Skip to content

Commit

Permalink
feat: add ci-nix.yml
Browse files Browse the repository at this point in the history
  • Loading branch information
jmuelbert committed Nov 5, 2024
1 parent 7a1d1f6 commit 80f8086
Showing 1 changed file with 129 additions and 0 deletions.
129 changes: 129 additions & 0 deletions .github/workflows/ci-nix.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,129 @@
name: Build

Check failure

Code scanning / Scorecard

Token-Permissions High

score is 0: no topLevel permission defined
Remediation tip: Visit https://app.stepsecurity.io/secureworkflow.
Tick the 'Restrict permissions for GITHUB_TOKEN'
Untick other options
NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead.
Click Remediation section below for further remediation help
on:
pull_request:
branches: [main, add_nix_support]
paths:
- '**.cmake'
- '**.cpp'
- '**.hpp'
- '**.hpp.in'
- '**.h'
- '**.h.in'
- '**/CMakeLists.txt'
- .clang.tidy
- .github/workflow/ci-nix.yml
- CMakePresets.json
- flake.lock
- iwyu.imp
- packaging/com.jmuelbert.jmbde-QT.desktop
- packaging/com.jmuelbert.jmbde-QT.metainfo.yml
- packaging/com.jmuelbert.jmbde-QT.svg
- packaging/com.jmuelbert.jmbde-QT.yaml
push:
branches: [main, add_nix_support]
paths:
- '**.cmake'
- '**.cpp'
- '**.hpp'
- '**.hpp.in'
- '**.h'
- '**.h.in'
- '**/CMakeLists.txt'
- .clang.tidy
- .github/workflow/ci-nix.yml
- CMakePresets.json
- flake.lock
- iwyu.imp
- packaging/com.jmuelbert.jmbde-QT.desktop
- packaging/com.jmuelbert.jmbde-QT.metainfo.yml
- packaging/com.jmuelbert.jmbde-QT.svg
- packaging/com.jmuelbert.jmbde-QT.yaml
workflow_dispatch:
jobs:
build:
strategy:
fail-fast: true
matrix:
compiler: [clang, gcc]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/nix-installer-action@v14

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/magic-nix-cache-action@v8

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- name: Restore ccache cache
id: cache-ccache-restore
uses: actions/cache/restore@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
with:
key: coverage-${{ matrix.compiler }}-ccache-
path: .ccache
- name: Build
run: nix develop --command just workflow ci-${{ matrix.compiler }}
- name: Prepare ccache timestamp
id: ccache_cache_timestamp
shell: cmake -P {0}
run: |
string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
message("::echo timestamp=${current_date}")
- name: Save ccache cache
uses: actions/cache/save@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
if: always() && steps.cache-ccache-restore.outputs.cache-hit != 'true'
with:
key: coverage-${{ matrix.compiler }}-ccache-${{ steps.ccache_cache_timestamp.outputs.timestamp }}
path: .ccache
package-nix:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/nix-installer-action@v14

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/magic-nix-cache-action@v8

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- name: Build the Nix package
'run': nix build
coverage:
permissions:

Check failure on line 82 in .github/workflows/ci-nix.yml

View check run for this annotation

Trunk.io / Trunk Check

checkov(CKV2_GHA_1)

[new] Ensure top-level permissions are not set to write-all
pull-requests: write
strategy:
matrix:
compiler: [clang]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/nix-installer-action@v14

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/magic-nix-cache-action@v8

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- name: Restore ccache cache
id: cache-ccache-restore
uses: actions/cache/restore@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
with:
key: coverage-${{ matrix.compiler }}-ccache-
path: .ccache
- name: Generate Coverage
run: nix develop --command just workflow coverage-${{ matrix.compiler }}
- name: Prepare ccache timestamp
id: ccache_cache_timestamp
shell: cmake -P {0}
run: |
string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
message("::echo timestamp=${current_date}")
- name: Save ccache cache
uses: actions/cache/save@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
if: always() && steps.cache-ccache-restore.outputs.cache-hit != 'true'
with:
key: coverage-${{ matrix.compiler }}-ccache-${{ steps.ccache_cache_timestamp.outputs.timestamp }}
path: .ccache
- name: Code Coverage Report
uses: clearlyip/code-coverage-report-action@v5

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
id: code_coverage_report_action
with:
artifact_download_workflow_names: build,schedule
badge: true
fail_on_negative_difference: true
file_coverage_error_min: 40
file_coverage_warning_max: 60
filename: build-coverage-${{ matrix.compiler }}/cobertura.xml
overall_coverage_fail_threshold: 60
- name: Add Coverage PR Comment
uses: marocchino/sticky-pull-request-comment@v2

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
if: github.event_name == 'pull_request'
with:
GITHUB_TOKEN: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
recreate: true
path: code-coverage-results.md

0 comments on commit 80f8086

Please sign in to comment.