ci: migrate CI to kestra-io/actions #11770

* ci: migrate CI to kestra-io/actions

- advance on https://github.com/kestra-io/kestra-ee/issues/5363

* ci: change Dockerfile.pr to dynamic version

# Conflicts:
#	Dockerfile.pr

.github/actions/plugins-list/action.yml

@@ -1,29 +0,0 @@
-name: 'Load Kestra Plugin List'
-description: 'Composite action to load list of plugins'
-inputs:
-  plugin-version:
-    description: "Kestra version"
-    default: 'LATEST'
-    required: true
-  plugin-file:
-    description: "File of the plugins"
-    default: './.plugins'
-    required: true
-outputs:
-  plugins:
-    description: "List of all Kestra plugins"
-    value: ${{ steps.plugins.outputs.plugins }}
-  repositories:
-    description: "List of all Kestra repositories of plugins"
-    value: ${{ steps.plugins.outputs.repositories }}
-runs:
-  using: composite
-  steps:
-    - name: Get Plugins List
-      id: plugins
-      shell: bash
-      run: |
-        PLUGINS=$([ -f ${{ inputs.plugin-file }} ] && cat ${{ inputs.plugin-file }} | grep "io\\.kestra\\." | sed -e '/#/s/^.//' | sed -e "s/LATEST/${{ inputs.plugin-version }}/g" | cut -d':' -f2- | xargs || echo '');
-        REPOSITORIES=$([ -f ${{ inputs.plugin-file }} ] && cat ${{ inputs.plugin-file }} | grep "io\\.kestra\\." | sed -e '/#/s/^.//' | cut -d':' -f1 | uniq | sort | xargs || echo '')
-        echo "plugins=$PLUGINS" >> $GITHUB_OUTPUT
-        echo "repositories=$REPOSITORIES" >> $GITHUB_OUTPUT

.github/actions/setup-vars/action.yml

@@ -1,20 +0,0 @@
-name: 'Setup vars'
-description: 'Composite action to setup common vars'
-outputs:
-  tag:
-    description: "Git tag"
-    value: ${{ steps.vars.outputs.tag }}
-  commit:
-    description: "Git commit"
-    value: ${{ steps.vars.outputs.commit }}
-runs:
-  using: composite
-  steps:
-    # Setup vars
-    - name: Set variables
-      id: vars
-      shell: bash
-      run: |
-        TAG=${GITHUB_REF#refs/*/}
-        echo "tag=${TAG}" >> $GITHUB_OUTPUT
-        echo "commit=$(git rev-parse --short "$GITHUB_SHA")" >> $GITHUB_OUTPUT

.github/workflows/auto-translate-ui-keys.yml

@@ -1,67 +0,0 @@
-name: Auto-Translate UI keys and create PR
-
-on:
-  schedule:
-    - cron: "0 9-21/3 * * *"  # Every 3 hours from 9 AM to 9 PM
-  workflow_dispatch:
-    inputs:
-      retranslate_modified_keys:
-        description: "Whether to re-translate modified keys even if they already have translations."
-        type: choice
-        options:
-          - "false"
-          - "true"
-        default: "false"
-        required: false
-
-jobs:
-  translations:
-    name: Translations
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-        - uses: actions/checkout@v5
-          name: Checkout
-          with:
-            fetch-depth: 0
-
-        - name: Set up Python
-          uses: actions/setup-python@v6
-          with:
-            python-version: "3.x"
-
-        - name: Install Python dependencies
-          run: pip install gitpython openai
-
-        - name: Generate translations
-          run: python ui/src/translations/generate_translations.py ${{ github.event.inputs.retranslate_modified_keys }}
-          env:
-            OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-
-        - name: Set up Node
-          uses: actions/setup-node@v5
-          with:
-            node-version: "20.x"
-
-        - name: Set up Git
-          run: |
-            git config --global user.name "GitHub Action"
-            git config --global user.email "actions@github.com"
-
-        - name: Commit and create PR
-          env:
-            GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          run: |
-            BRANCH_NAME="chore/update-translations-$(date +%s)"
-            git checkout -b $BRANCH_NAME
-            git add ui/src/translations/*.json
-            if git diff --cached --quiet; then
-              echo "No changes to commit. Exiting with success."
-              exit 0
-            fi
-            git commit -m "chore(core): localize to languages other than english" -m "Extended localization support by adding translations for multiple languages using English as the base. This enhances accessibility and usability for non-English-speaking users while keeping English as the source reference."
-            git push -u origin $BRANCH_NAME || (git push origin --delete $BRANCH_NAME && git push -u origin $BRANCH_NAME)
-            gh pr create --title "Translations from en.json" --body $'This PR was created automatically by a GitHub Action.\n\nSomeone from the @kestra-io/frontend team needs to review and merge.' --base ${{ github.ref_name }} --head $BRANCH_NAME
-
-        - name: Check keys matching
-          run: node ui/src/translations/check.js

.github/workflows/codeql-analysis.yml

@@ -1,85 +0,0 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-name: "CodeQL"
-
-on:
-  schedule:
-    - cron: '0 5 * * 1'
-
-  workflow_dispatch: {}
-
-jobs:
-  analyze:
-    name: Analyze
-    runs-on: ubuntu-latest
-
-    strategy:
-      fail-fast: false
-      matrix:
-        # Override automatic language detection by changing the below list
-        # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python']
-        language: ['java', 'javascript']
-        # Learn more...
-        # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection
-
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v5
-      with:
-        # We must fetch at least the immediate parents so that if this is
-        # a pull request then we can checkout the head.
-        fetch-depth: 2
-
-    # If this run was triggered by a pull request event, then checkout
-    # the head of the pull request instead of the merge commit.
-    - run: git checkout HEAD^2
-      if: ${{ github.event_name == 'pull_request' }}
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
-      with:
-        languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
-
-    # Set up JDK
-    - name: Set up JDK
-      uses: actions/setup-java@v5
-      if: ${{ matrix.language == 'java' }}
-      with:
-        distribution: 'temurin'
-        java-version: 21
-
-    - name: Setup gradle
-      if: ${{ matrix.language == 'java' }}
-      uses: gradle/actions/setup-gradle@v4
-
-    - name: Build with Gradle
-      if: ${{ matrix.language == 'java' }}
-      run: ./gradlew testClasses -x :ui:assembleFrontend
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      if: ${{ matrix.language != 'java' }}
-      uses: github/codeql-action/autobuild@v3
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3

