rust-ci-github-actions-workflow/.github/workflows/lint.yaml at main · yonasBSD/rust-ci-github-actions-workflow · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
name: Linting

on:
  workflow_run:
    workflows: ["Test with Code Coverage"]
    types:
      - completed

env:
  CARGO_TERM_COLOR: always

jobs:
  # The "Gatekeeper" - This is the only place you need the 'if' logic
  gatekeeper:
    runs-on: ubuntu-latest
    if: ${{ github.event.workflow_run.conclusion == 'success' }}
    steps:
      - run: echo "Upstream tests passed. Proceeding with linting..."

  fmt:
    name: Rustfmt and treefmt
    needs: gatekeeper # Depends on the gatekeeper passing
    runs-on: ubuntu-latest
    env:
      SCCACHE_GHA_ENABLED: "true"
      RUSTC_WRAPPER: "sccache"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.deps.dev:443
            api.github.com:443
            api.osv.dev:443
            api.scorecard.dev:443
            fulcio.sigstore.dev:443
            github.com:443
            oss-fuzz-build-logs.storage.googleapis.com:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443
            www.bestpractices.dev:443
            objects.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            static.rust-lang.org:443
            static.crates.io:443
            index.crates.io:443

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - name: Tree Format
        uses: yonasBSD/toolkit@7757e45441401d468ec049000c61571426a47de4 # v1.0.0
        with:
          run: |
            treefmt

  clippy:
    name: Clippy
    needs: gatekeeper # Depends on the gatekeeper passing
    runs-on: ubuntu-latest
    env:
      SCCACHE_GHA_ENABLED: "true"
      RUSTC_WRAPPER: "sccache"
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
        with:
          disable-sudo: true
          egress-policy: block
          allowed-endpoints: >
            api.deps.dev:443
            api.github.com:443
            api.osv.dev:443
            api.scorecard.dev:443
            fulcio.sigstore.dev:443
            github.com:443
            oss-fuzz-build-logs.storage.googleapis.com:443
            rekor.sigstore.dev:443
            tuf-repo-cdn.sigstore.dev:443
            www.bestpractices.dev:443
            objects.githubusercontent.com:443
            release-assets.githubusercontent.com:443
            static.rust-lang.org:443
            index.crates.io:443
            static.crates.io:443

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9

      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
        with:
          toolchain: stable
          components: clippy

      - uses: actions-rs/clippy-check@b5b5f21f4797c02da247df37026fcd0a5024aa4d # v1.0.7
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          args: --all-targets --all-features
          name: Clippy Output