Bump github/codeql-action/upload-sarif from 4.36.2 to 4.37.3 #86
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| validate: | |
| name: Validate Flake | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 | |
| with: | |
| github_access_token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('flake.nix', 'flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| gc-max-store-size-linux: 3221225472 | |
| purge: true | |
| purge-prefixes: nix-${{ runner.os }}- | |
| purge-created: 0 | |
| purge-last-accessed: P7D | |
| purge-primary-key: never | |
| - name: Validate flake | |
| run: nix flake check --no-build | |
| nix-build: | |
| name: Nix Build | |
| runs-on: ubuntu-latest | |
| needs: [validate] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 | |
| with: | |
| github_access_token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('flake.nix', 'flake.lock', 'nix/**', 'go.mod', 'go.sum') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| gc-max-store-size-linux: 3221225472 | |
| purge: true | |
| purge-prefixes: nix-${{ runner.os }}- | |
| purge-created: 0 | |
| purge-last-accessed: P7D | |
| purge-primary-key: never | |
| - name: Build flake | |
| id: build | |
| run: | | |
| set -o pipefail | |
| nix build .#default --print-build-logs 2>&1 | tee build.log | |
| - name: Surface vendorHash fix on mismatch | |
| if: failure() && steps.build.outcome == 'failure' | |
| run: | | |
| if ! grep -q "hash mismatch in fixed-output derivation" build.log; then | |
| exit 0 | |
| fi | |
| NEW_HASH=$( | |
| grep -oE 'got:[[:space:]]+sha256-[A-Za-z0-9+/=]+' build.log \ | |
| | head -1 | awk '{print $NF}' | |
| ) | |
| { | |
| echo "## vendorHash is stale" | |
| echo "" | |
| echo "Go dependencies changed but \`deployahVendorHash\` in \`flake.nix\` was not updated." | |
| echo "" | |
| echo "Update \`flake.nix\`:" | |
| echo "" | |
| echo '```nix' | |
| echo "deployahVendorHash = \"${NEW_HASH}\";" | |
| echo '```' | |
| echo "" | |
| echo "Or run: \`nix run .#update-vendor-hash\`" | |
| } >> "$GITHUB_STEP_SUMMARY" | |
| echo "::error file=flake.nix::deployahVendorHash is stale — update to ${NEW_HASH}" | |
| check: | |
| name: ${{ matrix.check }} | |
| runs-on: ubuntu-latest | |
| needs: [validate] | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| check: [tidy, lint, fmt, lint-md, update-vendor-hash] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 | |
| with: | |
| github_access_token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('flake.nix', 'flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| gc-max-store-size-linux: 3221225472 | |
| purge: true | |
| purge-prefixes: nix-${{ runner.os }}- | |
| purge-created: 0 | |
| purge-last-accessed: P7D | |
| purge-primary-key: never | |
| - name: Run ${{ matrix.check }} | |
| run: nix run .#${{ matrix.check }} | |
| - name: Verify no uncommitted changes | |
| if: matrix.check == 'tidy' || matrix.check == 'fmt' || matrix.check == 'update-vendor-hash' | |
| run: | | |
| if [ -n "$(git status --porcelain)" ]; then | |
| echo "::error::Run 'nix run .#${{ matrix.check }}' and commit changes" | |
| git diff | |
| exit 1 | |
| fi | |
| unit-test: | |
| name: Unit Tests | |
| runs-on: ubuntu-latest | |
| needs: [validate] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 | |
| with: | |
| github_access_token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('flake.nix', 'flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| gc-max-store-size-linux: 3221225472 | |
| purge: true | |
| purge-prefixes: nix-${{ runner.os }}- | |
| purge-created: 0 | |
| purge-last-accessed: P7D | |
| purge-primary-key: never | |
| - name: Run unit tests with race detector | |
| run: nix run .#test-unit | |
| - name: Upload coverage artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: coverage-unit | |
| path: coverage-unit.out | |
| retention-days: 1 | |
| integration-test: | |
| name: Integration Tests | |
| runs-on: ubuntu-latest | |
| needs: [validate] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 | |
| with: | |
| github_access_token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('flake.nix', 'flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| gc-max-store-size-linux: 3221225472 | |
| purge: true | |
| purge-prefixes: nix-${{ runner.os }}- | |
| purge-created: 0 | |
| purge-last-accessed: P7D | |
| purge-primary-key: never | |
| - name: Run integration tests with race detector | |
| run: nix run .#test-integration | |
| - name: Upload coverage artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: coverage-integration | |
| path: coverage-integration.out | |
| retention-days: 1 | |
| e2e-test: | |
| name: E2E Tests | |
| runs-on: ubuntu-latest | |
| needs: [validate] | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31 | |
| with: | |
| github_access_token: ${{ secrets.GITHUB_TOKEN }} | |
| - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569 # v7 | |
| with: | |
| primary-key: nix-${{ runner.os }}-${{ hashFiles('flake.nix', 'flake.lock') }} | |
| restore-prefixes-first-match: nix-${{ runner.os }}- | |
| gc-max-store-size-linux: 3221225472 | |
| purge: true | |
| purge-prefixes: nix-${{ runner.os }}- | |
| purge-created: 0 | |
| purge-last-accessed: P7D | |
| purge-primary-key: never | |
| # Kind node-image preload/cache is tracked in #41; omit until wired. | |
| # Race is off in test-e2e on purpose (Kind + client-go; see nix/apps/testing.nix). | |
| - name: Run e2e tests | |
| run: nix run .#test-e2e | |
| env: | |
| CI: "true" | |
| DEPLOYAH_E2E_FORCE: "1" | |
| - name: Upload coverage artifact | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7 | |
| with: | |
| name: coverage-e2e | |
| path: coverage-e2e.out | |
| retention-days: 1 | |
| report: | |
| name: Coverage Report | |
| runs-on: ubuntu-latest | |
| needs: [unit-test, integration-test, e2e-test] | |
| if: always() && needs.unit-test.result == 'success' && needs.integration-test.result == 'success' && needs.e2e-test.result == 'success' | |
| permissions: | |
| contents: read | |
| id-token: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Download unit test coverage | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: coverage-unit | |
| - name: Download integration test coverage | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: coverage-integration | |
| - name: Download e2e test coverage | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8 | |
| with: | |
| name: coverage-e2e | |
| - name: Upload unit coverage to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7 | |
| with: | |
| use_oidc: true | |
| fail_ci_if_error: true | |
| files: ./coverage-unit.out | |
| flags: unittests | |
| name: deployah-unit | |
| disable_search: true | |
| - name: Upload integration coverage to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7 | |
| with: | |
| use_oidc: true | |
| fail_ci_if_error: true | |
| files: ./coverage-integration.out | |
| flags: integration | |
| name: deployah-integration | |
| disable_search: true | |
| - name: Upload e2e coverage to Codecov | |
| uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7 | |
| with: | |
| use_oidc: true | |
| fail_ci_if_error: true | |
| files: ./coverage-e2e.out | |
| flags: e2e | |
| name: deployah-e2e | |
| disable_search: true |