Skip to content

Commit

Permalink
CI/CD: Use my forks of the third-party GitHub actions.
Browse files Browse the repository at this point in the history
This is a step towards implementing GitHub's GitHub Actions security
hardening advice.

```
$ sed -ri 's|(uses: +)([^/]+)/([^@])|\1briansmith/\2-\3|g' .github/workflows/ci.yml
$ grep "uses:" .github/workflows/ci.yml | sort | uniq
      - uses: briansmith/actions-cache@v2
      - uses: briansmith/actions-checkout@v2
      - uses: briansmith/actions-rs-toolchain@v1
      - uses: briansmith/codecov-codecov-action@v1
```
  • Loading branch information
briansmith committed Apr 27, 2021
1 parent 96a2a0f commit 6e77bb9
Showing 1 changed file with 19 additions and 19 deletions.
38 changes: 19 additions & 19 deletions .github/workflows/ci.yml
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,12 @@ jobs:
runs-on: ubuntu-18.04

steps:
- uses: actions-rs/toolchain@v1
- uses: briansmith/actions-rs-toolchain@v1
with:
toolchain: stable
profile: minimal
components: rustfmt
- uses: actions/checkout@v2
- uses: briansmith/actions-checkout@v2
with:
persist-credentials: false
- run: cargo fmt --all -- --check
Expand All @@ -29,13 +29,13 @@ jobs:
runs-on: ubuntu-18.04

steps:
- uses: actions-rs/toolchain@v1
- uses: briansmith/actions-rs-toolchain@v1
with:
toolchain: stable
profile: minimal
components: clippy

- uses: actions/checkout@v2
- uses: briansmith/actions-checkout@v2
with:
persist-credentials: false

Expand All @@ -48,12 +48,12 @@ jobs:
runs-on: ubuntu-18.04

steps:
- uses: actions-rs/toolchain@v1
- uses: briansmith/actions-rs-toolchain@v1
with:
toolchain: stable
profile: minimal

- uses: actions/cache@v2
- uses: briansmith/actions-cache@v2
with:
path: |
~/.cargo/bin/cargo-audit
Expand All @@ -63,7 +63,7 @@ jobs:

- run: cargo install cargo-audit --vers "0.13.1"

- uses: actions/checkout@v2
- uses: briansmith/actions-checkout@v2
with:
persist-credentials: false

Expand All @@ -78,12 +78,12 @@ jobs:
runs-on: ubuntu-18.04

steps:
- uses: actions-rs/toolchain@v1
- uses: briansmith/actions-rs-toolchain@v1
with:
toolchain: stable
profile: minimal

- uses: actions/cache@v2
- uses: briansmith/actions-cache@v2
with:
path: |
~/.cargo/bin/cargo-deny
Expand All @@ -93,7 +93,7 @@ jobs:

- run: cargo install cargo-deny --locked --vers "0.8.5"

- uses: actions/checkout@v2
- uses: briansmith/actions-checkout@v2
with:
persist-credentials: false

Expand All @@ -117,13 +117,13 @@ jobs:
- target: x86_64-unknown-linux-gnu

steps:
- uses: actions-rs/toolchain@v1
- uses: briansmith/actions-rs-toolchain@v1
with:
override: true
target: ${{ matrix.target }}
toolchain: ${{ matrix.rust_channel }}

- uses: actions/checkout@v2
- uses: briansmith/actions-checkout@v2
with:
persist-credentials: false

Expand All @@ -137,12 +137,12 @@ jobs:
runs-on: ubuntu-18.04

steps:
- uses: actions-rs/toolchain@v1
- uses: briansmith/actions-rs-toolchain@v1
with:
toolchain: stable
profile: minimal

- uses: actions/checkout@v2
- uses: briansmith/actions-checkout@v2
with:
persist-credentials: false

Expand Down Expand Up @@ -208,14 +208,14 @@ jobs:
- if: ${{ contains(matrix.host_os, 'ubuntu') }}
run: sudo apt-get update -y

- uses: actions/checkout@v2
- uses: briansmith/actions-checkout@v2
with:
persist-credentials: false

- if: ${{ !contains(matrix.host_os, 'windows') }}
run: mk/install-build-tools.sh --target=${{ matrix.target }} ${{ matrix.features }}

- uses: actions-rs/toolchain@v1
- uses: briansmith/actions-rs-toolchain@v1
with:
override: true
target: ${{ matrix.target }}
Expand Down Expand Up @@ -263,14 +263,14 @@ jobs:
- if: ${{ contains(matrix.host_os, 'ubuntu') }}
run: sudo apt-get update -y

- uses: actions/checkout@v2
- uses: briansmith/actions-checkout@v2
with:
persist-credentials: false

- if: ${{ !contains(matrix.host_os, 'windows') }}
run: RING_COVERAGE=1 mk/install-build-tools.sh --target=${{ matrix.target }} ${{ matrix.features }}

- uses: actions-rs/toolchain@v1
- uses: briansmith/actions-rs-toolchain@v1
with:
override: true
target: ${{ matrix.target }}
Expand All @@ -283,7 +283,7 @@ jobs:
run: |
RING_COVERAGE=1 mk/cargo.sh +${{ matrix.rust_channel }} test -vv --target=${{ matrix.target }} ${{ matrix.cargo_options }} ${{ matrix.features }} ${{ matrix.mode }}
- uses: codecov/codecov-action@v1
- uses: briansmith/codecov-codecov-action@v1
with:
directory: ./target/${{ matrix.target }}/debug/coverage/reports
fail_ci_if_error: true
Expand Down

0 comments on commit 6e77bb9

Please sign in to comment.