.github/workflows/e2e.yml

@@ -1,86 +0,0 @@
-name: 'E2E tests revival'
-description: 'New E2E tests implementation started by Roman. Based on playwright in npm UI project, tests Kestra OSS develop docker image. These tests are written from zero, lets make them unflaky from the start!.'
-on:
-  schedule:
-    - cron: "0 * * * *"  # Every hour
-  workflow_call:
-    inputs:
-      noInputYet:
-        description: 'not input yet.'
-        required: false
-        type: string
-        default: "no input"
-  workflow_dispatch:
-    inputs:
-      noInputYet:
-        description: 'not input yet.'
-        required: false
-        type: string
-        default: "no input"
-jobs:
-  check:
-    timeout-minutes: 15
-    runs-on: ubuntu-latest
-    env:
-      GOOGLE_SERVICE_ACCOUNT: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
-    steps:
-      - name: Login to DockerHub
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ github.token }}
-
-      - name: Checkout kestra
-        uses: actions/checkout@v5
-        with:
-          path: kestra
-
-      # Setup build
-      - uses: kestra-io/actions/composite/setup-build@main
-        name: Setup - Build
-        id: build
-        with:
-          java-enabled: true
-          node-enabled: true
-          python-enabled: true
-
-      - name: Install Npm dependencies
-        run: |
-          cd kestra/ui
-          npm i
-          npx playwright install --with-deps chromium
-
-      - name: Run E2E Tests
-        run: |
-          cd kestra
-          sh build-and-start-e2e-tests.sh
-
-      - name: Upload Playwright Report as Github artifact
-        # 'With this report, you can analyze locally the results of the tests. see https://playwright.dev/docs/ci-intro#html-report'
-        uses: actions/upload-artifact@v4
-        if: ${{ !cancelled() }}
-        with:
-          name: playwright-report
-          path: kestra/ui/playwright-report/
-          retention-days: 7
-        # Allure check
-        # TODO I don't know what it should do
-#      - uses: rlespinasse/github-slug-action@v5
-#        name: Allure - Generate slug variables
-#
-#      - name: Allure - Publish report
-#        uses: andrcuns/allure-publish-action@v2.9.0
-#        if: always() && env.GOOGLE_SERVICE_ACCOUNT != ''
-#        continue-on-error: true
-#        env:
-#          GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_AUTH_TOKEN }}
-#          JAVA_HOME: /usr/lib/jvm/default-jvm/
-#        with:
-#          storageType: gcs
-#          resultsGlob: "**/build/allure-results"
-#          bucket: internal-kestra-host
-#          baseUrl: "https://internal.dev.kestra.io"
-#          prefix: ${{ format('{0}/{1}', github.repository, 'allure/java') }}
-#          copyLatest: true
-#          ignoreMissingResults: true

.github/workflows/gradle-release-plugins.yml

@@ -1,74 +0,0 @@
-name: Run Gradle Release for Kestra Plugins
-
-on:
-  workflow_dispatch:
-    inputs:
-      releaseVersion:
-        description: 'The release version (e.g., 0.21.0)'
-        required: true
-        type: string
-      nextVersion:
-        description: 'The next version (e.g., 0.22.0-SNAPSHOT)'
-        required: true
-        type: string
-      dryRun:
-        description: 'Use DRY_RUN mode'
-        required: false
-        default: 'false'
-jobs:
-  release:
-    name: Release plugins
-    runs-on: ubuntu-latest
-    steps:
-      # Checkout
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      # Setup build
-      - uses: kestra-io/actions/composite/setup-build@main
-        id: build
-        with:
-          java-enabled: true
-          node-enabled: true
-          python-enabled: true
-
-      # Get Plugins List
-      - name: Get Plugins List
-        uses: ./.github/actions/plugins-list
-        id: plugins-list
-        with:
-          plugin-version: 'LATEST'
-
-      - name: 'Configure Git'
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      # Execute
-      - name: Run Gradle Release
-        if: ${{ github.event.inputs.dryRun == 'false' }}
-        env:
-          GITHUB_PAT: ${{ secrets.GH_PERSONAL_TOKEN }}
-        run: |
-          chmod +x ./dev-tools/release-plugins.sh;
-
-          ./dev-tools/release-plugins.sh \
-          --release-version=${{github.event.inputs.releaseVersion}} \
-          --next-version=${{github.event.inputs.nextVersion}} \
-          --yes \
-           ${{ steps.plugins-list.outputs.repositories }}
-
-      - name: Run Gradle Release (DRY_RUN)
-        if: ${{ github.event.inputs.dryRun == 'true' }}
-        env:
-          GITHUB_PAT: ${{ secrets.GH_PERSONAL_TOKEN }}
-        run: |
-          chmod +x ./dev-tools/release-plugins.sh;
-
-          ./dev-tools/release-plugins.sh \
-          --release-version=${{github.event.inputs.releaseVersion}} \
-          --next-version=${{github.event.inputs.nextVersion}} \
-          --dry-run \
-          --yes \
-          ${{ steps.plugins-list.outputs.repositories }}

.github/workflows/gradle-release.yml

@@ -1,84 +0,0 @@
-name: Run Gradle Release
-run-name: "Releasing Kestra ${{ github.event.inputs.releaseVersion }} 🚀"
-on:
-  workflow_dispatch:
-    inputs:
-      releaseVersion:
-        description: 'The release version (e.g., 0.21.0)'
-        required: true
-        type: string
-      nextVersion:
-        description: 'The next version (e.g., 0.22.0-SNAPSHOT)'
-        required: true
-        type: string
-env:
-  RELEASE_VERSION: "${{ github.event.inputs.releaseVersion }}"
-  NEXT_VERSION: "${{ github.event.inputs.nextVersion }}"
-jobs:
-  release:
-    name: Release Kestra
-    runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/develop'
-    steps:
-      # Checks
-      - name: Check Inputs
-        run: |
-          if ! [[ "$RELEASE_VERSION" =~ ^[0-9]+(\.[0-9]+)\.0$ ]]; then
-            echo "Invalid release version. Must match regex: ^[0-9]+(\.[0-9]+)\.0$"
-            exit 1
-          fi
-
-          if ! [[ "$NEXT_VERSION" =~ ^[0-9]+(\.[0-9]+)\.0-SNAPSHOT$ ]]; then
-            echo "Invalid next version. Must match regex: ^[0-9]+(\.[0-9]+)\.0-SNAPSHOT$"
-            exit 1;
-          fi
-      # Checkout
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-          path: kestra
-
-      # Setup build
-      - uses: kestra-io/actions/composite/setup-build@main
-        id: build
-        with:
-          java-enabled: true
-          node-enabled: true
-          python-enabled: true
-          caches-enabled: true
-
-      - name: Configure Git
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      # Execute
-      - name: Run Gradle Release
-        env:
-          GITHUB_PAT: ${{ secrets.GH_PERSONAL_TOKEN }}
-        run: |
-          # Extract the major and minor versions
-          BASE_VERSION=$(echo "$RELEASE_VERSION" | sed -E 's/^([0-9]+\.[0-9]+)\..*/\1/')
-          PUSH_RELEASE_BRANCH="releases/v${BASE_VERSION}.x"
-
-          cd kestra
-
-          # Create and push release branch
-          git checkout -b "$PUSH_RELEASE_BRANCH";
-          git push -u origin "$PUSH_RELEASE_BRANCH";
-
-          # Run gradle release
-          git checkout develop;
-
-          if [[ "$RELEASE_VERSION" == *"-SNAPSHOT" ]]; then
-            ./gradlew release -Prelease.useAutomaticVersion=true \
-            -Prelease.releaseVersion="${RELEASE_VERSION}" \
-            -Prelease.newVersion="${NEXT_VERSION}" \
-            -Prelease.pushReleaseVersionBranch="${PUSH_RELEASE_BRANCH}" \
-            -Prelease.failOnSnapshotDependencies=false
-          else
-            ./gradlew release -Prelease.useAutomaticVersion=true \
-            -Prelease.releaseVersion="${RELEASE_VERSION}" \
-            -Prelease.newVersion="${NEXT_VERSION}" \
-            -Prelease.pushReleaseVersionBranch="${PUSH_RELEASE_BRANCH}"
-          fi

