Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add nix support #1041

Open
wants to merge 23 commits into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from 15 commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 25 additions & 0 deletions .github/workflows/appstream-util-validate.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
name: Validate MetaInfo

Check failure

Code scanning / Scorecard

Token-Permissions High

score is 0: no topLevel permission defined
Remediation tip: Visit https://app.stepsecurity.io/secureworkflow.
Tick the 'Restrict permissions for GITHUB_TOKEN'
Untick other options
NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead.
Click Remediation section below for further remediation help

Check failure

Code scanning / check-spelling

Check File Path Error

workflows is not a recognized word. (check-file-path)

Check failure

Code scanning / check-spelling

Check File Path Error

appstream is not a recognized word. (check-file-path)

Check failure on line 1 in .github/workflows/appstream-util-validate.yml

View check run for this annotation

Trunk.io / Trunk Check

checkov(CKV2_GHA_1)

[new] Ensure top-level permissions are not set to write-all
"on":
pull_request:
branches: [main, add_nix_support]
paths:
- '**.nix'
- .github/workflows/appstream-util-validate.yaml

Check failure

Code scanning / check-spelling

Unrecognized Spelling Error

appstream is not a recognized word. (unrecognized-spelling)
- flake.lock
- packaging/linux/com.jmuelbert,jmbde.metainfo.xml

Check failure

Code scanning / check-spelling

Unrecognized Spelling Error

metainfo is not a recognized word. (unrecognized-spelling)
push:
branches: [main, add_nix_support]
paths:
- '**.nix'
- .github/workflows/appstream-util-validate.yaml
- flake.lock
- packaging/linux/com.jmuelbert,jmbde.metainfo.xml
jobs:
appstream-util-validate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/nix-installer-action@v14

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/magic-nix-cache-action@v8

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- name: Check the MetaInfo file
run: nix develop --command appstream-util validate packaging/com.jmuelbert.jmbde.metainfo.xml
129 changes: 129 additions & 0 deletions .github/workflows/ci-nix.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,129 @@
name: Build

Check failure

Code scanning / Scorecard

Token-Permissions High

score is 0: no topLevel permission defined
Remediation tip: Visit https://app.stepsecurity.io/secureworkflow.
Tick the 'Restrict permissions for GITHUB_TOKEN'
Untick other options
NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead.
Click Remediation section below for further remediation help

Check failure

Code scanning / check-spelling

Check File Path Error

workflows is not a recognized word. (check-file-path)
on:
pull_request:
branches: [main, add_nix_support]
paths:
- '**.cmake'
- '**.cpp'
- '**.hpp'
- '**.hpp.in'
- '**.h'
- '**.h.in'
- '**/CMakeLists.txt'
- .clang.tidy
- .github/workflow/ci-nix.yml
- CMakePresets.json
- flake.lock
- iwyu.imp
- packaging/com.jmuelbert.jmbde-QT.desktop
- packaging/com.jmuelbert.jmbde-QT.metainfo.yml
- packaging/com.jmuelbert.jmbde-QT.svg
- packaging/com.jmuelbert.jmbde-QT.yaml
push:
branches: [main, add_nix_support]
paths:
- '**.cmake'
- '**.cpp'
- '**.hpp'
- '**.hpp.in'
- '**.h'
- '**.h.in'
- '**/CMakeLists.txt'
- .clang.tidy
- .github/workflow/ci-nix.yml
- CMakePresets.json
- flake.lock
- iwyu.imp
- packaging/com.jmuelbert.jmbde.desktop
- packaging/com.jmuelbert.jmbde.metainfo.yml
- packaging/com.jmuelbert.jmbde.svg
- packaging/com.jmuelbert.jmbde.yaml
workflow_dispatch:
jobs:
build:
strategy:
fail-fast: true
matrix:
compiler: [clang, gcc]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/nix-installer-action@v14

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/magic-nix-cache-action@v8

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- name: Restore ccache cache
id: cache-ccache-restore
uses: actions/cache/restore@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
with:
key: coverage-${{ matrix.compiler }}-ccache-
path: .ccache
- name: Build
run: nix develop --command just workflow ci-${{ matrix.compiler }}
- name: Prepare ccache timestamp
id: ccache_cache_timestamp
shell: cmake -P {0}
run: |
string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
message("::echo timestamp=${current_date}")
- name: Save ccache cache
uses: actions/cache/save@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
if: always() && steps.cache-ccache-restore.outputs.cache-hit != 'true'
with:
key: coverage-${{ matrix.compiler }}-ccache-${{ steps.ccache_cache_timestamp.outputs.timestamp }}
path: .ccache
package-nix:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/nix-installer-action@v14

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/magic-nix-cache-action@v8

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- name: Build the Nix package
'run': nix build
coverage:
permissions:

Check failure on line 82 in .github/workflows/ci-nix.yml

View check run for this annotation

Trunk.io / Trunk Check

checkov(CKV2_GHA_1)

[new] Ensure top-level permissions are not set to write-all
pull-requests: write
strategy:
matrix:
compiler: [clang]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/nix-installer-action@v14

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- uses: DeterminateSystems/magic-nix-cache-action@v8

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue
- name: Restore ccache cache
id: cache-ccache-restore
uses: actions/cache/restore@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
with:
key: coverage-${{ matrix.compiler }}-ccache-
path: .ccache
- name: Generate Coverage
run: nix develop --command just workflow coverage-${{ matrix.compiler }}
- name: Prepare ccache timestamp
id: ccache_cache_timestamp
shell: cmake -P {0}
run: |
string(TIMESTAMP current_date "%Y-%m-%d-%H;%M;%S" UTC)
message("::echo timestamp=${current_date}")
- name: Save ccache cache
uses: actions/cache/save@v4

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: GitHub-owned GitHubAction not pinned by hash
Click Remediation section below to solve this issue
if: always() && steps.cache-ccache-restore.outputs.cache-hit != 'true'
with:
key: coverage-${{ matrix.compiler }}-ccache-${{ steps.ccache_cache_timestamp.outputs.timestamp }}
path: .ccache
- name: Code Coverage Report
uses: clearlyip/code-coverage-report-action@v5

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue

Check failure

Code scanning / check-spelling

Unrecognized Spelling Error

clearlyip is not a recognized word. (unrecognized-spelling)
id: code_coverage_report_action
with:
artifact_download_workflow_names: build,schedule
badge: true
fail_on_negative_difference: true
file_coverage_error_min: 40
file_coverage_warning_max: 60
filename: build-coverage-${{ matrix.compiler }}/cobertura.xml

Check failure

Code scanning / check-spelling

Unrecognized Spelling Error

cobertura is not a recognized word. (unrecognized-spelling)
overall_coverage_fail_threshold: 60
- name: Add Coverage PR Comment
uses: marocchino/sticky-pull-request-comment@v2

Check warning

Code scanning / Scorecard

Pinned-Dependencies Medium

score is 1: third-party GitHubAction not pinned by hash
Click Remediation section below to solve this issue

Check failure

Code scanning / check-spelling

Unrecognized Spelling Error

marocchino is not a recognized word. (unrecognized-spelling)
if: github.event_name == 'pull_request'
with:
GITHUB_TOKEN: ${{ secrets.GH_TOKEN_FOR_UPDATES }}
recreate: true
path: code-coverage-results.md
Loading
Loading