From 868cca25a54548bd1a7ea93c0b902b4a0b2f11c2 Mon Sep 17 00:00:00 2001 From: Roshan Kumar Date: Wed, 23 Sep 2026 13:43:42 +0530 Subject: [PATCH] ci: give the dev branch the same workflow coverage as main (#60) * ci: give the dev branch the same workflow coverage as main Add dev to the push filters of Continuous Integration and OpenSSF Scorecard, and to the pull_request base filter of the Pull Request workflow. Scheduled workflows only ever run on the default branch, so Daily Build and Coverity Scan now fan out over a main/dev matrix, check out the matrix branch explicitly and tag their artifacts with it. Coverity passes the scanned ref and sha to upload-sarif so dev findings are not attributed to main, and Scorecard only publishes results from the default branch, which is all the Scorecard API accepts. * ci: run daily build and coverity on default branch, cache from main and dev --- .github/actions/environment-check/action.yml | 4 ++-- .github/workflows/ci.yml | 1 + .github/workflows/coverity.yml | 11 +++++++++-- .github/workflows/daily_build.yml | 18 +++++++++--------- .github/workflows/pull_request.yml | 1 + .github/workflows/scorecard.yml | 4 +++- 6 files changed, 25 insertions(+), 14 deletions(-) diff --git a/.github/actions/environment-check/action.yml b/.github/actions/environment-check/action.yml index ec2b7ad..99f9c99 100644 --- a/.github/actions/environment-check/action.yml +++ b/.github/actions/environment-check/action.yml @@ -340,8 +340,8 @@ runs: echo "===== Cache Content Summary =====" du -sh "$RUNNER_TEMP/dvledtx-deps" || true - - name: Save environment cache (main branch only) - if: steps.env-cache.outputs.cache-hit != 'true' && github.ref == 'refs/heads/main' + - name: Save environment cache (main and dev branches) + if: steps.env-cache.outputs.cache-hit != 'true' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/dev') uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4 with: path: | diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7088c5f..04f9e6e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,6 +9,7 @@ on: push: branches: - main + - dev tags: - '*' workflow_dispatch: diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml index 2964dd2..47ae311 100644 --- a/.github/workflows/coverity.yml +++ b/.github/workflows/coverity.yml @@ -19,7 +19,7 @@ concurrency: jobs: coverity: - name: Coverity Scan + name: Coverity Scan (${{ github.event.repository.default_branch }}) runs-on: ubuntu-latest timeout-minutes: 30 permissions: @@ -36,10 +36,14 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.sha }} + ref: refs/heads/${{ github.event.repository.default_branch }} fetch-depth: 0 persist-credentials: false + - name: Resolve scanned commit + id: scanned + run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT" + - name: Environment check uses: ./.github/actions/environment-check @@ -55,3 +59,6 @@ jobs: with: sarif_file: reports/coverity-results.sarif category: coverity + # The workflow runs on the default branch, so the scanned ref must be stated explicitly. + ref: refs/heads/${{ github.event.repository.default_branch }} + sha: ${{ steps.scanned.outputs.sha }} diff --git a/.github/workflows/daily_build.yml b/.github/workflows/daily_build.yml index 886f5aa..69def9f 100644 --- a/.github/workflows/daily_build.yml +++ b/.github/workflows/daily_build.yml @@ -19,7 +19,7 @@ concurrency: jobs: build: - name: Daily Build + name: Daily Build (${{ github.event.repository.default_branch }}) runs-on: ubuntu-latest timeout-minutes: 60 permissions: @@ -37,7 +37,7 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.sha }} + ref: refs/heads/${{ github.event.repository.default_branch }} fetch-depth: 0 persist-credentials: false @@ -72,12 +72,12 @@ jobs: uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: - name: DVLED-SW-TK-DailyBuild-${{ github.run_id }} + name: DVLED-SW-TK-DailyBuild-${{ github.event.repository.default_branch }}-${{ github.run_id }} path: ${{ github.workspace }}/reports/ retention-days: 30 afl-fuzz: - name: Daily AFL Fuzz + name: Daily AFL Fuzz (${{ github.event.repository.default_branch }}) runs-on: ubuntu-latest # 2h of fuzzing plus headroom for dependency install and the harness build. timeout-minutes: 138 @@ -88,7 +88,7 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.sha }} + ref: refs/heads/${{ github.event.repository.default_branch }} fetch-depth: 0 persist-credentials: false @@ -101,12 +101,12 @@ jobs: uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: - name: afl-fuzz-results-${{ github.run_id }} + name: afl-fuzz-results-${{ github.event.repository.default_branch }}-${{ github.run_id }} path: fuzz/findings/ retention-days: 14 libfuzzer: - name: Daily libFuzzer + name: Daily libFuzzer (${{ github.event.repository.default_branch }}) runs-on: ubuntu-latest # max-seconds applies per sanitizer mode (ASan + UBSan), so the fuzzing # itself takes ~2h; the rest covers the two builds. @@ -118,7 +118,7 @@ jobs: - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: - ref: ${{ github.sha }} + ref: refs/heads/${{ github.event.repository.default_branch }} fetch-depth: 0 persist-credentials: false @@ -131,7 +131,7 @@ jobs: uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 if: always() with: - name: libfuzzer-results-${{ github.run_id }} + name: libfuzzer-results-${{ github.event.repository.default_branch }}-${{ github.run_id }} path: | fuzz/libfuzzer_corpus/ fuzz/ubsan_corpus/ diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml index 57b8e6f..e663467 100644 --- a/.github/workflows/pull_request.yml +++ b/.github/workflows/pull_request.yml @@ -10,6 +10,7 @@ on: types: [opened, synchronize, reopened, ready_for_review] branches: - main + - dev workflow_dispatch: diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 360d32a..b4a040a 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -9,6 +9,7 @@ on: push: branches: - main + - dev schedule: # Weekly on Monday at 06:30 UTC - cron: '30 6 * * 1' @@ -40,7 +41,8 @@ jobs: with: results_file: scorecard-results.sarif results_format: sarif - publish_results: true + # The Scorecard API only accepts results published from the default branch. + publish_results: ${{ github.ref_name == github.event.repository.default_branch }} repo_token: ${{ secrets.SCORECARD_TOKEN }} - name: Upload SARIF to Security tab