mirror of
https://github.com/rizsotto/Bear.git
synced 2026-10-28 10:15:05 +01:00
Laszlo NagyandClaude Opus 5.5
68fd15c4ce
A new RustSec advisory can turn a dependency bad with no commit in this repo, and the audit job only ran on push. The advisory check moves next to CodeQL, which already runs weekly. The license, ban, and source checks only change with Cargo.toml or Cargo.lock, so they stay with the build. Every cargo call in CI now passes --locked, so CI tests the committed lockfile instead of one it resolved itself. Push builds are limited to master and next. A PR branch pushed to this repo used to run every workflow twice. The cargo-deny version pin is documented in .deny.toml, where the syntax it protects lives, and both workflows point there. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
65 lines
1.6 KiB
YAML
65 lines
1.6 KiB
YAML
name: CodeQL
|
|
|
|
on:
|
|
push:
|
|
branches: [master, next]
|
|
pull_request:
|
|
schedule:
|
|
- cron: '23 4 * * 1'
|
|
|
|
env:
|
|
CARGO_TERM_COLOR: always
|
|
# Keep identical to the cargo-deny version in .deny.toml.
|
|
CARGO_DENY_VERSION: 0.20.2
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
analyze:
|
|
name: Analyze (${{ matrix.language }})
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
security-events: write
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
include:
|
|
- language: actions
|
|
build-mode: none
|
|
- language: rust
|
|
build-mode: none
|
|
# The preload shim is compiled by the cc crate, so CodeQL has
|
|
# to trace a real build to see it.
|
|
- language: c-cpp
|
|
build-mode: manual
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
if: matrix.build-mode == 'manual'
|
|
with:
|
|
toolchain: stable
|
|
- uses: github/codeql-action/init@v4
|
|
with:
|
|
languages: ${{ matrix.language }}
|
|
build-mode: ${{ matrix.build-mode }}
|
|
- if: matrix.build-mode == 'manual'
|
|
run: cargo build -p intercept-preload --locked
|
|
- uses: github/codeql-action/analyze@v4
|
|
with:
|
|
category: /language:${{ matrix.language }}
|
|
|
|
advisories:
|
|
name: Advisories
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v7
|
|
- uses: dtolnay/rust-toolchain@stable
|
|
with:
|
|
toolchain: stable
|
|
- uses: taiki-e/install-action@v2
|
|
with:
|
|
tool: cargo-deny@${{ env.CARGO_DENY_VERSION }}
|
|
- name: Run Cargo Deny
|
|
run: cargo deny check advisories
|