mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-09-24 21:30:12 +01:00
Jon Ross-Perkins
b73387fc84
Also a small pass on workflow names. Note, I'm a little concerned that the test/nightly release/pre-commit endpoints may be fragile. At the same time, it's also where it may be most useful, to prevent network access by arbitrary test code. I think this is imperfect, but maybe we can try it out and see if it's much of an issue. Note, the discord wiki action is currently broken, this should fix it.
1.0 KiB
1.0 KiB
Workflows
Hardening
Workflows are hardened using Step Security tool. Findings for the "Harden Runner" steps are available online.
Allowed endpoints
Most jobs only have a few endpoints, but due to tools which do downloads, a few have significantly more. These are:
- pre_commit.yaml (Bazel, pre-commit)
- nightly_release.yaml (Bazel)
- tests.yaml (Bazel)
When updating one of these, consider updating all of them.
We try to keep allowed-endpoints with one per line. Prettier wants to wrap
them, which we fix this with prettier-ignore.
Testing
We keep around an action-test branch in carbon-lang, which can be used to test
triggers with push: configurations. For example:
on:
push:
branches: [action-test]