Deny - Linux #93
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Deny - Linux | |
| # | |
| # Checks for security vulnerabilities or license incompatibilities | |
| # | |
| # Runs on: | |
| # - scheduled UTC midnight | |
| # - on PR review (see comment-trigger.yml) | |
| # - on demand from github actions UI | |
| name: Deny - Linux | |
| on: | |
| workflow_call: | |
| workflow_dispatch: | |
| schedule: | |
| # Same schedule as nightly.yml | |
| - cron: "0 5 * * 2-6" # Runs at 5:00 AM UTC, Tuesday through Saturday | |
| permissions: | |
| statuses: write | |
| jobs: | |
| test-deny: | |
| runs-on: ubuntu-24.04 | |
| timeout-minutes: 30 | |
| env: | |
| CARGO_INCREMENTAL: 0 | |
| steps: | |
| - name: (PR review) Set latest commit status as pending | |
| if: ${{ github.event_name == 'pull_request_review' }} | |
| uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1 | |
| with: | |
| sha: ${{ github.event.review.commit_id }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| context: Deny - Linux | |
| status: pending | |
| - name: (PR review) Checkout PR branch | |
| if: ${{ github.event_name == 'pull_request_review' }} | |
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| with: | |
| ref: ${{ github.event.review.commit_id }} | |
| - name: Checkout branch | |
| if: ${{ github.event_name != 'pull_request_review' }} | |
| uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 | |
| - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0 | |
| name: Cache Cargo registry + index | |
| with: | |
| path: | | |
| ~/.cargo/bin/ | |
| ~/.cargo/registry/index/ | |
| ~/.cargo/registry/cache/ | |
| ~/.cargo/git/db/ | |
| key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }} | |
| restore-keys: | | |
| ${{ runner.os }}-cargo- | |
| - run: sudo -E bash scripts/environment/bootstrap-ubuntu-24.04.sh | |
| - run: bash scripts/environment/prepare.sh --modules=cargo-deny | |
| - run: echo "::add-matcher::.github/matchers/rust.json" | |
| - name: Check cargo deny advisories/licenses | |
| run: make check-deny | |
| - name: (PR review) Set latest commit status as ${{ job.status }} | |
| uses: myrotvorets/set-commit-status-action@3730c0a348a2ace3c110851bed53331bc6406e9f # v2.0.1 | |
| if: always() && github.event_name == 'pull_request_review' | |
| with: | |
| sha: ${{ github.event.review.commit_id }} | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| context: Deny - Linux | |
| status: ${{ job.status }} |