build(deps): bump github/codeql-action/init from 4.37.9 to 4.38.1 #249
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: lint | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| branches: | |
| - main | |
| workflow_dispatch: | |
| concurrency: | |
| group: ci-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: true | |
| permissions: | |
| contents: read | |
| jobs: | |
| workflow-lint: | |
| name: GitHub Actions workflow lint | |
| if: ${{ github.event_name != 'schedule' }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 10 | |
| steps: | |
| - &checkout | |
| name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| - name: Set up Go | |
| uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 | |
| with: | |
| go-version: stable | |
| - name: Run actionlint | |
| run: | | |
| # Workflows only. actionlint is a workflow linter: handed a | |
| # composite action.yml it parses it AS a workflow and reports a | |
| # missing "jobs" section, so the action files cannot be added to | |
| # this glob. They are covered by being exercised instead -- the GNU | |
| # oracle action is how CI builds its reference, so a malformed one | |
| # fails the job rather than passing quietly. | |
| # | |
| # This lint, plus CI itself running the workflows, is what replaced | |
| # 19 xtask tests that asserted on the TEXT of .github/ files. Those | |
| # failed when YAML legitimately re-wrapped a line and passed when a | |
| # string merely appeared in a comment; one of them demanded | |
| # "--without-x", i.e. it was enforcing the exact mis-configuration | |
| # it was meant to catch. | |
| go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12 .github/workflows/*.yml | |
| # ubuntu-24.04 no longer ships shellcheck, and the step below dies with | |
| # exit 127 -- "shellcheck: command not found" -- which the run reports as | |
| # a lint FAILURE rather than a missing linter. Pinned for the same reason | |
| # actionlint is: the findings, and so whether this job is red, differ | |
| # between versions. | |
| - name: Install shellcheck | |
| run: | | |
| curl -sSfL -o /tmp/shellcheck.tar.xz \ | |
| https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.x86_64.tar.xz | |
| tar -xJf /tmp/shellcheck.tar.xz -C /tmp | |
| sudo install -m 0755 /tmp/shellcheck-v0.11.0/shellcheck /usr/local/bin/shellcheck | |
| shellcheck --version | |
| - name: Lint release shell contracts | |
| run: | | |
| # -x so sourced helpers are followed. The packaging scripts are in | |
| # this list because they were not: removing a variable's assignment | |
| # while a later line still read it passed `bash -n`, passed every | |
| # test, and only failed when a release job ran package-release.sh. | |
| # SC2154 catches exactly that. | |
| shellcheck -x \ | |
| install.sh \ | |
| scripts/dispatch-release-event.sh \ | |
| scripts/generate-release-notes.sh \ | |
| scripts/prepare-docker-runtime-context.sh \ | |
| scripts/test-dispatch-release-event.sh \ | |
| scripts/test-docker-runtime-context.sh \ | |
| scripts/test-generate-release-notes.sh \ | |
| scripts/check-native-font-boundaries.sh \ | |
| scripts/lib/macos-macho.sh \ | |
| scripts/vendor-macos-runtime.sh \ | |
| scripts/test-macos-dependency-closure.sh \ | |
| scripts/package-release.sh \ | |
| scripts/package-appimage.sh \ | |
| scripts/package-deb.sh \ | |
| scripts/package-rpm.sh \ | |
| scripts/test-linux-release-artifacts.sh \ | |
| scripts/ci/setup-linux.sh | |
| sh -n install.sh | |
| bash -n \ | |
| scripts/dispatch-release-event.sh \ | |
| scripts/generate-release-notes.sh \ | |
| scripts/prepare-docker-runtime-context.sh \ | |
| scripts/test-dispatch-release-event.sh \ | |
| scripts/test-docker-runtime-context.sh \ | |
| scripts/test-generate-release-notes.sh \ | |
| scripts/check-native-font-boundaries.sh \ | |
| scripts/lib/macos-macho.sh \ | |
| scripts/vendor-macos-runtime.sh \ | |
| scripts/test-macos-dependency-closure.sh | |
| - name: Test Docker runtime context contract | |
| run: ./scripts/test-docker-runtime-context.sh | |
| - name: Test release dispatch contract | |
| run: ./scripts/test-dispatch-release-event.sh | |
| - name: Test release-note generation contract | |
| run: ./scripts/test-generate-release-notes.sh | |
| - name: Check native font dependency boundaries | |
| run: ./scripts/check-native-font-boundaries.sh | |
| # The dependency closure is pure path logic over otool output, so it is | |
| # testable with stub tools on Linux. Running it here means a regression | |
| # is caught in seconds on every push instead of by a macOS release job | |
| # forty minutes in. | |
| - name: Test macOS dependency closure contract | |
| run: ./scripts/test-macos-dependency-closure.sh | |
| fmt: | |
| name: cargo fmt (${{ matrix.label }}) | |
| if: ${{ github.event_name != 'schedule' }} | |
| runs-on: ${{ matrix.runner }} | |
| timeout-minutes: 30 | |
| env: | |
| CARGO_TERM_COLOR: always | |
| RUST_BACKTRACE: 1 | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - runner: ubuntu-24.04 | |
| label: linux-x86_64 | |
| - runner: macos-latest | |
| label: macos-aarch64 | |
| - runner: windows-latest | |
| label: windows-msvc-x86_64 | |
| steps: | |
| - *checkout | |
| - name: Set up Rust tooling | |
| uses: ./.github/actions/setup-rust | |
| with: | |
| # cargo fmt does not compile: a build cache here is ~180 MiB per | |
| # platform for no reuse, against a shared 10 GiB repo limit. | |
| cache: "false" | |
| cache-key: ci-fmt-${{ matrix.label }} | |
| - name: cargo fmt | |
| run: | | |
| cargo fmt --all --check | |
| cargo fmt --manifest-path crates/neovm-core/fuzz/Cargo.toml --check | |
| cargo-deny: | |
| name: cargo deny | |
| if: ${{ github.event_name != 'schedule' }} | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 15 | |
| steps: | |
| - *checkout | |
| - name: Check advisories, licenses, bans, and sources | |
| uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2 | |
| with: | |
| command: check | |
| arguments: --all-features | |
| command-arguments: --hide-inclusion-graph |