Skip to content

Commit 91da30a

Browse files
rvolosatovsrvolosatovs
committed
ci: setup basic CI
Signed-off-by: Roman Volosatovs <[email protected]>
1 parent ce8a697 commit 91da30a

File tree

10 files changed

+463
-8
lines changed

10 files changed

+463
-8
lines changed

‎.github/CODEOWNERS

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @rvolosatovs

‎.github/actions/build-nix/action.yml

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
name: build via Nix
2+
3+
inputs:
4+
package:
5+
description: package specification to build
6+
required: true
7+
8+
runs:
9+
using: composite
10+
steps:
11+
- run: nix build -L '.#${{ inputs.package }}'
12+
shell: bash
13+
- run: nix run -L --inputs-from . 'nixpkgs#coreutils' -- --coreutils-prog=cp -RLv ./result '${{ inputs.package }}'
14+
shell: bash
15+
- uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
16+
with:
17+
name: ${{ inputs.package }}
18+
path: ${{ inputs.package }}

‎.github/actions/install-nix/action.yml

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: install Nix
2+
3+
inputs:
4+
cachixAuthToken:
5+
description: auth token for https://app.cachix.org/organization/wasmcloud/cache/west
6+
7+
runs:
8+
using: composite
9+
steps:
10+
- uses: DeterminateSystems/nix-installer-action@v14
11+
with:
12+
extra-conf: |
13+
accept-flake-config = true
14+
15+
- uses: DeterminateSystems/magic-nix-cache-action@v8
16+
17+
- uses: cachix/cachix-action@v15
18+
continue-on-error: true
19+
with:
20+
name: west
21+
authToken: '${{ inputs.cachixAuthToken }}'

‎.github/dependabot.yml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
version: 2
2+
updates:
3+
- package-ecosystem: "cargo"
4+
directory: "/"
5+
schedule:
6+
interval: "daily"
7+
8+
- package-ecosystem: "gomod"
9+
directory: "/go"
10+
schedule:
11+
interval: "daily"
12+
13+
- package-ecosystem: "github-actions"
14+
directory: "/"
15+
schedule:
16+
interval: "daily"
17+
- package-ecosystem: "github-actions"
18+
directory: "/.github/actions/build-nix"
19+
schedule:
20+
interval: "daily"
21+
- package-ecosystem: "github-actions"
22+
directory: "/.github/actions/install-nix"
23+
schedule:
24+
interval: "daily"

‎.github/workflows/nix.yml

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
name: nix
2+
3+
on:
4+
merge_group:
5+
pull_request:
6+
push:
7+
branches:
8+
- main
9+
10+
concurrency:
11+
group: ${{ github.workflow }}-${{ github.ref }}
12+
cancel-in-progress: true
13+
14+
jobs:
15+
fmt:
16+
runs-on: ubuntu-latest
17+
steps:
18+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
19+
- uses: ./.github/actions/install-nix
20+
with:
21+
cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
22+
- run: nix fmt
23+
24+
shell:
25+
runs-on: ubuntu-latest
26+
steps:
27+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
28+
- uses: ./.github/actions/install-nix
29+
with:
30+
cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
31+
- run: |
32+
nix profile install
33+
wit-bindgen-wrpc --version
34+
wrpc-wasmtime-nats --version
35+
36+
develop:
37+
runs-on: ubuntu-latest
38+
steps:
39+
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
40+
- uses: ./.github/actions/install-nix
41+
with:
42+
cachixAuthToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
43+
- run: nix develop -L --ignore-environment -c cargo tree

‎.github/workflows/scorecard.yml

+72
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
# This workflow uses actions that are not certified by GitHub. They are provided
2+
# by a third-party and are governed by separate terms of service, privacy
3+
# policy, and support documentation.
4+
5+
name: Scorecard supply-chain security
6+
on:
7+
# For Branch-Protection check. Only the default branch is supported. See
8+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
9+
branch_protection_rule:
10+
# To guarantee Maintained check is occasionally updated. See
11+
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
12+
schedule:
13+
- cron: '45 1 * * 1'
14+
push:
15+
branches: [ "main" ]
16+
17+
# Declare default permissions as read only.
18+
permissions: read-all
19+
20+
jobs:
21+
analysis:
22+
name: Scorecard analysis
23+
runs-on: ubuntu-latest
24+
permissions:
25+
# Needed to upload the results to code-scanning dashboard.
26+
security-events: write
27+
# Needed to publish results and get a badge (see publish_results below).
28+
id-token: write
29+
# Uncomment the permissions below if installing in a private repository.
30+
# contents: read
31+
# actions: read
32+
33+
steps:
34+
- name: "Checkout code"
35+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
36+
with:
37+
persist-credentials: false
38+
39+
- name: "Run analysis"
40+
uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
41+
with:
42+
results_file: results.sarif
43+
results_format: sarif
44+
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
45+
# - you want to enable the Branch-Protection check on a *public* repository, or
46+
# - you are installing Scorecard on a *private* repository
47+
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action#authentication-with-pat.
48+
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
49+
50+
# Public repositories:
51+
# - Publish results to OpenSSF REST API for easy access by consumers
52+
# - Allows the repository to include the Scorecard badge.
53+
# - See https://github.com/ossf/scorecard-action#publishing-results.
54+
# For private repositories:
55+
# - `publish_results` will always be set to `false`, regardless
56+
# of the value entered here.
57+
publish_results: true
58+
59+
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
60+
# format to the repository Actions tab.
61+
- name: "Upload artifact"
62+
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
63+
with:
64+
name: SARIF file
65+
path: results.sarif
66+
retention-days: 5
67+
68+
# Upload the results to GitHub's code scanning dashboard.
69+
- name: "Upload to code-scanning"
70+
uses: github/codeql-action/upload-sarif@4dd16135b69a43b6c8efb853346f8437d92d3c93 # v3.26.6
71+
with:
72+
sarif_file: results.sarif

‎.github/workflows/update.yml

+20
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: nix-flake-update
2+
3+
on:
4+
schedule:
5+
- cron: "0 0 * * *"
6+
workflow_dispatch:
7+
8+
jobs:
9+
nix-flake-update:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: rvolosatovs/nix-flake-update-action@60ed905545151a290d73ce1302c23f4fb7ff43f0 # v2.0.4
13+
with:
14+
app-id: ${{ secrets.BOT_APP_ID }}
15+
private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
16+
assignees: rvolosatovs
17+
reviewers: rvolosatovs
18+
delete-branch: true
19+
signoff: true
20+
labels: dependencies

0 commit comments

Comments
 (0)