Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CI improvements #288

Merged
merged 9 commits into from
Nov 3, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 35 additions & 8 deletions .github/workflows/test.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,24 @@

name: CI

on: [push, pull_request]
on:
# Run on pushes to the default branch.
push:
branches:
- main

# Run on all PRs.
pull_request:
types:
- opened
- synchronize
- reopened

# Support merge queues.
merge_group:

# Allow running this workflow manually from the Actions tab.
workflow_dispatch:

defaults:
run:
Expand All @@ -20,29 +37,39 @@ jobs:
# Steps represent a sequence of tasks that will be executed as part of the job
steps:
# Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Git checkout
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
with:
submodules: recursive
clean: true
persist-credentials: false
set-safe-directory: true

- name: Setup Node.js environment
uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe dependabot is not updating them because of the hash? Or because of the comment. Not sure either 🤷‍♂️

Copy link
Contributor Author

@lishaduck lishaduck Nov 1, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dependabot is smart enough for it to work on my other projects. If the comment is wrong, it'll also override it (rather than ignoring it or not updating), which is nice.

(Otherwise, I wouldn't use this. I prefer security updates+possible supply chain attack over old versions)

with:
node-version: 16.x
cache: 'npm'

- name: Cache ~/.elm
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: ~/.elm
key: elm-${{ runner.os }}-${{ hashFiles('**/elm.json', 'elm-tooling.json') }}
restore-keys: |
elm-${{ runner.os }}-
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've read https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/caching-dependencies-to-speed-up-workflows but I still don't get how this is not dangerous.

If elm.json has changed, then recovering from other caches seems like a recipe for problems, though I don't understand what it recovers. What am I missing?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Say I've got an elm.json with elm-review@2.14.1 and elm-syntax@8.3.4. I bump elm-syntax, so the old cache is invalidated, but it'll still grab the last cache from the same branch, then main (so you can't get a cache from a fork and get a supply-chain attack), so elm make doesn't have to redownload the unchanged elm-review. Then, it'll upload the new cache (with the new elm-syntax) with a new hash.
It has the potential to create larger caches, but if it becomes a problem, you can just clear the cache.


- name: Cache node_modules
id: cache-node_modules
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: node_modules
key: node_modules-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
restore-keys: |
node_modules-${{ runner.os }}-

- name: Cache turbo build setup
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
with:
path: .turbo
key: ${{ runner.os }}-turbo-${{ github.sha }}
Expand All @@ -53,15 +80,15 @@ jobs:
if: steps.cache-node_modules.outputs.cache-hit != 'true'
env:
NO_ELM_TOOLING_INSTALL: 1
run: npm ci
run: npm ci --engine-strict

- name: elm-tooling install
run: npx --no-install elm-tooling install

- name: Install turbo
run: npm install -g turbo

- name: Test nodejs version requirements
- name: Test Node.js version requirements
run: turbo run check-engines

- name: Run tests
Expand Down
2 changes: 1 addition & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@
"turbo": "^2.1.2",
"typescript": "~5.6.2"
},
"packageManager": "npm@8.19.4",
"packageManager": "npm@8.19.4+sha512.dc700d97c8bd0ca9d403cf4fe0a12054d376f048d27830a6bc4a9bcce02ec42143cdd059ce3525f7dce09c6a4e52e9af5b996f268d8729c8ebb1cfad7f2bf51f",
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you explain how to find the hash for this?
So that if I want to update it some point I know how to keep this security improvement.

Do you also have more information/resources on why this is a good idea?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wrote it manually originally, but remembered a few days ago (in a personal project) that there's a cli, so getting the hash is as simple as corepack use npm@x.x.x, and it'll add the hash in automatically.

Corepack then does an integrity check when downloading

"engines": {
"node": "14 >=14.21 || 16 >=16.20 || 18 || 20 || >=22"
}
Expand Down