Skip to content

Commit e7e4590

Browse files
ipetkovipetkov
authored
ci: Add zizmor linting and fix any findings (#1055)
1 parent 233ab58 commit e7e4590

8 files changed

Lines changed: 162 additions & 56 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ updates:
99
commit-message:
1010
prefix: "chore"
1111
include: "scope"
12+
cooldown:
13+
default-days: 7
1214
- package-ecosystem: cargo
1315
directories:
1416
- "/examples/*"
@@ -23,3 +25,5 @@ updates:
2325
commit-message:
2426
prefix: "chore"
2527
include: "scope"
28+
cooldown:
29+
default-days: 7

‎.github/workflows/pages.yml‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,13 @@ jobs:
1515
build:
1616
name: build
1717
runs-on: ubuntu-latest
18+
environment: cachix
1819
steps:
19-
- uses: actions/checkout@v7
20-
- uses: cachix/install-nix-action@v31
21-
- uses: cachix/cachix-action@v17
20+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
21+
with:
22+
persist-credentials: false
23+
- uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
24+
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
2225
with:
2326
name: crane
2427
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
@@ -29,7 +32,7 @@ jobs:
2932
rsync -r -L ./result/ ./output
3033
- name: upload artifact
3134
id: deployment
32-
uses: actions/upload-pages-artifact@v5
35+
uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
3336
with:
3437
path: ./output
3538

@@ -46,4 +49,4 @@ jobs:
4649
steps:
4750
- name: Deploy to GitHub Pages
4851
id: deployment
49-
uses: actions/deploy-pages@v5
52+
uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0

‎.github/workflows/publish-flakehub.yml‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,26 @@ on:
44
push:
55
tags:
66
- "v*.*.*"
7+
8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
10+
cancel-in-progress: true
11+
12+
permissions:
13+
contents: read
14+
715
jobs:
816
publish-flakehub:
17+
name: publish-flakehub
918
runs-on: "ubuntu-latest"
1019
permissions:
11-
id-token: "write"
20+
id-token: "write" # Necessary for authenticating against FlakeHub
1221
contents: "read"
1322
steps:
14-
- uses: "actions/checkout@v7"
15-
- uses: "DeterminateSystems/nix-installer-action@main"
16-
- uses: "DeterminateSystems/flakehub-push@main"
23+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
24+
with:
25+
persist-credentials: false
26+
- uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
27+
- uses: DeterminateSystems/flakehub-push@71f57208810a5d299fc6545350981de98fdbc860 # v6
1728
with:
1829
visibility: "public"

‎.github/workflows/test.yml‎

Lines changed: 71 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,10 @@ on:
77
- 'master'
88
- 'ci*' # Allow testing CI fixes without opening a PR
99

10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
12+
cancel-in-progress: true
13+
1014
permissions:
1115
contents: read
1216

@@ -22,6 +26,7 @@ jobs:
2226
- examples-darwin
2327
- examples-linux
2428
- tests
29+
- zizmor
2530

2631
tests:
2732
strategy:
@@ -31,27 +36,36 @@ jobs:
3136
include:
3237
# NB: current latest release of 2.33.0 has bugs
3338
- install_url: https://releases.nixos.org/nix/nix-2.31.2/install
39+
name: run tests
3440
# Latest and greatest release of Nix
3541
#- install_url: https://nixos.org/nix/install
3642
# The 25.11 branch ships with Nix 2.31.2
3743
- install_url: https://releases.nixos.org/nix/nix-2.31.2/install
38-
nixpkgs-override: "--override-input nixpkgs $(./ci/ref-from-lock.sh ./test#nixpkgs-latest-release)"
44+
USE_LATEST_RELEASE: "1"
45+
name: run tests 25.11
3946
runs-on: ubuntu-latest
47+
name: ${{ matrix.name }}
48+
environment: cachix
49+
env:
50+
USE_LATEST_RELEASE: ${{ matrix.USE_LATEST_RELEASE }}
4051
steps:
41-
- uses: actions/checkout@v7
42-
- uses: cachix/install-nix-action@v31
52+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
53+
with:
54+
persist-credentials: false
55+
- uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
4356
with:
4457
install_url: ${{ matrix.install_url }}
45-
- uses: cachix/cachix-action@v17
58+
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
4659
with:
4760
name: crane
4861
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
4962
- run: nix flake check -L .#
50-
- run: nix develop --accept-flake-config --command ./ci/fast-flake-check.sh ./test ${{ matrix.nixpkgs-override }}
63+
- run: ./ci/run-test-suite.sh
5164
- name: extra tests
52-
run: nix develop --accept-flake-config --command ./extra-tests/test.sh
65+
run: nix develop .#ci --accept-flake-config --command ./extra-tests/test.sh
5366

