-
Notifications
You must be signed in to change notification settings - Fork 115
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ci: Migrate audit steps from Buildkite to GitHub Actions
- Loading branch information
Showing
6 changed files
with
74 additions
and
52 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| # NOTE: This name appears in GitHub's Checks API and in workflow's status badge. | ||
| name: ci-audit-rust | ||
|
|
||
| # Trigger the workflow when: | ||
| on: | ||
| # A push occurs to one of the matched branches. | ||
| push: | ||
| # XXX: Ideally, on the master branch we would only run this workflow if | ||
| # there are changes to the Cargo.toml or Cargo.local files (like for pull | ||
| # requests). | ||
| # However, this doesn't work when pushing a new 'stable/*' branch. The build | ||
| # on a new branch does not trigger unless there are changes compared to | ||
| # master on the filtered path. | ||
| # If this is ever fixed, or per branch filters are possible, bring back the | ||
| # path filter to only run this workflow if there are changes to the | ||
| # Cargo.toml or Cargo.local files. | ||
| branches: | ||
| - master | ||
| - stable/* | ||
| # Or when a pull request event occurs for a pull request against one of the | ||
| # matched branches and at least one modified file matches the configured | ||
| # paths. | ||
| pull_request: | ||
| branches: | ||
| - master | ||
| - stable/* | ||
| paths: | ||
| - '**/Cargo.toml' | ||
| - '**/Cargo.lock' | ||
| # Or every day at 04:00 UTC (for the default/master branch). | ||
| schedule: | ||
| - cron: "0 4 * * *" | ||
|
|
||
| jobs: | ||
|
|
||
| audit-rust: | ||
| # NOTE: This name appears in GitHub's Checks API. | ||
| name: audit-rust | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v2 | ||
| # NOTE: To run this step locally, make sure you have cargo-audit installed | ||
| # and run 'make audit-rust'. | ||
| - name: Audit Rust dependencies for vulnerabilities | ||
| uses: actions-rs/audit-check@v1 | ||
| with: | ||
| token: ${{ secrets.GITHUB_TOKEN }} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -43,11 +43,29 @@ jobs: | |
| uses: actions/[email protected] | ||
| with: | ||
| go-version: "1.15.x" | ||
| - name: Set up Rust | ||
| uses: actions-rs/toolchain@v1 | ||
| - name: Install prerequisites | ||
| run: | | ||
| python -m pip install \ | ||
| https://github.com/oasislabs/towncrier/archive/oasis-master.tar.gz \ | ||
| gitlint | ||
| - name: Install Nancy | ||
| run: | | ||
| set -eux | ||
| cd $(mktemp --directory /tmp/nancy.XXXXX) | ||
| NANCY_TARBALL=nancy-linux.amd64-v${NANCY_VERSION}.tar.gz | ||
| ${CURL_CMD} ${NANCY_URL_PREFIX}/v${NANCY_VERSION}/${NANCY_TARBALL} \ | ||
| --output ${NANCY_TARBALL} | ||
| ${CURL_CMD} ${NANCY_URL_PREFIX}/v${NANCY_VERSION}/nancychecksums.txt \ | ||
| --output CHECKSUMS | ||
| sha256sum --check --ignore-missing CHECKSUMS | ||
| tar -xf ${NANCY_TARBALL} | ||
| sudo mv nancy /usr/local/bin | ||
| env: | ||
| NANCY_URL_PREFIX: https://github.com/sonatype-nexus-community/nancy/releases/download/ | ||
| NANCY_VERSION: 1.0.1 | ||
| CURL_CMD: curl --proto =https --tlsv1.2 -sSL --fail | ||
| - name: Check for presence of a Change Log fragment (only pull requests) | ||
| run: | | ||
| # Fetch the pull request' base branch so towncrier will be able to | ||
|
|
@@ -81,6 +99,11 @@ jobs: | |
| make lint-docs | ||
| # Always run this step so that all linting errors can be seen at once. | ||
| if: always() | ||
| - name: Audit Go dependencies for vulnerabilities | ||
| run: | | ||
| make audit-go | ||
| # Always run this step so that all linting errors can be seen at once. | ||
| if: always() | ||
| - name: Check go mod tidy | ||
| # NOTE: go mod tidy doesn't implement a check mode yet. | ||
| # For more details, see: https://github.com/golang/go/issues/27005. | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters