mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-09-24 19:20:13 +01:00
Chandler Carruth
04793ba525
Previously, we left it on by default and only disabled it in CI. However, as we have grown more and more examples, the cost of stamping has steadily risen: every example has to be rebuilt because the busybox binary and installation contain an updated stamp. I noticed that I was almost never getting cache hits for these even when I should and it seems like what was once true is no more for daily development. I've updated the default, the docs for the default, and explicitly enabled stamping in the nightly release workflow. I left the explicit disabling in the CI workflows as that seems harmless and a good defense in case we want to shift the default again. One alternative that I didn't pursue because of the complexity was to create two distinct installation prefixes automatically, one with the `.nostamp` suffixed binaries installed and one without that suffix. We could then point example builds and other within-Bazel uses at the non-stamped tree to get maximal caching. But it would create two whole installation trees without much benefit. It seemed simpler to just disable stamping by default for development builds.
Workflows
Hardening
Workflows are hardened using Step Security tool. Findings for the "Harden Runner" steps are available online.
Allowed endpoints
Most jobs only have a few endpoints, but due to tools which do downloads, a few have significantly more. These are:
- pre_commit.yaml (Bazel, pre-commit)
- nightly_release.yaml (Bazel)
- tests.yaml (Bazel)
When updating one of these, consider updating all of them.
We try to keep allowed-endpoints with one per line. Prettier wants to wrap
them, which we fix this with prettier-ignore.
Testing
We keep around an action-test branch in carbon-lang, which can be used to test
triggers with push: configurations. For example:
on:
push:
branches: [action-test]