internal/ci/base: add helpers for OS + Go version matrices

It's still up to each workflow to set up the matrix and use these,
but being able to reuse these common bits is nice.

Inline a `let` and a hidden field too, as the added indirection just
made the matrix setup harder to follow.

While here, cue fmt internal/ci.

Signed-off-by: Daniel Martí <[email protected]>
Change-Id: Ic7d9099928944f6842ad069683e9fbdb6b81a79d
Reviewed-on: https://cue.gerrithub.io/c/cue-lang/cue/+/1219301
Unity-Result: CUE porcuepine <[email protected]>
Reviewed-by: Paul Jolly <[email protected]>
TryBot-Result: CUEcueckoo <[email protected]>

Author: mvdan

.github/workflows/trybot.yaml

@@ -21,13 +21,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        go-version:
-          - 1.23.x
-          - 1.24.x
         runner:
           - ns-linux-amd64-large
           - ns-macos-arm64
           - ns-windows-amd64
+        go-version:
+          - 1.23.x
+          - 1.24.x
     runs-on: ${{ matrix.runner }}
     if: |-
       (contains(github.event.head_commit.message, '

internal/ci/base/github.cue

@@ -19,14 +19,27 @@ bashWorkflow: githubactions.#Workflow & {
 	jobs: [string]: defaults: run: shell: "bash --noprofile --norc -euo pipefail {0}"
 }
 
+// These are useful for workflows where we use a matrix over different OS runners
+// or multiple Go versions. Note that the matrix names must match.
+matrixRunnerName:    "runner"
+matrixRunnerExpr:    "matrix.\(matrixRunnerName)"
+matrixGoVersionName: "go-version"
+matrixGoVersionExpr: "matrix.\(matrixGoVersionName)"
+
+// isLatestGoLinux is a GitHub expression that evaluates to true if the job
+// is running on Linux with the latest version of Go. This expression is often
+// used to run certain steps just once per CI workflow, to avoid duplicated work.
+isLatestGoLinux: "(\(matrixGoVersionExpr) == '\(latestGo)' && \(matrixRunnerExpr) == '\(linuxMachine)')"
+
 installGo: {
 	#setupGo: githubactions.#Step & {
 		name: "Install Go"
 		uses: "actions/setup-go@v5"
 		with: {
 			// We do our own caching in setupCaches.
-			cache:        false
-			"go-version": string
+			cache: false
+			// Allow overriding when using matrixGoVersionExpr.
+			"go-version": string | *latestGo
 		}
 	}
 
@@ -167,7 +180,7 @@ setupCaches: {
 			// We skip the cache entirely on the nightly runs, to catch flakes.
 			// Note that this conditional is just a no-op for jobs without a nightly schedule.
 			// TODO(mvdan): remove the windowsMachine condition once Windows supports caching on Namespace.
-			if:   "github.event_name != 'schedule' && matrix.runner != '\(windowsMachine)'"
+			if:   "github.event_name != 'schedule' && \(matrixRunnerExpr) != '\(windowsMachine)'"
 			uses: "namespacelabs/nscloud-cache-action@v1"
 			with: {
 				let cacheModes = list.Concat([[
@@ -181,7 +194,7 @@ setupCaches: {
 					cache: strings.Join(cacheModes, "\n")
 				}
 				if len(cachePaths) > 0 {
-					path:  strings.Join(cachePaths, "\n")
+					path: strings.Join(cachePaths, "\n")
 				}
 			}
 		},
@@ -210,7 +223,7 @@ staticcheck: githubactions.#Step & {
 	#modfile: string | *"" // an optional -modfile flag to not use the main go.mod
 	let gotool = [
 		if #modfile != "" {
-		    "go tool -modfile=\(#modfile)"
+			"go tool -modfile=\(#modfile)"
 		},
 		"go tool",
 	][0]

internal/ci/github/trybot.cue

@@ -37,11 +37,17 @@ workflows: trybot: _repo.bashWorkflow & {
 
 	jobs: {
 		test: {
-			strategy:  _testStrategy
-			"runs-on": "${{ matrix.runner }}"
+			strategy: {
+				"fail-fast": false
+				matrix: {
+					(_repo.matrixRunnerName): [_repo.linuxMachine, _repo.macosMachine, _repo.windowsMachine]
+					(_repo.matrixGoVersionName): [_repo.previousGo, _repo.latestGo]
+				}
+			}
+			"runs-on": "${{ \(_repo.matrixRunnerExpr) }}"
 
 			let installGo = _repo.installGo & {
-				#setupGo: with: "go-version": goVersionVal
+				#setupGo: with: "go-version": "${{ \(_repo.matrixGoVersionExpr) }}"
 				_
 			}
 
@@ -60,10 +66,10 @@ workflows: trybot: _repo.bashWorkflow & {
 				_repo.earlyChecks & {
 					// These checks don't vary based on the Go version or OS,
 					// so we only need to run them on one of the matrix jobs.
-					if: _isLatestLinux
+					if: _repo.isLatestGoLinux
 				},
 				_goTest & {
-					if: "\(_repo.isProtectedBranch) || !\(_isLatestLinux)"
+					if: "\(_repo.isProtectedBranch) || !\(_repo.isLatestGoLinux)"
 				},
 				_goTestRace,
 				_goTest32bit,
@@ -82,30 +88,12 @@ workflows: trybot: _repo.bashWorkflow & {
 		}
 	}
 
