carbon-language/carbon-lang

mirror of https://github.com/carbon-language/carbon-lang.git synced 2026-09-24 22:02:23 +01:00

Files

T

History

Jon Ross-Perkins 95fd890698 Allow pre-commit to talk to googleapis (#4966 )

Example:
-
https://app.stepsecurity.io/github/carbon-language/carbon-lang/actions/runs/13320074606
-
https://github.com/carbon-language/carbon-lang/actions/runs/13320074606/job/37247235705

I'm not sure what it's being used for (even blocked, nothing unexpected
failed) but if bazel or similar is trying to talk to this it should be
fine.

2025-02-14 20:21:20 +00:00

..

auto_assign_prs.yaml

Add dwblaikie as a toolchain reviewer (#4820 )

2025-01-17 16:51:53 +00:00

auto_label_prs.yaml

Move the language server into toolchain's busybox. (#4469 )

2024-11-01 19:49:39 +00:00

clang_tidy.yaml

Fix clang-tidy to run on the merge queue (#4773 )

2025-01-08 16:44:53 +00:00

discord_wiki.yaml

Fix stray quote in action (#4193 )

2024-08-06 23:31:44 +00:00

gh_pages_ci.yaml

Build a website. (#4189 )

2024-08-20 17:53:06 +00:00

gh_pages_deploy.yaml

Build a website. (#4189 )

2024-08-20 17:53:06 +00:00

nightly_release.yaml

Fix path to carbon binary in nightly builder (#4737 )

2024-12-23 22:54:30 +00:00

pre_commit_suggestions.yaml

Update workflows for security hardening. (#4192 )

2024-08-06 23:14:23 +00:00

pre_commit.yaml

Allow pre-commit to talk to googleapis (#4966 )

2025-02-14 20:21:20 +00:00

proposal_labeled.yaml

Update workflows for security hardening. (#4192 )

2024-08-06 23:14:23 +00:00

proposal_ready.yaml

Update workflows for security hardening. (#4192 )

2024-08-06 23:14:23 +00:00

README.md

Update workflows for security hardening. (#4192 )

2024-08-06 23:14:23 +00:00

sync_repos.yaml

Update workflows for security hardening. (#4192 )

2024-08-06 23:14:23 +00:00

tests.yaml

Split out clang-tidy to not run in merge (#4428 )

2024-10-21 19:59:40 +00:00

triage_inactive.yaml

Update workflows for security hardening. (#4192 )

2024-08-06 23:14:23 +00:00

README.md

Workflows

Hardening

Workflows are hardened using Step Security tool. Findings for the "Harden Runner" steps are available online.

Allowed endpoints

Most jobs only have a few endpoints, but due to tools which do downloads, a few have significantly more. These are:

pre_commit.yaml (Bazel, pre-commit)
nightly_release.yaml (Bazel)
tests.yaml (Bazel)

When updating one of these, consider updating all of them.

We try to keep allowed-endpoints with one per line. Prettier wants to wrap them, which we fix this with prettier-ignore.

Testing

We keep around an action-test branch in carbon-lang, which can be used to test triggers with push: configurations. For example:

on:
  push:
    branches: [action-test]