mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-10-01 09:04:58 +01:00
Dana JansensandJon Ross-Perkins
f5e69734d9
The version of clangd/clang-tidy on developer machines has slowly diverged from the one on the CI builders, which is causing a slowly increasing amount of pain as clang-tidy CI runs fail (incorrectly) over things that a newer clangd/clang-tidy was perfectly fine with locally. This bumps the Clang version used in the ubuntu builders to 19, which is the most recent in Debian stable. We use https://apt.llvm.org instead of LLVM's GitHub releases (https://github.com/llvm/llvm-project/releases) as the former more reliably has packages for newer Clang/LLVM versions on x64. The community-build releases binaries on LLVM's GitHub have stopped including Ubuntu packages that match the GitHub x64 Ubuntu workers for some time (for at least the 18 and 19 releases). By moving to apt.llvm.org packages we only download and install the headers and libraries needed for development, rather than every output of building llvm, which is much faster and saves lots of disk space. We also remove the system installations of other versions of clang/llvm so we should end up using negative disk space. We can no longer easily cache the installation but apt.llvm.org is a reliable end point. We bump the ubuntu image version for the github workers to 24.04, as apt.llvm.org has stopped building images for 22.10 in 2022 at its end of life. The `pre_commit` workflow disabled sudo unlike the other workflows that install Clang/LLVM, including the `clang-tidy` workflow (which is also run on `pull_request`). We bring it into alignment with the other workflows so that we can install the llvm packages. And we lock its ubuntu image to 24.04 so that it can be moved in lockstep with the other workflows that depend on Clang/LLVM. --------- Co-authored-by: Jon Ross-Perkins <jperkins@google.com>
Workflows
Hardening
Workflows are hardened using Step Security tool. Findings for the "Harden Runner" steps are available online.
Allowed endpoints
Most jobs only have a few endpoints, but due to tools which do downloads, a few have significantly more. These are:
- pre_commit.yaml (Bazel, pre-commit)
- nightly_release.yaml (Bazel)
- tests.yaml (Bazel)
When updating one of these, consider updating all of them.
We try to keep allowed-endpoints with one per line. Prettier wants to wrap
them, which we fix this with prettier-ignore.
Testing
We keep around an action-test branch in carbon-lang, which can be used to test
triggers with push: configurations. For example:
on:
push:
branches: [action-test]