From 749d9851be0526c83b220db14addd19fa6aa2c55 Mon Sep 17 00:00:00 2001 From: Eric Rodrigues Pires Date: Sat, 4 Jul 2026 19:13:05 -0300 Subject: [PATCH] Update GitHub workflows --- .github/workflows/build.yml | 18 +++++++++--------- .github/workflows/mdbook.yml | 32 +++++++++++++++++--------------- .github/workflows/nix.yml | 6 +++--- .github/workflows/release.yml | 22 +++++++++++----------- .github/workflows/validate.yml | 24 ++++++++++++------------ .github/workflows/zizmor.yml | 4 ++-- 6 files changed, 54 insertions(+), 52 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 3ced2f6..83b5497 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -16,12 +16,12 @@ jobs: contents: read packages: write steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: true - name: Collect Docker metadata id: meta - uses: docker/metadata-action@c1e51972afc2121e065aed6d45c65596fe445f3f # v5.8.0 + uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0 with: images: | ${{ vars.DOCKERHUB_USERNAME }}/${{ vars.DOCKERHUB_IMAGE }} @@ -32,24 +32,24 @@ jobs: type=semver,pattern={{version}} type=semver,pattern={{major}}.{{minor}} - name: Set up QEMU - uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 + uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0 - name: Set up Docker Buildx - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0 with: cache-binary: false - name: Login to Docker Hub - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: username: ${{ vars.DOCKERHUB_USERNAME }} password: ${{ secrets.dockerhub-push-token }} - name: Login to Github Container Registry - uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0 + uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.ghcr-push-token }} - name: Build and push - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: context: . push: true @@ -61,12 +61,12 @@ jobs: cache-from: type=gha cache-to: type=gha,mode=max - name: Export binaries - uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 + uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0 with: target: binary outputs: type=local,dest=out - name: Upload artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: sandhole-binaries path: out/ diff --git a/.github/workflows/mdbook.yml b/.github/workflows/mdbook.yml index d1939f5..512d632 100644 --- a/.github/workflows/mdbook.yml +++ b/.github/workflows/mdbook.yml @@ -14,25 +14,27 @@ jobs: build-book: name: Build book runs-on: ubuntu-24.04 - env: - MDBOOK_VERSION: 0.5.2 steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - name: Install mdBook - uses: taiki-e/install-action@3d30e7d625f7c928dccd48823053b03bb2f6ed05 # v2.65.4 + - name: Install Nix + uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 with: - tool: mdbook@${{ env.MDBOOK_VERSION }} + nix_path: nixpkgs=channel:nixpkgs-unstable + github_access_token: ${{ secrets.GITHUB_TOKEN }} - name: Build with mdBook - run: mdbook build book + run: nix-build ./nix -A packages._book + - name: Install rsync + run: | + nix-env -iA rsync -f '' - name: Deploy to Sandhole if: github.ref == 'refs/heads/main' - uses: up9cloud/action-rsync@e5f52e6a78755fa0ddbfd2d52f61de0490661665 # master - env: - SOURCE: book/book/ - HOST: ${{ secrets.BOOK_SSH_HOST }} - PORT: ${{ secrets.BOOK_SSH_PORT }} - USER: ${{ secrets.BOOK_SSH_USER }} - KEY: ${{ secrets.BOOK_SSH_KEY }} - TARGET: ${{ secrets.BOOK_SSH_TARGET }} + run: | + echo "${{ secrets.BOOK_SSH_KEY }}" > /tmp/ssh-key + chmod 600 /tmp/ssh-key + rsync \ + --delete-after \ + -acPe 'ssh -p ${{ secrets.BOOK_SSH_PORT }} -i /tmp/ssh-key -o StrictHostKeyChecking=accept-new' \ + result/ \ + ${{ secrets.BOOK_SSH_USER }}@${{ secrets.BOOK_SSH_HOST }}:${{ secrets.BOOK_SSH_TARGET }} diff --git a/.github/workflows/nix.yml b/.github/workflows/nix.yml index 6b82940..756ac9d 100644 --- a/.github/workflows/nix.yml +++ b/.github/workflows/nix.yml @@ -22,13 +22,13 @@ jobs: system: aarch64-linux runs-on: ${{ matrix.runner }} steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: true - name: Install Nix - uses: cachix/install-nix-action@4e002c8ec80594ecd40e759629461e26c8abed15 # v31.9.0 + uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6 with: - nix_path: nixpkgs=channel:nixos-unstable + nix_path: nixpkgs=channel:nixpkgs-unstable github_access_token: ${{ secrets.GITHUB_TOKEN }} extra_nix_config: | system = ${{ matrix.system }} diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4d4dbd3..8f1758e 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -18,11 +18,11 @@ jobs: contents: read id-token: write steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: true - name: Authenticate - uses: rust-lang/crates-io-auth-action@b7e9a28eded4986ec6b1fa40eeee8f8f165559ec # v1.0.3 + uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5 