Skip to content

Commit f43e009

Browse files
maxrakemaxrake
authored
Update workflows to current standards (#1618)
This change updates the `cargo-update` workflow to be more like the rest of the repos in the `phylum-dev` org. That is, it will no longer fail if an update PR already exists. Additional changes made include: * Update macOS runners from `macos-14` to `macos-15` * Use environment variable for the branch name to be DRY * Allow major version tags when specifying trusted actions * Update existing comments and add more comments Resources: * [Standard GitHub-hosted runners for public repos](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners/about-github-hosted-runners#standard-github-hosted-runners-for-public-repositories) * [Latest `macos-15` image release](https://github.com/actions/runner-images/releases/tag/macos-15-arm64%2F20250714.1971) * [SW included in latest `macos-15` image](https://github.com/actions/runner-images/blob/main/images/macos/macos-15-arm64-Readme.md)
1 parent 0387919 commit f43e009

4 files changed

Lines changed: 49 additions & 34 deletions

File tree

‎.github/dependabot.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ updates:
1515
- dependency-name: "*"
1616
update-types: ["version-update:semver-minor", "version-update:semver-patch"]
1717

18-
# All GitHub actions should be pinned to an explicit SHA instead of a tag name.
18+
# All untrusted GitHub actions should be pinned to an explicit SHA instead of a tag name.
1919
# Each pin should include a comment about the version of the action to which it corresponds.
2020
# Dependabot will update these comments at the same time that it updates the pin.
2121
- package-ecosystem: "github-actions"

‎.github/workflows/cargo-update.yml‎

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3,40 +3,55 @@ name: Update Deps
33

44
on:
55
workflow_dispatch:
6-
# Run every Monday
6+
# Run every Monday at 0530 UTC
77
schedule:
88
- cron: '30 5 * * 1'
99

1010
jobs:
1111
cargo-update:
12+
name: Update dependencies
1213
runs-on: ubuntu-latest
14+
env:
15+
UPDATE_BRANCH_NAME: auto-cargo-update
1316
steps:
1417
- name: Checkout the repo
15-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
18+
uses: actions/checkout@v4
1619

1720
- name: Cargo update
1821
run: cargo update
1922

2023
- name: Commit changes
2124
id: commit
25+
# There may not be any updates to commit/push
2226
continue-on-error: true
2327
run: |
2428
git config user.name 'phylum-bot'
2529
git config user.email '69485888+phylum-bot@users.noreply.github.com'
2630
git commit -a -m "Bump dependencies"
27-
git push --force origin HEAD:auto-cargo-update
31+
git push --force origin HEAD:${{ env.UPDATE_BRANCH_NAME }}
2832
2933
- name: Create Pull Request
34+
id: pr
3035
if: ${{ steps.commit.outcome == 'success' }}
31-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
36+
# The PR may already exist (e.g., created in previous week and not merged yet) so we
37+
# allow it here and check in the next step so workflow failures will be extraordinary
38+
continue-on-error: true
39+
uses: actions/github-script@v7
3240
with:
3341
github-token: ${{ secrets.GH_RELEASE_PAT }}
3442
script: |
35-
github.rest.pulls.create({
43+
const response = await github.rest.pulls.create({
3644
owner: context.repo.owner,
3745
repo: context.repo.repo,
38-
head: "auto-cargo-update",
46+
head: "${{ env.UPDATE_BRANCH_NAME }}",
3947
base: context.ref,
4048
title: "Bump dependencies",
4149
body: "Bump dependencies for all SemVer-compatible updates.",
4250
});
51+
console.log(response);
52+
53+
- name: Verify PR exists
54+
if: ${{ steps.pr.outcome == 'failue' }}
55+
env:
56+
GH_TOKEN: ${{ github.token }}
57+
run: gh pr view ${{ env.UPDATE_BRANCH_NAME }}

‎.github/workflows/release.yml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
runs-on: ubuntu-latest
1919
steps:
2020
- name: Checkout the repo
21-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21+
uses: actions/checkout@v4
2222

2323
- name: Install protoc
2424
run: sudo apt-get install -y protobuf-compiler
@@ -32,7 +32,7 @@ jobs:
3232
run: cargo run --package xtask gencomp
3333

3434
- name: Upload shell completions
35-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
35+
uses: actions/upload-artifact@v4
3636
with:
3737
name: shell-completions
3838
path: ./target/completions/
@@ -50,17 +50,17 @@ jobs:
5050
- target: aarch64-unknown-linux-gnu
5151
os: [self-hosted, linux, arm64]
5252
- target: x86_64-apple-darwin
53-
os: macos-14
53+
os: macos-15
5454
- target: aarch64-apple-darwin
55-
os: macos-14
55+
os: macos-15
5656
- target: x86_64-pc-windows-msvc
5757
os: windows-latest
5858
extension: .exe
5959
flags: --no-default-features -F extensions
6060
runs-on: ${{ matrix.os }}
6161
steps:
6262
- name: Checkout the repo
63-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
63+
uses: actions/checkout@v4
6464
with:
6565
fetch-depth: 0
6666

@@ -83,7 +83,7 @@ jobs:
8383
run: cargo +stable build --release --target ${{ matrix.target }} ${{ matrix.flags }}
8484

8585
- name: Upload release artifacts
86-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
86+
uses: actions/upload-artifact@v4
8787
with:
8888
name: phylum-${{ matrix.target }}
8989
path: ./target/${{ matrix.target }}/release/phylum${{ matrix.extension }}
@@ -99,12 +99,12 @@ jobs:
9999
run: sudo apt-get install -yq zip
100100

