deps: bump clap from 4.6.2 to 4.6.4 in the rust-deps group #314
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| push: | |
| branches: [main] | |
| tags: ['*'] | |
| pull_request: | |
| branches: [main] | |
| permissions: {} | |
| # This makes `-o pipefail` the default behavior for `run:` steps. | |
| defaults: | |
| run: | |
| shell: bash | |
| jobs: | |
| unit-tests: | |
| runs-on: ubuntu-latest | |
| container: quay.io/fedora/fedora:latest # zizmor: ignore[unpinned-images] | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Install tools | |
| run: dnf install -y cargo clippy rustfmt just ShellCheck nodejs-npm openssl-devel git jq | |
| - name: Configure git | |
| run: git config --global --add safe.directory '*' | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install markdownlint | |
| run: npm install -g markdownlint-cli | |
| # do this first to avoid building implicitly bumping the lockfile | |
| - name: Verify Cargo.lock and README.md are in sync | |
| run: just versioncheck | |
| - name: Build | |
| run: just build | |
| - name: Check | |
| run: just checkall | |
| e2e-tests: | |
| needs: unit-tests | |
| runs-on: ${{ matrix.runner }} | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - name: e2e-tests (fedora, amd64) | |
| runner: ubuntu-24.04 | |
| arch: amd64 | |
| push: true | |
| - name: e2e-tests (fedora, arm64) | |
| runner: ubuntu-24.04-arm | |
| arch: arm64 | |
| push: true | |
| - name: e2e-tests (ubi9) | |
| runner: ubuntu-24.04 | |
| base: registry.access.redhat.com/ubi9/ubi:latest | |
| tests: self | |
| - name: e2e-tests (ubi10) | |
| runner: ubuntu-24.04 | |
| base: registry.access.redhat.com/ubi10/ubi:latest | |
| tests: self | |
| name: ${{ matrix.name }} | |
| permissions: | |
| contents: read | |
| packages: write # Required to push image to ghcr.io | |
| container: | |
| image: quay.io/fedora/fedora:latest # zizmor: ignore[unpinned-images] | |
| options: --privileged --cgroupns=host -v /var/lib/containers -v /var/tmp -v /tmp | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Install tools | |
| run: dnf install -y just buildah podman skopeo jq diffutils | |
| - name: Build image | |
| env: | |
| BASE_IMAGE: ${{ matrix.base || '' }} | |
| run: | | |
| if [ -n "${BASE_IMAGE}" ]; then | |
| just buildimg -- --build-arg=BASE="${BASE_IMAGE}" | |
| else | |
| just buildimg | |
| fi | |
| - name: Run tests | |
| env: | |
| TESTS: ${{ matrix.tests }} | |
| run: | | |
| just test ${TESTS} | |
| - name: Upload test results | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: ${{ matrix.name }} | |
| path: tests/e2e/results/ | |
| - name: Push to ghcr.io | |
| if: github.event_name == 'push' && matrix.push | |
| env: | |
| ARCH: ${{ matrix.arch }} | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| podman login -u "${GITHUB_ACTOR}" -p "${GH_TOKEN}" ghcr.io | |
| podman push chunkah "ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}-${ARCH}" | |
| manifest: | |
| needs: e2e-tests | |
| if: github.event_name == 'push' | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| packages: write # Required to push image to ghcr.io | |
| id-token: write # Required to get ID token to sign image using Cosign | |
| steps: | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| - name: Create and push manifest | |
| id: push-manifest | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| run: | | |
| set -euo pipefail | |
| podman login -u "${GITHUB_ACTOR}" -p "${GH_TOKEN}" ghcr.io | |
| podman manifest create "ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}" \ | |
| "ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}-amd64" \ | |
| "ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}-arm64" | |
| podman manifest push --digestfile=/tmp/manifest-digest \ | |
| "ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}" | |
| echo "digest=$(cat /tmp/manifest-digest)" >> "${GITHUB_OUTPUT}" | |
| if [[ "${GITHUB_REF}" == refs/tags/* ]]; then | |
| TAG="${GITHUB_REF#refs/tags/}" | |
| else | |
| TAG='latest' | |
| fi | |
| podman tag "ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}" \ | |
| "ghcr.io/${GITHUB_REPOSITORY}:${TAG}" | |
| podman manifest push "ghcr.io/${GITHUB_REPOSITORY}:${TAG}" | |
| - name: Sign ghcr.io image | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| MANIFEST_DIGEST: ${{ steps.push-manifest.outputs.digest }} | |
| run: | | |
| cosign login ghcr.io -u "${GITHUB_ACTOR}" -p "${GH_TOKEN}" | |
| cosign sign --yes --recursive \ | |
| "ghcr.io/${GITHUB_REPOSITORY}@${MANIFEST_DIGEST}" | |
| release: | |
| needs: manifest | |
| if: github.event_name == 'push' | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| packages: write # Required to clean up old images from ghcr.io | |
| id-token: write # Required to get ID token to sign image using Cosign | |
| steps: | |
| - name: Install skopeo | |
| run: | | |
| sudo apt-get update | |
| sudo apt-get install -y skopeo | |
| - name: Install cosign | |
| uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2 | |
| - name: Push to quay.io | |
| id: push-quay | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| QUAY_AUTH: ${{ secrets.QUAY_AUTH }} | |
| run: | | |
| set -euo pipefail | |
| mkdir -p ~/.docker | |
| echo "${QUAY_AUTH}" > ~/.docker/config.json | |
| if [[ "${GITHUB_REF}" == refs/tags/* ]]; then | |
| TAG="${GITHUB_REF#refs/tags/}" | |
| skopeo copy --all --digestfile=/tmp/quay-digest \ | |
| --src-creds="${GITHUB_ACTOR}:${GH_TOKEN}" \ | |
| "docker://ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}" \ | |
| "docker://quay.io/coreos/chunkah:${TAG}" | |
| skopeo copy --all --src-creds="${GITHUB_ACTOR}:${GH_TOKEN}" \ | |
| "docker://ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}" \ | |
| 'docker://quay.io/coreos/chunkah:latest' | |
| else | |
| skopeo copy --all --digestfile=/tmp/quay-digest \ | |
| --src-creds="${GITHUB_ACTOR}:${GH_TOKEN}" \ | |
| "docker://ghcr.io/${GITHUB_REPOSITORY}:${GITHUB_SHA}" \ | |
| 'docker://quay.io/coreos/chunkah:dev' | |
| fi | |
| echo "digest=$(cat /tmp/quay-digest)" >> "${GITHUB_OUTPUT}" | |
| - name: Sign quay.io image | |
| env: | |
| QUAY_DIGEST: ${{ steps.push-quay.outputs.digest }} | |
| run: | | |
| cosign sign --yes --recursive "quay.io/coreos/chunkah@${QUAY_DIGEST}" | |
| - name: Cleanup old images | |
| uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0 | |
| with: | |
| package-name: chunkah | |
| package-type: container | |
| min-versions-to-keep: 20 | |
| ignore-versions: '^v.*$' |