ci(deps): bump the github-actions group with 4 updates (#11) #49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| workflow_dispatch: | |
| concurrency: | |
| group: ci-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUSTFLAGS: -D warnings | |
| jobs: | |
| check: | |
| name: fmt, clippy, test | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Rust toolchain | |
| run: rustup toolchain install stable --profile minimal --component rustfmt --component clippy | |
| - name: Cache cargo registry and build | |
| uses: actions/cache@3edfce9056124e459a23f683a21433670d47daca # v4.2.3 | |
| with: | |
| path: | | |
| ~/.cargo/registry | |
| ~/.cargo/git | |
| target | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('Cargo.lock') }} | |
| restore-keys: ${{ runner.os }}-cargo- | |
| - name: Format | |
| run: cargo fmt --check | |
| - name: Clippy | |
| run: cargo clippy --all-targets --locked | |
| - name: Test | |
| run: cargo test --locked | |
| - name: Self-test rule set | |
| run: cargo run --release --locked -- --self-test | |
| - name: Check README/landing rule counts are in sync | |
| env: | |
| GRACKLE_BIN: ${{ github.workspace }}/target/release/grackle | |
| run: | | |
| python3 .hugo/scripts/regen_readme_counts.py || true | |
| if ! git diff --exit-code README.md docs/index.md; then | |
| echo "::error::README.md/docs/index.md rule counts are stale. Run the readme-rule-counts pre-commit hook (or python3 .hugo/scripts/regen_readme_counts.py) and commit." | |
| exit 1 | |
| fi | |
| snap: | |
| name: Build snap (dry run) | |
| runs-on: ubuntu-latest | |
| needs: check | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: audit | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 # need tags so `git describe` can resolve the version | |
| persist-credentials: false | |
| - name: Check for snap-relevant changes | |
| id: changed | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| run: | | |
| set -euo pipefail | |
| if [ -z "${BASE_SHA:-}" ]; then | |
| echo "run=true" >> "$GITHUB_OUTPUT" | |
| exit 0 | |
| fi | |
| if git diff --name-only "$BASE_SHA" HEAD \ | |
| | grep -qE '^(snap/|Cargo\.(toml|lock)|src/)'; then | |
| echo "run=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "run=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Resolve snap version | |
| if: steps.changed.outputs.run == 'true' | |
| run: git describe --tags --always | sed 's/^v//' > snap/.version | |
| - name: Build snap | |
| id: build | |
| if: steps.changed.outputs.run == 'true' | |
| uses: snapcore/action-build@3bdaa03e1ba6bf59a65f84a751d943d549a54e79 # v1.3.0 | |
| - name: Install and smoke-test the snap | |
| if: steps.changed.outputs.run == 'true' | |
| env: | |
| SNAP_FILE: ${{ steps.build.outputs.snap }} | |
| run: | | |
| set -euo pipefail | |
| sudo snap install --dangerous "$SNAP_FILE" | |
| grackle --version | |
| grackle --self-test |