Bump @actions/io from 1.1.3 to 3.0.2 #864
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'build-test' | |
| on: # rebuild any PRs and main branch changes | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| - 'releases/*' | |
| permissions: {} | |
| jobs: | |
| build: # make sure build/ci work properly | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - run: | | |
| npm install | |
| - run: | | |
| npm run all | |
| test-oidc: # make sure the action works on a clean machine without building | |
| # OIDC is not available for pull requests from forks, so skip these jobs there. | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| roleToken: | |
| - rg_oidc_akr_m17rp5g5mz25rvkctys6 | |
| gem-server: | |
| - 'https://rubygems.org' | |
| include: | |
| - roleToken: rg_oidc_akr_y6txf9nm3c4kttxgnsgg | |
| gem-server: 'https://staging.rubygems.org' | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: ./ | |
| with: | |
| role-to-assume: '${{ matrix.roleToken }}' | |
| gem-server: '${{ matrix.gem-server }}' | |
| - name: Test token | |
| run: | | |
| curl -v --fail '${{ matrix.gem-server }}/api/v1/oidc/api_key_roles/${{ matrix.roleToken }}' -H "Authorization: $RUBYGEMS_API_KEY" | |
| test-trusted-publisher: # make sure the action works on a clean machine without building | |
| # OIDC is not available for pull requests from forks, so skip these jobs there. | |
| if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository | |
| runs-on: ubuntu-latest | |
| permissions: | |
| id-token: write | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| gem-server: | |
| - 'rubygems.org' | |
| - 'staging.rubygems.org' | |
| steps: | |
| - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - uses: ./ | |
| with: | |
| gem-server: 'https://${{ matrix.gem-server }}' | |
| audience: '${{ matrix.gem-server }}' | |
| - name: Test token | |
| run: | | |
| output="$(curl -s -w "\n\n%{http_code}" -v -X POST 'https://${{ matrix.gem-server }}/api/v1/gems' -H "Authorization: $RUBYGEMS_API_KEY" -H 'Accept: application/json')" | |
| expected="$(printf "RubyGems.org cannot process this gem.\nPlease try rebuilding it and installing it locally to make sure it's valid.\nError:\ngem package contains no entries\n\n\n422")" | |
| test "$output" = "$expected" || (echo "$output" && exit 1) | |
| test-all: | |
| needs: [test-oidc, test-trusted-publisher] | |
| # Run even when the OIDC jobs are skipped on fork pull requests, so this | |
| # required check resolves correctly instead of being stuck as skipped. | |
| if: always() | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Check OIDC job results | |
| env: | |
| TEST_OIDC_RESULT: ${{ needs.test-oidc.result }} | |
| TEST_TRUSTED_PUBLISHER_RESULT: ${{ needs.test-trusted-publisher.result }} | |
| run: | | |
| echo "test-oidc: $TEST_OIDC_RESULT" | |
| echo "test-trusted-publisher: $TEST_TRUSTED_PUBLISHER_RESULT" | |
| for result in "$TEST_OIDC_RESULT" "$TEST_TRUSTED_PUBLISHER_RESULT"; do | |
| if [ "$result" = "failure" ] || [ "$result" = "cancelled" ]; then | |
| exit 1 | |
| fi | |
| done |