diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 057e26e..6b2034f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,8 +1,13 @@ +--- name: Continuous Integration on: push: + branches: + - main pull_request: + branches: + - main permissions: read-all @@ -10,35 +15,30 @@ env: CARGO_TERM_COLOR: always jobs: - build_and_test: - name: build and test + test: + name: Test runs-on: ubuntu-latest steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2 - - name: Build - run: cargo build --verbose - - name: Test - run: cargo test --verbose + - run: cargo test --verbose fuzz: - name: fuzz + name: Fuzz runs-on: ubuntu-latest steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2 with: toolchain: nightly - - name: Sanity check fuzzers - run: | + - run: | cargo install cargo-fuzz - cd fuzz cargo fuzz run parse_parameters -- -max_total_time=5 cargo fuzz run parse_error_causes -- -max_total_time=5 cargo fuzz run parse_packet -- -max_total_time=5 check-rustfmt: - name: check (rustfmt) + name: Check (rustfmt) runs-on: ubuntu-latest steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 @@ -49,7 +49,7 @@ jobs: - run: cargo fmt --all -- --check check-clippy: - name: check (clippy) + name: Check (clippy) runs-on: ubuntu-latest steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 @@ -59,30 +59,27 @@ jobs: - run: cargo clippy --all-features --all-targets -- -D warnings check-doctests: - name: check (doctests) + name: Check (doc tests) runs-on: ubuntu-latest steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2 # NOTE: We need to run `cargo test --doc` separately from normal tests: # https://github.com/rust-lang/cargo/issues/6669 - - name: Run doctests - run: cargo test --doc - env: + - env: RUST_BACKTRACE: 1 - - name: Check `cargo doc` for lint issues - env: + run: cargo test --doc + - env: RUSTDOCFLAGS: "--deny warnings" run: cargo doc --no-deps --all-features --document-private-items - build-cxx: - name: cxx (build) + check-cxx: + name: Check (cxx) runs-on: ubuntu-latest steps: - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 - uses: actions-rust-lang/setup-rust-toolchain@1780873c7b576612439a134613cc4cc74ce5538c # v1.15.2 - - name: Build and sanity test - run: | + - run: | cd examples/pingpong/ make clean all ./main diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 5ea87e2..1b0983f 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -9,7 +9,7 @@ on: branches: - main schedule: - - cron: '40 15 * * 3' + - cron: '0 6 * * MON' permissions: read-all diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 382ad7f..2225ede 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -1,78 +1,38 @@ -# This workflow uses actions that are not certified by GitHub. They are provided -# by a third-party and are governed by separate terms of service, privacy -# policy, and support documentation. +--- +name: Scorecard -name: Scorecard supply-chain security on: - # For Branch-Protection check. Only the default branch is supported. See - # https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection branch_protection_rule: - # To guarantee Maintained check is occasionally updated. See - # https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained - schedule: - - cron: '40 15 * * 3' push: - branches: [ "main" ] + branches: + - main + schedule: + - cron: '0 6 * * MON' -# Declare default permissions as read only. permissions: read-all jobs: - analysis: - name: Scorecard analysis + analyze: + name: Analyze + if: > + github.event.repository.default_branch == github.ref_name || + github.event_name == 'pull_request' runs-on: ubuntu-latest - # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled. - if: github.event.repository.default_branch == github.ref_name || github.event_name == 'pull_request' permissions: - # Needed to upload the results to code-scanning dashboard. - security-events: write - # Needed to publish results and get a badge (see publish_results below). id-token: write - # Uncomment the permissions below if installing in a private repository. - # contents: read - # actions: read - + security-events: write steps: - - name: "Checkout code" - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: persist-credentials: false - - - name: "Run analysis" - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 + - uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3 with: - results_file: results.sarif + results_file: scorecard.sarif results_format: sarif - # (Optional) "write" PAT token. Uncomment the `repo_token` line below if: - # - you want to enable the Branch-Protection check on a *public* repository, or - # - you are installing Scorecard on a *private* repository - # To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional. - # repo_token: ${{ secrets.SCORECARD_TOKEN }} - - # Public repositories: - # - Publish results to OpenSSF REST API for easy access by consumers - # - Allows the repository to include the Scorecard badge. - # - See https://github.com/ossf/scorecard-action#publishing-results. - # For private repositories: - # - `publish_results` will always be set to `false`, regardless - # of the value entered here. publish_results: true - - # (Optional) Uncomment file_mode if you have a .gitattributes with files marked export-ignore - # file_mode: git - - # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF - # format to the repository Actions tab. - - name: "Upload artifact" - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 with: - name: SARIF file - path: results.sarif - retention-days: 5 - - # Upload the results to GitHub's code scanning dashboard (optional). - # Commenting out will disable upload of results to your repo's Code Scanning dashboard - - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9 + path: scorecard.sarif + - uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9 with: - sarif_file: results.sarif + sarif_file: scorecard.sarif