.github/workflows/main-build.yml

@@ -1,6 +1,11 @@
 name: Main Workflow
 
 on:
+  push:
+    branches:
+      - releases/*
+      - develop
+
   workflow_dispatch:
     inputs:
       skip-test:
@@ -11,53 +16,58 @@ on:
         options:
           - "true"
           - "false"
-      plugin-version:
-          description: "plugins version"
-          required: false
-          type: string
-  push:
-    branches:
-      - master
-      - main
-      - releases/*
-      - develop
-    tags:
-      - v*
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-main
   cancel-in-progress: true
 
 jobs:
-  tests:
-    name: Execute tests
-    uses: ./.github/workflows/workflow-test.yml
+  backend-tests:
+    name: Backend tests
     if: ${{ github.event.inputs.skip-test == 'false' || github.event.inputs.skip-test == '' }}
-    with:
-      report-status: false
+    uses: kestra-io/actions/.github/workflows/kestra-oss-backend-tests.yml@main
+    secrets:
+      GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      GOOGLE_SERVICE_ACCOUNT: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
 
-  release:
-    name: Release
-    needs: [tests]
-    if: "!failure() && !cancelled() && !startsWith(github.ref, 'refs/heads/releases')"
-    uses: ./.github/workflows/workflow-release.yml
+  frontend-tests:
+    name: Frontend tests
+    if: ${{ github.event.inputs.skip-test == 'false' || github.event.inputs.skip-test == '' }}
+    uses: kestra-io/actions/.github/workflows/kestra-oss-frontend-tests.yml@main
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish-develop-docker:
+    name: Publish Docker
+    needs: [backend-tests, frontend-tests]
+    if: "!failure() && !cancelled() && github.ref == 'refs/heads/develop'"
+    uses: kestra-io/actions/.github/workflows/kestra-oss-publish-docker.yml@main
     with:
-        plugin-version: ${{ inputs.plugin-version != '' && inputs.plugin-version || (github.ref == 'refs/heads/develop' && 'LATEST-SNAPSHOT' || 'LATEST') }}
+      plugin-version: 'LATEST-SNAPSHOT'
     secrets:
       DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
       DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+
+
+  publish-develop-maven:
+    name: Publish develop Maven
+    needs: [ backend-tests, frontend-tests ]
+    if: "!failure() && !cancelled() && github.ref == 'refs/heads/develop'"
+    uses: kestra-io/actions/.github/workflows/kestra-oss-publish-maven.yml@main
+    secrets:
       SONATYPE_USER: ${{ secrets.SONATYPE_USER }}
       SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
       SONATYPE_GPG_KEYID: ${{ secrets.SONATYPE_GPG_KEYID }}
       SONATYPE_GPG_PASSWORD: ${{ secrets.SONATYPE_GPG_PASSWORD }}
       SONATYPE_GPG_FILE: ${{ secrets.SONATYPE_GPG_FILE }}
-      GH_PERSONAL_TOKEN: ${{ secrets.GH_PERSONAL_TOKEN }}
-      SLACK_RELEASES_WEBHOOK_URL: ${{ secrets.SLACK_RELEASES_WEBHOOK_URL }}
 
   end:
     runs-on: ubuntu-latest
-    needs:
-      - release
+    needs: [publish-develop-docker, publish-develop-maven]
     if: always()
     steps:
       - name: Trigger EE Workflow

.github/workflows/pre-release.yml

@@ -0,0 +1,49 @@
+name: Pre Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+
+jobs:
+  build-artifacts:
+    name: Build Artifacts
+    uses: kestra-io/actions/.github/workflows/kestra-oss-build-artifacts.yml@main
+
+  backend-tests:
+    name: Backend tests
+    uses: kestra-io/actions/.github/workflows/kestra-oss-backend-tests.yml@main
+    secrets:
+      GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+      GOOGLE_SERVICE_ACCOUNT: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
+
+  frontend-tests:
+    name: Frontend tests
+    uses: kestra-io/actions/.github/workflows/kestra-oss-frontend-tests.yml@main
+    secrets:
+      GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  publish-maven:
+    name: Publish Maven
+    needs: [ backend-tests, frontend-tests ]
+    if: "!failure() && !cancelled()"
+    uses: kestra-io/actions/.github/workflows/kestra-oss-publish-maven.yml@main
+    secrets:
+      SONATYPE_USER: ${{ secrets.SONATYPE_USER }}
+      SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
+      SONATYPE_GPG_KEYID: ${{ secrets.SONATYPE_GPG_KEYID }}
+      SONATYPE_GPG_PASSWORD: ${{ secrets.SONATYPE_GPG_PASSWORD }}
+      SONATYPE_GPG_FILE: ${{ secrets.SONATYPE_GPG_FILE }}
+
+  publish-github:
+    name: Github Release
+    needs: [build-artifacts, backend-tests, frontend-tests]
+    if: "!failure() && !cancelled()"
+    uses: kestra-io/actions/.github/workflows/kestra-oss-publish-github.yml@main
+    secrets:
+      GH_PERSONAL_TOKEN: ${{ secrets.GH_PERSONAL_TOKEN }}
+      SLACK_RELEASES_WEBHOOK_URL: ${{ secrets.SLACK_RELEASES_WEBHOOK_URL }}

.github/workflows/pull-request-cleanup.yml

@@ -3,7 +3,7 @@ name: Pull Request - Delete Docker
 on:
   pull_request:
     types: [closed]
-
+# TODO import a reusable one
 jobs:
   publish:
     name: Pull Request - Delete Docker

.github/workflows/pull-request.yml

@@ -2,18 +2,12 @@ name: Pull Request Workflow
 
 on:
   pull_request:
-    branches:
-      - develop
-      - releases/*
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}-pr
   cancel-in-progress: true
 
 jobs:
-  # ********************************************************************************************************************
-  # File changes detection
-  # ********************************************************************************************************************
   file-changes:
     if: ${{ github.event.pull_request.draft == false }}
     name: File changes detection
@@ -34,14 +28,11 @@ jobs:
               - '!{ui,.github}/**'
           token: ${{ secrets.GITHUB_TOKEN }}
 
-  # ********************************************************************************************************************
-  # Tests
-  # ********************************************************************************************************************
   frontend:
     name: Frontend - Tests
     needs: [file-changes]
     if: "needs.file-changes.outputs.ui == 'true'"
-    uses: ./.github/workflows/workflow-frontend-test.yml
+    uses: kestra-io/actions/.github/workflows/kestra-oss-frontend-tests.yml@main
     secrets:
       GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
@@ -50,7 +41,7 @@ jobs:
     name: Backend - Tests
     needs: file-changes
     if: "needs.file-changes.outputs.backend == 'true'"
-    uses: ./.github/workflows/workflow-backend-test.yml
+    uses: kestra-io/actions/.github/workflows/kestra-oss-backend-tests.yml@main
     secrets:
       GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
@@ -59,5 +50,8 @@ jobs:
 
   e2e-tests:
     name: E2E - Tests
-    uses: ./.github/workflows/e2e.yml
+    uses: kestra-io/actions/.github/workflows/kestra-oss-e2e-tests.yml@main
 