id: auth - name: Publish run: cargo publish @@ -54,7 +54,7 @@ jobs: runs-on: ${{ matrix.runner }} steps: - name: Checkout repository - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: true - name: Fetch MSRV and add target @@ -71,7 +71,7 @@ jobs: mkdir dist cp target/${{ matrix.target }}/release/sandhole dist/sandhole-${{ matrix.key }} - name: Upload artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: sandhole-${{ matrix.key }} path: dist @@ -88,7 +88,7 @@ jobs: runs-on: ${{ matrix.runner }} steps: - name: Checkout repository - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: true - name: Fetch MSRV and add target @@ -103,7 +103,7 @@ jobs: mkdir dist cp target/${{ matrix.target }}/release/sandhole.exe dist/sandhole-${{ matrix.key }}.exe - name: Upload artifact - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0 + uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 with: name: sandhole-${{ matrix.key }} path: dist @@ -118,26 +118,26 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: true - name: Download Linux artifact - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: sandhole-binaries path: out/ - name: Download macos-amd64 artifact - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: sandhole-macos-amd64 path: out/ - name: Download macos-arm64 artifact - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: sandhole-macos-arm64 path: out/ - name: Download windows-amd64 artifact - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0 + uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 with: name: sandhole-windows-amd64 path: out/ diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml index 2ba58f9..3ac7f79 100644 --- a/.github/workflows/validate.yml +++ b/.github/workflows/validate.yml @@ -18,7 +18,7 @@ jobs: name: Check rustfmt formatting on MSRV runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Fetch MSRV @@ -33,14 +33,14 @@ jobs: name: Check Clippy lints on MSRV runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Fetch MSRV run: | rustup toolchain install ${RUST_MSRV}-x86_64-unknown-linux-gnu rustup override set ${RUST_MSRV}-x86_64-unknown-linux-gnu - - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1 - name: Run Clippy run: | rustup component add clippy @@ -49,14 +49,14 @@ jobs: name: Build on MSRV (default features) runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Fetch MSRV run: | rustup toolchain install ${RUST_MSRV}-x86_64-unknown-linux-gnu rustup override set ${RUST_MSRV}-x86_64-unknown-linux-gnu - - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 - name: Build run: | cargo build --locked @@ -64,14 +64,14 @@ jobs: name: Build on MSRV (no default features) runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Fetch MSRV run: | rustup toolchain install ${RUST_MSRV}-x86_64-unknown-linux-gnu rustup override set ${RUST_MSRV}-x86_64-unknown-linux-gnu - - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2 + - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 - name: Build run: | cargo build --locked --no-default-features @@ -91,11 +91,11 @@ jobs: target: x86_64-pc-windows-msvc runs-on: ${{ matrix.runner }} steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Install cargo-nextest - uses: taiki-e/install-action@3d30e7d625f7c928dccd48823053b03bb2f6ed05 # v2.65.4 + uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: tool: cargo-nextest@${{ env.CARGO_NEXTEST_VERSION }} - name: Fetch nightly Rust @@ -115,11 +115,11 @@ jobs: name: Test coverage on nightly (ubuntu-24.04) runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Install cargo-llvm-cov and cargo-nextest - uses: taiki-e/install-action@3d30e7d625f7c928dccd48823053b03bb2f6ed05 # v2.65.4 + uses: taiki-e/install-action@c93ccc03e00cd0e08e494f5fd058a6c55a6a1907 # v2.82.8 with: tool: cargo-llvm-cov@${{ env.CARGO_LLVM_COV_VERSION }},cargo-nextest@${{ env.CARGO_NEXTEST_VERSION }} - name: Fetch nightly Rust @@ -132,7 +132,7 @@ jobs: run: | cargo llvm-cov nextest --no-fail-fast --verbose --codecov --locked --output-path codecov.json - name: Upload coverage reports to Codecov - uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1 + uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0 with: files: ./codecov.json token: ${{ secrets.CODECOV_TOKEN }} diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index d6d2117..dee35c8 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -12,10 +12,10 @@ jobs: permissions: security-events: write steps: - - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Check GitHub Actions - uses: zizmorcore/zizmor-action@e639db99335bc9038abc0e066dfcd72e23d26fb4 # v0.3.0 + uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 with: inputs: ./.github/ -- 2.51.2