ci: add zizmor security lint (#267) #53
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Release | |
| on: | |
| push: | |
| branches: [main] | |
| permissions: {} | |
| jobs: | |
| release: | |
| name: Release | |
| runs-on: blacksmith-2vcpu-ubuntu-2404 | |
| if: ${{ github.repository == 'x52dev/protobug' }} | |
| outputs: | |
| releases: ${{ steps.release-plz.outputs.releases }} | |
| releases_created: ${{ steps.release-plz.outputs.releases_created }} | |
| permissions: | |
| contents: write | |
| id-token: write | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Install Rust | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| - name: Authenticate with crates.io | |
| uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5 | |
| id: auth | |
| - name: release-plz | |
| uses: MarcoIeni/release-plz-action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5.131 | |
| id: release-plz | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }} | |
| - name: Install Nix | |
| if: ${{ steps.release-plz.outputs.prs_created == 'true' || steps.release-plz.outputs.releases_created == 'true' }} | |
| uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c # v35 | |
| - name: Enter Nix devshell | |
| if: ${{ steps.release-plz.outputs.prs_created == 'true' || steps.release-plz.outputs.releases_created == 'true' }} | |
| uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1.2.1 | |
| with: | |
| arguments: .#ci-release | |
| - name: Bump changelog versions | |
| if: ${{ steps.release-plz.outputs.prs_created == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_PLZ_PR_JSON: ${{ steps.release-plz.outputs.pr }} | |
| run: x52-bump-changelogs | |
| - name: Update release notes | |
| if: ${{ steps.release-plz.outputs.releases_created == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_PLZ_RELEASES_JSON: ${{ steps.release-plz.outputs.releases }} | |
| run: x52-update-release-notes | |
| - name: Comment on release PR | |
| if: ${{ steps.release-plz.outputs.releases_created == 'true' }} | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASES_JSON: ${{ steps.release-plz.outputs.releases }} | |
| run: x52-comment-release-pr "$RELEASES_JSON" "$GITHUB_SHA" | |
| upload-assets: | |
| name: Upload release assets | |
| needs: release | |
| if: ${{ needs.release.outputs.releases_created == 'true' }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - { os: macos-latest, target: aarch64-apple-darwin } | |
| - { os: macos-latest, target: universal-apple-darwin } | |
| - { os: macos-latest, target: x86_64-apple-darwin } | |
| - { os: ubuntu-latest, target: aarch64-unknown-linux-gnu } | |
| - { os: ubuntu-latest, target: aarch64-unknown-linux-musl } | |
| # - { os: ubuntu-latest, target: x86_64-unknown-freebsd } | |
| - { os: ubuntu-latest, target: x86_64-unknown-linux-gnu } | |
| - { os: ubuntu-latest, target: x86_64-unknown-linux-musl } | |
| # - { os: windows-latest, target: aarch64-pc-windows-msvc } | |
| - { os: windows-latest, target: x86_64-pc-windows-msvc } | |
| runs-on: ${{ matrix.os }} | |
| timeout-minutes: 60 | |
| permissions: | |
| attestations: write | |
| contents: write | |
| id-token: write | |
| env: | |
| CARGO_INCREMENTAL: 0 | |
| CARGO_NET_GIT_FETCH_WITH_CLI: true | |
| CARGO_NET_RETRY: 10 | |
| CARGO_TERM_COLOR: always | |
| RELEASE_TAG: ${{ fromJSON(needs.release.outputs.releases)[0].tag }} | |
| RUST_BACKTRACE: 1 | |
| RUSTUP_MAX_RETRIES: 10 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| ref: ${{ env.RELEASE_TAG }} | |
| persist-credentials: false | |
| - name: Install nasm | |
| if: matrix.os == 'windows-latest' | |
| uses: ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b # v1.5.2 | |
| - name: Install Rust | |
| uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0 | |
| with: | |
| cache: false | |
| - uses: taiki-e/setup-cross-toolchain-action@12b7ad4acfa95a1476779d6c06699b96ec1691f8 # v1.42.0 | |
| with: | |
| target: ${{ matrix.target }} | |
| # TODO: see if this is needed after next deploy | |
| # - if: endsWith(matrix.target, 'windows-msvc') | |
| # run: echo "RUSTFLAGS=${RUSTFLAGS} -C target-feature=+crt-static" >> "${GITHUB_ENV}" | |
| - name: Build and upload to release | |
| id: upload-release | |
| uses: taiki-e/upload-rust-binary-action@f0d45ae91ee7b8ee928de7a9d04d893a08bcbec6 # v1.30.2 | |
| with: | |
| bin: protobug | |
| target: ${{ matrix.target }} | |
| checksum: sha256 | |
| ref: refs/tags/${{ env.RELEASE_TAG }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Generate artifact attestation | |
| uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1 | |
| with: | |
| subject-path: "${{ steps.upload-release.outputs.archive }}.*" | |
| release-assets-uploaded: | |
| name: Release assets uploaded | |
| if: ${{ needs.release.outputs.releases_created == 'true' }} | |
| runs-on: ubuntu-latest | |
| needs: | |
| - release | |
| - upload-assets | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install Nix | |
| uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c # v35 | |
| - name: Enter Nix devshell | |
| uses: nicknovitski/nix-develop@9be7cfb4b10451d3390a75dc18ad0465bed4932a # v1.2.1 | |
| with: | |
| arguments: .#ci-release | |
| - name: Comment on release PR | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASES_JSON: ${{ needs.release.outputs.releases }} | |
| run: x52-comment-release-assets-uploaded "$RELEASES_JSON" "$GITHUB_SHA" |