+  generate-pull-request-docker-image:
+    name: Generate PR docker image
+    uses: kestra-io/actions/.github/workflows/kestra-oss-pullrequest-publish-docker.yml@main

.github/workflows/release-docker.yml

@@ -0,0 +1,34 @@
+name: Publish docker
+
+on:
+  workflow_dispatch:
+    inputs:
+      retag-latest:
+        description: 'Retag latest Docker images'
+        required: true
+        type: boolean
+        default: false
+      retag-lts:
+        description: 'Retag LTS Docker images'
+        required: true
+        type: boolean
+        default: false
+      plugin-version:
+        description: 'Plugin version'
+        required: false
+        type: string
+        default: "LATEST"
+
+jobs:
+  publish-docker:
+    name: Publish Docker
+    if: startsWith(github.ref, 'refs/tags/v')
+    uses: kestra-io/actions/.github/workflows/kestra-oss-publish-docker.yml@main
+    with:
+      plugin-version: ${{ inputs.plugin-version }}
+      retag-latest: ${{ inputs.retag-latest }}
+      retag-lts: ${{ inputs.retag-lts }}
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}

.github/workflows/setversion-tag-plugins.yml

@@ -1,60 +0,0 @@
-name: Set Version and Tag Plugins
-
-on:
-  workflow_dispatch:
-    inputs:
-      releaseVersion:
-        description: 'The release version (e.g., 0.21.0)'
-        required: true
-        type: string
-      dryRun:
-        description: 'Use DRY_RUN mode'
-        required: false
-        default: 'false'
-jobs:
-  tag:
-    name: Release plugins
-    runs-on: ubuntu-latest
-    steps:
-      # Checkout
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      # Get Plugins List
-      - name: Get Plugins List
-        uses: ./.github/actions/plugins-list
-        id: plugins-list
-        with:
-          plugin-version: 'LATEST'
-
-      - name: 'Configure Git'
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      # Execute
-      - name: Set Version and Tag Plugins
-        if: ${{ github.event.inputs.dryRun == 'false' }}
-        env:
-          GITHUB_PAT: ${{ secrets.GH_PERSONAL_TOKEN }}
-        run: |
-          chmod +x ./dev-tools/setversion-tag-plugins.sh;
-          
-          ./dev-tools/setversion-tag-plugins.sh \
-          --release-version=${{github.event.inputs.releaseVersion}} \
-          --yes \
-           ${{ steps.plugins-list.outputs.repositories }}
-
-      - name: Set Version and Tag Plugins (DRY_RUN)
-        if: ${{ github.event.inputs.dryRun == 'true' }}
-        env:
-          GITHUB_PAT: ${{ secrets.GH_PERSONAL_TOKEN }}
-        run: |
-          chmod +x ./dev-tools/setversion-tag-plugins.sh;
-          
-          ./dev-tools/setversion-tag-plugins.sh \
-          --release-version=${{github.event.inputs.releaseVersion}} \
-          --dry-run \
-          --yes \
-          ${{ steps.plugins-list.outputs.repositories }}

.github/workflows/setversion-tag.yml

@@ -1,60 +0,0 @@
-name: Set Version and Tag
-run-name: "Set version and Tag Kestra to ${{ github.event.inputs.releaseVersion }} 🚀"
-on:
-  workflow_dispatch:
-    inputs:
-      releaseVersion:
-        description: 'The release version (e.g., 0.21.1)'
-        required: true
-        type: string
-env:
-  RELEASE_VERSION: "${{ github.event.inputs.releaseVersion }}"
-jobs:
-  release:
-    name: Release Kestra
-    runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/heads/releases/v')
-    steps:
-      # Checks
-      - name: Check Inputs
-        run: |
-          if ! [[ "$RELEASE_VERSION" =~ ^[0-9]+(\.[0-9]+)(\.[0-9]+)(-rc[0-9])?(-SNAPSHOT)?$ ]]; then
-            echo "Invalid release version. Must match regex: ^[0-9]+(\.[0-9]+)(\.[0-9]+)-(rc[0-9])?(-SNAPSHOT)?$"
-            exit 1
-          fi
-
-          # Extract the major and minor versions
-          BASE_VERSION=$(echo "$RELEASE_VERSION" | sed -E 's/^([0-9]+\.[0-9]+)\..*/\1/')
-          RELEASE_BRANCH="refs/heads/releases/v${BASE_VERSION}.x"
-
-          CURRENT_BRANCH="$GITHUB_REF"
-          if ! [[ "$CURRENT_BRANCH" == "$RELEASE_BRANCH" ]]; then
-            echo "Invalid release branch. Expected $RELEASE_BRANCH, was $CURRENT_BRANCH"
-            exit 1
-          fi
-
-      # Checkout
-      - name: Checkout
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.GH_PERSONAL_TOKEN }}
-
-      # Configure
-      - name: Git - Configure
-        run: |
-          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git config --global user.name "github-actions[bot]"
-
-      # Execute
-      - name: Run Gradle Release
-        env:
-          GITHUB_PAT: ${{ secrets.GH_PERSONAL_TOKEN }}
-        run: |
-          # Update version
-          sed -i "s/^version=.*/version=$RELEASE_VERSION/" ./gradle.properties
-          git add ./gradle.properties
-          git commit -m"chore(version): update to version '$RELEASE_VERSION'"
-          git push
-          git tag -a "v$RELEASE_VERSION" -m"v$RELEASE_VERSION"
-          git push --tags

.github/workflows/vulnerabilities-check.yml

@@ -22,12 +22,11 @@ jobs:
           fetch-depth: 0
 
       # Setup build
-      - uses: ./actions/.github/actions/setup-build
+      - uses: kestra-io/actions/composite/setup-build@main
         id: build
         with:
           java-enabled: true
           node-enabled: true
-          caches-enabled: true
 
       # Npm
       - name: Npm - Install
@@ -49,77 +48,3 @@ jobs:
         with:
           name: dependency-check-report
           path: build/reports/dependency-check-report.html
-
-  develop-image-check:
-    name: Image Check (develop)
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: write
-      actions: read
-    steps:
-      # Checkout
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      # Setup build
-      - uses: kestra-io/actions/composite/setup-build@main
-        id: build
-        with:
-          java-enabled: false
-          node-enabled: false
-          caches-enabled: true
-
-      # Run Trivy image scan for Docker vulnerabilities, see https://github.com/aquasecurity/trivy-action
-      - name: Docker Vulnerabilities Check
-        uses: aquasecurity/trivy-action@0.33.1
-        with:
-          image-ref: kestra/kestra:develop
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
-          severity: 'CRITICAL,HIGH'
-          output: 'trivy-results.sarif'
-          skip-dirs: /app/plugins
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: 'trivy-results.sarif'
-          category: docker-
-
-  latest-image-check:
-    name: Image Check (latest)
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      security-events: write
-      actions: read
-    steps:
-      # Checkout
-      - uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      # Setup build
-      - uses: kestra-io/actions/composite/setup-build@main
-        id: build
-        with:
-          java-enabled: false
-          node-enabled: false
-
-      # Run Trivy image scan for Docker vulnerabilities, see https://github.com/aquasecurity/trivy-action
-      - name: Docker Vulnerabilities Check
-        uses: aquasecurity/trivy-action@0.33.1
-        with:
-          image-ref: kestra/kestra:latest
-          format: table
-          skip-dirs: /app/plugins
-          scanners: vuln
-          severity: 'CRITICAL,HIGH'
-          output: 'trivy-results.sarif'
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: 'trivy-results.sarif'

.github/workflows/workflow-backend-test.yml

@@ -1,74 +0,0 @@
-name: Backend - Tests
-
-on:
-  workflow_call:
-    secrets:
-      GITHUB_AUTH_TOKEN:
-        description: "The GitHub Token."
-        required: true
-      CODECOV_TOKEN:
-        description: 'Codecov Token'
-        required: true
-      SONAR_TOKEN:
-        description: 'Sonar Token'
-        required: true
-      GOOGLE_SERVICE_ACCOUNT:
-        description: 'Google Service Account'
-        required: true
-
-permissions:
-  contents: write
-  checks: write
-  actions: read
-  pull-requests: write
-
-jobs:
-  test:
-    name: Backend - Tests
-    runs-on: ubuntu-latest
-    env:
-      GOOGLE_SERVICE_ACCOUNT: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
-      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-    steps:
-      - uses: actions/checkout@v5
-        name: Checkout - Current ref
-        with:
-          fetch-depth: 0
-
-      # Setup build
-      - uses: kestra-io/actions/composite/setup-build@main
-        name: Setup - Build
-        id: build
-        with:
-          java-enabled: true
-          node-enabled: true
-          python-enabled: true
-
-      # Services
-      - name: Setup - Start docker compose
-        shell: bash
-        run: docker compose -f docker-compose-ci.yml up -d
-
-      # Gradle check
-      - name: Gradle - Build
-        if: ${{ github.event.inputs.skip-test == 'false' || github.event.inputs.skip-test == '' }}
-        env:
-          GOOGLE_SERVICE_ACCOUNT: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
-        shell: bash
-        run: |
-          echo $GOOGLE_SERVICE_ACCOUNT | base64 -d > ~/.gcp-service-account.json
-          export GOOGLE_APPLICATION_CREDENTIALS=$HOME/.gcp-service-account.json
-          ./gradlew check javadoc --parallel
-
-      - name: comment PR with test report
-        if: ${{ !cancelled() && github.event_name == 'pull_request' }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_AUTH_TOKEN }}
-        run: npx --yes @kestra-io/kestra-devtools generateTestReportSummary --only-errors --ci $(pwd)
-
-      # Report Java
-      - name: Report - Java
-        uses: kestra-io/actions/composite/report-java@main
-        if: ${{ !cancelled() }}
-        with:
-          secrets: ${{ toJSON(secrets) }}

.github/workflows/workflow-build-artifacts.yml

@@ -1,80 +0,0 @@
-name: Build Artifacts
-
-on:
-  workflow_call: {}
-
-jobs:
-  build:
-    name: Build - Artifacts
-    runs-on: ubuntu-latest
-    outputs:
-        docker-tag: ${{ steps.vars.outputs.tag }}
-        docker-artifact-name: ${{ steps.vars.outputs.artifact }}
-        plugins: ${{ steps.plugins.outputs.plugins }}
-    env:
-      PLUGIN_VERSION: ${{ github.event.inputs.plugin-version != null && github.event.inputs.plugin-version || 'LATEST' }}
-    steps:
-      - name: Checkout - Current ref
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      # Npm
-      - name: Setup - Npm install
-        shell: bash
-        working-directory: ui
-        run: npm ci
-
-      # Setup build
-      - uses: kestra-io/actions/composite/setup-build@main
-        name: Setup - Build
-        id: build
-        with:
-          java-enabled: true
-          node-enabled: true
-
-      # Get Plugins List
-      - name: Plugins - Get List
-        uses: ./.github/actions/plugins-list
-        if: "!startsWith(github.ref, 'refs/tags/v')"
-        id: plugins-list
-        with:
-          plugin-version: ${{ env.PLUGIN_VERSION }}
-
-      # Set Plugins List
-      - name: Plugins - Set List
-        id: plugins
-        if: "!startsWith(github.ref, 'refs/tags/v')"
-        shell: bash
-        run: |
-          PLUGINS="${{ steps.plugins-list.outputs.plugins }}"
-          TAG=${GITHUB_REF#refs/*/}
-          if [[ $TAG = "master" || $TAG == v* ]]; then
-            echo "plugins=$PLUGINS" >> $GITHUB_OUTPUT
-          else
-            echo "plugins=--repositories=https://central.sonatype.com/repository/maven-snapshots/ $PLUGINS" >> $GITHUB_OUTPUT
-          fi
-
-      # Build
-      - name: Gradle - Build
-        shell: bash
-        run: |
-          ./gradlew executableJar
-
-      - name: Artifacts - Copy exe to image
-        shell: bash
-        run: |
-          cp build/executable/* docker/app/kestra && chmod +x docker/app/kestra
-
-      # Upload artifacts
-      - name: Artifacts - Upload JAR
-        uses: actions/upload-artifact@v4
-        with:
-          name: jar
-          path: build/libs/
-
-      - name: Artifacts - Upload Executable
-        uses: actions/upload-artifact@v4
-        with:
-          name: exe
-          path: build/executable/

.github/workflows/workflow-frontend-test.yml

@@ -1,70 +0,0 @@
-name: Frontend - Tests
-
-on:
-  workflow_call:
-    secrets:
-      GITHUB_AUTH_TOKEN:
-        description: "The GitHub Token."
-        required: true
-      CODECOV_TOKEN:
-        description: 'Codecov Token'
-        required: true
-
-env:
-  # to save corepack from itself
-  COREPACK_INTEGRITY_KEYS: 0
-
-jobs:
-  test:
-    name: Frontend - Tests
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v5
-
-      - name: Cache Node Modules
-        id: cache-node-modules
-        uses: actions/cache@v4
-        with:
-          path: |
-            ui/node_modules
-          key: modules-${{ hashFiles('ui/package-lock.json') }}
-
-      - name: Cache Playwright Binaries
-        id: cache-playwright
-        uses: actions/cache@v4
-        with:
-          path: |
-            ~/.cache/ms-playwright
-          key: playwright-${{ hashFiles('ui/package-lock.json') }}
-
-      - name: Npm - install
-        if: steps.cache-node-modules.outputs.cache-hit != 'true'
-        working-directory: ui
-        run: npm ci
-
-      - name: Npm - lint
-        uses: reviewdog/action-eslint@v1
-        with:
-          github_token: ${{ secrets.GITHUB_AUTH_TOKEN }}
-          reporter: github-pr-review
-          workdir: ui
-
-      - name: Npm - Run build
-        working-directory: ui
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        run: npm run build
-
-      - name: Run front-end unit tests
-        working-directory: ui
-        run: npm run test:unit -- --coverage
-
-      - name: Storybook - Install Playwright
-        working-directory: ui
-        if: steps.cache-playwright.outputs.cache-hit != 'true'
-        run: npx playwright install --with-deps
-
-      - name: Run storybook component tests
-        working-directory: ui
-        run: npm run test:storybook -- --coverage

