Skip to content

Commit c542163

Browse files
bleggettbleggett
committed
Add workflow stuff
1 parent e3a0442 commit c542163

7 files changed

Lines changed: 263 additions & 0 deletions

File tree

‎.github/dependabot.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
version: 2
2+
updates:
3+
4+
- package-ecosystem: "github-actions"
5+
directory: "/"
6+
schedule:
7+
interval: "daily"
8+
cooldown:
9+
default-days: 7
10+
groups:
11+
actions-updates:
12+
dependency-type: "production"
13+
applies-to: "version-updates"
14+
actions-dev-updates:
15+
dependency-type: "development"
16+
applies-to: "version-updates"
17+
18+
- package-ecosystem: "cargo"
19+
directory: "/"
20+
schedule:
21+
interval: "daily"
22+
cooldown:
23+
default-days: 7
24+
groups:
25+
cargo-updates:
26+
dependency-type: "production"
27+
applies-to: "version-updates"
28+
cargo-dev-updates:
29+
dependency-type: "development"
30+
applies-to: "version-updates"

‎.github/workflows/ci-actions.yaml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: GitHub Actions Security Analysis
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
branches: ["**"]
8+
9+
permissions:
10+
contents: read # Default token to read
11+
12+
jobs:
13+
zizmor:
14+
name: zizmor latest via PyPI
15+
runs-on: ubuntu-latest
16+
permissions:
17+
security-events: write # Needed to write security events to github
18+
contents: read # Needed to read clone repo
19+
actions: read # Needed to read actions
20+
steps:
21+
- name: Harden the runner (Audit all outbound calls)
22+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
23+
with:
24+
egress-policy: audit
25+
26+
- name: Checkout repository
27+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
28+
with:
29+
persist-credentials: false
30+
31+
- name: Install the latest version of uv
32+
uses: astral-sh/setup-uv@3259c6206f993105e3a61b142c2d97bf4b9ef83d # v7.1.0
33+
34+
- name: Run zizmor
35+
run: uvx zizmor --pedantic --format sarif . > results.sarif
36+
env:
37+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
38+
39+
- name: Upload SARIF file
40+
uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 # v4.30.8
41+
with:
42+
sarif_file: results.sarif
43+
category: zizmor

‎.github/workflows/ci-code.yaml‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
name: Lint and Test Code
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- src/**
9+
- Cargo.*
10+
- rust-toolchain.toml
11+
- .github/workflows/ci-code.yaml
12+
13+
permissions:
14+
contents: read # Default token to read
15+
16+
jobs:
17+
rustfmt:
18+
name: rustfmt
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: harden runner
22+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
23+
with:
24+
egress-policy: audit
25+
26+
- name: checkout repository
27+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
28+
with:
29+
submodules: recursive
30+
persist-credentials: false
31+
32+
- name: 'cargo fmt'
33+
run: cargo fmt --all -- --check
34+
35+
full-build:
36+
runs-on: ubuntu-latest
37+
strategy:
38+
fail-fast: false
39+
matrix:
40+
arch:
41+
- x86_64
42+
env:
43+
TARGET_ARCH: "${{ matrix.arch }}"
44+
name: 'Full build linux-${{ matrix.arch }}'
45+
steps:
46+
- name: harden runner
47+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
48+
with:
49+
egress-policy: audit
50+
51+
- name: checkout repository
52+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
53+
with:
54+
submodules: recursive
55+
persist-credentials: false
56+
57+
- name: cargo build
58+
run: cargo build
59+
60+
clippy:
61+
runs-on: ubuntu-latest
62+
strategy:
63+
matrix:
64+
arch:
65+
- x86_64
66+
env:
67+
TARGET_ARCH: "${{ matrix.arch }}"
68+
name: 'Full clippy linux-${{ matrix.arch }}'
69+
steps:
70+
- name: harden runner
71+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
72+
with:
73+
egress-policy: audit
74+
75+
- name: checkout repository
76+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
77+
with:
78+
submodules: recursive
79+
persist-credentials: false
80+
- name: 'cargo clippy'
81+
run: cargo clippy

