chore(deps): bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 #1787
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Run test suite" | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened] | |
| push: | |
| branches: | |
| - 'master' | |
| - 'ci*' # Allow testing CI fixes without opening a PR | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| tests-pass: | |
| name: all systems go | |
| runs-on: ubuntu-latest | |
| if: ${{ always() && contains(needs.*.result, 'failure') }} | |
| steps: | |
| - run: exit 1 | |
| needs: | |
| - lints | |
| - examples-darwin | |
| - examples-linux | |
| - tests | |
| - zizmor | |
| tests: | |
| strategy: | |
| # Allow other jobs to finish building and cache properly before bailing | |
| fail-fast: false | |
| matrix: | |
| include: | |
| # Latest and greatest release of Nix | |
| - install_url: https://nixos.org/nix/install | |
| name: run tests | |
| # The 26.05 branch ships with Nix 2.34.7 | |
| - install_url: https://releases.nixos.org/nix/nix-2.34.7/install | |
| USE_LATEST_RELEASE: "1" | |
| name: run tests 26.05 | |
| runs-on: ubuntu-latest | |
| name: ${{ matrix.name }} | |
| environment: cachix | |
| env: | |
| USE_LATEST_RELEASE: ${{ matrix.USE_LATEST_RELEASE }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 | |
| with: | |
| install_url: ${{ matrix.install_url }} | |
| - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17 | |
| with: | |
| name: crane | |
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - run: nix flake check -L .# | |
| - run: ./ci/run-test-suite.sh | |
| - name: extra tests | |
| run: nix develop .#ci --accept-flake-config --command ./extra-tests/test.sh | |
| examples-linux: | |
| name: build examples | |
| strategy: | |
| # Allow other jobs to finish building and cache properly before bailing | |
| fail-fast: false | |
| matrix: | |
| example: | |
| - alt-registry | |
| - build-std | |
| - cross-musl | |
| - cross-rust-overlay | |
| - cross-windows | |
| - custom-toolchain | |
| - end-to-end-testing | |
| - quick-start | |
| - quick-start-simple | |
| - quick-start-workspace | |
| - sqlx | |
| - trunk-workspace | |
| - trunk | |
| runs-on: ubuntu-latest | |
| environment: cachix | |
| env: | |
| EXAMPLE: ${{ matrix.example }} | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 | |
| - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17 | |
| with: | |
| name: crane | |
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - name: validate examples | |
| # Nix won't write a lockfile when --override-input is used (which is good because it will | |
| # complain that the lock file is .gitignored), but nix-eval-jobs doesn't, so we'll have to | |
| # "opt-out" of our lockfile .gitignore | |
| run: | | |
| rm ./examples/.gitignore | |
| nix develop .#ci --accept-flake-config --command ./ci/check-example.sh "./examples/${EXAMPLE}" "./test#nixpkgs" | |
| examples-darwin: | |
| name: build examples (darwin) | |
| strategy: | |
| # Allow other jobs to finish building and cache properly before bailing | |
| fail-fast: false | |
| runs-on: macos-latest | |
| environment: cachix | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 | |
| - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17 | |
| with: | |
| name: crane | |
| authToken: ${{ secrets.CACHIX_AUTH_TOKEN }} | |
| - name: validate examples | |
| # Nix won't write a lockfile when --override-input is used (which is good because it will | |
| # complain that the lock file is .gitignored), but nix-eval-jobs doesn't, so we'll have to | |
| # "opt-out" of our lockfile .gitignore | |
| run: | | |
| rm ./examples/.gitignore | |
| set -euo pipefail | |
| for f in $(find ./examples -maxdepth 1 -mindepth 1 -type d -not -name build-std -not -name cross-musl -not -name cross-rust-overlay -not -name cross-windows | sort -u); do | |
| nix flake check \ | |
| --accept-flake-config \ | |
| --print-build-logs \ | |
| --reference-lock-file ./test/flake.lock \ | |
| --override-input crane ./. \ | |
| "${f}" | |
| done | |
| lints: | |
| runs-on: ubuntu-latest | |
| name: check lints | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 | |
| - name: check formatting | |
| run: nix fmt -- --ci | |
| - name: check for dead code | |
| run: nix develop .#deadnix --command deadnix . | |
| zizmor: | |
| name: run zizmor | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files. | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 | |
| - name: Run zizmor 🌈 | |
| run: nix develop .#zizmor --command zizmor --persona=auditor --format=sarif . >results.sarif | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload SARIF file | |
| uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 | |
| with: | |
| sarif_file: results.sarif | |
| category: zizmor |