.github/workflows/workflow-github-release.yml

@@ -1,79 +0,0 @@
-name: Github - Release
-
-on:
-  workflow_dispatch:
-  workflow_call:
-    secrets:
-      GH_PERSONAL_TOKEN:
-        description: "The Github personal token."
-        required: true
-      SLACK_RELEASES_WEBHOOK_URL:
-        description: "The Slack webhook URL."
-        required: true
-
-
-
-jobs:
-  publish:
-    name: Github - Release
-    runs-on: ubuntu-latest
-    steps:
-      # Check out
-      - name: Checkout - Repository
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-          submodules: true
-
-
-      # Download Exec
-      # Must be done after checkout actions
-      - name: Artifacts - Download executable
-        uses: actions/download-artifact@v5
-        if: startsWith(github.ref, 'refs/tags/v')
-        with:
-          name: exe
-          path: build/executable
-
-      - name: Check if current tag is latest
-        id: is_latest
-        run: |
-          latest_tag=$(git tag | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | sed 's/^v//' | sort -V | tail -n1)
-          current_tag="${GITHUB_REF_NAME#v}"
-          if [ "$current_tag" = "$latest_tag" ]; then
-          echo "latest=true" >> $GITHUB_OUTPUT
-          else
-          echo "latest=false" >> $GITHUB_OUTPUT
-          fi
-        env:
-          GITHUB_REF_NAME: ${{ github.ref_name }}
-
-      # GitHub Release
-      - name: Create GitHub release
-        uses: kestra-io/actions/composite/github-release@main
-        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
-        env:
-          MAKE_LATEST: ${{ steps.is_latest.outputs.latest }}
-          GITHUB_TOKEN: ${{ secrets.GH_PERSONAL_TOKEN }}
-          SLACK_RELEASES_WEBHOOK_URL: ${{ secrets.SLACK_RELEASES_WEBHOOK_URL }}
-
-      # Trigger gha workflow to bump helm chart version
-      - name: GitHub - Trigger the Helm chart version bump
-        uses: peter-evans/repository-dispatch@v3
-        with:
-          token: ${{ secrets.GH_PERSONAL_TOKEN }}
-          repository: kestra-io/helm-charts
-          event-type: update-helm-chart-version
-          client-payload: |-
-            {
-              "new_version": "${{ github.ref_name }}",
-              "github_repository": "${{ github.repository }}",
-              "github_actor": "${{ github.actor }}"
-            }
-
-      - name: Merge Release Notes
-        if: ${{ startsWith(github.ref, 'refs/tags/v') }}
-        uses: kestra-io/actions/composite/github-release-note-merge@main
-        env:
-            GITHUB_TOKEN: ${{ secrets.GH_PERSONAL_TOKEN }}
-            RELEASE_TAG: ${{ github.ref_name }}

.github/workflows/workflow-publish-docker.yml

@@ -1,208 +0,0 @@
-name: Create Docker images on Release
-
-on:
-  workflow_dispatch:
-    inputs:
-      retag-latest:
-        description: 'Retag latest Docker images'
-        required: true
-        type: choice
-        default: "false"
-        options:
-          - "true"
-          - "false"
-      retag-lts:
-        description: 'Retag LTS Docker images'
-        required: true
-        type: choice
-        default: "false"
-        options:
-          - "true"
-          - "false"
-      release-tag:
-        description: 'Kestra Release Tag (by default, deduced with the ref)'
-        required: false
-        type: string
-      plugin-version:
-        description: 'Plugin version'
-        required: false
-        type: string
-        default: "LATEST"
-      force-download-artifact:
-        description: 'Force download artifact'
-        required: false
-        type: choice
-        default: "true"
-        options:
-          - "true"
-          - "false"
-  workflow_call:
-    inputs:
-      plugin-version:
-        description: "Plugin version"
-        default: 'LATEST'
-        required: false
-        type: string
-      force-download-artifact:
-        description: 'Force download artifact'
-        required: false
-        type: string
-        default: "true"
-    secrets:
-      DOCKERHUB_USERNAME:
-        description: "The Dockerhub username."
-        required: true
-      DOCKERHUB_PASSWORD:
-        description: "The Dockerhub password."
-        required: true
-
-env:
-  PLUGIN_VERSION: ${{ inputs.plugin-version != null && inputs.plugin-version || 'LATEST' }}
-jobs:
-  plugins:
-    name: List Plugins
-    runs-on: ubuntu-latest
-    outputs:
-      plugins: ${{ steps.plugins.outputs.plugins }}
-    steps:
-      # Checkout
-      - uses: actions/checkout@v5
-
-      # Get Plugins List
-      - name: Get Plugins List
-        uses: ./.github/actions/plugins-list
-        id: plugins
-        with: # remap LATEST-SNAPSHOT to LATEST
-          plugin-version: ${{ env.PLUGIN_VERSION == 'LATEST-SNAPSHOT' && 'LATEST' || env.PLUGIN_VERSION }}
-
-  # ********************************************************************************************************************
-  # Build
-  # ********************************************************************************************************************
-  build-artifacts:
-    name: Build Artifacts
-    if: ${{ inputs.force-download-artifact == 'true' }}
-    uses: ./.github/workflows/workflow-build-artifacts.yml
-
-  docker:
-    name: Publish Docker
-    needs: [ plugins, build-artifacts ]
-    if: always()
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        image:
-          - name: "-no-plugins"
-            plugins: ""
-            packages: jattach
-            python-libs: ""
-          - name: ""
-            plugins: ${{needs.plugins.outputs.plugins}}
-            packages: python3 python-is-python3 python3-pip curl jattach
-            python-libs: kestra
-    steps:
-      - uses: actions/checkout@v5
-
-      # Vars
-      - name: Set image name
-        id: vars
-        run: |
-          if [[ "${{ inputs.release-tag }}" == "" ]]; then
-            TAG=${GITHUB_REF#refs/*/}
-            echo "tag=${TAG}" >> $GITHUB_OUTPUT
-          else
-            TAG="${{ inputs.release-tag }}"
-            echo "tag=${TAG}" >> $GITHUB_OUTPUT
-          fi
-
-          if [[ $GITHUB_REF == refs/tags/* ]]; then
-            if [[ $TAG =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-              # this will remove the patch version number
-              MINOR_SEMVER=${TAG%.*}
-              echo "minor_semver=${MINOR_SEMVER}" >> $GITHUB_OUTPUT
-            else
-              echo "Tag '$TAG' is not a valid semver (vMAJOR.MINOR.PATCH), skipping minor_semver"
-            fi
-          fi
-
-          if [[ "${{ env.PLUGIN_VERSION }}" == *"-SNAPSHOT" ]]; then
-            echo "plugins=--repositories=https://central.sonatype.com/repository/maven-snapshots/ ${{ matrix.image.plugins }}" >> $GITHUB_OUTPUT;
-          else
-            echo "plugins=${{ matrix.image.plugins }}" >> $GITHUB_OUTPUT
-          fi
-
-      # Download executable from artifact
-      - name: Artifacts - Download executable
-        uses: actions/download-artifact@v5
-        with:
-          name: exe
-          path: build/executable
-
-      - name: Copy exe to image
-        run: |
-          cp build/executable/* docker/app/kestra && chmod +x docker/app/kestra
-
-      # Docker setup
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Docker - Fix Qemu
-        shell: bash
-        run: |
-          docker run --rm --privileged multiarch/qemu-user-static --reset -p yes -c yes
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      # Docker Login
-      - name: Login to DockerHub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_PASSWORD }}
-
-      # Docker Build and push
-      - name: Push to Docker Hub
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          push: true
-          tags: ${{ format('kestra/kestra:{0}{1}', steps.vars.outputs.tag, matrix.image.name) }}
-          platforms: linux/amd64,linux/arm64
-          build-args: |
-            KESTRA_PLUGINS=${{ steps.vars.outputs.plugins }}
-            APT_PACKAGES=${{ matrix.image.packages }}
-            PYTHON_LIBRARIES=${{ matrix.image.python-libs }}
-
-      - name: Install regctl
-        if: startsWith(github.ref, 'refs/tags/v')
-        uses: regclient/actions/regctl-installer@main
-
-      - name: Retag to minor semver version
-        if: startsWith(github.ref, 'refs/tags/v') && steps.vars.outputs.minor_semver != ''
-        run: |
-          regctl image copy ${{ format('kestra/kestra:{0}{1}', steps.vars.outputs.tag, matrix.image.name) }} ${{ format('kestra/kestra:{0}{1}', steps.vars.outputs.minor_semver, matrix.image.name) }}
-
-      - name: Retag to latest
-        if: startsWith(github.ref, 'refs/tags/v') && inputs.retag-latest == 'true'
-        run: |
-          regctl image copy ${{ format('kestra/kestra:{0}{1}', steps.vars.outputs.tag, matrix.image.name) }} ${{ format('kestra/kestra:latest{0}', matrix.image.name) }}
-
-      - name: Retag to LTS
-        if: startsWith(github.ref, 'refs/tags/v') && inputs.retag-lts == 'true'
-        run: |
-          regctl image copy ${{ format('kestra/kestra:{0}{1}', steps.vars.outputs.tag, matrix.image.name) }} ${{ format('kestra/kestra:latest-lts{0}', matrix.image.name) }}
-
-  end:
-    runs-on: ubuntu-latest
-    needs:
-      - docker
-    if: always()
-    env:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-    steps:
-      - name: Slack notification
-        if: ${{ failure() && env.SLACK_WEBHOOK_URL != 0 }}
-        uses: kestra-io/actions/composite/slack-status@main
-        with:
-          webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}
-