101101
- name: Checkout the repo
102-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
102+
uses: actions/checkout@v4
103103
with:
104104
path: cli
105105

106106
- name: Download release artifacts
107-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
107+
uses: actions/download-artifact@v4
108108

109109
- name: Prep archives
110110
run: |
@@ -128,7 +128,7 @@ jobs:
128128
done
129129
130130
- name: Upload release artifacts
131-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
131+
uses: actions/upload-artifact@v4
132132
with:
133133
name: release-archives
134134
path: |
@@ -138,7 +138,7 @@ jobs:
138138
retention-days: 7
139139

140140
- name: Create release notes
141-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
141+
uses: actions/github-script@v7
142142
with:
143143
script: |
144144
const fs = require("node:fs");
@@ -160,7 +160,7 @@ jobs:
160160
fs.writeFileSync("RELEASE-NOTES.txt", releaseNotes);
161161
162162
- name: Upload release notes
163-
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
163+
uses: actions/upload-artifact@v4
164164
with:
165165
name: RELEASE-NOTES.txt
166166
path: RELEASE-NOTES.txt
@@ -179,7 +179,7 @@ jobs:
179179
runs-on: ubuntu-latest
180180
steps:
181181
- name: Download release artifacts
182-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
182+
uses: actions/download-artifact@v4
183183
with:
184184
name: release-archives
185185

@@ -193,13 +193,13 @@ jobs:
193193
done
194194
195195
- name: Download release notes
196-
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
196+
uses: actions/download-artifact@v4
197197
with:
198198
name: RELEASE-NOTES.txt
199199

200200
- name: Create GitHub release
201201
id: create_release
202-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
202+
uses: actions/github-script@v7
203203
with:
204204
# The response is explicitly returned here so it will be available for other steps
205205
script: |
@@ -242,7 +242,7 @@ jobs:
242242
# Don't trigger for pre-releases
243243
if: ${{ !contains(github.ref, 'rc') }}
244244
# Reference: https://docs.github.com/en/rest/repos/repos#create-a-repository-dispatch-event
245-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
245+
uses: actions/github-script@v7
246246
with:
247247
github-token: ${{ secrets.GH_RELEASE_PAT }}
248248
script: |
@@ -258,7 +258,7 @@ jobs:
258258
# Don't trigger for pre-releases
259259
if: ${{ !contains(github.ref, 'rc') }}
260260
# Reference: https://docs.github.com/en/rest/repos/repos#create-a-repository-dispatch-event
261-
uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
261+
uses: actions/github-script@v7
262262
with:
263263
github-token: ${{ secrets.GH_RELEASE_PAT }}
264264
script: |

‎.github/workflows/test.yml‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
runs-on: ubuntu-latest
1919
steps:
2020
- name: Checkout the repo
21-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21+
uses: actions/checkout@v4
2222

2323
- name: Install Rust nightly toolchain
2424
run: rustup toolchain install --no-self-update nightly --profile minimal -c rustfmt
@@ -34,14 +34,14 @@ jobs:
3434
include:
3535
- os: ubuntu-latest
3636
flags: --all-features
37-
- os: macos-14
37+
- os: macos-15
3838
flags: --all-features
3939
- os: windows-latest
4040
flags: --no-default-features -F extensions
4141
runs-on: ${{ matrix.os }}
4242
steps:
4343
- name: Checkout the repo
44-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
44+
uses: actions/checkout@v4
4545

4646
- if: ${{ runner.os == 'macOS' }}
4747
name: Install protoc
@@ -65,14 +65,14 @@ jobs:
6565
strategy:
6666
fail-fast: false
6767
matrix:
68-
os: [ubuntu-22.04, macos-14]
68+
os: [ubuntu-22.04, macos-15]
6969
include:
7070
- os: windows-latest
7171
flags: --no-default-features -F extensions
7272
runs-on: ${{ matrix.os }}
7373
steps:
7474
- name: Checkout the repo
75-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
75+
uses: actions/checkout@v4
7676

7777
- if: ${{ runner.os == 'macOS' }}
7878
name: Install protoc
@@ -96,11 +96,11 @@ jobs:
9696
strategy:
9797
fail-fast: false
9898
matrix:
99-
os: [ubuntu-22.04, macos-14, windows-latest]
99+
os: [ubuntu-22.04, macos-15, windows-latest]
100100
runs-on: ${{ matrix.os }}
101101
steps:
102102
- name: Checkout the repo
103-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
103+
uses: actions/checkout@v4
104104

105105
- if: ${{ runner.os == 'macOS' }}
106106
name: Install protoc
@@ -127,11 +127,11 @@ jobs:
127127
strategy:
128128
fail-fast: false
129129
matrix:
130-
os: [ubuntu-22.04, macos-14]
130+
os: [ubuntu-22.04, macos-15]
131131
runs-on: ${{ matrix.os }}
132132
steps:
133133
- name: Checkout the repo
134-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
134+
uses: actions/checkout@v4
135135

136136
- if: ${{ runner.os == 'macOS' }}
137137
name: Install protoc
@@ -155,7 +155,7 @@ jobs:
155155
container: denoland/deno
156156
steps:
157157
- name: Checkout the repo
158-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
158+
uses: actions/checkout@v4
159159

160160
- name: deno fmt
161161
run: deno fmt --check
@@ -171,7 +171,7 @@ jobs:
171171
runs-on: ubuntu-latest
172172
steps:
173173
- name: Checkout the repo
174-
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
174+
uses: actions/checkout@v4
175175

176176
- name: Script Style Check
177177
run: find . -iname "*.sh" -print0 | xargs -0 shellcheck -o all -S style -s sh

0 commit comments

Comments
 (0)