5467
examples-linux:
68+
name: build examples
5569
strategy:
5670
# Allow other jobs to finish building and cache properly before bailing
5771
fail-fast: false
@@ -71,10 +85,15 @@ jobs:
7185
- trunk-workspace
7286
- trunk
7387
runs-on: ubuntu-latest
88+
environment: cachix
89+
env:
90+
EXAMPLE: ${{ matrix.example }}
7491
steps:
75-
- uses: actions/checkout@v7
76-
- uses: cachix/install-nix-action@v31
77-
- uses: cachix/cachix-action@v17
92+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
93+
with:
94+
persist-credentials: false
95+
- uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
96+
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
7897
with:
7998
name: crane
8099
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
@@ -84,17 +103,21 @@ jobs:
84103
# "opt-out" of our lockfile .gitignore
85104
run: |
86105
rm ./examples/.gitignore
87-
nix develop .# --accept-flake-config --command ./ci/check-example.sh ./examples/${{ matrix.example }} "./test#nixpkgs"
106+
nix develop .#ci --accept-flake-config --command ./ci/check-example.sh "./examples/${EXAMPLE}" "./test#nixpkgs"
88107
89108
examples-darwin:
109+
name: build examples (darwin)
90110
strategy:
91111
# Allow other jobs to finish building and cache properly before bailing
92112
fail-fast: false
93113
runs-on: macos-latest
114+
environment: cachix
94115
steps:
95-
- uses: actions/checkout@v7
96-
- uses: cachix/install-nix-action@v31
97-
- uses: cachix/cachix-action@v17
116+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
117+
with:
118+
persist-credentials: false
119+
- uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
120+
- uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
98121
with:
99122
name: crane
100123
authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
@@ -104,26 +127,45 @@ jobs:
104127
# "opt-out" of our lockfile .gitignore
105128
run: |
106129
rm ./examples/.gitignore
107-
nix develop .# --accept-flake-config --command bash -c '
108-
set -euo pipefail
109-
for f in $(find ./examples -maxdepth 1 -mindepth 1 -type d -not -name build-std -not -name cross-musl -not -name cross-rust-overlay -not -name cross-windows | sort -u); do
110-
# NB: nix-eval-jobs appears broken on darwin atm?
111-
# /nix/store/2419grj384lg233jqchamm73il9iyjxg-libcxx-16.0.6-dev/include/c++/v1/optional:962: assertion this->has_value() failed: optional operator* called on a disengaged valueerror: error: while checking worker process, evaluation worker got killed by signal 6 (Abort trap: 6)
112-
nix flake check \
113-
--accept-flake-config \
114-
--print-build-logs \
115-
--reference-lock-file ./test/flake.lock \
116-
--override-input crane ./. \
117-
"${f}"
118-
done
119-
'
130+
set -euo pipefail
131+
for f in $(find ./examples -maxdepth 1 -mindepth 1 -type d -not -name build-std -not -name cross-musl -not -name cross-rust-overlay -not -name cross-windows | sort -u); do
132+
nix flake check \
133+
--accept-flake-config \
134+
--print-build-logs \
135+
--reference-lock-file ./test/flake.lock \
136+
--override-input crane ./. \
137+
"${f}"
138+
done
120139
121140
lints:
122141
runs-on: ubuntu-latest
142+
name: check lints
123143
steps:
124-
- uses: actions/checkout@v7
125-
- uses: cachix/install-nix-action@v31
144+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
145+
with:
146+
persist-credentials: false
147+
- uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
126148
- name: check formatting
127149
run: nix fmt -- --ci
128150
- name: check for dead code
129-
run: nix develop .# --command deadnix .
151+
run: nix develop .#deadnix --command deadnix .
152+
153+
zizmor:
154+
name: run zizmor
155+
runs-on: ubuntu-latest
156+
permissions:
157+
security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
158+
steps:
159+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
160+
with:
161+
persist-credentials: false
162+
- uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
163+
- name: Run zizmor 🌈
164+
run: nix develop .#zizmor --command zizmor --persona=auditor --format=sarif . >results.sarif
165+
env:
166+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
167+
- name: Upload SARIF file
168+
uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
169+
with:
170+
sarif_file: results.sarif
171+
category: zizmor

