Repository navigation
ci: pin the runner image and the branch-ref actions - #92
singlerider wants to merge 6 commits into
Conversation
|
CI state on this PR, none of it from this diff. lint and test are pre-existing at
Under local Rust 1.96.1 clippy passes, so this only appears because the toolchain floats. benchmark is a fork artifact. Happy to pin |
2d4fa68 to
c1150e1
Compare
singlerider
changed the title
c1150e1 to
948ce17
Compare
ubuntu-latest is a label GitHub moves. The image changes under us and a green pipeline turns red on a morning nobody touched the code. Pinning to ubuntu-24.04 means the runner moves when we move it. dtolnay/rust-toolchain was called at @stable, a branch, not a release. It is pinned to a commit, dated in the trailing comment because that repo publishes no release tag for it. Version-tagged actions are untouched.
948ce17 to
b79d73e
Compare
The lint job ran an unpinned `pipx install ruff`, which picked up 0.16.9 and failed on 8 pre-existing errors (import order, __slots__ sort, SIM102, SIM201). The Rust job tracked `stable`, whose clippy now denies for_kv_map in src/node/base.rs. Both blocked unrelated PRs such as blacklanternsecurity#92. Pin ruff==0.16.9 in the workflow and dev group, pin Rust 1.97.1 with clippy and rustfmt in rust-toolchain.toml and rust-tests.yml, and fix the errors in source.
…ore/pin-actions-sha
Fork PRs get a read-only GITHUB_TOKEN, so the comment step failed the job after the benchmark itself passed.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## stable #92 +/- ##
=====================================
Coverage 100% 100%
=====================================
Files 3 3
Lines 604 605 +1
=====================================
+ Hits 604 605 +1 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
Green and mergeable, with #94 folded in. Part of blacklanternsecurity/bbot-enterprise#149. |
|
@liquidsec needs a review and merge from someone with write access. |
windows-latest and macos-latest were still floating in the wheel matrix.
|
@liquidsec @shart123456 @en0f review requested. I can't add reviewers on this repo (read-only access). |
Move all release work into a new tag-triggered publish.yml adapted from blastdns: tag/version check against Cargo.toml and pyproject.toml, reuse of the test workflows via workflow_call, maturin wheel matrix, sdist, crates.io publish, PyPI upload via OIDC trusted publishing with build provenance, and a GitHub release carrying an SPDX SBOM. python-tests.yml and rust-tests.yml now only run tests. The maturin publish, wheel, sdist, release and cargo publish jobs that ran on push to stable are removed, so no branch push publishes or tags anything. actions-rs/toolchain is replaced with actions-rust-lang/setup-rust-toolchain. Every action is pinned to a commit SHA with a version comment, and Linux runners use ubuntu-24.04. Refs: bbot-enterprise#139, bbot-enterprise#155, bbot-enterprise#150
|
i want to take the pinned actions but I can't take the publish changes as-is |
3 participants
ubuntu-latestis a label GitHub moves. The image behind it changes on GitHub's schedule, and a pipeline nobody touched goes red on a Tuesday. This pins every job toubuntu-24.04so the runner moves when we move it.It also pins the action refs that point at a branch (
@stable,@latest) rather than a release. Each pin carries the version it resolves to, or the commit date where upstream publishes no tag for that branch. Version-tagged actions stay on their tags and Dependabot keeps bumping them.Validation
actionlintclean on the changed workflows. No logic, matrix, or step changes: only theruns-on:value and the branch refs.Part of https://github.com/blacklanternsecurity/bbot-enterprise/issues/149.
Folded in
for_kv_map), solintandtestgo green here.benchmark.yml: the PR comment step now skips fork PRs. They get a read-only token, which failed the job after the benchmark itself passed.