.github/workflows/workflow-publish-maven.yml

@@ -1,57 +0,0 @@
-name: Publish - Maven
-
-on:
-  workflow_call:
-    secrets:
-      SONATYPE_USER:
-        description: "The Sonatype username."
-        required: true
-      SONATYPE_PASSWORD:
-        description: "The Sonatype password."
-        required: true
-      SONATYPE_GPG_KEYID:
-        description: "The Sonatype GPG key id."
-        required: true
-      SONATYPE_GPG_PASSWORD:
-        description: "The Sonatype GPG password."
-        required: true
-      SONATYPE_GPG_FILE:
-        description: "The Sonatype GPG file."
-        required: true
-
-jobs:
-  publish:
-    name: Publish - Maven
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout - Current ref
-        uses: actions/checkout@v5
-
-      # Setup build
-      - name: Setup - Build
-        uses: kestra-io/actions/composite/setup-build@main
-        id: build
-        with:
-          java-enabled: true
-          node-enabled: true
-
-      # Publish
-      - name: Publish - Release package to Maven Central
-        shell: bash
-        env:
-          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USER }}
-          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
-          SONATYPE_GPG_KEYID: ${{ secrets.SONATYPE_GPG_KEYID }}
-          SONATYPE_GPG_PASSWORD: ${{ secrets.SONATYPE_GPG_PASSWORD }}
-          SONATYPE_GPG_FILE: ${{ secrets.SONATYPE_GPG_FILE}}
-        run: |
-          mkdir -p ~/.gradle/
-          echo "signing.keyId=${SONATYPE_GPG_KEYID}" > ~/.gradle/gradle.properties
-          echo "signing.password=${SONATYPE_GPG_PASSWORD}" >> ~/.gradle/gradle.properties
-          echo "signing.secretKeyRingFile=${HOME}/.gradle/secring.gpg" >> ~/.gradle/gradle.properties
-          echo ${SONATYPE_GPG_FILE} | base64 -d > ~/.gradle/secring.gpg
-          ./gradlew publishToMavenCentral
-
-      # Gradle dependency
-      - name: Java - Gradle dependency graph
-        uses: gradle/actions/dependency-submission@v4

.github/workflows/workflow-pullrequest-publish-docker.yml

@@ -1,78 +0,0 @@
-name: Pull Request - Publish Docker
-
-on:
-  pull_request:
-    branches:
-      - develop
-
-jobs:
-  build-artifacts:
-    name: Build Artifacts
-    if: github.repository == 'kestra-io/kestra' # prevent running on forks
-    uses: ./.github/workflows/workflow-build-artifacts.yml
-
-  publish:
-    name: Publish Docker
-    if: github.repository == 'kestra-io/kestra' # prevent running on forks
-    runs-on: ubuntu-latest
-    needs: build-artifacts
-    env:
-      GITHUB_IMAGE_PATH: "ghcr.io/kestra-io/kestra-pr"
-    steps:
-      - name: Checkout - Current ref
-        uses: actions/checkout@v5
-        with:
-          fetch-depth: 0
-
-      # Docker setup
-      - name: Docker - Setup QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Docker - Setup Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      # Docker Login
-      - name: Login to GHCR
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      # Build Docker Image
-      - name: Artifacts - Download executable
-        uses: actions/download-artifact@v5
-        with:
-          name: exe
-          path: build/executable
-
-      - name: Docker - Copy exe to image
-        shell: bash
-        run: |
-          cp build/executable/* docker/app/kestra && chmod +x docker/app/kestra
-
-      - name: Docker - Build image
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: ./Dockerfile.pr
-          push: true
-          tags: ${{ env.GITHUB_IMAGE_PATH }}:${{ github.event.pull_request.number }}
-          platforms: linux/amd64,linux/arm64
-
-      # Add comment on pull request
-      - name: Add comment to PR
-        uses: actions/github-script@v8
-        with:
-          github-token: ${{ secrets.GITHUB_TOKEN }}
-          script: |
-            await github.rest.issues.createComment({
-              issue_number: context.issue.number,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              body: `**🐋 Docker image**: \`${{ env.GITHUB_IMAGE_PATH }}:${{ github.event.pull_request.number }}\`\n` +
-                `\n` +
-                `\`\`\`bash\n` +
-                `docker run --pull=always --rm -it -p 8080:8080 --user=root -v /var/run/docker.sock:/var/run/docker.sock -v /tmp:/tmp ${{ env.GITHUB_IMAGE_PATH }}:${{ github.event.pull_request.number }} server local\n` +
-                `\`\`\``
-            })

