mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-22 23:11:07 +09:00
Jeremy Daer
dfd2dd2bca
Dependabot version updates are disabled for this repo, so the weekly github-actions group never proposed these. The pins had been frozen since March: zizmor-action v0.5.2 ships zizmor 1.23.1, which flags secrets-outside-env at the default persona -- that moved to the auditor persona in zizmor 1.24.0. v0.6.2 ships zizmor 1.29.0. Both linters pass locally at the new versions.
129 lines
3.5 KiB
YAML
129 lines
3.5 KiB
YAML
name: CI
|
|
|
|
on:
|
|
push:
|
|
branches: [ main ]
|
|
pull_request:
|
|
branches: [ main ]
|
|
|
|
permissions: {}
|
|
|
|
jobs:
|
|
scan:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up Ruby
|
|
uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
|
|
with:
|
|
ruby-version: .ruby-version
|
|
bundler-cache: true
|
|
|
|
- name: Scan for security vulnerabilities
|
|
run: bin/brakeman
|
|
|
|
lint:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up Ruby
|
|
uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
|
|
with:
|
|
ruby-version: .ruby-version
|
|
bundler-cache: true
|
|
|
|
- name: Lint code for consistent style
|
|
run: bin/rubocop
|
|
|
|
lint-actions:
|
|
name: GitHub Actions audit
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
|
|
steps:
|
|
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Run actionlint
|
|
uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
|
|
|
|
- name: Run zizmor
|
|
uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
|
|
with:
|
|
advanced-security: false
|
|
|
|
test:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
services:
|
|
redis:
|
|
image: redis # zizmor: ignore[unpinned-images] -- version tag is fine for service containers
|
|
ports:
|
|
- 6379:6379
|
|
options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
|
|
steps:
|
|
- name: Install packages
|
|
run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libsqlite3-0 libvips curl ffmpeg
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up Ruby
|
|
uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
|
|
env:
|
|
REDIS_URL: redis://localhost:6379/0
|
|
with:
|
|
ruby-version: .ruby-version
|
|
bundler-cache: true
|
|
|
|
- name: Run tests
|
|
run: bin/rails db:setup test
|
|
|
|
test_system:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
contents: read
|
|
services:
|
|
redis:
|
|
image: redis # zizmor: ignore[unpinned-images] -- version tag is fine for service containers
|
|
ports:
|
|
- 6379:6379
|
|
options: --health-cmd "redis-cli ping" --health-interval 10s --health-timeout 5s --health-retries 5
|
|
steps:
|
|
- name: Install packages
|
|
run: sudo apt-get update && sudo apt-get install --no-install-recommends -y libsqlite3-0 libvips curl ffmpeg
|
|
|
|
- name: Checkout code
|
|
uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Set up Ruby
|
|
uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
|
|
env:
|
|
REDIS_URL: redis://localhost:6379/0
|
|
with:
|
|
ruby-version: .ruby-version
|
|
bundler-cache: true
|
|
|
|
- name: Run tests
|
|
run: bin/rails db:setup test:system
|