-	let matrixRunner = "matrix.runner"
-	let goVersion = "matrix.go-version"
-	let goVersionVal = "${{ \(goVersion) }}"
-
-	_testStrategy: {
-		"fail-fast": false
-		matrix: {
-			"go-version": [_repo.previousGo, _repo.latestGo]
-			runner: [_repo.linuxMachine, _repo.macosMachine, _repo.windowsMachine]
-		}
-	}
-
-	// _isLatestLinux returns a GitHub expression that evaluates to true if the job
-	// is running on Linux with the latest version of Go. This expression is often
-	// used to run certain steps just once per CI workflow, to avoid duplicated
-	// work.
-	_isLatestLinux: "(\(goVersion) == '\(_repo.latestGo)' && \(matrixRunner) == '\(_repo.linuxMachine)')"
-
 	_goGenerate: githubactions.#Step & {
 		name: "Generate"
 		run:  "go generate ./..."
 		// The Go version corresponds to the precise version specified in
 		// the matrix. Skip windows for now until we work out why re-gen is flaky
-		if: _isLatestLinux
+		if: _repo.isLatestGoLinux
 	}
 
 	_goTest: githubactions.#Step & {
@@ -117,7 +105,7 @@ workflows: trybot: _repo.bashWorkflow & {
 		// The end-to-end tests require a github token secret and are a bit slow,
 		// so we only run them on pushes to protected branches and on one
 		// environment in the source repo.
-		if: "github.repository == '\(_repo.githubRepositoryPath)' && (\(_repo.isProtectedBranch) || \(_repo.isTestDefaultBranch)) && \(_isLatestLinux)"
+		if: "github.repository == '\(_repo.githubRepositoryPath)' && (\(_repo.isProtectedBranch) || \(_repo.isTestDefaultBranch)) && \(_repo.isLatestGoLinux)"
 	}] & [
 		// Two setup steps per the upstream docs:
 		// https://github.com/google-github-actions/setup-gcloud#service-account-key-json
@@ -157,15 +145,15 @@ workflows: trybot: _repo.bashWorkflow & {
 		// However, CUE does not have any such build tags yet, and we don't use
 		// dependencies that vary wildly between platforms.
 		// For now, to save CI resources, just run the checks on one matrix job.
-		if: _isLatestLinux
+		if: _repo.isLatestGoLinux
 	}] & [
 		_repo.goChecks,
 		{
 			name: "Verify the end-to-end tests still build"
 			// Ensure that the end-to-end tests in ./internal/_e2e, which are only run
 			// on pushes to protected branches, still build correctly before merging.
 			"working-directory": "./internal/_e2e"
-			run: "go test -run=-"
+			run:                 "go test -run=-"
 		},
 		// Note that we don't want tooling dependencies in the go.mod file,
 		// given how many downstreams rely on the cue module having few dependencies.
@@ -179,7 +167,7 @@ workflows: trybot: _repo.bashWorkflow & {
 		// We use `git ls-remote` to list all tags from each remote git repository
 		// because it does not depend on custom REST API endpoints and is very fast.
 		// Note that it sorts tag names as strings, which is not the best, but works OK.
-		if:   "(\(_repo.isProtectedBranch) || \(_repo.isTestDefaultBranch)) && \(_isLatestLinux)"
+		if:   "(\(_repo.isProtectedBranch) || \(_repo.isTestDefaultBranch)) && \(_repo.isLatestGoLinux)"
 		name: "Check all git tags are available"
 		run: """
 			cd $(mktemp -d)
@@ -202,7 +190,7 @@ workflows: trybot: _repo.bashWorkflow & {
 		// Windows and Mac on CI are slower than Linux, and most data races are not specific
 		// to any OS or Go version in particular, so only run all tests with -race on Linux
 		// to not slow down CI unnecessarily.
-		if:   _isLatestLinux
+		if:   _repo.isLatestGoLinux
 		name: "Test with -race"
 		env: GORACE: "atexit_sleep_ms=10" // Otherwise every Go package being tested sleeps for 1s; see https://go.dev/issues/20364.
 		run: "go test -race ./..."
@@ -218,7 +206,7 @@ workflows: trybot: _repo.bashWorkflow & {
 		// We skip this step when testing CLs and PRs, as Linux on the latest Go is the slowest
 		// job in the matrix due to the use of `go test -race`. 32-bit bugs should be rare,
 		// so them only getting caught once a patch is merged into master is not a big problem.
-		if:   "(\(_repo.isProtectedBranch) || \(_repo.isTestDefaultBranch)) && \(_isLatestLinux)"
+		if:   "(\(_repo.isProtectedBranch) || \(_repo.isTestDefaultBranch)) && \(_repo.isLatestGoLinux)"
 		name: "Test on 32 bits"
 		env: GOARCH: "386"
 		run: "go test -short ./..."