Skip to content

Commit 09989bb

Browse files
Puffy1215Puffy1215
committed
Merge branch 'dev-branch' into 2726-clonebreaking
2 parents 6f81a7d + df26240 commit 09989bb

33 files changed

+738
-162
lines changed

‎.github/workflows/benchmark.yml

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ on:
1313
branches:
1414
- main
1515
name: benchmark pull requests
16+
permissions: read-all
17+
1618
jobs:
1719
runBenchmark:
1820
name: run benchmark
@@ -32,15 +34,20 @@ jobs:
3234
# For pushes to main, compare against the previous commit
3335
BRANCH_NAME: ${{ github.event_name == 'pull_request' && github.base_ref || github.event.before }}
3436
steps:
35-
- uses: actions/checkout@v4
37+
- name: Harden the runner (Audit all outbound calls)
38+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
39+
with:
40+
egress-policy: audit
41+
42+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3643
with:
3744
fetch-depth: 10 # Fetch current commit and its parent
38-
- uses: arduino/setup-protoc@v3
45+
- uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
3946
with:
4047
repo-token: ${{ secrets.GITHUB_TOKEN }}
41-
- uses: dtolnay/rust-toolchain@master
48+
- uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0
4249
with:
4350
toolchain: stable
44-
- uses: boa-dev/criterion-compare-action@v3
51+
- uses: boa-dev/criterion-compare-action@adfd3a94634fe2041ce5613eb7df09d247555b87 # v3.2.4
4552
with:
4653
branchName: ${{ env.BRANCH_NAME }}

