mirror of
https://github.com/microsoft/regorus.git
synced 2026-08-05 02:16:11 +00:00
c43c94559a
Security Improvements: - Pin all GitHub Actions to specific commit hashes instead of version tags - Update actions/checkout from v4 to commit 08eba0b27e820071cde6df949e0beb9ba4906955 - Update actions/setup-python from v5 to commit a26af69be951a213d495a4c3e4e4022e16d87065 (v5.6.0) - Update actions/setup-java from v4 to commit dded0888837ed1f317902acf8a20df0ad188d165 (v5.0.0) - Update actions/setup-node from v4 to commit 1e60f620b9541d16bece96c5465dc8ee9832be0b (v4.4.0) - Update actions/setup-go from v5 to commit 41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed (v5.1.0) - Update actions/setup-dotnet from v4 to commit 3e891b0cb619bf60e2c25674b222b8940e2c1c25 (v4.1.0) - Update actions/upload-artifact from v4 to commit ea165f8d65b6e75b540449e92b4886f43607fa02 (v4.6.2) - Update actions/download-artifact from v4 to commit 634f93cb2916e3fdff6788551b99b062d0335ce0 (v5.0.0) - Update github/codeql-action from v3 to commit 01fe2e8c43536ad5e1085bad5e7cd6fbc8a30988 (v3.29.11) Rust Toolchain Consolidation: - Create custom composite action .github/actions/toolchains/rust/action.yml - Standardize on Rust 1.89.0 (latest stable) with clippy and rustfmt components - Add optional targets parameter for cross-compilation support - Replace dtolnay/rust-toolchain@stable across 16 workflows This creates a more secure, maintainable, and consistent CI/CD pipeline with centralized Rust toolchain management across all workflows. Signed-off-by: Anand Krishnamoorthi <anakrish@microsoft.com>
57 lines
1.7 KiB
YAML
57 lines
1.7 KiB
YAML
# This workflow uses actions that are not certified by GitHub.
|
|
# They are provided by a third-party and are governed by
|
|
# separate terms of service, privacy policy, and support
|
|
# documentation.
|
|
# rust-clippy is a tool that runs a bunch of lints to catch common
|
|
# mistakes in your Rust code and help improve your Rust code.
|
|
# More details at https://github.com/rust-lang/rust-clippy
|
|
# and https://rust-lang.github.io/rust-clippy/
|
|
|
|
name: rust-clippy analyze
|
|
|
|
on:
|
|
push:
|
|
branches: [ "main" ]
|
|
pull_request:
|
|
# The branches below must be a subset of the branches above
|
|
branches: [ "main" ]
|
|
workflow_dispatch:
|
|
schedule:
|
|
# Run at 8:00 AM every day
|
|
- cron: "0 8 * * *"
|
|
|
|
jobs:
|
|
rust-clippy-analyze:
|
|
name: Run rust-clippy analyzing
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
security-events: write
|
|
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
|
|
|
|
- name: Setup Rust toolchain
|
|
uses: ./.github/actions/toolchains/rust
|
|
|
|
- name: Install required cargo
|
|
run: cargo install clippy-sarif sarif-fmt
|
|
|
|
- name: Fetch
|
|
run: cargo fetch
|
|
|
|
- name: Run rust-clippy
|
|
run:
|
|
cargo clippy
|
|
--all-features
|
|
--message-format=json | clippy-sarif | tee rust-clippy-results.sarif | sarif-fmt
|
|
--frozen
|
|
continue-on-error: true
|
|
|
|
- name: Upload analysis results to GitHub
|
|
uses: github/codeql-action/upload-sarif@c298edae2d512d807fe4bdc57c0ac5a036f61501 # v3.29.11
|
|
with:
|
|
sarif_file: rust-clippy-results.sarif
|
|
wait-for-processing: true
|