      deploy:
        type: boolean
        default: false
      
      # Input nombre
      timeout:
        type: number
        default: 30
    
    secrets:
      # Secret requis
      api-key:
        required: true
      
      # Secret optionnel
      slack-webhook:
        required: false
    
    outputs:
      version:
        description: 'Built version'
        value: ${{ jobs.build.outputs.version }}

Types d'inputs

Type	Exemple
string	'production'
boolean	true
number	30

🔝 Retour à la table des matières

---

3 - Appeler un workflow

Depuis le même repo

# .github/workflows/ci.yml
name: CI

on: [push]

jobs:
  call-build:
    uses: ./.github/workflows/reusable-build.yml
    with:
      node-version: '20'
    secrets:
      npm-token: ${{ secrets.NPM_TOKEN }}

Depuis un autre repo

name: CI

on: [push]

jobs:
  call-build:
    uses: owner/repo/.github/workflows/reusable-build.yml@main
    with:
      node-version: '20'
    secrets:
      npm-token: ${{ secrets.NPM_TOKEN }}

Avec inherit secrets

jobs:
  call-workflow:
    uses: ./.github/workflows/reusable.yml
    secrets: inherit  # Passe tous les secrets automatiquement

Enchaîner des workflows

name: Full Pipeline

on:
  push:
    branches: [main]

jobs:
  build:
    uses: ./.github/workflows/reusable-build.yml
    with:
      node-version: '18'
  
  test:
    needs: build
    uses: ./.github/workflows/reusable-test.yml
  
  deploy:
    needs: test
    uses: ./.github/workflows/reusable-deploy.yml
    with:
      environment: production
    secrets: inherit

🔝 Retour à la table des matières

---

4 - Inputs et secrets

Validation des inputs

on:
  workflow_call:
    inputs:
      environment:
        type: string
        required: true
        description: 'Must be staging or production'

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Validate environment
        run: |
          if [[ "${{ inputs.environment }}" != "staging" && "${{ inputs.environment }}" != "production" ]]; then
            echo "Invalid environment: ${{ inputs.environment }}"
            exit 1
          fi

Secrets dynamiques

# Caller workflow
jobs:
  deploy:
    uses: ./.github/workflows/deploy.yml
    with:
      environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'staging' }}
    secrets:
      deploy-key: ${{ github.ref == 'refs/heads/main' && secrets.PROD_KEY || secrets.STAGING_KEY }}

Secrets d'organisation

# Le workflow réutilisable peut accéder aux secrets org
# si le repo appelant y a accès
jobs:
  deploy:
    uses: org/shared-workflows/.github/workflows/deploy.yml@main
    secrets:
      api-key: ${{ secrets.ORG_API_KEY }}

🔝 Retour à la table des matières

---

5 - Outputs

Définir des outputs

# Reusable workflow
on:
  workflow_call:
    outputs:
      version:
        description: 'The built version'
        value: ${{ jobs.build.outputs.version }}
      artifact-name:
        description: 'Name of the uploaded artifact'
        value: ${{ jobs.build.outputs.artifact }}

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.version.outputs.version }}
      artifact: ${{ steps.artifact.outputs.name }}
    
    steps:
      - id: version
        run: echo "version=1.0.${{ github.run_number }}" >> $GITHUB_OUTPUT
      
      - id: artifact
        run: echo "name=build-${{ github.run_number }}" >> $GITHUB_OUTPUT

Utiliser les outputs

# Caller workflow
jobs:
  build:
    uses: ./.github/workflows/reusable-build.yml
    with:
      node-version: '18'
  
  deploy:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - run: |
          echo "Deploying version: ${{ needs.build.outputs.version }}"
          echo "Artifact: ${{ needs.build.outputs.artifact-name }}"

Outputs complexes

# Reusable workflow
jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      matrix: ${{ steps.generate.outputs.matrix }}
    steps:
      - id: generate
        run: |
          echo 'matrix={"include":[{"env":"staging"},{"env":"production"}]}' >> $GITHUB_OUTPUT

# Caller workflow
jobs:
  build:
    uses: ./.github/workflows/reusable-build.yml
  
  deploy:
    needs: build
    strategy:
      matrix: ${{ fromJSON(needs.build.outputs.matrix) }}
    runs-on: ubuntu-latest
    steps:
      - run: echo "Deploying to ${{ matrix.env }}"

🔝 Retour à la table des matières

---

6 - Exercices pratiques

Exercice 1 : Workflow réutilisable simple

Créez un workflow réutilisable de build Node.js :

Solution

# .github/workflows/reusable-node-build.yml
name: Reusable Node Build

on:
  workflow_call:
    inputs:
      node-version:
        type: string
        default: '18'

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ inputs.node-version }}
          cache: 'npm'
      - run: npm ci
      - run: npm run build

# .github/workflows/ci.yml
name: CI

on: push

jobs:
  build:
    uses: ./.github/workflows/reusable-node-build.yml
    with:
      node-version: '20'

Exercice 2 : Workflow avec outputs

Créez un workflow qui retourne la version :

Solution

# .github/workflows/reusable-version.yml
name: Version

on:
  workflow_call:
    outputs:
      version:
        value: ${{ jobs.generate.outputs.version }}

jobs:
  generate:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.ver.outputs.version }}
    steps:
      - id: ver
        run: echo "version=1.0.${{ github.run_number }}" >> $GITHUB_OUTPUT

# .github/workflows/release.yml
name: Release

on: push

jobs:
  version:
    uses: ./.github/workflows/reusable-version.yml
  
  release:
    needs: version
    runs-on: ubuntu-latest
    steps:
      - run: echo "Releasing ${{ needs.version.outputs.version }}"

Quiz

Q1. Quel trigger permet de rendre un workflow réutilisable ?

Réponse

workflow_call

Q2. Comment passer tous les secrets automatiquement ?

Réponse

secrets: inherit

🔝 Retour à la table des matières

---

Points clés à retenir

• workflow_call pour rendre un workflow réutilisable
• uses: pour appeler un workflow (même repo ou externe)
• inputs : paramètres avec types (string, boolean, number)
• secrets : données sensibles passées explicitement
• secrets: inherit pour passer tous les secrets
• outputs : retourner des valeurs au workflow appelant
• Organisation : centraliser les workflows partagés

🔝 Retour à la table des matières

---

← Chapitre précédent | Chapitre suivant : Pipelines CI/CD →