.github/workflows/workflow-release.yml

@@ -1,85 +0,0 @@
-name: Release
-
-on:
-  workflow_dispatch:
-    inputs:
-      plugin-version:
-        description: "plugins version"
-        default: 'LATEST'
-        required: false
-        type: string
-      publish-docker:
-        description: "Publish Docker image"
-        default: 'false'
-        required: false
-        type: string
-  workflow_call:
-    inputs:
-      plugin-version:
-        description: "plugins version"
-        default: 'LATEST'
-        required: false
-        type: string
-    secrets:
-      DOCKERHUB_USERNAME:
-        description: "The Dockerhub username."
-        required: true
-      DOCKERHUB_PASSWORD:
-        description: "The Dockerhub password."
-        required: true
-      SONATYPE_USER:
-        description: "The Sonatype username."
-        required: true
-      SONATYPE_PASSWORD:
-        description: "The Sonatype password."
-        required: true
-      SONATYPE_GPG_KEYID:
-        description: "The Sonatype GPG key id."
-        required: true
-      SONATYPE_GPG_PASSWORD:
-        description: "The Sonatype GPG password."
-        required: true
-      SONATYPE_GPG_FILE:
-        description: "The Sonatype GPG file."
-        required: true
-      GH_PERSONAL_TOKEN:
-        description: "GH personnal Token."
-        required: true
-      SLACK_RELEASES_WEBHOOK_URL:
-        description: "Slack webhook for releases channel."
-        required: true
-jobs:
-  build-artifacts:
-    name: Build - Artifacts
-    uses: ./.github/workflows/workflow-build-artifacts.yml
-
-  Docker:
-    name: Publish Docker
-    needs: build-artifacts
-    uses: ./.github/workflows/workflow-publish-docker.yml
-    if: github.ref == 'refs/heads/develop' || inputs.publish-docker == 'true'
-    with:
-      force-download-artifact: 'false'
-      plugin-version: ${{ inputs.plugin-version != null && inputs.plugin-version || 'LATEST' }}
-    secrets:
-      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
-      DOCKERHUB_PASSWORD: ${{ secrets.DOCKERHUB_PASSWORD }}
-
-  Maven:
-    name: Publish Maven
-    uses: ./.github/workflows/workflow-publish-maven.yml
-    secrets:
-      SONATYPE_USER: ${{ secrets.SONATYPE_USER }}
-      SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
-      SONATYPE_GPG_KEYID: ${{ secrets.SONATYPE_GPG_KEYID }}
-      SONATYPE_GPG_PASSWORD: ${{ secrets.SONATYPE_GPG_PASSWORD }}
-      SONATYPE_GPG_FILE: ${{ secrets.SONATYPE_GPG_FILE }}
-
-  Github:
-    name: Github Release
-    needs: build-artifacts
-    if: startsWith(github.ref, 'refs/tags/v')
-    uses: ./.github/workflows/workflow-github-release.yml
-    secrets:
-      GH_PERSONAL_TOKEN: ${{ secrets.GH_PERSONAL_TOKEN }}
-      SLACK_RELEASES_WEBHOOK_URL: ${{ secrets.SLACK_RELEASES_WEBHOOK_URL }}

.github/workflows/workflow-test.yml

@@ -1,95 +0,0 @@
-name: Tests
-
-on:
-  schedule:
-    - cron: '0 4 * * 1,2,3,4,5'
-  workflow_call:
-    inputs:
-      report-status:
-        description: "Report status of the jobs in outputs"
-        type: string
-        required: false
-        default: false
-    outputs:
-      frontend_status:
-        description: "Status of the frontend job"
-        value: ${{ jobs.set-frontend-status.outputs.frontend_status }}
-      backend_status:
-        description: "Status of the backend job"
-        value: ${{ jobs.set-backend-status.outputs.backend_status }}
-
-jobs:
-  file-changes:
-    name: File changes detection
-    runs-on: ubuntu-latest
-    timeout-minutes: 60
-    outputs:
-      ui: ${{ steps.changes.outputs.ui }}
-      backend: ${{ steps.changes.outputs.backend }}
-    steps:
-      - uses: actions/checkout@v5
-        if: "!startsWith(github.ref, 'refs/tags/v')"
-      - uses: dorny/paths-filter@v3
-        if: "!startsWith(github.ref, 'refs/tags/v')"
-        id: changes
-        with:
-          filters: |
-            ui:
-              - 'ui/**'
-            backend:
-              - '!{ui,.github}/**'
-          token: ${{ secrets.GITHUB_TOKEN }}
-
-  frontend:
-    name: Frontend - Tests
-    needs: file-changes
-    if: "needs.file-changes.outputs.ui == 'true' || startsWith(github.ref, 'refs/tags/v')"
-    uses: ./.github/workflows/workflow-frontend-test.yml
-    secrets:
-      GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-
-  backend:
-    name: Backend - Tests
-    needs: file-changes
-    if: "needs.file-changes.outputs.backend == 'true' || startsWith(github.ref, 'refs/tags/v')"
-    uses: ./.github/workflows/workflow-backend-test.yml
-    secrets:
-      GITHUB_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-      GOOGLE_SERVICE_ACCOUNT: ${{ secrets.GOOGLE_SERVICE_ACCOUNT }}
-
-  # Output every job status
-  # To be used in other workflows
-  report-status:
-    name: Report Status
-    runs-on: ubuntu-latest
-    needs: [ frontend, backend ]
-    if: always() && (inputs.report-status == 'true')
-    outputs:
-      frontend_status: ${{ steps.set-frontend-status.outputs.frontend_status }}
-      backend_status: ${{ steps.set-backend-status.outputs.backend_status }}
-    steps:
-      - id: set-frontend-status
-        name: Set frontend job status
-        run: echo "::set-output name=frontend_status::${{ needs.frontend.result }}"
-
-      - id: set-backend-status
-        name: Set backend job status
-        run: echo "::set-output name=backend_status::${{ needs.backend.result }}"
-
-  notify:
-    name: Notify - Slack
-    runs-on: ubuntu-latest
-    needs: [ frontend, backend ]
-    steps:
-      - name: Notify failed CI
-        if: |
-          always() &&
-            (needs.frontend.result != 'success' || needs.backend.result != 'success') &&
-            (github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')
-        uses: kestra-io/actions/composite/slack-status@main
-        with:
-          webhook-url: ${{ secrets.SLACK_WEBHOOK_URL }}

Dockerfile.pr

@@ -0,0 +1,8 @@
+ARG KESTRA_DOCKER_BASE_VERSION=develop
+FROM  kestra/kestra:$KESTRA_DOCKER_BASE_VERSION
+
+USER root
+
+COPY --chown=kestra:kestra docker /
+
+USER kestra