Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add workflows build-nix, addstream-val #1040

Closed
wants to merge 8 commits into from
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions .github/workflows/appstream-util-validate.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
name: Validate MetaInfo

Check failure

Code scanning / Scorecard

Token-Permissions High

score is 0: no topLevel permission defined
Remediation tip: Visit https://app.stepsecurity.io/secureworkflow.
Tick the 'Restrict permissions for GITHUB_TOKEN'
Untick other options
NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead.
Click Remediation section below for further remediation help

Check failure on line 1 in .github/workflows/appstream-util-validate.yml

View check run for this annotation

Trunk.io / Trunk Check

checkov(CKV2_GHA_1)

[new] Ensure top-level permissions are not set to write-all
"on":
pull_request:
branches: [main, add_nix_support]
paths:
- '**.nix'
- .github/workflows/appstream-util-validate.yaml
- flake.lock
- packaging/com.jwillikers.CyrillicEncoder.metainfo.xml
push:
branches: [main, add_nix_support]
paths:
- '**.nix'
- .github/workflows/appstream-util-validate.yaml
- flake.lock
- packaging/com.jwillikers.CyrillicEncoder.metainfo.xml
jobs:
appstream-util-validate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/nix-installer-action@v14

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/magic-nix-cache-action@v8

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- name: Check the MetaInfo file
run: nix develop --command appstream-util validate packaging/co.jmuelbert.jmbde-QT.metainfo.xml
129 changes: 129 additions & 0 deletions .github/workflows/ci-nix.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,129 @@
name: Build

Check failure

Code scanning / Scorecard

Token-Permissions High

score is 0: no topLevel permission defined
Remediation tip: Visit https://app.stepsecurity.io/secureworkflow.
Tick the 'Restrict permissions for GITHUB_TOKEN'
Untick other options
NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead.
Click Remediation section below for further remediation help
on:
pull_request:
branches: [main, add_nix_support]
paths:
- '**.cmake'
- '**.cpp'
- '**.hpp'
- '**.hpp.in'
- '**.h'
- '**.h.in'
- '**/CMakeLists.txt'
- .clang.tidy
- .github/workflow/ci-nix.yml
- CMakePresets.json
- flake.lock
- iwyu.imp
- packaging/com.jmuelbert.jmbde-QT.desktop
- packaging/com.jmuelbert.jmbde-QT.metainfo.yml
- packaging/com.jmuelbert.jmbde-QT.svg
- packaging/com.jmuelbert.jmbde-QT.yaml
push:
branches: [main, add_nix_support]
paths:
- '**.cmake'
- '**.cpp'
- '**.hpp'
- '**.hpp.in'
- '**.h'
- '**.h.in'
- '**/CMakeLists.txt'
- .clang.tidy
- .github/workflow/ci-nix.yml
- CMakePresets.json
- flake.lock
- iwyu.imp
- packaging/com.jmuelbert.jmbde-QT.desktop
- packaging/com.jmuelbert.jmbde-QT.metainfo.yml
- packaging/com.jmuelbert.jmbde-QT.svg
- packaging/com.jmuelbert.jmbde-QT.yaml
workflow_dispatch:
jobs:
build:
strategy:
fail-fast: true
matrix:
compiler: [clang, gcc]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/nix-installer-action@v14

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/magic-nix-cache-action@v8

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- name: Restore ccache cache
id: cache-ccache-restore
uses: actions/cache/restore@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
with:
key: coverage-${{ matrix.compiler }}-ccache-
path: .ccache
- name: Build
run: nix develop --command just workflow ci-${{ matrix.compiler }}
- name: Prepare ccache timestamp
id: ccache_cache_timestamp
shell: cmake -P {0}
run: |
string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
message("::echo timestamp=${current_date}")
- name: Save ccache cache
uses: actions/cache/save@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
if: always() && steps.cache-ccache-restore.outputs.cache-hit != 'true'
with:
key: coverage-${{ matrix.compiler }}-ccache-${{ steps.ccache_cache_timestamp.outputs.timestamp }}
path: .ccache
package-nix:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/nix-installer-action@v14

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/magic-nix-cache-action@v8

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- name: Build the Nix package
'run': nix build
coverage:
permissions:

Check failure on line 82 in .github/workflows/ci-nix.yml

View check run for this annotation

Trunk.io / Trunk Check

checkov(CKV2_GHA_1)

[new] Ensure top-level permissions are not set to write-all
pull-requests: write
strategy:
matrix:
compiler: [clang]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/nix-installer-action@v14

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/magic-nix-cache-action@v8

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- name: Restore ccache cache
id: cache-ccache-restore
uses: actions/cache/restore@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
with:
key: coverage-${{ matrix.compiler }}-ccache-
path: .ccache
- name: Generate Coverage
run: nix develop --command just workflow coverage-${{ matrix.compiler }}
- name: Prepare ccache timestamp
id: ccache_cache_timestamp
shell: cmake -P {0}
run: |
string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
message("::echo timestamp=${current_date}")
- name: Save ccache cache
uses: actions/cache/save@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
if: always() && steps.cache-ccache-restore.outputs.cache-hit != 'true'
with:
key: coverage-${{ matrix.compiler }}-ccache-${{ steps.ccache_cache_timestamp.outputs.timestamp }}
path: .ccache
- name: Code Coverage Report
uses: clearlyip/code-coverage-report-action@v5

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
id: code_coverage_report_action
with:
artifact_download_workflow_names: build,schedule
badge: true
fail_on_negative_difference: true
file_coverage_error_min: 40
file_coverage_warning_max: 60
filename: build-coverage-${{ matrix.compiler }}/cobertura.xml
overall_coverage_fail_threshold: 60
- name: Add Coverage PR Comment
uses: marocchino/sticky-pull-request-comment@v2

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
if: github.event_name == 'pull_request'
with:
GITHUB_TOKEN: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
recreate: true
path: code-coverage-results.md
Loading
Loading