‎.github/workflows/update-flake.yml‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -5,25 +5,29 @@ on:
55
schedule:
66
- cron: '37 16 3,18 * *'
77

8+
concurrency:
9+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
10+
cancel-in-progress: true
11+
812
permissions:
913
contents: read
1014

1115
jobs:
1216
update-and-push-deps:
17+
name: flake update
1318
runs-on: ubuntu-latest
19+
environment: flake-update
1420
steps:
15-
- uses: actions/checkout@v7
16-
- uses: cachix/install-nix-action@v31
21+
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
22+
with:
23+
persist-credentials: false
24+
- uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
1725
with:
1826
extra_nix_config: |
1927
access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
20-
- uses: cachix/cachix-action@v17
21-
with:
22-
name: crane
23-
authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
2428
- name: Update flake.lock
2529
id: flakeupdate
26-
uses: DeterminateSystems/update-flake-lock@v28
30+
uses: DeterminateSystems/update-flake-lock@834c491b2ece4de0bbd00d85214bb5e83b4da5c6 # v28
2731
with:
2832
token: ${{ secrets.PAT_FLAKE_UPDATE }}
2933
branch: "automation/flake-update"
@@ -34,6 +38,7 @@ jobs:
3438
dependencies
3539
flake update
3640
- name: Enable Pull Request Automerge
37-
run: gh pr merge --squash --delete-branch --auto ${{ steps.flakeupdate.outputs.pull-request-number }}
41+
run: gh pr merge --squash --delete-branch --auto "${PR_NUMBER}"
3842
env:
3943
GH_TOKEN: ${{ secrets.PAT_FLAKE_UPDATE }}
44+
PR_NUMBER: ${{ steps.flakeupdate.outputs.pull-request-number }}

‎ci/check-example.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ cp {"${gitRoot}/test","${example}"}/flake.lock
2525
# otherwise nix-eval-jobs appears to ignore the previous entry and make up its own
2626
# (which ignores the versions we have pinned, so not what we want)
2727
git add -N --force "${example}/flake.lock"
28+
# shellcheck disable=SC2064
2829
trap "git rm -f ${example}/flake.lock" EXIT
2930

3031
"${gitRoot}/ci/fast-flake-check.sh" "${commonArgs[@]}"

‎ci/run-test-suite.sh‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
#!/usr/bin/env bash
2+
set -euo pipefail
3+
4+
cd "$(dirname "$0")/.." || exit 1
5+
6+
override_args=()
7+
if [[ -n "${USE_LATEST_RELEASE:-}" ]]; then
8+
override_args+=(--override-input nixpkgs "$(./ci/ref-from-lock.sh ./test#nixpkgs-latest-release)")
9+
fi
10+
11+
set -x
12+
nix develop .#ci --accept-flake-config --command ./ci/fast-flake-check.sh ./test "${override_args[@]}"

‎flake.nix‎

Lines changed: 38 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -154,16 +154,44 @@
154154
inherit pkgs myLib;
155155
};
156156

157-
devShells.default = pkgs.mkShell {
158-
nativeBuildInputs = with pkgs; [
159-
deadnix
160-
formatter
161-
jq
162-
mdbook
163-
nix-eval-jobs
164-
taplo
165-
];
166-
};
157+
devShells =
158+
let
159+
forCi = [
160+
pkgs.jq
161+
pkgs.nix-eval-jobs
162+
];
163+
forDeadnix = [
164+
pkgs.deadnix
165+
];
166+
forZizmor = [
167+
pkgs.zizmor
168+
];
169+
in
170+
{
171+
default = pkgs.mkShell {
172+
nativeBuildInputs =
173+
forCi
174+
++ forDeadnix
175+
++ forZizmor
176+
++ [
177+
formatter
178+
pkgs.mdbook
179+
pkgs.taplo
180+
];
181+
};
182+
183+
ci = pkgs.mkShell {
184+
nativeBuildInputs = forCi;
185+
};
186+
187+
deadnix = pkgs.mkShell {
188+
nativeBuildInputs = forDeadnix;
189+
};
190+
191+
zizmor = pkgs.mkShell {
192+
nativeBuildInputs = forZizmor;
193+
};
194+
};
167195
}
168196
);
169197
}

0 commit comments

Comments
 (0)