‎.github/workflows/release.yaml‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
name: Release libscap-bindings
2+
3+
on:
4+
# This workflow runs on every push to main to either open
5+
# a PR or publish the release.
6+
push:
7+
branches:
8+
- main
9+
10+
permissions:
11+
contents: read # Default token to read
12+
13+
jobs:
14+
release-plz-release:
15+
if: ${{ github.repository_owner == 'edera-dev' }}
16+
name: Release-plz release
17+
runs-on: ubuntu-latest
18+
environment: release # Environment for trusted publishing
19+
permissions:
20+
contents: write # Needed to write release artifacts
21+
id-token: write # Needed for trusted publishing
22+
steps:
23+
- name: Harden the runner (Audit all outbound calls)
24+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
25+
with:
26+
egress-policy: audit
27+
28+
- name: Checkout repository
29+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
30+
with:
31+
fetch-depth: 0
32+
persist-credentials: false
33+
34+
- name: Install Rust toolchain
35+
uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # zizmor: ignore[stale-action-refs] -- pinned to stable branch
36+
37+
- name: generate cultivator token
38+
uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
39+
id: generate-token
40+
with:
41+
app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
42+
private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
43+
44+
- name: Run release-plz
45+
uses: release-plz/action@d529f731ae3e89610ada96eda34e5c6ba3b12214 # v0.5
46+
with:
47+
command: release
48+
env:
49+
GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}"
50+
51+
release-plz-pr:
52+
if: ${{ github.repository_owner == 'edera-dev' }}
53+
name: Release-plz PR
54+
runs-on: ubuntu-latest
55+
environment: release # Environment for trusted publishing
56+
permissions:
57+
contents: write # Needed to write release artifacts
58+
id-token: write # Needed for trusted publishing
59+
pull-requests: write # Needed to create pull requests
60+
concurrency:
61+
group: release-plz-${{ github.ref }}
62+
cancel-in-progress: false
63+
steps:
64+
- name: Harden the runner (Audit all outbound calls)
65+
uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
66+
with:
67+
egress-policy: audit
68+
69+
- name: Checkout repository
70+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
71+
with:
72+
fetch-depth: 0
73+
persist-credentials: false
74+
75+
- name: Install Rust toolchain
76+
uses: dtolnay/rust-toolchain@5d458579430fc14a04a08a1e7d3694f545e91ce6 # zizmor: ignore[stale-action-refs] -- pinned to stable branch
77+
78+
- name: generate cultivator token
79+
uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
80+
id: generate-token
81+
with:
82+
app-id: "${{ secrets.EDERA_CULTIVATION_APP_ID }}"
83+
private-key: "${{ secrets.EDERA_CULTIVATION_APP_PRIVATE_KEY }}"
84+
85+
- name: Run release-plz
86+
uses: release-plz/action@d529f731ae3e89610ada96eda34e5c6ba3b12214 # v0.5
87+
with:
88+
command: release-pr
89+
env:
90+
GITHUB_TOKEN: "${{ steps.generate-token.outputs.token }}"

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
/target
2+
/local

‎.release-plz.toml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
[workspace]
2+
pr_branch_prefix = "release/"
3+
pr_labels = ["release"]
4+
release_always = true
5+
git_release_enable = false
6+
git_tag_enable = false
7+
changelog_update = false
8+
9+
[[package]]
10+
name = "libscap-bindings"
11+
git_release_name = "v{{ version }}"
12+
git_tag_name = "v{{ version }}"
13+
git_tag_enable = true
14+
git_release_enable = true

‎rust-toolchain.toml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[toolchain]
2+
channel = "1.89.0"
3+
components = ["rustfmt", "rust-std", "clippy"]

0 commit comments

Comments
 (0)