‎.github/workflows/ci.yml

Lines changed: 67 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
name: CI
22
env:
33
CI: true
4+
permissions: read-all
45
on:
56
pull_request:
67
push:
@@ -29,40 +30,51 @@ jobs:
2930
runs-on: ${{ matrix.os }}
3031
continue-on-error: ${{ matrix.rust == 'beta' }}
3132
steps:
33+
- name: Harden the runner (Audit all outbound calls)
34+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
35+
with:
36+
egress-policy: audit
37+
3238
- name: Free disk space
3339
if: ${{ matrix.os == 'ubuntu-latest'}}
3440
run: |
3541
df -h
3642
sudo rm -rf /usr/local/lib/android
3743
sudo rm -rf /usr/share/dotnet
3844
df -h
39-
- uses: actions/checkout@v4
45+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
4046
with:
4147
submodules: true
42-
- uses: dtolnay/rust-toolchain@master
48+
- uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0
4349
with:
4450
toolchain: ${{ matrix.rust }}
4551
components: rustfmt
4652
- name: "Set rustup profile"
4753
run: rustup set profile minimal
48-
- uses: arduino/setup-protoc@v3
54+
- uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
4955
with:
5056
repo-token: ${{ secrets.GITHUB_TOKEN }}
5157
- name: Test
5258
run: bash ./scripts/test.sh
5359
lint:
5460
runs-on: ubuntu-latest
5561
steps:
56-
- uses: actions/checkout@v4
62+
- name: Harden the runner (Audit all outbound calls)
63+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
64+
with:
65+
egress-policy: audit
66+
67+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
5768
with:
5869
submodules: true
59-
- uses: dtolnay/rust-toolchain@stable
70+
- uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4
6071
with:
72+
toolchain: stable
6173
components: rustfmt, clippy
62-
- uses: taiki-e/install-action@v2
74+
- uses: taiki-e/install-action@d4635f2de61c8b8104d59cd4aede2060638378cc # v2.49.45
6375
with:
6476
tool: cargo-hack
65-
- uses: arduino/setup-protoc@v3
77+
- uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
6678
with:
6779
repo-token: ${{ secrets.GITHUB_TOKEN }}
6880
- name: Format
@@ -75,8 +87,13 @@ jobs:
7587
example: [opentelemetry, opentelemetry-sdk, opentelemetry-otlp, opentelemetry-zipkin]
7688
runs-on: ubuntu-latest # TODO: Check if this could be covered for Windows. The step used currently fails on Windows.
7789
steps:
78-
- uses: actions/checkout@v4
79-
- uses: dtolnay/rust-toolchain@nightly
90+
- name: Harden the runner (Audit all outbound calls)
91+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
92+
with:
93+
egress-policy: audit
94+
95+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
96+
- uses: dtolnay/rust-toolchain@a02741459ec5e501b9843ed30b535ca0a0376ae4
8097
with:
8198
toolchain: nightly-2024-06-30
8299
components: rustfmt
@@ -93,11 +110,16 @@ jobs:
93110
runs-on: ${{ matrix.os }}
94111
continue-on-error: true
95112
steps:
96-
- uses: actions/checkout@v4
113+
- name: Harden the runner (Audit all outbound calls)
114+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
115+
with:
116+
egress-policy: audit
117+
118+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
97119
with:
98120
submodules: true
99121
- name: Set up Rust ${{ matrix.rust }}
100-
uses: dtolnay/rust-toolchain@master
122+
uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0
101123
with:
102124
toolchain: ${{ matrix.rust }}
103125
- name: Patch dependencies versions
@@ -108,19 +130,30 @@ jobs:
108130
runs-on: ubuntu-latest # This uses the step `EmbarkStudios/cargo-deny-action@v1` which is only supported on Linux
109131
continue-on-error: true # Prevent sudden announcement of a new advisory from failing ci
110132
steps:
111-
- uses: actions/checkout@v4
112-
- uses: EmbarkStudios/cargo-deny-action@v2
133+
- name: Harden the runner (Audit all outbound calls)
134+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
135+
with:
136+
egress-policy: audit
137+
138+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
139+
- uses: EmbarkStudios/cargo-deny-action@34899fc7ba81ca6268d5947a7a16b4649013fea1 # v2.0.11
113140
with:
114141
command: check advisories
115142
docs:
116143
continue-on-error: true
117144
runs-on: ubuntu-latest
118145
steps:
119-
- uses: actions/checkout@v4
120-
- uses: dtolnay/rust-toolchain@stable
146+
- name: Harden the runner (Audit all outbound calls)
147+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
121148
with:
149+
egress-policy: audit
150+
151+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
152+
- uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4
153+
with:
154+
toolchain: stable
122155
components: rustfmt
123-
- uses: arduino/setup-protoc@v3
156+
- uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
124157
with:
125158
repo-token: ${{ secrets.GITHUB_TOKEN }}
126159
- name: doc
@@ -133,25 +166,30 @@ jobs:
133166
runs-on: ubuntu-latest
134167
if: ${{ ! contains(github.event.pull_request.labels.*.name, 'dependencies') }}
135168
steps:
136-
- uses: actions/checkout@v4
169+
- name: Harden the runner (Audit all outbound calls)
170+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
171+
with:
172+
egress-policy: audit
173+
174+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
137175
with:
138176
submodules: true
139-
- uses: dtolnay/rust-toolchain@stable
177+
- uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4
140178
with:
141179
toolchain: stable
142180
components: rustfmt,llvm-tools-preview
143-
- uses: arduino/setup-protoc@v3
181+
- uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
144182
with:
145183
repo-token: ${{ secrets.GITHUB_TOKEN }}
146184
- name: cargo install cargo-llvm-cov
147-
uses: taiki-e/install-action@cargo-llvm-cov
185+
uses: taiki-e/install-action@5075451c95db43b063f20f0c8fef04c04d5bf0ba # cargo-llvm-cov
148186
- name: cargo generate-lockfile
149187
if: hashFiles('Cargo.lock') == ''
150188
run: cargo generate-lockfile
151189
- name: cargo llvm-cov
152190
run: cargo llvm-cov --locked --all-features --workspace --lcov --lib --output-path lcov.info
153191
- name: Upload to codecov.io
154-
uses: codecov/codecov-action@v4
192+
uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4.6.0
155193
env:
156194
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
157195
with:
@@ -160,13 +198,18 @@ jobs:
160198
continue-on-error: true
161199
runs-on: ubuntu-latest
162200
steps:
163-
- uses: actions/checkout@v4
201+
- name: Harden the runner (Audit all outbound calls)
202+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
203+
with:
204+
egress-policy: audit
205+
206+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
164207
with:
165208
submodules: true
166-
- uses: dtolnay/rust-toolchain@master
209+
- uses: dtolnay/rust-toolchain@56f84321dbccf38fb67ce29ab63e4754056677e0
167210
with:
168211
toolchain: stable
169-
- uses: taiki-e/install-action@v2
212+
- uses: taiki-e/install-action@d4635f2de61c8b8104d59cd4aede2060638378cc # v2.49.45
170213
with:
171214
tool: cargo-machete
172215
- name: cargo machete

