fix: install pinned tools into a runner-writable path #138
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: ci | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| # ci-gate is this repository's required context. A required check is never | |
| # reported to a merge queue unless its workflow subscribes to merge_group, | |
| # so without this an enabled queue would wait forever for a status that can | |
| # never arrive. | |
| merge_group: | |
| types: [checks_requested] | |
| workflow_dispatch: | |
| permissions: {} | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| # Cancel superseded PR iterations, but never a queued merge-group candidate | |
| # or a main push: cancelling those makes branch protection observe a | |
| # partial-cancel status instead of a decisive result. | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| validate: | |
| name: static validators | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Harden runner | |
| uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0 | |
| with: | |
| egress-policy: block | |
| allowed-endpoints: > | |
| agent.api.stepsecurity.io:443 | |
| github.com:443 | |
| api.github.com:443 | |
| objects.githubusercontent.com:443 | |
| release-assets.githubusercontent.com:443 | |
| raw.githubusercontent.com:443 | |
| astral.sh:443 | |
| pypi.org:443 | |
| files.pythonhosted.org:443 | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Python | |
| uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: "3.13" | |
| - name: Set up uv | |
| uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 | |
| with: | |
| version: 0.11.30 | |
| - name: Install validator dependencies | |
| run: uv pip install --system --require-hashes -r requirements-ci.txt | |
| - name: Run static validators | |
| run: python3 scripts/validate_all.py | |
| actionlint: | |
| permissions: | |
| contents: read | |
| uses: ./.github/workflows/actionlint.yml | |
| zizmor: | |
| permissions: | |
| contents: read | |
| security-events: write | |
| uses: ./.github/workflows/zizmor-sarif.yml | |
| ci-gate: | |
| name: ci-gate | |
| needs: [validate, actionlint, zizmor] | |
| runs-on: ubuntu-latest | |
| if: always() | |
| timeout-minutes: 5 | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Aggregate required results | |
| env: | |
| VALIDATE_RESULT: ${{ needs.validate.result }} | |
| ACTIONLINT_RESULT: ${{ needs.actionlint.result }} | |
| ZIZMOR_RESULT: ${{ needs.zizmor.result }} | |
| run: | | |
| set -euo pipefail | |
| for r in "$VALIDATE_RESULT" "$ACTIONLINT_RESULT" "$ZIZMOR_RESULT"; do | |
| if [ "$r" != "success" ]; then | |
| echo "required job failed: $r" >&2 | |
| exit 1 | |
| fi | |
| done | |
| echo "ci-gate passed" |