mirror of
https://github.com/carbon-language/carbon-lang.git
synced 2026-09-30 07:35:00 +01:00
Jon Ross-Perkins
b73387fc84
Also a small pass on workflow names. Note, I'm a little concerned that the test/nightly release/pre-commit endpoints may be fragile. At the same time, it's also where it may be most useful, to prevent network access by arbitrary test code. I think this is imperfect, but maybe we can try it out and see if it's much of an issue. Note, the discord wiki action is currently broken, this should fix it.
40 lines
1.0 KiB
Markdown
40 lines
1.0 KiB
Markdown
# Workflows
|
|
|
|
<!--
|
|
Part of the Carbon Language project, under the Apache License v2.0 with LLVM
|
|
Exceptions. See /LICENSE for license information.
|
|
SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
-->
|
|
|
|
## Hardening
|
|
|
|
Workflows are hardened using
|
|
[Step Security tool](https://app.stepsecurity.io/secureworkflow). Findings for
|
|
the "Harden Runner" steps are
|
|
[available online](https://app.stepsecurity.io/github/carbon-language/carbon-lang/actions/runs).
|
|
|
|
### Allowed endpoints
|
|
|
|
Most jobs only have a few endpoints, but due to tools which do downloads, a few
|
|
have significantly more. These are:
|
|
|
|
- pre_commit.yaml (Bazel, pre-commit)
|
|
- nightly_release.yaml (Bazel)
|
|
- tests.yaml (Bazel)
|
|
|
|
When updating one of these, consider updating all of them.
|
|
|
|
We try to keep `allowed-endpoints` with one per line. Prettier wants to wrap
|
|
them, which we fix this with `prettier-ignore`.
|
|
|
|
## Testing
|
|
|
|
We keep around an `action-test` branch in carbon-lang, which can be used to test
|
|
triggers with `push:` configurations. For example:
|
|
|
|
```
|
|
on:
|
|
push:
|
|
branches: [action-test]
|
|
```
|