‎.github/workflows/codeql-analysis.yml

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
name: "CodeQL Analysis"
2+
3+
env:
4+
CODEQL_ENABLE_EXPERIMENTAL_FEATURES : true # CodeQL support for Rust is experimental
5+
6+
permissions: read-all
7+
8+
on:
9+
push:
10+
branches: [main]
11+
schedule:
12+
- cron: '0 0 * * *' # once in a day at 00:00
13+
workflow_dispatch:
14+
15+
jobs:
16+
analyze:
17+
name: Analyze
18+
runs-on: ubuntu-latest
19+
permissions:
20+
security-events: write # for github/codeql-action/autobuild to send a status report
21+
22+
strategy:
23+
fail-fast: false
24+
25+
steps:
26+
- name: Harden the runner (Audit all outbound calls)
27+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
28+
with:
29+
egress-policy: audit
30+
31+
- name: Checkout repository
32+
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
33+
with:
34+
submodules: true
35+
36+
- name: Initialize CodeQL
37+
uses: github/codeql-action/init@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
38+
with:
39+
languages: rust
40+
41+
- name: Autobuild
42+
uses: github/codeql-action/autobuild@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15
43+
44+
- name: Perform CodeQL Analysis
45+
uses: github/codeql-action/analyze@45775bd8235c68ba998cffa5171334d58593da47 # v3.28.15

‎.github/workflows/fossa.yml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,13 +5,17 @@ on:
55
branches:
66
- main
77

8-
permissions:
9-
contents: read
8+
permissions: read-all
109

1110
jobs:
1211
fossa:
1312
runs-on: ubuntu-latest
1413
steps:
14+
- name: Harden the runner (Audit all outbound calls)
15+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
16+
with:
17+
egress-policy: audit
18+
1519
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1620

1721
- uses: fossas/fossa-action@c0a7d013f84c8ee5e910593186598625513cc1e4 # v1.6.0

‎.github/workflows/integration_tests.yml

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,24 +5,32 @@ on:
55
pull_request:
66
types: [ labeled, synchronize, opened, reopened ]
77

8+
permissions: read-all
9+
810
jobs:
911
integration_tests:
1012
runs-on: ubuntu-latest
1113
timeout-minutes: 10
1214
steps:
15+
- name: Harden the runner (Audit all outbound calls)
16+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
17+
with:
18+
egress-policy: audit
19+
1320
- name: Free disk space
1421
run: |
1522
df -h
1623
sudo rm -rf /usr/local/lib/android
1724
sudo rm -rf /usr/share/dotnet
1825
df -h
19-
- uses: actions/checkout@v4
26+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2027
with:
2128
submodules: true
22-
- uses: dtolnay/rust-toolchain@stable
29+
- uses: dtolnay/rust-toolchain@fcf085fcb4b4b8f63f96906cd713eb52181b5ea4
2330
with:
31+
toolchain: stable
2432
components: rustfmt
25-
- uses: arduino/setup-protoc@v3
33+
- uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3.0.0
2634
with:
2735
repo-token: ${{ secrets.GITHUB_TOKEN }}
2836
- name: Run integration tests

‎.github/workflows/markdown-link-check.yml

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,21 @@ on:
88
paths:
99
- '**/*.md'
1010

11+
permissions: read-all
12+
1113
jobs:
1214
markdown-link-check:
1315
runs-on: ubuntu-latest
1416
steps:
15-
- uses: actions/checkout@v4
17+
- name: Harden the runner (Audit all outbound calls)
18+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
19+
with:
20+
egress-policy: audit
21+
22+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
1623

1724
- name: Install markdown-link-check
18-
run: npm install -g markdown-link-check@3.11.2
25+
run: npm install -g "git://github.com/tcort/markdown-link-check.git#ef7e09486e579ba7479700b386e7ca90f34cbd0a" # v3.13.7
1926

2027
- name: Run markdown-link-check
2128
run: |

‎.github/workflows/ossf-scorecard.yml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,11 @@ jobs:
1919
# Needed for GitHub OIDC token if publish_results is true
2020
id-token: write
2121
steps:
22+
- name: Harden the runner (Audit all outbound calls)
23+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
24+
with:
25+
egress-policy: audit
26+
2227
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
2328
with:
2429
persist-credentials: false

‎.github/workflows/pr_naming.yml

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,19 @@ on:
44
pull_request:
55
types: [opened, synchronize, reopened, edited]
66

7+
permissions: read-all
8+
79
jobs:
810
validate-pr-title:
911
runs-on: ubuntu-latest
1012
steps:
13+
- name: Harden the runner (Audit all outbound calls)
14+
uses: step-security/harden-runner@c6295a65d1254861815972266d5933fd6e532bdf # v2.11.1
15+
with:
16+
egress-policy: audit
17+
1118
- name: PR Conventional Commit Validation
12-
uses: ytanikin/[email protected]
19+
uses: ytanikin/pr-conventional-commits@8267db1bacc237419f9ed0228bb9d94e94271a1d # 1.4.1
1320
with:
1421
task_types: '["build","chore","ci","docs","feat","fix","perf","refactor","revert","test"]'
1522
add_label: 'false'

0 commit comments

Comments
 (0)