[0ssigeno]

Goal

Bring the CI improvements developed in IntelOwlPrivate back into the shared workflows so every Certego repo can use them.

Why

IntelOwlPrivate cut its GitHub Actions minutes by ~40% and its python test run by ~half, and found a Jest bug that turns failing tests green. Other repos still run the old template.

How

1. _node.yml: Jest step keeps the test exit code when coverage is uploaded (bug: failing tests used to pass); output stays in the log via tee.
2. _python.yml: license check moved to its own job, gated at job level (a Docker action's image is built even when its step is skipped).
3. actions/services: postgres healthcheck 1s × 60 retries instead of 10s × 5.
4. _python.yml: run_tests input (default true); false only warms caches.
5. _python.yml: venv installed with uv; disk space freed only on a venv cache miss and with opt-in free_disk_space.
6. _python.yml: test_parallelism input → manage.py test --parallel (coverage combine from CI: support parallel coverage in reusable python workflow #240 kept).
7. _python.yml: opt-in use_db_snapshot — cached pg_dump keyed on migration files, --keepdb, cold migrate when the snapshot holds migrations no longer on disk.
8. _python.yml: cache_key input; set (e.g. ci) to share venv/APT caches warmed by a default-branch push.
9. _release_and_tag.yml: optional per-image docker_mapping[].context, falling back to working_directory.
10. workflows/README.md + CHANGELOG: new inputs and recommended caller patterns (path filters, draft gate + ready_for_review, concurrency, cache warm-up push, release-title check).
11. Re-synced .github/workflows/_release_and_tag.yml with its root copy — it had drifted on develop.

Plan and decisions: .claude/plans/ci_public/plan.md

Behaviour changes with default inputs: the license check is now a separate check (Check requirements licenses) that runs on every run, not only on a venv miss — add it to required checks; the venv is created by uv and has no pip — custom commands must call uv pip.

Out of scope

• _detect_changes.yml and create_*_cache.yaml are kept, even though IntelOwl replaced them with path-filtered callers.
• use_db_snapshot / test_parallelism are not wired into the non-coverage (unittest discover) path; documented instead.
• .github/workflows/release.yml and requirements-linters.txt copies that already differ from root on develop are left as they are.

🤖 Generated with Claude Code

[0ssigeno]

CI green on the self-test fixtures (python, node, licenses). Reviewed before push; fixes in 3ff5b31. Companion IntelOwl sync: certego/IntelOwlPrivate#1373.

[sevdog]

Perché non usare pg_restore per questi 3 step?

Suggested change

	docker exec postgres dropdb -U "$PG_USER" --if-exists "test_${PG_DB}"
	docker exec postgres createdb -U "$PG_USER" "test_${PG_DB}"
	docker exec -i postgres psql -v ON_ERROR_STOP=1 -U "$PG_USER" -d "test_${PG_DB}" < db-snapshot.sql
	docker exec postgres pg_restore -U "$PG_USER" --if-exists --clean --create -d "test_${PG_DB}" < db-snapshot.sql

Oppure usare l'opzione template di createdb (che usa il DB indicato come base da copiare)

Suggested change

	docker exec postgres dropdb -U "$PG_USER" --if-exists "test_${PG_DB}"
	docker exec postgres createdb -U "$PG_USER" "test_${PG_DB}"
	docker exec -i postgres psql -v ON_ERROR_STOP=1 -U "$PG_USER" -d "test_${PG_DB}" < db-snapshot.sql
	docker exec postgres dropdb -U "$PG_USER" --if-exists "test_${PG_DB}"
	docker exec postgres createdb -U "$PG_USER" -T ${PG_DB} "test_${PG_DB}"

[sevdog]

Ho un dubbio: se la snapshot è cachata in base all'hash dei file delle migrazioni, come è possibile che facciamo una cache-hit e nella snapshot ci siano migrazioni cancellate?

[sevdog]

Perché qui hai messo hashFiles('db-snapshot.sql') != '' invece di steps.db-cache.outputs.cache-hit == 'true'?

In base al commento non capisco bene il senso di usare hashFiles.