diff --git a/.github/workflows/security_audit.yml b/.github/workflows/security_audit.yml new file mode 100644 index 00000000..0e679b9f --- /dev/null +++ b/.github/workflows/security_audit.yml @@ -0,0 +1,29 @@ +--- +name: Security audit +on: + push: + paths: + - '**/Cargo.toml' + - '**/Cargo.lock' +jobs: + security_audit: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v1 + - uses: actions-rs/audit-check@v1 + with: + token: ${{ secrets.GITHUB_TOKEN }} + +--- +name: Security audit [Daily] +on: + schedule: + - cron: '0 0 * * *' +jobs: + security_audit: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v1 + - uses: actions-rs/audit-check@v1 + with: + token: ${{ secrets.GITHUB_TOKEN }} diff --git a/.github/workflows/workflow.yml b/.github/workflows/workflow.yml index 4c3f7bb6..6ea1eba3 100644 --- a/.github/workflows/workflow.yml +++ b/.github/workflows/workflow.yml @@ -1,3 +1,4 @@ +--- name: Main workflow on: push: @@ -22,7 +23,6 @@ jobs: toolchain: stable components: rustfmt override: true - - run: rustup component add rustfmt - uses: actions-rs/cargo@v1 with: command: fmt @@ -45,28 +45,33 @@ jobs: token: ${{ secrets.GITHUB_TOKEN }} args: --all-targets --all-features -- -D clippy::all - # Run a security audit on dependencies - cargo_audit: - name: Cargo Audit [Security] - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@v2 - - uses: actions-rs/toolchain@v1 - with: - toolchain: stable - override: true - - run: cargo install --force cargo-audit - - run: cargo generate-lockfile - - uses: actions-rs/cargo@v1 - with: - command: audit - # Ensure that the project could be successfully compiled cargo_check: name: Compile runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 + + - name: Cache cargo registry + uses: actions/cache@v1 + with: + path: ~/.cargo/registry + key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }} + restore-keys: | + ${{ runner.os }}-cargo-registry- + - name: Cache cargo index + uses: actions/cache@v1 + with: + path: ~/.cargo/git + key: ${{ runner.os }}-cargo-index-${{ hashFiles('**/Cargo.lock') }} + restore-keys: | + ${{ runner.os }}-cargo-index- + - name: Cache cargo build + uses: actions/cache@v1 + with: + path: target + key: ${{ runner.os }}-cargo-build-target-${{ hashFiles('**/Cargo.lock') }} + - uses: actions-rs/toolchain@v1 with: profile: minimal @@ -81,7 +86,6 @@ jobs: # On both Rust stable and Rust nightly test: name: Test Suite - needs: [cargo_check] runs-on: ${{ matrix.os }} strategy: fail-fast: false @@ -98,11 +102,15 @@ jobs: with: path: ~/.cargo/registry key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }} + restore-keys: | + ${{ runner.os }}-cargo-registry- - name: Cache cargo index uses: actions/cache@v1 with: path: ~/.cargo/git key: ${{ runner.os }}-cargo-index-${{ hashFiles('**/Cargo.lock') }} + restore-keys: | + ${{ runner.os }}-cargo-index- - name: Cache cargo build uses: actions/cache@v1 with: @@ -174,9 +182,9 @@ jobs: git config --global user.name "Matan Kushner" git config --global user.email "hello@matchai.dev" - cd $(brew --repo homebrew/core) + cd $(brew --repo homebrew/core) git fetch origin - sudo git reset --hard origin/master + sudo git reset --hard origin/master cd - brew bump-formula-pr --url=https://github.com/starship/starship/archive/$(git describe --tags).tar.gz --message="Automated release pull request using continuous integration." --no-browse -v starship --force @@ -212,6 +220,21 @@ jobs: steps: - uses: actions/checkout@v2 + - name: Cache cargo registry + uses: actions/cache@v1 + with: + path: ~/.cargo/registry + key: ${{ runner.os }}-cargo-registry-${{ hashFiles('**/Cargo.lock') }} + restore-keys: | + ${{ runner.os }}-cargo-registry- + - name: Cache cargo index + uses: actions/cache@v1 + with: + path: ~/.cargo/git + key: ${{ runner.os }}-cargo-index-${{ hashFiles('**/Cargo.lock') }} + restore-keys: | + ${{ runner.os }}-cargo-index- + - name: Install Rust toolchain uses: actions-rs/toolchain@v1 with: @@ -230,7 +253,7 @@ jobs: with: command: build args: --release --target ${{ matrix.target }} - + - name: Build target (musl) if: matrix.target == 'x86_64-unknown-linux-musl' uses: actions-rs/cargo@v1